Beiträge

Vortrag und Podcast: Unterschätzte Gefahr? Cyberangriffe auf Lieferketten

Vortrag:

Regelmäßig veranstaltet das BIGS Potsdam sogenannte PizzaSeminare, bei denen Teilnehmer nicht nur Pizza genießen können, sondern auch die Möglichkeit haben einen spannenden Vortrag zu einem aktuellen Thema zu diskutieren. Esther Kern und Alexander Szanto haben das erste nicht-digitale Seminar des Jahres genutzt, um ihre Forschung aus Cyberfactory#1 vorzustellen: Cyberangriffe auf Lieferketten und die damit verbundenen Kosten für die betroffenen Unternehmen. Das Seminar fand am 19. August 2021 in Berlin statt.

Hier geht es zu den Folien.

Podcast:

Im Anschluss an die Präsentation haben die Sprecher eine Podcastfolge zum gleichen Thema aufgenommen, moderiert von Dr. Tim Stuchtey. Die Folge ist Teil der Reihe “Sicher das? – Der BIGS-Podcast zur Sicherheitsforschung”, herausgegeben vom Brandenburgischen Institut für Gesellschaft und Sicherheit.

Hier geht es zum Podcast.

Thema:

Für viele Unternehmen ist die IT- und Cybersicherheit, trotz nach wie vor z.T. gravierender Sicherheitslücken, inzwischen Bestandteil des Risikomanagements. Die Qualität der technischen und organisatorischen Maßnahmen sowie das zur Verfügung stehende Budget, unterscheiden sich dabei jedoch erheblich. Dafür mitverantwortlich ist auch teilweise die fehlende Sensibilisierung für bestimmte Sicherheitsthemen in den Entscheidungsebenen sowie die Einschätzung der Kosten-Nutzenkalkulation. IT- und Cybersicherheit wird häufig im Arbeitsalltag nicht wahrgenommen und wenn, dann nur als zusätzliche Arbeitsbelastung. Was Unternehmen jedoch wahrnehmen, ist der Schaden der entsteht, wenn das eigene Unternehmen betroffen ist.

Kein neues, aber ein nach wie vor vielfach unterschätztes Thema in der Präventionsbetrachtung ist der Umgang mit Lieferketten. Diese werden bei einer Risikobetrachtung häufig nicht mitberücksichtigt und somit die Chance verpasst, Abhängigkeiten zu identifizieren, geeignete Redundanzen aufzubauen und sowohl Schnittstellen als auch Schwachstellen bei Zulieferern besser zu schützen.

Bei sogenannten Cyber Supply Chain Attacks nutzen Angreifer gezielt Schwachstellen in den Lieferketten für ihre bösartigen Zwecke aus. Am 13. Dezember 2020 meldete FireEye die Entdeckung eines weit verbreiteten Supply-Chain-Angriffs, bei dem SolarWinds Orion Business Software Updates trojanisiert wurden, um Malware zu verbreiten.  ORION ist eine IT-Überwachungs- und -Verwaltungssoftware, die von der überwiegenden Mehrheit der Fortune-500-Unternehmen sowie von vielen Regierungsbehörden verwendet wird. Zu den betroffenen Einrichtungen gehören Behörden sowie Organisationen aus den Bereichen Beratung, Technologie, Telekommunikation, Gesundheitswesen und Öl- und Gasindustrie auf vier Kontinenten. Nach Angaben von SolarWinds ist die Sicherheitslücke wahrscheinlich das Ergebnis eines hochentwickelten, gezielten und manuellen Angriffs auf die Lieferkette durch einen unbekannten Nationalstaat.

Symantec berichtet in seinem Internet Security Threat Report von 2019 von einem Anstieg der Angriffe auf die Lieferkette um 78 % im Jahr 2018, wobei die 20 größten beobachteten Gruppen besonders aktiv sind.  Bekannte Gruppen wie Dragonfly nutzen seit 2011 gezielt Zulieferer, um sich Zugang zu den Zielunternehmen zu verschaffen, wobei die Ziele in diesem Fall hauptsächlich im Energiesektor liegen.

Vor diesem Hintergrund hat sich das BIGS in Kooperation mit VTT, das Ökosystem von Lieferketten näher angeschaut und die finanziellen Auswirkungen von Angriffen auf diese betrachtet.

