PETRAS Internet of Things hub

January 2016 - January 2021

PROTECTIVE: Proactive Risk Management through Improved Cyber Situational Awareness

August 2016 - August 2019

Date:	August 2016 - August 2019
Project leader:	Jassim Happa (Oxford leader: 10 partners coordinated via Dublin)

PROTECTIVE is designed to improve an organisations ongoing awareness of the risk posed to its business by cyber security attacks. PROTECTIVE makes two key contributions to achieve this enhanced situational awareness. Firstly it increases the computer security incident response team’s (CSIRT) threat awareness through improved security monitoring and increased sharing of threat intelligence between organisations within a community. Secondly it ranks critical alerts based on the potential damage the attack can inflict on the threatened assets and hence to the organisations business. High impact alerts that target important hosts will have a higher priority than other alerts. Through the combination of these two measures organisations are better prepared to handle incoming attacks, malware outbreaks and other security problems and to guide the development of the prevention and remediation processes.
The PROTECTIVE system is designed to provide solutions for public domain CSIRTs and SME’s who both have needs outside the mainstream of cyber security solution provision. Public CSIRTs needs arise in part because commercial tools do not address their unique requirements. This has created a shortfall, clearly articulated by ENISA, of tools with the required analytical and visualisation capabilities to enable public CSIRTs provide optimised services to their constituency. SME’s also are vulnerable to cybercrime as they have limited resources to protect themselves and often a limited understanding of what needs to be done. Two pilots will be conducted to evaluate and validate the PROTECTIVE outcomes with CSIRTs from 3 National Research and Educational Networks (NRENs) and with SMEs via a managed security service provider (MSSP).
The PROTECTIVE consortium is constituted of 3 NRENs, 3 academic and four commercial partners from 8 countries so as to maximise the technical and commercial impact of the outputs and the dissemination and uptake of the results. http://cordis.europa.eu/project/rcn/202674_en.html

Trusted Cloud Knowledge Transfer Partnership

June 2015 - May 2017

Date:	June 2015 - May 2017
Project leader:	David Wallom

The EPSRC MyTrustedCloud project (2011) was highly successful with aspects of this work are being taken forward directly in an InnovateUK funded Knowledge Transfer Project. The original project investigated how this integration of trusted and cloud computing could be used in a practical scenario. The usecase supported trusted data exchange and application attestation to manage communication between the Distribution and transmission networks using cloud computing as the data exchange vehicle. The project created a detailed threat analysis of using IaaS cloud systems and the specific countermeasures that trusted platform allow within the system, an exemplar software framework in which energy researchers are able to start making use of commercially sensitive information while at the same time make full use of cloud computing.

The Trusted Cloud Knowledge Transfer Partnership (2015-17) will develop this substantially further bringing verifiable data privacy and security to production public cloud computing. This project, working with corporate partner 100PercentIT, will build a production trusted cloud which will be certified by NCSC and include digital key management technologies to ensure isolation of user certificates from the cloud provider. Through the developed Porridge remote attestation service it will enable multiple business models rooted in cryptographically verifiable trust. A cloud user will be able to verify the identity and configuration of any remote system in a scaleable and resiliant manner building from the cloud storage and physical infrastructure through to a full chain of trust capability of any virtual instance started within the cloud. This will support software whitelisting within all of the computational systems and trusted application or software signing through the trusted storage. The KTP has stated aims of doubling the profitability of the commercial partner who already has over 20 current and potential customers interested in this new capability and who have stated they would pay for it as soon as available and certified.

Global Cyber Security Capacity Centre

April 2013 - March 2017

Date:	April 2013 - March 2017
Project leader:	Sadie Creese, Ian Brown, Michael Goldsmith, David Upton

