2022 IEEE CSR Workshop on Cyber Resilience and Economics (CRE)

10:00–11:40 CET

Technical session WS-CRE-1

Chair: N. J. Multari, Pacific Northwest National Lab (US)
Room: Nafsika

10:00–10:20

Welcome by the CRE Chairs

N. J. Multari and R. McQuaid

10:20–10:40

Policy-based profiles for intrusion response systems

K. Hughes

10:40–11:20

Invited talk: Towards trustworthy AI: The European human-centered approach

George Sharkov, European Software Institute (BG)

Abstract. In recent years, ethical issues across all technological fields, including artificial intelligence, have become a prominent topic for public discussion. The European Union, with its industry and academia at the forefront, is now viewed as a pioneer on the world stage for the implementation of an ethical approach toward an ethically driven, data-empowered society. Thanks to measures such as the General Data Protection Regulation, the European High-Level Expert Group on AI, the recently proposed AI Act, ensuring and providing access to trustworthy AI is no longer only a competitive advantage, but a basic necessity for the sector’s healthy growth.

Making the initial steps toward regulating AI has been a topic of interest in Europe, especially within recent years. While AI systems have many benefits, they also carry many risks that need to be addressed carefully and appropriately. Topics, such as compliance, lawful, ethical, and technologically robust AI have been developed to support an ethical approach to Artificial Intelligence and promote a sense of responsibility among organizations, governments, institutions, and companies of all sizes.

The EU risk-based approach towards requirements and recommendations for regulating Artificial Intelligence and ensuring the development of ethical and human-centered AI solutions, has become a fundamental approach towards the evolution of the potential of AI solutions. Certifying artificial intelligence systems based on their lawfulness, reliability, and human-centricity, however, is not a task easy to achieve. We will discuss some challenges, related to AI governance and certification as an important opportunity to shape the future and well-being of Europe.

Biography. Dr. George Sharkov is CEO of the European Software Institute CEE and a head of Cyber Security and Resilience Lab since 2003. He was an adviser to the Bulgarian Minister of Defense (2014-2021) and the National Cybersecurity Coordinator, leading the development of the national Cyber Resilience strategy. Member of the EU AI High Level Expert Group, SMEs voice at ETSI technical committees (TC CYBER and ISG “Securing AI”), ENISA Ad-Hoc Group on AI, ENISA Stakeholders Cybersecurity Certification Group. He holds PhD in AI and lecturing at 4 leading universities (software quality, cybersecurity and resilience, active security).

13:20–14:20 CET

Lunch break

16:20–18:00 CET

Technical session WS-CRE-2

Chair: N. J. Multari, Pacific Northwest National Lab (US)
Room: Nafsika

16:20–16:40

Recap by the CRE Chairs

N. J. Multari and R. McQuaid

16:40–17:00

Using potential effects on threat events (PETE) to assess mitigation effectiveness and return on investment (ROI)

D. Bodeau, R. Graubart, and R. Mcquaid

17:00–17:40

Invited talk: The top 10 challenges (Ty’s and Cy’s) on the road to cyber resiliency

Scott Foote, Phenomenati Consulting (US)
Steve Foote, Phenomenati Consulting (US)

Abstract. This talk will examine the common challenges and “market forces” which organizations will encounter on their road to building resilient systems, as well as dive into concrete remediation strategies and tactics that enable those systems to operate more Resiliently in today’s contested domain of Cyber. The first half of the discussion will focus on emergent aspects of the Cyber environment and fundamental concerns/shortcomings with contemporary system architectures. Useful techniques to counter these detrimental trends will be enumerated and deliberated. The latter half of the session will directly address the predominant pressures in today’s acquisition environment of Cyber-related systems. These forces often work diametrically against achieving improvements in Resiliency. Approaches for successfully dealing with these pressures will be examined and reviewed.