Call for Papers: Symposium on Security and Privacy in Speech Communication

Call for papers to be presented at the

1st Symposium on Security and Privacy in Speech Communication

Online, November 10-12, 2021

 

The first edition of the SPSC Symposium aims at laying the first building blocks required to address the question how researchers and practitioners might bridge the gap between social perceptions and their technical counterparts with respect to what it means for our voices and speech to be secure and private.

The symposium brings together researchers and practitioners across multiple disciplines – more specifically: signal processing, cryptography, security, human-computer interaction, law, and anthropology. By integrating different disciplinary perspectives on speech-enabled technology and applications, the SPSC Symposium opens opportunities to collect and merge input regarding technical and social practices, as well as a deeper understanding of the situated ethics at play.The SPSC Symposium addresses interdisciplinary topics.

For more details, see CFP.


Topics of Interest:
Topics regarding the technical perspective include but are not limited to:
  • Speech Communication
  • Cyber security
  • Machine Learning
  • Natural Language Processing
Topics regarding the societal view include but are not limited to:
  • Human-Computer Interfaces (Speech as Medium)
  • Ethics & Law
  • Digital Humanities
We welcome contributions on related topics, as well as progress reports, project disseminations, or theoretical discussions and “work in progress”.  There also is a dedicated PhD track. In addition, guests from academia, industry and public institutions as well as interested students are welcome to attend the conference without having to make their own contribution. All accepted submissions will appear in the conference proceedings published in ISCA Archive.

Submission:
Papers intended for the SPSC Symposium should be up to four pages of text. An optional fifth page can be used for references only. Paper submissions must conform to the format defined in the paper preparation guidelines and as detailed in the author’s kit. Papers must be submitted via the online paper submission system. The working language of the conference is English, and papers must be written in English.

Reviews:
All submissions share the same registration deadline (with one week of submission updates afterwards). At least three single-blind reviews are provided, we aim to get feedback from interdisciplinary experts for each submission.

Important dates:
Paper submission opens:           April 10, 2021
Paper submission deadline:     June 30, 2021
Author notification:                      September 5, 2021
Final paper submission:              October 5, 2021
SPSC Symposium:                          November 10-12, 2021

Contact:
For further details contact mail@spsc-symposium2021.de!

LISA wird neuer Projektpartner von CyberFactory#1

 

Wir freuen uns über einen neuen Partner im CyberFactory#1-Konsortium: Seit Februar 2021 ist LISA Deutschland GmbH bei den deutschen Projektpartnern dabei. Die LISA Gruppe ist ein international bekanntes Unternehmen für intelligente Systeme und machinelles Lernen und verfügt über umfangreiche Erfahrung in der Entwicklung von Systemen für den Luft- und Raumfahrtbetrieb.

Im Rahmen des Projekts wird LISA einen autonomen Anomalie-Bot zur Verfügung stellen, der Cybersecurity-Anomalien erkennen soll, um die Produktion und Fertigung in der Fabrik der Zukunft zu verbessern. Der Bot wird innerhalb der Anwendungsfälle von Airbus Defense and Space (Spanien) eingesetzt, kann aber zur Erkennung von Cybersicherheitsanomalien in jeder Umgebung verwendet werden. Mehr über den Beitrag zum Projekt können Sie hier lesen.

 

Präsentationen auf vier akademischen Konferenzen

Unsere Kollegen vom Fraunhofer AISEC haben in den letzten Monaten vier Paper auf akademischen Konferenzen präsentiert. Klicken Sie auf die untenstehenden Titel um mehr über die einzelnen Beiträge zu erfahren.

Dieses Paper wurde auf dem DYNAMICS workshop am 7. Dezember 2020 auf der Annual Computer Security Applications Conference (ACSAC) präsentiert.

Hier kann man das Paper herunterladen.

Autoren: Philip Sperl und Konstantin Böttinger

Abstract: Neural Networks (NNs) are vulnerable to adversarial examples. Such inputs differ only slightly from their benign counterparts yet provoke misclassifications of the attacked NNs. The required perturbations to craft the examples are often negligible and even human imperceptible. To protect deep learning-based systems from such attacks, several countermeasures have been proposed with adversarial training still being considered the most effective. Here, NNs are iteratively retrained using adversarial examples forming a computational expensive and time consuming process often leading to a performance decrease. To overcome the downsides of adversarial training while still providing a high level of security, we present a new training approach we call \textit{entropic retraining}. Based on an information-theoretic-inspired analysis, entropic retraining mimics the effects of adversarial training without the need of the laborious generation of adversarial examples. We empirically show that entropic retraining leads to a significant increase in NNs’ security and robustness while only relying on the given original data. With our prototype implementation we validate and show the effectiveness of our approach for various NN architectures and data sets.