The Global Cyber Security Capacity Centre (GCSCC) is a leading international centre for research on efficient and effective cybersecurity capacity building. It has created the National Cybersecurity Capacity Maturity Model (CMM), the first-of-its-kind model to review a country’s cybersecurity capacity maturity. Together with key strategic international partners, such as the World Bank, the Organization of American States (OAS), the Commonwealth Telecommunications Organisation, and the International Telecommunication Union, the Capacity Centre has since 2015 successfully deployed the CMM in over 40 countries around the world, and significantly underpinned a regional study in Latin America and the Caribbean through collaboration with the OAS. The review processes and the resulting reports, drafted by the GCSCC, enabled the governments to benchmark national cybersecurity policy and strategies, cybersecurity culture, knowledge development, legal and regulatory frameworks, and risk controls. The results and recommendations enabled nations to better plan national strategies, facilitate international and regional collaboration and cooperation, and set priorities for strategic investment and capacity development. To foster global knowledge exchange and transfer of expertise gained in the global community, the GCSCC also runs the publicly-available Cybersecurity Capacity Portal, a global online resource for good practice and knowledge in cybersecurity capacity building, which also includes a mapping of international and regional capacity building efforts by the various actors in the field. [www.sbs.ox.ac.uk/cybersecurity-capacity/]
The deployment of the model has been in itself an effective capacity-building exercise and has been informing the thinking of the global community. The deployment of the CMM has also become part of two global and regional initiatives by the Global Forum on Cyber Expertise (GFCE). The GCSCC encourages the further uptake of the model by other countries and international community actors and has constant conversations with regional organisations, governments, private companies and other research institutions who work on this issue. It also has recently established its first regional partnership with the Oceania Cybersecurity Centre, which will be the focal point for cybersecurity capacity building in that region.

Rather than evaluating the country’s policies only, they look at the its maturity in addressing a wide range of questions, including: how well do the various stakeholders work together to create and revise policies, make decisions, and assess whether strategies are working? The resultant review allows countries to understand their strengths and weaknesses, and target their resources to develop cybersecurity capacity according to their national priorities.

This methodology has been endorsed by the Organization of American States, the World Bank, and the Commonwealth Telecommunications Organisation, and has been used to assess over 40 countries, including Bhutan, Jamaica, Uganda, the UK, and 32 members of the Organisation of American States (link). The model is a living document which continues to be revised and refined.

The Capacity Centre is also developing a model for Understanding Cyber Harm, moving beyond simple measures of financial harm to address complex issues of reputational, psychological, physical harm etc. Together the Capacity Maturity Model and the future HARM Model will enable nation states and/or organisations to make better informed decisions when it comes to financial investments in cybersecurity capacity building.

The Capacity Centre also hosts the Cybersecurity Capacity Portal, a global resource for expertise and knowledge on cybersecurity capacity building. This publicly-available online platform provides access to all of the tools, models and best cases, includes and inventory of international, regional and national cyber capacity building initiatives underway, and aggregates a number of other resources in the field.

More details at:
http://www.oxfordmartin.ox.ac.uk/cybersecurity

Governance for Responsible Innovation (GREAT)

February 2014 - January 2016

Richer Picture

April 2015 - September 2015

Identity Security in Cyberspace

December 2013 - April 2015

MetaVis

June 2014 - January 2015

CyberVis

May 2013 - August 2014

Trust Domains – A framework for modelling and designing e-service infrastructures for controlled sharing of information

