Partners Search: Topic SEC-2012.2.5-2 Cyber resilience – Secure cloud computing for critical infrastructure

Title: "Topic SEC-2012.2.5-2 Cyber resilience – Secure cloud computing for critical infrastructure

Description of topic:Cloud computing will change computing environments as we know them today. With the increasing use of this model which provides computing functions as a utility, more and more sectors will incorporate cloud services in the computing environment, eventually reaching ICT services which are operating critical infrastructures (e.g. telecommunication networks). The advantages of this new technology cannot be neglected, and commercial pressure will contribute to a widespread adoption. The objective of this topic is to analyse and evaluate cloud computing technologies with respect to potential security weaknesses in sensitive environments, and to further develop new technologies for implementing high assurance clouds. Trustable cloud computing systems and scenarios have to be developed, to allow sensitive applications to leverage the potentials of this new technology. Work done on this topic has to take into account existing research on cloud computing technologies and take it beyond state-of-the-art level towards trustworthy cloud computing. Furthermore, it is necessary to assure the societal acceptance of solutions produced by the project. Important topics of research include, but are not limited to:

• Data confidentiality in the cloud: one has to analyse how distributed systems can be built with cloud services that provide end-to-end data confidentiality
• Security in large scale cross-organisational systems: how can existing security mechanisms like security policy enforcement, identity and access management, incident response handling or auditing be adopted in large scale cloud environments

• Best practices for security in cloud computing for critical infrastructure ICT.

Expected impact: With the adoption of cloud computing in critical infrastructure, the results of this work should make sure that these new technologies do not introduce new weaknesses into these systems, but should increase knowledge of the impacts and consequences of these technologies. This will allow critical infrastructure operators and manufacturers to leverage their advantages without sacrificing system security. Furthermore testing, validation and demonstration of these technologies should be foreseen.

In summary, meeting the needs of the call requires looking at the following three topics, related to the cloud:

• Confidentiality
• Security
• Best Practice

Looking for: We are seeking one or two partner companies which could provide technical support in moving the project forward, by contributing to the main objective and perhaps leading in developing networked test procedures and / or demonstrations to be carried out remotely.