Biography. Scott is a senior executive and entrepreneur, with more than 35 years of technology experience in cybersecurity and the broader software industry. He has an acute ability to understand and map business needs to models, architectures, solutions, and technologies. An influential communicator skilled at “making the Complex, Simple” and “the Abstract, Concrete”, Scott has authored several thought leading pieces on cybersecurity from the original “Risk Formula” (in the 90s), to “Risk-Based Access Control” and the Cyber SA model of “Network, Mission, and Threat” (in the 00s), to the recent “SOC Taxonomy” and “5 What Imperatives” of security awareness.

Driven to bring “Order to Chaos”, his leadership experience includes building and leading growth-dominated products and services teams, organizations, and startups from 10s to 1000; and spans the solution lifecycle, with a specific focus on complex systems engineering and solution roadmap planning.

Scott is also a frequent speaker at industry events, is a member of several industry consortia, sits on a number of advisory boards and has been a member of the board of directors for enswers, Inc., Axixa Corporation, Realocity, Inc., Protinuum, LLC, and the Boston Affiliate of the Susan G. Komen Breast Cancer Foundation.

Biography. Steve is an accomplished software engineering executive, designing and implementing impactful enterprise applications and development teams which provide a competitive advantage for his clients. While leading software development organizations ranging from 4 to 600+ engineers, he has successfully applied his extensive knowledge of advanced software engineering, computer architecture, cyber security, mobile technologies, and enterprise applications to a variety of clients including finance, healthcare, pharmaceutical, commerce, law enforcement, intelligence, military, judicial, and treasury applications. Presently, Steve is leading the instantiation of software factories for a number of clients. These factories apply state-of-the-art, secured engineering practices (agile, cloud, mobile computing, DevSecOps) to produce advanced capabilities.

Steve’s own interest in agile software development stems from his years of experience in the commercial software market. While working in industry for companies including Oracle Corporation, Steve applied agile methodologies to the design of financial applications and industrial control systems, using advanced AI techniques and distributed processing capabilities that were the precursor to today’s Industrial IoT devices. Recognizing the need to better manage all of these distributed computing devices, Steve co-founded a company to deliver distributed systems management into the commercial marketplace. During that time, Steve patented a technique for implementing software agents on the early IoT devices for the purposes of securing them and managing them remotely.

Over the course of his career, Steve has published approximately 1,000 articles, reports, and white papers on topics including application development, advanced database applications, enterprise business applications (ERP), and cyber security (including the cover article for Information Security magazine in 1999 – 11/98). In recognition for his expertise in enterprise technologies, Steve was asked to serve as the lead judge for 3 consecutive years at the Best Practices in Enterprise Management Awards, an event covered by FORTUNE Magazine. In addition, Steve is the co-inventor of a patent regarding “Event management systems for distributed computing environments”. And Steve has served as an expert witness for multiple technology-related intellectual property lawsuits, at the U.S. state and federal level. He has also been a member of the board of directors for several companies including: the Hurwitz Group; enswers, Inc.; and Realocity, Inc.

18:00–18:20 CET

Coffee break

18:20–20:00 CET

Technical session WS-CRE-3

Chair: N. J. Multari, Pacific Northwest National Lab (US)
Room: Nafsika

18:20–18:40

Process mining for asymmetric cybersecurity audit

R. Turner

18:40–19:40

Panel discussion: Potential support and obstructions to cyber resilience

— Paul Nielsen, Carnegie Mellon University/Software Engineering Institute (US)

Paul D. Nielsen is Director and Chief Executive Officer of the Carnegie Mellon University Software Engineering Institute (SEI), a leader and key innovator in areas central to U.S. Department of Defense including software quality, artificial intelligence engineering, mission assurance, network and system resilience, and the increasing overlap of software and systems engineering. Nielsen is a member of the U.S. National Academy of Engineering (NAE); a Fellow of the American Institute of Aeronautics and Astronautics (AIAA); the Institute for Electrical and Electronics Engineers (IEEE); and the International Council on Systems Engineering (INCOSE); and a frequent speaker and panelist at conferences, workshops, and symposia. He serves on the Defense Science Board and several other advisory boards. Prior to joining the SEI in 2004, Nielsen served in the U.S. Air Force, retiring as a major general and commander of Air Force research after 32 years of distinguished service. Nielsen holds PhD and MS degrees in Applied Science from the University of California (Davis).

