– 56 institutions from 21 countries across Europe collaborated on the research and innovation project

More than 21 outcomes, over 300 scientific publications, a multi-stakeholder ecosystem bringing together stakeholders from research, industry, start-ups and public bodies: all this and more was achieved by the European CONCORDIA project, which ended on 31st March. The four-year, €16-million project (plus €7 million of industrial funding) covered a wide range of topics, including cyberattacks on critical infrastructure, information security and data protection, certification, and competence building.

“Multiple crises such as the pandemic, the war in Ukraine, and climate and energy crises underline the increasing importance of building a secure, trusted and resilient digitally sovereign Europe,” said project coordinator Professor Gabi Dreo from the University of the Bundeswehr Munich.

“CONCORDIA has fully achieved its objective of building such an ecosystem, being agile, innovative and open. CONCORDIA’s results will not only provide valuable input to the European Cybersecurity Competence Centre and the network of National Cybersecurity Centres, and with this to the whole European cybersecurity community, but they will also work to strengthen and speed up research, development, and especially innovation.”

The CONCORDIA project delivers 21 outcomes to help counter the rapidly growing number of complex cyberattacks and the increasing threat landscape. They are divided into six main categories: Policy, Technology Tools, Education, Technology Pilots, and Certification and Research. All the results are now available to the public on the project website.

One of the outputs is a set of strategic recommendations for cybersecurity in Europe published under the title Roadmap for Cybersecurity in Europe. It links various areas such as research and innovation, education, economics and investment, law, and certification and standardization in a holistic way. So far, interest has focused mainly on research and development aspects of cybersecurity. The new strategy document describes nine fundamental dimensions that affect cybersecurity, showing where the current focus should be. A CONCORDIA Monitoring Board has been developed for the continuous gathering of feedback from the cybersecurity community.

Other tools include the KYPO Cyber Range Platform, which Masaryk University developed and, thanks to the project, released as open source in 2020.

“We believe the KYPO Cyber Range Platform is a significant contribution to the cybersecurity community. The open-source cyber range makes hands-on cybersecurity education widely available to universities and organizations in Europe and worldwide,” said Jakub Čegan, the head of cybersecurity exercises at Masaryk University.

“This activity aims to address the great lack of cybersecurity experts by providing a platform for the development and execution of cybersecurity training and exercises.” The KYPO Cyber Range was awarded the 2021 EC Innovation Radar competition in the Disruptive Tech category.

Defence against DDoS attacks is addressed by another of the project’s tools – the DDoS Clearing House, piloted in Italy and the Netherlands. Sharing data and the experience of experts in the face of attacks helps organizations find out what attacks exist so they can prepare for them in advance. Developing Cyber Threat Intelligence platforms for the telco and finance sectors are other examples of the project’s achievements.

The CONCORDIA project (Cyber security cOmpeteNCe fOr Research anD Innovation) links the technical and social sciences and involves 56 institutions from across the EU, including universities, research centres, private companies and public bodies from 17 EU member states, Switzerland, Norway, Israel and the UK. It is coordinated by the University of the Bundeswehr Munich. The project is funded by the European Union to an amount of almost 16 million euros. The project started on 1st January 2019 and ended on 31st March 2023.

The CONCORDIA project has received funding from the European Union’s Horizon 2020 Research and Innovation Programme under Grant Agreement No 830927.

The post CONCORDIA project ends. It delivered 21 results to strengthen European cybersecurity appeared first on CONCORDIA.

The ENISA Report “Cybersecurity for SMEs”, provides insights on the relationship of European SMEs with digital tools and the challenges faced. For example, the majority of the European SMEs that participated in the survey, use various information services as part of their daily business operations (e.g.Teleworking, e-banking, email and communication services) and 85% of the organisations have identified cybersecurity as a key concern.

Small and Medium-sized Enterprises (SMEs) are the backbone of the EU’s economy. They represent 99% of all businesses in the EU and employ around 100 million people. They also account for more than half of Europe’s GDP and play a key role in adding value to all sectors of the EU economy. They serve both as enablers for the digital transformation and as a core element of the EU social fabric.

