Cybersecurity platform: scaling up

A small automated remote-controlled car moves backwards and forwards at regular intervals in front of a low cardboard wall. Jose Manuel Rubio Hernan, a post-doc in the RST (Réseaux et Services de Télécommunication) department at Télécom SudParis, handles it carefully. " I'm collecting data on its movement, its distance from the wall and its speed", he explains. At first sight, a curious experiment to study cybersecurity.

"The aim is then to simulate a cyber attack on the computer protocols controlling the vehicle, and to see the resulting data. An attacker can send it the wrong information to change its speed or direction, while communicating false good data to the vehicle operator, to avoid detection." In other words, observe in detail the course of a cyberattack and its consequences, not only computer-related but also physical and material, to better understand how to counter them. All under realistic conditions, using robots and Lego MindStorms models (like the model trains, above) connected to the network and controlled by computer.

"However, to really test these cybersecurity processes, we need to go through a full-scale deployment: that's the next challenge for our platform", says Joaquin Garcia-Alfaro, teacher-researcher in the RST department, and member of the Cyber CNI (Critical National Infrastructures) chair supported by IMT Atlantique. "Although realistic, our simulations with models are programmed by a certain determinism. We're missing the hazards of reality.

However, it would be difficult to ask a company like SNCF to provide real trains, for example, and see the results of a collision test caused by a cyber attack. "Jose Manuel Rubio Hernan continues: "The advantage of mock-ups is that you can study real protocols and visualize, as close to reality as possible, the consequences on the physical part.

While simulating realistic situations is one of the main strengths of Télécom SudParis' cybersecurity platform, the know-how of its researchers and engineers goes far beyond this.

The platform is particularly interested in the protection of "critical infrastructures". The latter refers to all areas likely to have an impact on everyone's life, including those managed by Cyber CNI Chair partners such as EDF in the energy sector, Orange in telecommunications, and Airbus in air transport and aeronautics. An issue at the heart of international concerns since the WannaCry cyberattack, a ransomware that paralyzed British hospital IT systems in May 2017.

Conventional cyber defense strategies too often focus on protecting data and information alone," comments Joaquin Garcia-Alfaro. Our aim, on the cybersecurity platform, is to improve protection of the system itself - more precisely, what controls and commands it."

By exploiting the network flow sorting properties of SDN (Software-Defined Network), researchers in the cybersecurity platform apply strategies to secure SCADA (Supervisory Control And Data Acquisition) remote control and command technologies. These technologies act as intermediaries between the IT and physical layers of critical infrastructure systems.

"Of course, operators of critical infrastructures will always have legitimate reservations about providing data, captured under real-life operational conditions, at the risk of revealing weaknesses or seeing them exploited maliciously", stresses the teacher-researcher. The solution would therefore be to guarantee that partners in the cybersecurity platform are able to manage their data in a properly controlled way.

While progress is being made, the challenge of "scaling up " remains considerable.