Cyber security – one of the big, urgent issues of society, science, and economy
Today, the well-being of all citizens, the industrial competitiveness and the sovereignty of nations are strongly influenced by the correct functioning of increasingly complex and interconnected IT systems. The reliable security and privacy-friendliness of these systems must therefore be backed up with state of the art technology. However, the level of cyber security has not been able to keep pace with the dramatically increasing demands on it over the past decades: faulty computer systems are used for spying on and sabotaging even the most security-critical infrastructures (e.g., energy supply network, water supply, communication network, transportation network, the financial sector); the Internet has become a virtual bazaar in which people exchange information and goods freely and in relative anonymity, without having to fear being held accountable for misconduct; consumers put an enormous amount of personal information in social networks and cloud storage these days, but do not realize what serious privacy issues will be caused long term by this kind of digital outing. Even more than other critical infrastructures, IT systems are subject to strong and ever faster technical change. This, on the one hand, makes it difficult to define and guarantee their critical system characteristics, but, on the other hand, makes it possible to actively influence this development instead of just surrendering to it.
Benefits of a cross-border research institute
The underlying issues are highly complex and require substantial progress in the area of cyber security – ranging from basic research (e.g., in the areas of cryptography, privacy, and soft- ware analysis) to application-oriented research (e.g., in the areas of developing secure software and system solutions). Many of these tasks are of European interest (e.g., collaborative early detection and defense against cyber attacks, the technical implementation of the ambitious European privacy requirements, and more), and existing institutes and research clusters have yet to deal with them in the necessary comprehensive and integrative manner. Sustainable solutions that also have international support and the potential to shape the area require fundamentally new approaches and new forms of cooperation between top researchers from different disciplines (along with the corresponding organizational units), with their approaches and research objectives that have been often isolated up to now.
Therefore, taking a leading position worldwide in cyber security research must be the core of government activity in Europe in order to understand and actively influence technological development and derive recommendations for politics, business, and the general public. This requires a holistic solution strategy based on sustainable cutting-edge research and the pooling of existing strengths and established cooperation in this field of research. Especially the European solutions have to be established and focused across national borders. Germany and France are very strong and appropriate partners for this kind of initiative in the area of cyber security, both for strong geopolitical reasons as well as in terms of content: the two countries are world leaders in cyber security research as well as in IT security industries and services (e.g. Gemalto, Thales, Airbus,. . . ) with established collaboration of both national security agencies (ANSSI and BSI), and being neighbors allows for closer exchange and intensive collaboration. Moreover, establishing a collective institute across country boundaries is tightly aligned with the strategic internationalization plans of both countries, e.g., BMBF’s recently announced International Cooperation Action Plan1 that aims to “achieve a new quality in European and international scientific cooperation and take the Internationalization Strategy a step further”.
In order to address all the important and urgent issues of cyber security holistically, such an institute must take a comprehensive approach to all relevant topics according to a strategically aligned research program. This requires, on the one hand, a strong concentration on the scientific fundamentals of cyber security and, on the other hand, the development of methods, tools, and prototype systems that meet practical needs in the mid to long term.
An in-depth focus on the following topics is essential:
– Foundations of cyber security
– System security
– Usable security
– Network security
– Computer and network forensics
– Secure software engineering
– Security guarantees for critical applications
– Detection, analysis and defense against cyber-attacks
– Risk and compliance
In order to set up a real, strong and sustainable dynamic, we plane to first build the center between Nancy and Saarbrücken, with strong collaborations in both countries as well as in Europe.
Saarbrücken is the natural location in Germany for a French-German Cyber Security Institute. In addition to the close proximity to France and a multitude of existing collaborations with French partners, Saarbrücken is one of the world’s most visible locations in the area of cyber security research: Saarland University already hosts the national center of excellence in cyber security CISPA with international appeal on site. This expertise is further enhanced by their neighboring partner institutes: the Max Planck Institute for Informatics (MPI-INF), the Max Planck Institute for Software Systems (MPI-SWS), the German Research Center for Artifi- cial Intelligence (DFKI), and the Cluster of Excellence Multimodal Computing and Interaction (MMCI). Cyber security is a core topic at all these institutes.
Nancy is the natural location in France for heading the French side of the French-German Cyber Security Institute. For several decades there is a strong tradition of close collaboration with German partners, in particular from Saarbrücken. Together with Université de Lorraine and CNRS, Inria has developed in Nancy a strong position on cyber security with four project teams working in cryptology, cryptographic and voting protocols, virology and network security. A specific High Security Lab has been set up to host sensitive data and to perform in a trusted environment experiments on security software and on malwares.
There is already long-standing, institutionalized cooperation between the cyber security research sites in Saarbrücken and Nancy (e.g., through existing programs such as the University of the Greater Region, through research framework agreements between the MPI-INF / CISPA and Inria, Université de Lorraine and CNRS / LORIA in Nancy, and more). This makes the cyber security research locations in Nancy and Saarbrücken particularly ideal partners for the proposed institute concept, moreover because of their close geographical proximity (Nancy-Saarbrücken are distant of 90 minutes by car). This is essential for close cooperation between the locations.
Structure of the institute and required personnel
CERI will be shared over Nancy and Saarbrücken, hosting researchers in both places. It will be led by two directors, one for each site. The directors jointly determine the institute’s common overall development strategy. In addition to the directors, each site will consist of 12 main groups, in the aforementioned research areas. All of the research areas are developing funda- mental principles and methodological approaches to be implemented in prototypes and, for that reason, comprise a high degree of prototypical software development. Therefore, the institute should include support with regard to the realization of the prototype software systems and, in particular, ensures the interoperability between the different prototypes. The institute will also contain supports for researchers by providing secretarial services, travel and human resources management, as well as support in ordering, budgeting, and accounting. In total, the number of employees for the institute will closely correspond to the size of comparable international research institutes: for each site, the institute shall encompass about 110-120 researchers, an infrastructure group of about 6-8 engineers, as well as IT administrators and administrative personnel, corresponding to about 8 Me/year of necessary base funding for each site, additional to what exists currently.
Impact on European research, transfer and innovation
By developing such an ambitious initiative, we plan to have strong and decisive impact on research, transfer and innovation in the domain of cyber security. The institute strives for impact primarily through high-quality publications and software artefacts, technology transfer to industry and spin-off companies, by being an elite training ground for cyber security students and researchers, and by its outreach activities to media, industry as well as political and governmental impact. To this end, we will closely collaborate with other main cyber security labs in both countries and in Europe, as well as at the international levels.
The CERI concept has been presented to the partners and has got many enthusiastic support letters and we hope the creation decision to be taken soon. As a very ambitious project, its sustainable founding is currently under discussion between the French and German ministries of research as well as with the local authorities. In particular on June 22, the Région Lorraine organized in Metz a colloquium “Cybersécurité civile en Lorraine : enjeux et propositions” Une dimension nouvel le pour la coopération Franco-Al lemande.
Michael Backes, CISPA, Saarland University and MPI-SWS
Claude Kirchner, Inria
1 A compact version can be found here: http://www.bmbf.de/pub/International_Cooperation_action_plan.pdf .