Contrary to a concept that cyber-attacks occur only to large organisations, all enterprises can be attacked regardless of their size and stored information.Within this report, seven categories of major challenges for SMEs have been identified:

• low cybersecurity awareness of the personnel,
• inadequate protection of critical and sensitive information,
• lack of budget,
• lack of ICT cybersecurity specialists,
• lack of suitable cybersecurity guidelines specific to SMEs,
• shadow IT, i.e. shift of work in ICT environment out of SME’s control,
• low management support.

The ENISA Report concludes with recommendations and guidance at a company, national and European level. On the other hand, as part of the CONCORDIA project Task T4.3, a methodology for cybersecurity planning and investment has been proposed, as a way to further assist and guide SMEs regarding cybersecurity.

Purpose of this report

A team comprising of members from Task 4.3 (Economics) and Task 5. 3. (Certification and Standardisation), took the recommendations of the ENISA reports and sought out to investigate if such guidelines, templates and standards exist and whether they are in line with the relevant results of the CONCORDIA project.

The post Report on SME cybersecurity standards appeared first on CONCORDIA.

European laws have been in the focus of great criticism regarding their long reaching effect. The General Data Protection Regulation (GDPR) changed the privacy landscape for private and public entities far beyond the European borders. It also formed the basis for the re-evaluation of the Privacy Shield framework and its eventual collapse[1]. Certain newly enacted legislation[2]^,[3] is expected to globally affect businesses offering hosting, internet provision, domain name and cloud computing services, online platforms, such as social networking and marketplaces, and search engines. These regulations are presented and summarized in the relevant CONCORDIA deliverable[4].

But what about the other way around? What about the case of legislation outside the EU affecting the European area? Is it possible for extraterritorial laws to hurt EU sovereignty?

Extraterritorial laws extend the jurisdiction (in this article, the term jurisdiction refers to any kind of jurisdiction: prescriptive, adjudicative or enforcement jurisdiction) of foreign laws such, that their legal power is exercised outside the territorial borders of the originating country. Extraterritorial laws have existed for a long time, troubling courts and governments around the globe.

In the digital domain, there are two sources of legislative developments that can potentially traverse the EU borders. On 23 March 2018, the US Clarifying Lawful Overseas Use of Data Act (CLOUD Act) was signed into law[5]. The CLOUD Act seeks to speed up access to electronic information stored in US-based digital providers, when requested by crime investigators outside the US. It is argued[6], though, that under the hood, the CLOUD Act contains provisions that seem threating to citizens’ privacy. The bill amends the Stored Communications Act (SCA) so that US government bodies are authorized to compel a US provider to hand over the content of stored customer communications when held in a foreign country. It also allows foreign governments to obtain surveillance data, by way of prior established executive agreements.

On the other side of the map, China has been fencing against extraterritorial laws, while at the same time preparing its own arsenal of far-reaching legislation. Since 2020, existing laws have been updated and several legislative products have come into force to support China in blocking foreign sanctions laws[7]. China is also extending the reach of its laws[8]. The Asian country is constructing a system for the application of domestic laws beyond its territory, mimicking the US and the EU. In June 2021, China passed the Data Security Law[9], a supplement to the country’s Cybersecurity Law (2017), aiming to regulate the issues surrounding the processing of any kind of data. The Data Security Law also applies to data processing activities carried out outside China when the relevant activities have direct impact to the nation’s security, the lawful rights of Chinese citizen’s and organizations or China’s public interest. More recently, the Personal Information Protection Law (PIPL) of China was enacted, to stipulate how personal data are handled, in a manner similar to the GDPR, with similar extraterritorial effects[10]. The dust is yet to settle, but its already obvious that EU companies will need to comply to a number of foreign regulations on the digital domain.

