ASOC - Establishment of an Academic Security Operations Center

11/01/2023 | Call 2022

The project deals with the conceptual design of a federated Academic Security Operation Center (ASOC). The ASOC is intended to ensure a rapid and, if possible, automated exchange of security information, IOCs, rules, SOAR workflows, use cases, playbooks, and knowledge in an academic context. Thus, the project includes the development of a maturity level determination of the individual participants, a secure data protection-compliant exchange of information, methods for AI-supported threat hunting as well as further education and training on an open-source basis and the corresponding preservation of digital sovereignty and the clarification of the legal and social issues of an ASOC.

Austrian universities and academic institutions must face the cyber security challenges posed by real external threats on the one hand and existing or expected regulations such as the NIS2 Act on the other.
In this environment, the implementation of university-wide measures is often difficult and associated with many obstacles due to the federal structures with very independent institutes and heterogeneous IT structures. In addition, universities are struggling with a shortage of specialists, which means that employees, especially in the field of information security, are often successfully poached by large companies with a corresponding budget. In addition, securing the large, complex, and heterogeneous network infrastructures and systems at universities and monitoring the resulting data volumes pose enormous challenges.

In order to support universities in this task, make optimal use of synergy effects and significantly increase cyber security, the long-term plan is to establish an academic Security Operations Center (SOC) via ACOmarket, which will offer ACOnet participants central services for proactive measures, atack detection and countermeasures. This will give universities and their ZIDs (Computer Centers) as end users the opportunity to benefit from proven services, experience, and resources to strengthen their cyber security without having to build it up from scratch.

The establishment of a cross-university SOC brings with it many challenges for which there are currently no solutions, and which therefore require research. In general, SOCs have not yet been uniformly defined and there are hardly any internationally tested implementations, particularly in the academic environment.
ASOC addresses organizational and, above all, technical core challenges such as decentralized data storage and reliable correlation and atack detection in large heterogeneous databases, drawing on the latest findings, algorithms, and methods from science and from the company's partners. Social and legal aspects are also taken into account.

The project is also intended to provide a starting point for applying the project results in initiatives at European level and thus transferring them to an international level, particularly with regard to the key areas of open source and maintaining digital sovereignty.

Project leader:
SBA Research

Project partners:

Bedarfsträger:
Forschungspartner:
Unternehmenspartner:

Contact:
Markus Klemen und Alexander Szönyi
Floragasse 7, 5. Stock, 1040 Wien

Telefon
+43 (1) 505 36 88

E-Mail
mklemen(at)sba-research.org
aszoenyi(at)sba-research.org

Homepage
www.sba-research.org
https://www.sba-research.org/research/projects/asoc/

Back

Austrian Research Promotion Agency (FFG)