Arquitectura de Cyber Situational Awareness (CySA) para la protección de infraestructuras críticas

Abstract

Security in cyberspace is today a key challenge for any organization with the continuous growth of cyberattacks worldwide. In the current technological reality, in which physical and cyber domains are increasingly interdependent, this task is still most essential since actions in any of these scopes can lead to devastating consequences on both. This is even more important in case of critical infrastructures (CI), inasmuch as well-being of nations and their citizens depends on their proper functioning. New solutions are therefore needed in order to efficiently face the defence of all kind of CI in this hybrid scenario, in which traditional security tools (firewall, IDS/IPS and even SIEM systems) are by themselves insufficient against largescale attacks and where more complete workarounds such as the most recent SCADA systems still remain focused on very specific sectors. This doctoral thesis introduces an innovative Situational Awareness (SA) approach for the suitable CI protection in the cyber-physical context. In particular, a hybrid SA architecture that provides, through advanced representation techniques, a Common Operational Picture of both physical and cyber dimensions in a unique visualization space is proposed to support operator's decision-making. The defined architecture has been applied in two different Cyber Command & Control solutions for CI protection: GESTPIC system for cyber-physical SA advanced visualization, and HYBINT as a novel tool for intelligence information integration and analysis. The model presented in this research has been validated in both simulated and real working environments, awakening the interest of potential end users and being confirmed as a groundbreaking proposal in its field in the specialized forums in which it has participated.