Cybersecurity mission: meeting the evolving needs of the industry

We are all more and more connected and becoming more security conscious. If we talk about the Internet of Things (IoT) and devices being interconnected in nearly all contexts of our lives, security is key. It is a given fact but well worth noting that the question is how to continuously develop practices to mitigate targeted cyber intrusions. The SMESEC Project, funded by the European Union, has put some cybersecurity experts to the task and now is proving the concept in a real infrastructure in Patras City, Greece. 

The role of Information Technology (IT) and Operational Technology (OT) 

In order to appreciate how to better construct cybersecurity practices, it’s good to understand what Information Technology (IT) and Operational Technology (OT) environments are and how they operate and interact. As Gartner explains, IT refers to the entire spectrum of technologies for information processing, including software, hardware, communications technologies, and related services. OT, in turn, relates to hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes, and events in the enterprise.

In general lines, priorities for IT are data confidentiality and security; information integrity and availability is not so important. OT always prioritizes that work with devices is possible, that is, their availability,  and so confidentiality plays a secondary role.

Towards the necessary convergence of IT and OT 

Yet in many industry sectors the difference is not so clear. If we look at Industrial IoT we have machinery connected to networked sensors and software that deliver data enabling smart analytics to optimize industrial processes. We can see that the boundaries between the OT and IT scenarios can easily blur. 

Being the nature of systems in constant change, companies need to respond by aligning IT and OT policies and tools. Coexistence is not enough, processes and information flow have to be convergent. As explained by Cisco, this alignment can mean significant cost savings.

A dedicated project with European funding

In the framework of the EU Program for Research and Innovation, there is a dedicated initiative addressing this key need. SMESEC is the acronym for “Protecting Small and Medium-sized Enterprises digital technology through an innovative cyber-SECurity framework”, a project led by an international group of cybersecurity experts from 7 countries. The project was especially conceived to help (small and medium) companies with limited knowledge of cybersecurity. The outcome is an easy-to-install and deploy cybersecurity framework developed within 36 months that will be ready for these companies to implement.  

SMESEC has now completed its first 24 months successfully deploying a real use case for industrial services where cybersecurity tools are being integrated and orchestrated, actually improving the IoT solution used to monitor industrial assets’ operations.

Based on its experience providing IoT based technology services to the industry for more than a decade, one of the project partners, Worldsensing, included a use case to be developed in an out-of-the-lab venue: a football stadium in Patras city, Greece. 

Adding cybersecurity solutions to the industrial IoT field 

A real infrastructure was selected to emulate a real-life situation where IoT technology is used for structural health monitoring, where a given infrastructure is monitored to ensure its integrity and prevent any undesired event such as a structural failure.

The preventive maintenance of any infrastructure needs to manage the OT domain without disregarding the IT-related information. This is particularly important if distributed pieces of hardware and software coexist, and communication is conducted through multiple methods and protocols.

Panachaiki football stadium is one of the oldest stadiums of Patras. Built in 1939 and with a capacity of 25,000 people, it is still operational hosting regular matches. Maintenance operations and structural checks take place to ensure that all premises are safe to use. There is an increasing demand for information from the authorities so that they can apply proactive corrective actions to the infrastructure management, if necessary.  

In order to monitor the stability of the structure, 10 Worldsensing data loggers have been installed. These wireless nodes are equipped with inclination, vibration and temperature sensors and transmit data to 2 gateways and a duplicated cloud infrastructure. The stability of the stadium terraces is surveyed to establish a dependency between the load charges and the movement of the structure, fixing alarm thresholds to activate contingency plans. 

Kostas Lampropoulos, University of Patras, explains that the use of high-end IoT devices gives the stadium authorities real-time access to data relevant to the inclination of cement pillars, which is critical for the stability of the entire construction. He highlights that the ability to collect a large set of historical data provides the engineers with an overview of the behaviour of the structure in different temperatures and loads, for example during a football match where the stadium is full of people. 

“SMESEC project is an exceptional opportunity for the technical directors of the stadium, as well as the engineers responsible for evaluating and certifying the structural health of the stadium.” Kostas Lampropoulos, Network Architectures and Management Group, Electrical and Computer Engineering Department, University of Patras.

Monitoring equipment has been installed in the stadium and cloud infrastructure put into operation to run the project. Since July 2018 the system has been gathering information from the data acquired by the in-situ instrumentation. And the SMESEC contribution has enabled to include a layer adding high-level security requirements to the standard functional requirements. This cybersecurity layer is added by evaluating the criticality of each asset that forms the information structure. The potential threats affecting each of the assets have been identified considering the probability of the event occurring and the resulting impact.

Ready for non-expert users 

Industrial IoT systems are commonly used by infrastructure operators with diverse profiles but generally focusing on the OT dimension and with low experience in cybersecurity. 

The project strives to make cybersecurity of IoT products easier to deploy and operate. With this objective, local experts as the University of Patras, and the stadium operator staff have been involved since the beginning. This has resulted in the project evolving to meet their needs, for instance a front-end visualization solution is being developed further to a direct requirement from the user. 

The user becomes an active asset in the protection of the infrastructure by receiving updated information of both operational and security domains. In order to better cover possible users’ needs, the project has categorised different profiles with a different cybersecurity expertise.

An exciting way ahead for integrity, confidentiality, and availability of data  

The solution developed is more than the sum of different security solutions: the system is able to correlate heterogeneous data inputs to raise IT alarms that complement the OT warnings that are already gathered by the Worldsensing system. 

The stadium operators are willing to expand the collaboration with the project and install additional IoT devices in other areas of the stadium. Antonis Koukouvinis, Head Engineer of the Safety Certification Process at the stadium, points out that this practice should be adopted in many other structures and buildings across the city of Patras, some of them historical monuments dating back from the 2nd-century Α.C. 

“Being Patras a highly seismogenic area, city gathering areas should be actively monitored with this enhanced solution in order to quickly identify any structural damages and prevent incidents that can have a severe impact on the public safety.” Antonis Koukouvinis, Head Engineer of the Safety Certification Process at the Panachaiki football stadium, Patras, Greece. 

The project has now 12 more months to continue to develop the real integration of cybersecurity and IoT technologies, and bring security solutions to society. End users of several industrial sectors will be able to access both OT and IT domains through a unified tool that allows comprehensive and reliable check-ups of the status of infrastructures at any time. 

This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 740787 (SMESEC). This work is supported by the Swiss State Secretariat for Education‚ Research and Innovation (SERI) under contract number 17.00067. The opinions expressed and arguments employed herein do not necessarily reflect the official views of these funding bodies.