How can critical infrastructure be protected?
The virus has shown just how vulnerable our society is. What’s more, we are susceptible in many other areas as well. In the case of critical infrastructure, such as the power grid, the supply of drinking water, telecommunications or transport, even the smallest glitch can trigger a chain reaction and create major disruption. Given the virtual impossibility of protecting these systems against the full spectrum of conceivable threats, Stolz counsels a different approach: “To achieve resilience along with the requisite flexibility and improvisation, we need to admit a certain degree of uncertainty into the equation.” In place of “security by design,” we need “resilience by design,” which helps us prepare for unforeseen situations.
Systems that can repair themselves are more resilient. The Fraunhofer Institute for Mechatronic Systems Design IEM in Paderborn is investigating whether biological principles of self-healing can be transferred to the connected systems found in industry. Following nature’s example, researchers are seeking to make these systems more resilient and thereby increase their autonomy. In effect, this means endowing them with an artificial immune system. “Our research focuses on the mechanisms of the adaptive immune system,” explains project manager Michael Hillebrand. “In concrete terms, we use the danger theory and analogues of so-called dendritic cells in order to monitor autonomous robots or automation systems. These cells are able to detect danger within a system on the basis of certain signal patterns. In an open, autonomous system, however, it is impossible to program explicitly and in advance for all possible signals and reactions. We therefore use an algorithm that can recognize dangerous patterns. The algorithm classifies these signals as known/harmless, unknown, or known/dangerous. The signals are linked to a monitor that displays the system’s state of health. In this way, the system is able learn – online and quasi autonomously – which signal patterns correlate to a loss in performance and then react accordingly. This ‘immune response’ is provided by T cell analogues, which simultaneously learn which recovery operation was successful.” In this way, other systems could also be taught to become self-healing.
The pandemic has had little impact on critical infrastructure. Yet with so many people now working from home, occasional fluctuations in bandwidth have offered a preview of what a complete crash of the information and communications infrastructure would mean. Numerous Fraunhofer Institutes are involved in projects devoted to enhancing the security of IT systems and telecommunications networks. In the EU project RESISTO, for example, the Fraunhofer Institute for High-Speed Dynamics, Ernst-Mach-Institut, EMI is investigating the threat posed by cyber, physical and combined cyber-physical attacks on current 4G/LTE networks and future 5G communication networks. Network resilience is a key issue in relation to the Internet of Things, autonomous vehicles and digital transformation. Using a simulated communication network, the research team are applying a standardized process to identify and evaluate critical issues and potential countermeasures. In addition, they are providing network operators with a decision-making tool in the form of a user interface with integrated applications.
Resilient IT structures
A resilience check for IT structures is provided by the Fraunhofer Institute for Intelligent Analysis and Information Systems IAIS in St. Augustin: “This covers more than just the security of IT systems,” explains Kai Pervölz, head of the preventative security business unit. “We draw up a cyber resilience strategy to help organizations prepare for a cyberattack and remain operational.” His researchers conduct a comprehensive analysis not only of IT architecture and any security measures already in place but also of organizational structures, processes and of the impact that an attack would have on the value chain. On this basis, they then draw up a catalog of technical and organizational measures. These range from emergency plans to security concepts for critical information assets and business processes to communication campaigns designed to instill greater security awareness throughout the entire organization. This is because the human element is a key factor in resilient systems.