All the above, demonstrate the extraterritorial implications of the respective legislation. Whether GDPR provisions are in danger of being bypassed or contradicted, is a matter that requires further investigation. But there is enough evidence to raise concerns over their effect on European sovereignty. Digital sovereignty is all about gaining and maintaining control over a country’s digital assets, whether these are data, services, hardware or even companies. And whenever foreign governments manage to infiltrate the Unions’ and its Members’ legal systems and reach to those very digital assets, European sovereignty is surely damaged.

For more information about the above and other similar issues, have a look at  Deliverable D4.4 of CONCORDIA, “Cybersecurity Roadmap for Europe”[11].

(By Kostas Magkos, George Drivas and the National Cyber Security Authority of Greece)

[1] The CJEU judgement in the Schrems II case – European Parliament, 2020 https://www.europarl.europa.eu/RegData/etudes/ATAG/2020/652073/EPRS_ATA(2020)652073_EN.pdf

[2] EU Regulation 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services (Digital Services Act) https://eur-lex.europa.eu/eli/reg/2022/2065/oj

[3] EU Regulation 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector (Digital Markets Act) https://eur-lex.europa.eu/eli/reg/2022/1925/oj

[4] Deliverable D4.3: 3rd year report on cybersecurity threats – CONCORDIA, 2021 https://www.concordia-h2020.eu/wp-content/uploads/2022/07/CONCORDIA-D4.3.pdf

[5] CLOUD Act Resources – The United States Department of Justice https://www.justice.gov/criminal-oia/cloud-act-resources

[6] “The CLOUD Act – A needed fix for U.S. and foreign law enforcement or threat to civil liberties?” – International Association of Privacy Professionals, 2018 https://iapp.org/news/a/the-cloud-act-a-needed-fix-for-u-s-and-foreign-law-enforcement-or-threat-to-civil-liberties/#

[7] Extraterritorial Sanctions with a Chinese Trademark, Steven Blockmans – CEPS, January 2021 https://www.ceps.eu/wp-content/uploads/2021/01/CEPS-PI2021-01_Extraterritorial-sanctions-with-Chinese-characteristics.pdf

[8] “Extraterritorial application of Chinese laws to be strengthened” – CHINA DAILY, 2020 https://global.chinadaily.com.cn/a/202001/22/WS5e27f2b9a310128217272ce3.html

[9] “China Issues Data Security Law” – The National Law Review, 2021 https://www.natlawreview.com/article/china-issues-data-security-law

[10] “China’s PIPL takes effect, compliance ‘a challenge’” – International Association of Privacy Professionals, 2021 https://iapp.org/news/a/chinas-pipl-takes-effect-compliance-a-challenge/

[11] Deliverable D4.4: Cybersecurity Roadmap for Europe – CONCORDIA, 2022 https://www.concordia-h2020.eu/wp-content/uploads/2021/10/CONCORDIA_Roadmap.pdf

The post Extraterritorial Laws vs European Sovereignty appeared first on CONCORDIA.

A set of strategic recommendations under the title ‘Roadmap for Cybersecurity in Europe’ has been launched by a group of experts from more than 50 European institutions. They have also created an interactive website where professionals from across the EU can comment on the document until the end of March. The roadmap was produced within the Concordia project, which brings together universities, innovation centres and private companies from 27 European countries. 

Cybersecurity is a matter of increasing urgency for public, academic and private institutions. More complex attacks can affect people’s daily lives, the functioning of companies and even operations of state.

“The introduction of innovations such as the cloud and edge computing, new networking technologies and artificial intelligence, the shift to remote work enforced by pandemics, and a lack of qualified professionals and necessary skills – all these factors have a fundamental effect on cybersecurity today,” explain the experts working on the project.  “Shortcomings in these areas have been immediately exploited by various threat actors with malicious intent, who have quickly taken advantage of this situation by exploiting social engineering and the software supply chain to mount attacks.”

Interest has so far focused mainly on technological aspects of cybersecurity. This focus is no longer sufficient, experts say. The new strategy document therefore describes nine fundamental dimensions that affect cybersecurity, showing where the current focus should be laid. These dimensions include for an example research and innovation, education, economics and investment, law, and certification and standardisation. It is also necessary to consider building a community of experts, institutions and other centres that will help ensure a secure and resilient European cybersecurity system.