— George Sharkov, European Software Institute (BG)

Dr. George Sharkov is CEO of the European Software Institute CEE and a head of Cyber Security and Resilience Lab since 2003. He was an adviser to the Bulgarian Minister of Defense (2014-2021) and the National Cybersecurity Coordinator, leading the development of the national Cyber Resilience strategy. Member of the EU AI High Level Expert Group, SMEs voice at ETSI technical committees (TC CYBER and ISG “Securing AI”), ENISA Ad-Hoc Group on AI, ENISA Stakeholders Cybersecurity Certification Group. He holds PhD in AI and lecturing at 4 leading universities (software quality, cybersecurity and resilience, active security).

— Scott Foote, Phenomenati Consulting (US)

Scott is a senior executive and entrepreneur, with more than 35 years of technology experience in cybersecurity and the broader software industry. He has an acute ability to understand and map business needs to models, architectures, solutions, and technologies. An influential communicator skilled at “making the Complex, Simple” and “the Abstract, Concrete”, Scott has authored several thought leading pieces on cybersecurity from the original “Risk Formula” (in the 90s), to “Risk-Based Access Control” and the Cyber SA model of “Network, Mission, and Threat” (in the 00s), to the recent “SOC Taxonomy” and “5 What Imperatives” of security awareness.

Driven to bring “Order to Chaos”, his leadership experience includes building and leading growth-dominated products and services teams, organizations, and startups from 10s to 1000; and spans the solution lifecycle, with a specific focus on complex systems engineering and solution roadmap planning.

Scott is also a frequent speaker at industry events, is a member of several industry consortia, sits on a number of advisory boards and has been a member of the board of directors for enswers, Inc., Axixa Corporation, Realocity, Inc., Protinuum, LLC, and the Boston Affiliate of the Susan G. Komen Breast Cancer Foundation.

— Steve Foote, Phenomenati Consulting (US)

Steve is an accomplished software engineering executive, designing and implementing impactful enterprise applications and development teams which provide a competitive advantage for his clients. While leading software development organizations ranging from 4 to 600+ engineers, he has successfully applied his extensive knowledge of advanced software engineering, computer architecture, cyber security, mobile technologies, and enterprise applications to a variety of clients including finance, healthcare, pharmaceutical, commerce, law enforcement, intelligence, military, judicial, and treasury applications. Presently, Steve is leading the instantiation of software factories for a number of clients. These factories apply state-of-the-art, secured engineering practices (agile, cloud, mobile computing, DevSecOps) to produce advanced capabilities.

Steve’s own interest in agile software development stems from his years of experience in the commercial software market. While working in industry for companies including Oracle Corporation, Steve applied agile methodologies to the design of financial applications and industrial control systems, using advanced AI techniques and distributed processing capabilities that were the precursor to today’s Industrial IoT devices. Recognizing the need to better manage all of these distributed computing devices, Steve co-founded a company to deliver distributed systems management into the commercial marketplace. During that time, Steve patented a technique for implementing software agents on the early IoT devices for the purposes of securing them and managing them remotely.

Over the course of his career, Steve has published approximately 1,000 articles, reports, and white papers on topics including application development, advanced database applications, enterprise business applications (ERP), and cyber security (including the cover article for Information Security magazine in 1999 – 11/98). In recognition for his expertise in enterprise technologies, Steve was asked to serve as the lead judge for 3 consecutive years at the Best Practices in Enterprise Management Awards, an event covered by FORTUNE Magazine. In addition, Steve is the co-inventor of a patent regarding “Event management systems for distributed computing environments”. And Steve has served as an expert witness for multiple technology-related intellectual property lawsuits, at the U.S. state and federal level. He has also been a member of the board of directors for several companies including: the Hurwitz Group; enswers, Inc.; and Realocity, Inc.