From Research to Tools: New Tools Help Municipalities Better Manage Cyberrisks in Infrastructure

How can municipalities gain better insight into the cyber risks associated with their infrastructure? Within the RAAK project, researchers, municipalities and cybersecurity experts are working on practical solutions to improve the security of the operational technology (OT) used in municipal infrastructure.

Since the start of this two-year practice-oriented research project, the project partners have been exploring how municipal professionals can use smart solutions to make OT systems more cyber-resilient. The focus is on municipal infrastructure for water management and traffic management.

From Passive Network Scans to Cyber Crisis Exercises

Recently, a working session was held with the project partners and representatives from the municipalities of Eindhoven, Rotterdam and Zoetermeer, as well as the Association of Netherlands Municipalities (VNG) and the Information Security Service (IBD), to discuss the scope and requirements of six tools being developed to support municipalities in establishing their OT security arrangements. These range from a simulation environment and a passive network scan to AI-assisted document analysis, OT vulnerability scans, tabletop exercises and a platform for cyber risk analysis.

The tools currently under development include:

• HydroSim: A simulation environment that replicates a water distribution system using virtual control systems. It can be used to identify technical vulnerabilities and illustrate the potential consequences of cyber incidents.
• Passive network scan: A tool under development that analyses communication patterns within OT networks to provide insight into system architecture and configuration.
• AI-assisted search and analysis tool: Research into ways of retrieving relevant information from municipal documents and contracts more quickly, for example, information about supplier agreements, risks and dependencies.
• OT vulnerability scan: An approach to identifying vulnerabilities in OT systems and publicly available information about municipal infrastructure. Practical experience with this approach has already been gained through Zero Day Zoetermeer.
• Tabletop exercises: Scenarios that help municipalities prepare for cyber incidents and their consequences for infrastructure and service delivery.
• Cyber risk analysis platform: A tool under development, based on the CSIR, to systematically identify and assess cyber risks associated with municipal infrastructure.

The tools are at different stages of development. Some have already been implemented or tested, while others are still being researched and further developed.

Practical Support for Municipalities

The aim of RAAK is to bridge the gap between knowledge, policy and implementation. Municipalities need not only insight into the risks associated with their OT systems, but also practical guidance on determining appropriate security measures and embedding them effectively within their organisations. This is necessary to ensure they are well prepared for potential incidents.

Over the coming period, the project partners will continue developing and testing the tools. Ultimately, the knowledge gained should also be useful to other municipalities, including through knowledge sharing via relevant networks and by linking the results to education and municipal practice.

In this way, RAAK contributes to the development of practical knowledge and tools to strengthen the digital resilience of municipal infrastructure.

About RAAK

RAAK is a two-year practice-oriented research project in which The Hague University of Applied Sciences, Utrecht University of Applied Sciences, the municipalities of Eindhoven, Rotterdam and Zoetermeer, the Association of Netherlands Municipalities (VNG), the Information Security Service (IBD), TNO, Hudson Cybertec and Security Delta (HSD) are working together to strengthen the cyber resilience of municipal infrastructure. The project is co-funded by the SIA Taskforce, part of the Dutch Research Council (NWO).

Photo credits: iStock/JoopHoek