Professionals can now comment on each of the areas in the document on an interactive website. Comments and additions will be displayed to the authors in a special form and taken into account in the new strategy once the commenting process is closed.

The Concordia project brings together natural, technical and social sciences. It involves 54 institutions from across the EU, including universities, innovation centres and private companies from Germany, Switzerland, Norway, the Netherlands, the UK, the Czech Republic and 21 other countries. It is coordinated by the Bundeswehr University Munich. The project is funded by the European Union to an amount of almost 16 million euros. A set of recommendations, the so-called roadmap, is one of the key outputs of the project, which will end in March.

The post Press Release: Experts launch roadmap for European cybersecurity and ask for comments appeared first on CONCORDIA.

We are proud to announce the release of the interactive tool that empowers cybersecurity experts to influence the Cybersecurity Roadmap for Europe, which was also delivered by the CONCORDIA project.

The CONCORDIA Monitorboard allows experts to rank challenges and recommendations or create new ones, providing a platform for them to share their insights and directly impact the Cybersecurity Roadmap for Europe.

The Cybersecurity Roadmap for Europe defines fundamental challenges and recommendations in nine dimensions: 

• Threat Landscape, 
• Research and Innovation, 
• Education and Skills, 
• Economics, 
• Investments, 
• Legal and Policy, 
• Certification, 
• Standardization, 
• and Community Building.

CONCORDIA Cybersecurity Roadmap for Europe in a Nutshell

The Roadmap is a crucial outcome of the CONCORDIA project for boosting European Cybersecurity. The main strategic objective of the CONCORDIA project is to lead the integration of Europe’s excellent cybersecurity competencies into the network of expertise to build the European secure, resilient, and trusted ecosystem for the Digital Sovereignty of Europe.

The post CONCORDIA launches Interactive Tool for Influencing Cybersecurity Roadmap for Europe! appeared first on CONCORDIA.

Defining the scope of a threat intelligence platform

 “Threat Intelligence” was a topic of paramount importance since the beginning of CONCORDIA. This aspect is not just present among the initial objectives, but it almost derives directly from the main purpose of the project. Specifically, if CONCORDIA sets its primary goal on building communities, we can say that all project’s activities revolve around leveraging these communities to improve cybersecurity. In this regard, threat Intelligence represents a necessary tool for communities to discuss today’s digital threats and, its “implementation”, represents a basic building block to face the aforementioned threats together and fight them collectively. 

 Over the last four years, the work on a CONCORDIA Platform for Threat Intelligence aimed not just to build technology but also to define the scope in which this technology is meant to be used. To clarify this, we started our journey from Gartner’s definition of Threat Intelligence. According to Gartner, Threat Intelligence is: 

 “Evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” 

 Within CONCORDIA, we especially focused on three key aspects (marked in bold). The “evidence-based knowledge” emphasizes the origin of threat intelligence information. This is often obtained from extended analysis and likely validated. For this reason, CONCORDIA generally refers to Threat Intelligence as high-quality data assuming a process (e.g., incident investigation) behind its creation. The part “about an existing or emerging menace” clarifies the meaning of the data. Threat Intelligence provides information either about concrete cyberattacks or potential ones. For this reason, CONCORDIA assumes that Threat Intelligence is a piece of information providing context to a given cyberattack. Finally, the phrase “to inform decisions regarding subjects’ response” indicates that not every piece of information about cyberattacks should be considered threat intelligence by default, but only those that are useful to respond (or prepare) against the related attacks. For this reason, CONCORDIA assumes that threat intelligence is “actionable” data, ready to be used to face or counteract a given threat. 

 With a definition of Threat Intelligence and a set of assumptions based on the aspects described above, we can think at a platform handling such information as a technological solution allowing partners to effectively share and manipulate data such that the assumptions hold. In other words, the CONCORDIA Platform for Threat Intelligence we started building creates a space where high-quality information about cyberattacks is stored as well as retrieved and leveraged by partners to improve their capability to respond or prepare against threats. 