Das zweite Paper wurde auch auf der Annual Computer Security Applications Conference (ACSAC) 2020 präsentiert.

Autoren: Karla Markert, Romain Parracone, Philip Sperl und Konstantin Böttinger.

Abstract: Security of automatic speech recognition (ASR) is becoming ever more important as such systems increasingly influence our daily life, notably through virtual assistants. Most of today’s ASR systems are based on neural networks and their vulnerability to adversarial examples has become a great matter of research interest. In parallel, the research for neural networks in the image domain has progressed, including methods for explaining their predictions. New concepts, referred to as attribution methods, have been developed to visualize regions in the input domain that strongly influence the image’s classification.  In this paper, we apply two visualization techniques to the ASR system Deepspeech and show significant visual differences between benign data and adversarial examples. With our approach we make first steps towards explaining ASR systems, enabling the understanding of their decision process.

Dieses Paper wurde auf der 4th ACM Computer Science in Cars Symposium (ACM CSCS 2020) vorgestellt.

Autoren: Karla Markert, Donika Mirdita und Konstantin Böttinger

Abstract: Voice control systems in vehicles offer great advantages for drivers, in particular more comfort and increased safety while driving.  Being continuously enhanced, they are planned to comfortably allow access to the networked home via external interfaces. At the same time, this far-reaching control enables new attack vectors and opens doors for cyber criminals. Any attacks on the voice control systems concern the safety of the car as well as the confidentiality and integrity of the user’s private data. For this reason, the analysis of targeted attacks on automatic speech recognition (ASR) systems, which extract the information necessary for voice control systems, is of great interest. The literature so far has only dealt with attacks on English ASR systems. Since most drivers interact with the voice control system in their mother tongue, it is important to study language-specific characteristics in the generation of so-called adversarial examples: manipulated audio data that trick ASR systems. In this paper, we provide a short overview on recent literature to discuss the language bias towards English in current research. Our preliminary findings underline that there are differences in the vulnerability of a German and an English ASR system.

Das vierte Paper wurde bereits im September auf der IEEE European Symposium on Security and Privacy 2020 präsentiert.

Hier kann man das Paper herunterladen.

Autoren: Philip Sperl, Ching-Yu Kao, Peng Chen, Xiao Lei, und Konstantin Boettinger

Abstract: In this paper, we present a novel end-to-end framework to detect such attacks during classification without influencing the target model’s performance. Inspired by recent research in neuron-coverage guided testing we show that dense layers of DNNs carry security-sensitive information. With a secondary DNN we analyze the activation patterns of the dense layers during classification runtime, which enables effective and real-time detection of adversarial examples. This approach has the advantage of leaving the already trained target model and its classification accuracy unchanged. Protecting vulnerable DNNs with such detection capabilities significantly improves robustness against state-of-the-art attacks.Our prototype implementation successfully detects adversarial examples in image, natural language, and audio processing. Thereby, we cover a variety of target DNNs, including Long Short Term Memory (LSTM) architectures. In addition to effectively defend against state-of-the-art attacks, our approach generalizes between different sets of adversarial examples. Thus, our method most likely enables us to detect even future, yet unknown attacks.

 

Virtuelles Panel – CyberFactory: How to make the Factory of the Future efficient and secure?

Am 9. Dezember fand unser virtuelles Panel zum Thema “CyberFactory#1: How to make the factory of the future efficient and secure” statt. Unsere Referenten, Adrien Bécue, İrem Hilavin und Jari Partanen, stellten das Projekt, den Anwendungsfall Vestel und Aspekte der FoF- Resilienz vor. Dann folgte eine Dikussionsrunde und Fragen unter anderem zu den Beziehungen von Mensch und Maschine oder zu den Möglichkeiten die dieses Projekt Unternehmen, die nicht direkt beteiligt sind, bieten kann. Unten finden Sie die Präsentationsfolien. Wir freuen uns auf viele weitere Veranstaltungen im neuen Jahr!

 

 

Zusammenfassung:

As factories digitalise and adopt automation technologies, they unlock new business models, manufacturing processes and logistics methods – as well as alternative roles for the people and machines that work in the factory. At the same time, these processes result in more complex IT and OT systems, presenting novel cyber security challenges and potentially leading to dangerous new interdependencies.

