The NCSC research problem book
Page 15 of 21
CP1 - How do we build security for systems with long operational lives?
How do we build security for systems with long operational lives?
Many cyber-physical systems are designed and built with the expectation they will operate for many years. A cyber-physical system must be kept up to date and secured with minimal overhead so it can operate safely and securely while other technologies around it advance. As the threat landscape changes, it’s important to make sure the capability to defend systems doesn’t lag behind an attacker’s capability.
To do this effectively means bringing together different research disciplines beyond cyber security. It’s also important to understand where approaches to security have worked well in the past.
Strands or sub-problems
-
Historical best practices
When new technology is rolled out, it often needs to function within existing technology, that is to say, in an environment that isn’t completely new. It’s important to put in place the right support to implement and manage these different technologies together. It should be possible to take the experience of the known challenges of integrating new technology into legacy systems, and use it to inform future practice.
-
DevOps
By looking at how cyber-physical systems are developed and managed, it may be possible to define new frameworks and practices to create more robust system processes. Fundamental to this is understanding where development approaches are less effective in cyber-physical systems than in IT systems.
-
Sustainability
To design and create cyber-physical systems, we need to consider their wider impact. Technology, material, policy and processes should be built to cope with the inevitable future changes over the lifetime of a system.
-
Skills and training
Identifying the right skills and training to support a system over the course of its life is one of the challenges of long-life systems. Skills could range from improving security awareness, coding or development capability for maintenance of systems. For cyber-physical systems, additional types of training might be necessary for specific operational needs.