 The scope in which the CONCORDIA Platform for Threat Intelligence works conceivably extends to the limit of the previous definition and could potentially cover any type of high-quality information about cyberattacks as well as provide any kind of service capable of manipulating that information to make it “actionable” for a given partner. However, concretely speaking, the set of possible information types, technologies, and services has been defined by CONCORDIA relevant stakeholders and planned in relation to the timeframe and the priorities of the project. This definition is the scope of the CONCORDIA Platform for Threat Intelligence and it corresponds today to the extent by which the platform is capable of operating from an “Architectural”, “Technological”, “Data” and “Operational” perspective. 

The architectural scope represents the structure of the platform, its building blocks, and their relationships, internal as well as external, towards the rest of the “CONCORDIA Ecosystem”. This scope also includes the possible ways in which the building blocks can communicate and, thus, the standards (e.g., languages, protocols, data formats) leveraged by each one of them to exchange information. The “Technological” scope directly follows the “Architectural” by defining the related implementation choices and, thus, describes the set of technologies used within the platform as well as the actual data those technologies are able to store, analyze and exchange. Intrinsically related to the “technological” scope, the “data” scope delineates the set of data types handled by the technologies employed in the CONCORDIA Platform for Threat Intelligence. These data types represent the extent of the platform’s semantic power and allow to share a common language across all platform’s users. Finally, the “operational” scope represents the set of mandates and processes regulating the access to the CONCORDIA Platform of Threat Intelligence as well as its collaborative usage. 

With the project approaching the end, all details about the aforementioned scopes will be completed and made public next year showing the full extent of the threat intelligence solutions envisioned within CONCORDIA. With this contribution, we hope to support European and non-European stakeholders in either starting their journey with threat intelligence or further leveraging the information they already handle within their own communities with the goal of achieving an increasingly (cyber) secure future. 

(By Marco Caselli, Siemens AG)

The post CONCORDIA’s take on Threat Intelligence appeared first on CONCORDIA.

Many applications can benefit from the use of groups of collaborating unoccupied aerial vehicles (UAVs), including logistics, disaster management, or fire monitoring and prevention. However, like all other computing and communicating platforms, UAVs can be vulnerable to cyber-attacks, which may jeopardise their mission, fully or partially.

As part of CONCORDIA, our team, consisting of researchers from Imperial College London and Airbus Defence and Space, has investigated how to analyse the impact of attacks on the viability of multi-UAV missions, and how to design missions resilient to attacks. Here, we outline some of the methodology followed and our key observations, focussing on a scenario of multi-UAV fire survey missions.

Key considerations: attack progression, containment and recovery

To estimate the impact of an attack on a group of UAVs, we have built a model for estimating mission performance over time given a possible attack scenario. We intend our model to be used as a tool to aid mission planning, and to decide whether to continue a mission when a cyber-attack has occurred. Although reasoning about the impact of failures is common, cyber-attacks differ significantly from failures, for example because they can propagate from vehicle to vehicle. Consequently, estimating attack impact must also account for attack propagation, and we model the stages of attack spread between UAVs, based on the vehicle connectivity topology. This enables us to assess the likely outcomes of different attack scenarios, for example, with different propagation speeds or attack containment countermeasures.

UAV missions are typically of short duration, as the flight time is limited by the battery capacity. Repair is therefore typically not an appropriate resiliency measure, and replacement vehicles are more likely to be used to ensure mission viability. Our analysis shows that such additional resourcing can help recover mission capacity. However, whether the recovery is sufficiently effective also depends on how rapidly the attack can spread and requires models such as the ones we have built.

Limiting the propagation of the attack (i.e., containment) is also possible by severing communication links or removing compromised UAVs from the mission. If this can be done fast enough, and early enough, the impact of the attack can be significantly reduced and the need for recovery capacity is lower.