Based on early results from the European research project CyberFactory#1, our panel will discuss both the opportunities and challenges represented by the digitalisation and automation of factories, including what the transition towards a new factory system of systems may look like – but also the new threats that organisations may face if security and resilience are not prioritised early in the process.

 

Sprecher:

Adrien Bécue, Project Leader CyberFactory#1, Head of Innovation, Airbus CyberSecurity, France

Jari Partanen, Task Leader CyberResilience, Head of Quality, Environment and Technology Management, Bittium, Finland

İrem Hilavin, Work Package Leader Integration & Validation, SW Design Architect, Vestel, Turkey

 

Towards resilient Factories of Future – Defining required capabilities for a resilient Factory of Future

Abstract

Ongoing digitalization and implementation of new techniques for the Factory of Future (FoF) brings up new opportunities as well new threats that must be concerned to conciliate optimization of the supply and manufacturing chain with the need for security, safety and resilience. The CyberFactory#1 project addresses these needs by providing a framework of possible capabilities for resilient FoF environments. To further define these capabilities an approach was used to define requirements and implementation planning based on Use-Cases and Misuse-Cases to enable the development of needed capabilities for resilient FoF.

Access to Document

https://www.researchgate.net/publication/342736698

Authors

Matthias Glawe (Airbus CyberSecurity), Linda Feeken (OFFIS e.V.-Institut für Informatik), Ching-Yu Kao (Fraunhofer AISEC), Elham Mirzaei (InSystems GmbH), Alexander Szanto (Brandenburgisches Institut für Gesellschaft und Sicherheit), Torsten Weinhold (Bombardier), Björn Wudka (HTW Berlin)

Conference

Automation 2020, 30 June – 1 July, Baden-Baden (Online)

Cite this

Glawe, M.; Feeken, L.; Kao, C.-Y.; Mirzaei, E.; Szanto, A.; Weinhold, T.; Wudka, B.: Towards resilient Factories of Future – Defining required capabilities for a resilient Factory of Future, in: Conference Paper Automation 2020, VDI-Berichte Nr. 2375, 2020.

Finnish Consortium with First Steps towards Improved FoF Security

When developing Factories of the Future, security is also an important aspect. CyberFactory#1 will respond to this challenge by developing a set of safety and security capabilities. One of these capabilities is cyber resilience. Although the development work has not yet started, CyberFactory#1’s Finnish partners prepared and presented a Cyber Resilience Starting Point Demo in the project review at Oulu in January.

Figure 1 A part o fthe demo set-up

Resilient communications

A key resilience function in FoF systems, including IIoT, is the ability to maintain constant connectivity to industrial control systems and other systems on a continuous basis. A single network may not provide sufficient reliability in critical manufacturin  g systems. Therefore, in order to build resilient manufacturing systems, a seamless network failover is relevant. The scenario in Figure 2 demonstrates IIoT device network switching for resilient communications.

Figure 2 Demo scenario 

Continuously up-to-date IIoT devices

A common flaw in IIoT systems is the cumbersome or non-existent update management system. Administrator needs to be provided with insight on the current rate of deployment of up-to-date and outdated devices, and with capability to monitor the update progress in real-time, using the device management console dashboards. The scenario in Figure 3 demonstrates the use of standards based device management (LWM2M) and the standard mechanism for updating IIoT gateway remotely.

Figure 3 Demo scenario for standards based device management and remote updates

Dynamic reconfiguration of IIoT devices

Dynamic security policies in IIoT devices are an important enabler for resilience of IIoT systems. Based on IIoT device produced data (and changes in certain data points) the security policy of the IIoT device gets updated from the device management server. This scenario demonstrated how dynamic reconfiguration enables the recovery from incidents and disaster situations.

The demo was created in collaboration with Bittium, Netox, VTT and Rugged Tooling, using the knowledge of each partner to create a realistic environment. “It was great to able to contribute to creating the traffic needed, and test our sensor in the mutually created environment”, says Esa from Rugged Tooling. “Bittium SafeMove® Analytics was adapted to the demo in order to demonstrate the fleet of the IIoT devices, in order to detect the devices and required updates for cyber resilient operations. We were also able to connect the system seamlessly and wirelessly with the cloud connectivity provided by Netox”” clarified Björn from Bittium.

This Starting Point Demo was a great collaboration effort and a remarkable first step towards the Kick-off of Work Package 5: FoF dynamic risk management and resilience in April 2020.

Involved Partners: Bittium, Netox, Rugged Tooling, VTT Technical Research Centre of Finland