April 2011 - March 2014

Date:	April 2011 - March 2014
Project leader:	Andrew Martin

Ensuring flows of information to the right people over multiple collaborating organisations is becoming increasingly important for both business and government. There are, however, trade-offs between the productivity and functional gains from sharing information, on the one hand, and the risks of leakage and opening up IT systems, on the other. Recent developments in trusted computing and virtualization can address these trade offs in a flexible manner, as they allow for the creation of policy controlled IT systems with configurable security properties. Collaborative, secure sharing solutions can be realized through the creation of dynamic 'Trust Domains' -- a notion that we propose to explore at and between all levels of the policy-service-infrastructure stack -- that enforce information flow and configuration policies. We created a customer-driven project starting from examples of information sharing within police forces and agencies they work with. Based on a practical understanding of the required flows and policies, we developed an abstract framework for qualifying types of and flows of information and a corresponding model of the associated risks. This allows process owners to describe their requirements and concerns. We researched how to qualify and map information flows to Trust Domain configurations, derived guidelines and templates for supporting solution architects in building IT services, and extended our set of analytics and modelling tools to help stakeholders gain an understanding of the risks associated with information flows and enforcement mechanisms.There are business opportunities for creating and operating new e-services with enhanced trust and security properties based on new methodologies and toolsets. The framework we created takes a business-driven approach to risk, trust and security and covers aspects of process and system analysis, design, configuration, security policy, human roles, and operational management. We create a value proposition by having the models, tools and methodologies that allows us to bridge the current gap between business level risk and system configuration and policy design. Hence mapping service needs onto trusted platforms, domains, and infrastructure. The project complements and expands ongoing, TSB-funded work on trust economics as well as on complexity, risk, and resilience management pioneered and exploited by HP's UK Enterprise Services. Both HP Enterprise Services and HP Labs, Bristol believe that bridging high-level incentive models and systems design for trust domains would be a unique global differentiator, not only aligned with US-NITRD 'game-changing' themes, but ahead of them in suggesting an integrated approach. The academic components of this project contributed the following developments in support of this programme: - The concept of Trust Domain, at and between the various levels of the socio-technical system stack (policy-service-infrastructure); - Mathematical systems modelling technologies to support tools and methodologies for reasoning about the properties, dynamics, and applications of the Trust Domain concept; - A thorough taxonomy of technical, design, and architectural properties which give rise to different trust characteristics in deployed services; - Modelling the quality of trust and expectations among components, to the extent of being able to make a meaningful comparison of solutions based on different architectural paradigms, within a given context.Targeted market: intra-corporate and intra-governmental data centres and 'clouds' whose stringent information flow control requirements cannot be met by today's providers.

SATURN: Self-organizing Adaptive Technology Underlying Resilient Networks

November 2009 - October 2012

MyTrustedCloud

February 2011 - October 2011

Ensuring Consent and Revocation (EnCoRe)

June 2008 - October 2011

DIET: A Different Approach to Smart Meter Data Insight against Energy Theft

Ongoing

Date:	Ongoing
Project leader:	David Wallom, Andrew Martin

In collaboration with British Gas, G4S, EDMI Smart Meters, The DIET project supports the development of new services to investigate coordinated analysis streams of consumption and logging data produced by smart meters.

Building on the EPSRC Advanced Dynamic Energy Pricing & Tariffs (ADEPT) and the 'Working with Infrastructure Creation of Knowledge Energy strategy Development (WICKED) projects we have developed a number of different analytic techniques from which we can match consumption to customer behaviour at the whole premises scale as well as full understand the different resolutions of data required for different levels of insight. Building on these two projects we are working through InnovateUK funding on the Data Insight against Energy Theft (DIET, 15-17) which also takes forward the established relationship with the energy sector, to develop an approach using smart meter logging and error messages alongside meter consumption data to identifying potential energy theft and faulty equipment by examining changes in data through time. The project will analyse data collected from a pool of SME electricity meters with a view to developing a reusable method for the domestic market operation.

These streams of meter status and error messages that are not normally retrieved give details on the physical environment of the meters and in conjunction with consumption data will enable creation of richer and more in-depth knowledge of system behaviour. The primary aim of these analytics are to discover and then recognise signatures for two different classes of events, possible meter failure scenarios and warnings on the occurrence of patterns indicative of meter attack/tamper.

Read more at .

http://www.oerc.ox.ac.uk/projects/diet-different-approach-smart-meter-data-insight-against-energy-theft

Smart Oxford

Ongoing

Early-Careers Researchers

Ongoing

Corporate Insider Threat Detection: Cyber Security Inside and Out

Ongoing

Oxford University – Cyber Security Oxford

Driving major developments in the theory and practice of cyber security

Research

Research activities

PETRAS Internet of Things hub

PROTECTIVE: Proactive Risk Management through Improved Cyber Situational Awareness

Trusted Cloud Knowledge Transfer Partnership

Global Cyber Security Capacity Centre

Governance for Responsible Innovation (GREAT)

Richer Picture

Identity Security in Cyberspace

MetaVis

CyberVis

Trust Domains – A framework for modelling and designing e-service infrastructures for controlled sharing of information

SATURN: Self-organizing Adaptive Technology Underlying Resilient Networks

MyTrustedCloud

Ensuring Consent and Revocation (EnCoRe)

DIET: A Different Approach to Smart Meter Data Insight against Energy Theft

Smart Oxford

Early-Careers Researchers

Corporate Insider Threat Detection: Cyber Security Inside and Out

Partners

Contact us

Site