Main takeaway: Use a model to quantify impact

So, different solutions can be adopted, with different consequences. Although these may seem intuitive, quantifying their impact requires detailed modelling and analysis. For example, when an attack is competing against its containment the outcome is difficult to predict through intuition alone: How many vehicles will need to be isolated? Will those remaining be enough to complete the mission? What recovery capacity will be enough to complete the mission to an acceptable standard?

The model and the approach we have developed enables quantifying these aspects and determining how different approaches to cyber-attack resilience can be used in alternation or in combination, to determine to what extent the mission’s objectives can be achieved, what recovery capacity is necessary to ensure mission viability, or whether the mission is best abandoned.

This approach is shown in the figures below, which depict the area coverage reached by a fire-survey mission, where a cyber-attack occurs at time t. Figure 1 highlights the problem when no model is used – the outcome from the interplay between the attack, defence and recovery is broadly unknown. Our approach, shown in Figure 2, allows us to build a quantified expectation of what is likely to happen, based on the different parameters, and to make decisions at the planning stage or during the mission itself.

Conclusion

Cyber-resilience of collaborative missions is a challenging research problem and decisions cannot be made on intuition alone. Models are required to understand how attacks unfold, and to quantify their impact on the system functionality. Our first article on doing this for multi-UAV missions is listed below. More to follow. Stay tuned!

[1] J. Soikkeli, C. Perner and E. C. Lupu, “Analyzing the Viability of UAV Missions Facing Cyber Attacks,” 2021 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), 2021, pp. 103-112, doi: 10.1109/EuroSPW54576.2021.00018.

(By Jukka Soikkeli and Emil Lupu, Imperial College London)

The post Cyber-attack impacts on multi-UAV missions: key observations to guide mission design appeared first on CONCORDIA.

How the existence of a Cybersecurity Skills Certification Framework will help the market and what if the connection to the European Cybersecurity Skills Framework?

One of the main directions of the work performed by the CONCORDIA project is cybersecurity related education and training. Other posts such as [[1], [2], [3]] have already explained the process and the different activities already performed by the project on this subject. The purpose of this blog is to present the final results of the activities related to the certification of skills.

In the CONCORDIA Methodology for the creation and deployment of new courses and/or teaching materials for cybersecurity professionals the value and importance of certification of skills has been underlined and described as complimentary and essential to the education process. At the same time, various studies[4],[5] show that skills certifications are important for professionals and organizations alike and as actions to help address the cybersecurity skills gap.

One of the problems brought forth by the feasibility study conducted by the project, was the great number of skills certifications, some of them having almost the same name but offering little assistance in comparing or identifying if they fit the needs and career ambitions of the individuals. To tackle this issue, the project team decided

1. to implement a cybersecurity skills certification scheme and pilot it, in order to gather best practices and
2. to present the extracted best practices in a proposal for a Cybersecurity Skills Certification Framework.

For the Role of the Cybersecurity Consultant, the project has already implemented over the last 2 years three iterations of the exams process and is currently preparing for organizing the fourth one. The feedback collected from the participants and the lessons learned helped us finalizing the C³ by CONCORDIA Certification Scheme [link] and fed further the more generic Skills Certification Framework.

The Cybersecurity Skills Certification Framework describes (at a higher level) the adjustments that should be made on an ISO 17024 compliant certification process and resulting certification schemes, to better fit the specificities of cybersecurity skills domain. Specifically, the document includes a number of requirements and information split into the basic certification principles:

• Impartiality (8 requirements),
• Responsiveness (5 requirements),
• Confidentiality (8 requirements),
• Responsibility (5 requirements) and
• Competence (18 requirements).

it should be pointed out that one of the first requirements of the proposed Cybersecurity Skills Certification Framework, is the mandate to design Certification Schemes on the basis of established and recognized Role Profiles, with explicit reference to the ones proposed by ENISA[6].

By adopting a common European Cybersecurity Skills Certification Framework, different organizations (certification bodies) realizing Cybersecurity Skills Certification Schemes will share a common baseline of processes and activities, thus producing comparable certificates in the market.

