I EDUCATION & SCIENCE
Critical Infrastructure – Critical for EU Many of the scientists and IT-specialists engaged in cyberdefence in Estonia agree that the events of the Bronze Night paved the way for development for Estonia to became the foremost country in cybersecurity. Being at the forefront enables to export the knowledge.
Serious Games Estonia is famed for its e-Governance and e-Services. Though for the general public this might be unfamiliar, for cyberdefence experts all over the world Estonia is also well known for its cyberdefence exercises. ‘Participation by invitation only’ states the modest note on the message. The aforementioned Locked Shields is the biggest and most advanced international live-fire cyberdefence exercise in the world. The annual scenario-based real-time network defence exercise, organized since 2010 by the Tallinn-based NATO CCDCOE, focuses on training the security experts, who protect national IT systems on a daily basis. Over 550 people and a total of 26 nations were involved in Locked Shields 2016. An exercise of that scale and scope needs constant effort to remain the biggest and most advanced of its kind. This is where the scientists of TUT come to the fore. Part of the research problem is how to make games that would be as efficient, but are equally viable in measuring the learning outcome. These kind of hands-on exercises are effective for eLearning skills: ‘However, there are lot of publications on learning on traditional courses, but no one has actually looked at learning aspects, measuring learning – like learning analytics – and how to improve these exercises from the learning prospective,’ says Maennel. So this is an aspect where cybersecurity meets pedagogy and all aggregates under the phrase ‘serious games’.
On example of that is Luis Carlos Herrera Velasquez a student who in 2016 defended a Master’s thesis on ‘A Comprehensive Instrument for Identifying Critical Information Infrastructure Services’. The thesis points to a significant issue the European Union is soon facing. The issue is called EU Directive 2016/114, which was adopted on 19 July, 2016, and has just now come into effect. EU Member States have at the time of writing 21 months (until 25 May, 2018) to identify operators of vital services. However, to the best of our knowledge there is no clear methodology available to do this task, say Olaf Maennel and Luis Carlos Herrera Velasquez. In his thesis Luis-Carlos Herrera Velasquez proposed such a methodology right now. If his methodology is applied, it could give a comparable framework to countries to identify its vital services. At the moment it seems quite random what different countries are actually doing – Estonia has 40 vital services, Italy has only two sectors, France identifies 12 sectors, Switzerland has 10 sectors, etc. Of course, what constitutes vital services varies from country to country for good reasons, but research has clearly shown that there are international inter-dependencies between critical infrastructure providers. It is also clear that attacks on one service could cause wide-spread cascading failures. ‘If those vital services are so interlinked, shouldn’t there also be a coherent methodology to identifying them?’ asks Maennel.
Simply put, the serious games combine education and knowledge and are created for a serious reason for implementation, for example, in health, city planning, safety, management, education; and in our case for cyberdefence. In Tallinn University’s School of Digital Technologies, creating serious games is an actual course for undergraduate students in Informatics. In cooperation with a PhD student and a founder of the startup RangeForce, Margus Ernits, TUT has helped to develop an Intelligent Training Exercise Environment (i-tee). It is a fully automated platform that offers a cyberdefence competition games for smaller group and individual. There are other similar exercise platforms in the world, but none of them have that sort of level of automation. The whole platform is available under an MIT license, and it is open source, which means it is free of charge for groups and is available commercially for individual learning via RangeForce.
42
LIFE IN ESTONIA #43
I
2016 FALL
Margus Ernits