The “Eraclito” project aims at providing strategic and tangible contribution to the modernization of the Nation itself in terms of cybersecurity posture and cyber risk management capabilities. The project intends to bring contributions to the cybersecurity state of the art in terms of knowledge, techniques, methodologies, and tools for cyber risks management, cyber threat intelligence and hunting as well as tools for managing the cybersecurity knowledge-base, with respect to National (i.e., Perimetro di Sicurezza Nazionale Cibernetica) and European (i.e., Cybersecurity Act) regulations.

WP1 – Organizational and Procedural Technological Model

The purpose of the WP is to identify and define the requirements of the identified “project targets” (end-users of Agenzia per la Cybersicurezza Nazionale – ACN, and “soggetto perimetrato”) about policy, procedures, processes, and tools related to regulatory aspects of PSNC, and, more generally, of cybersecurity European acts. The requirements will be specified in terms of identified area of investigation (i.e., human factor; cybersecurity policy, procedures, and processes; cybersecurity tools; security operational management and governance infrastructure, and technological infrastructure). Subsequently, the technological domains (i.e., IT, 5G, HW/Embedded, IoT, OT/ICS/CSP) dealt within project scope will be selected and metrics to identify the “regulation compliance level” and the relative “automation maturity level” of the “project targets” will be defined as well. Finally, the WP will provide specifications needed to put in place methodologies, techniques, and tools to fulfill the identified requirements as well as to increase the automation level of the related processes for the “project targets”.

Deliverables

WP2 – Methodologies, Techniques and Tool Implementation

The goal of this WP is to design and specify the ontological metamodel to provide the vocabulary for modeling the system under analysis and its related security information (e.g., threats, vulnerabilities, attacks, …). Moreover, the WP aims at identifying and implementing prototype tools for automating to the maximum extent the extraction of information (architecture, composition, security, and so on) from the target system. Part of the WP tasks will cover: (i) definition of methodologies to perform cyber risk assessment and management activity on the target system (“bene ICT” of a “soggetto perimetrato”); (ii) techniques to automate the cyber risk management process; (iii) definition of methodologies and techniques for Threat Hunting and Cyber Threat Intelligence (CTI), both for the selected technological domains, and (iv) definition of methodologies and techniques for assessment of users’ cybersecurity awareness as well as techniques to evaluate the impact of the human factor on the cyber risk of “project targets”.

Deliverables

WP3 – Clarifying and contextualizing the legal and ethical framework

WP3 aims at analysing the legislation related to the PSNC to identify and address critical issues. It will investigate how the specific rules of the perimeter interact with other legal frameworks spotting possible conflicts and synergies in the national and supranational (EU and International) level. Against this analysis, it will also liaison with the other WPs to identify legal and ethical gaps to be covered.

Deliverables