In this way professionals will have a clear understanding on which skills and knowledge are being validated through each certification scheme and to which Role profile these correspond to. The same value can be also identified by HR professionals who need to hire individuals that possess the appropriate skills and knowledge to perform the allocated tasks effectively.

The Cybersecurity Skills Certification Framework can be found at https://www.concordia-h2020.eu/wp-content/uploads/2022/12/CONCORDIA_Certification_Framework_1.0.pdf and we welcome any comments at argyro.chatzopoulou@tuv.at.

[1] https://www.concordia-h2020.eu/wp-content/uploads/2020/06/CONCORDIA-SkillsFeasibilityStudy-forpublication.pdf

[2] https://www.concordia-h2020.eu/wp-content/uploads/2020/07/CONCORDIAWorkshoponEducation2020-forpublication.pdf

[3] https://www.concordia-h2020.eu/wp-content/uploads/2021/07/Pilot_Course_BCSC_Report_Final.pdf

[4] https://www.isaca.org/go/state-of-cybersecurity-2022

[5] https://www.isc2.org/Research/Workforce-Study

[6] https://www.enisa.europa.eu/topics/cybersecurity-education/european-cybersecurity-skills-framework/ecsf-profiles-v-0-5-draft-release.pdf

The post A proposal for a Cybersecurity Skills Certification Framework appeared first on CONCORDIA.

We prepared the Field Manual to help you design your hands-on cybersecurity training in KYPO CRP. It is a minimalistic summary of our know-how gained through years of practice.

It is a challenge to design good cybersecurity training. We know it very well because we have done it many times – we trained professionals from giant energy companies, the government, or the bank sector.

However, it is meaningful to face this challenge. We all know that a skilled workforce is crucial in the domain. The digital resilience of our society requires professionals.

That’s the reason why we decide to create this Field Manual. It combines the main principles from several disciplines (management, andragogy, design, or even psychology) and the KYPO Cyber Range Platform fundamentals).

Of course, this is not a comprehensive description nor a substitute for KYPO CRP documentation. It is a minimalistic guide that will help the cybersecurity community create a mental model for preparing training.

We created the manual with the significant contribution of the CONCORDIA H2020 project

The post Field Manual for Cybersecurity Training Design appeared first on CONCORDIA.

The CONCORDIA Methodology and Guidelines for high school is out. Teachers are offered a flexible approach and 24 fiches to help prepare their cybersecurity and cybersafety related lessons.  

The CONCORDIA Methodology and Guidelines in support of high-school teachers describes a model of teaching and includes detailed information on how to address different cybersecurity and cybersafety topics in high school. We are also pointing to related initiatives deployed in different European countries. The document contains 470+ references and is structured as shown below:

The Methodology

The process we are proposing follows 3 phases: Assess/Plan/Deliver. At the core of our Methodology are (i) the active engagement of the students from the Assess phase, and (ii) the usage of the practical examples (see BYOE concept) and games/videos to illustrate the cybersecurity and cybersafety concepts. 

The Guidelines

The document covers 12 cybersafety and 12 cybersecurity topics we identified in the preparatory phase as essential to detail. Some of the topics are described at different levels of difficulty (Foundation, Intermediate, Advanced) as we considered fit for the high-school level, having in mind that we are addressing with this methodology a wide range of schools.

As part of cybersecurity, we thought relevant to provide a bit of guidance also on the most common cybersecurity related role profiles and certification schemes, to help students visualize a potential career path. 

The Annex 

The document closes with an annex grouping relevant initiatives deployed in Europe. The tabled structure helps teachers grasp easily the topic addressed, the age segment, the language, before deciding to explore it further. 

Let us know!

Are you a high school teacher interested to apply this methodology and use the cybersecurity / cybersafety related fiches we propose?

Drop us a message at contact@concordia.eu and we will update you on the related activities planned for beginning of 2023.

The post Teaching cybersecurity & cybersafety in high school appeared first on CONCORDIA.