1. Full III Validation Exercise Demonstration
15th November 2017

2. Full III Exercise Overview (1) - Setup
Replicate and validate the full GAMMA architecture
Several integrated security prototypes and security management entities (geo-distributed)
Human operators
Additional (but non-relevant) incoming messages simulated by security event generators (to achieve a more realistic workload)
© GAMMA.All rights reserved

3. Full III Exercise Overview (2) - Threats
Realistic coordinated and non-coordinated cyber attacks according to threats identified in GAMMA
Hacker attack on System-Wide Information Management (SWIM) to manipulate essential aeronautical weather data
Hacker attack on airplane systems via on-board network
© GAMMA.All rights reserved

4. Full III Exercise Overview (3) - Measurements
Situational Awareness (SASHA)
System Usability (SUS)
Trust (SATI)
Reaction & Transmission times
False Alerts / Missed Alerts
User Acceptance
+ Tailor-made questions and subjective feedback from observers
© GAMMA.All rights reserved

5. Full III Exercise Overview (4) - Runs
Performed Runs:
Run ID
Date
Internal Validation Runs (GAMMA operators from Leonardo):
IV1-1
15th Mar 2017
IV1-2
IV2
22nd Mar 2017
IV3-1
11th Apr 2017
IV3-2
Final Validation Runs
(external persons acting as GAMMA operators)
FV-1
4th May 2017
FV-2
© GAMMA.All rights reserved

6. Coordinated Countermeasures
European Level
Correlation +
Coordinated Countermeasures
EGCC
EGCC
Attack Warning
Attack Warning
Sanitized Alert
Sanitized Alert
Sanitized Alert
Sanitized Alert
Attack Warning
Attack Warning
No correlation
NGSMP 1
NGSMP 1
NGSMP 2
NGSMP 2
NGSMP 3
NGSMP 3
Alert
Alert
A passenger tries to
hack on-board systems
IMC
IMC
Alert
Alert
SWIM Node
Alert
Alert
Hacker Attack on SWIM
Target: Essential
Aeronautical Weather Data
03:30 / UTC 12:28:54 Start
05:16 / UTC 12:30:40 1st SWIM Attack starts
05:25 / UTC 12:30:49 IEG 1 detects and sends report to NGSMP1
05:30 / UTC 12:30:54 IEG 1 report received at NGSMP1
05:44 / UTC 12:31:08 NGSMP1 forwards the report to EGCC
05:59 / UTC 12:31:23 EGCC receives the IEG1 alert
06:31 / UTC 12:31:55 IMC attack + report
06:44 / UTC 12:32:08 IMC attack report received
07:00 / UTC 12:32:24 IEG2 attack + report (not visible in the video)
07:14 / UTC 12:32:38 IEG2 attack report received
07:28 / UTC 12:32:52 NGSMP2 forwards the IEG 2 report to EGCC
07:39 / UTC 12:33:03 Received and Correlation at EGCC
07:49 / UTC 12:33:13 Forward to NGSMP3
07:55 / UTC 12:33:19 Forward to SWIM
IEG 1
IEG 1
IEG 2
IEG 2
Weather Data
SWIM
Country 1
Country 2
Country 3

7. © GAMMA.All rights reserved
Quick Facts
After the second part of the coordinated attack is detected, the identification (even in a geo-distributed setup) can easily be done in less than one minute
All attacks were successfully defended
Very few false alerts in all exercise runs
Safe and efficient handling of security information
Average reaction time of human GAMMA operators (noticing the alert, understanding the alert, decision making and taking action): 23 sec
Positive user acceptance and experts feedback
© GAMMA.All rights reserved
Trust, Usability, Situational Awareness

8. © GAMMA.All rights reserved
Partners involved
Partner
Role
Component
Location
DLR
Exercise Lead / Coordination
Multi-Screen Workstation
Braunschweig, Germany
Leonardo
SMP operator
NGSMP1, NGSMP2, EGCC, SEGs
Chieti, Italy
Airbus DS
IEG operator
IEG 1, IEG 2 (Stub)
IEG 1: Elancourt, France,
IEG 2: Chieti, Italy
TRT
IMC operator
IMC
Reading, UK
42Solutions
IDS operator
IDS NGSMP1,
IDS NGSMP2,
IDS NGSMP3,
IDS EGCC
Eindhoven, Netherlands
Boeing RTE
SWIM Node operator
SWIM Node
Madrid, Spain
© GAMMA.All rights reserved
Wer hat was wo gemacht
Quick facts