Enforcing security requirements in networked information systems relies on technical security controls to mitigate the risks posed by increasingly sophisticated threats. Configuring these controls is challenging; even nowadays, administrators must perform it without adequate tool support. Hence, this process is plagued by errors that result in insecure postures, security incidents, and a lack of promptness in addressing threats. This paper presents the Security Capability Model (SCM), a formal model that abstracts the features that security controls offer for enforcing security policies, which includes an Information Model that depicts the basic concepts related to rules (i.e., conditions, actions, events) and policies (i.e., conditions’ evaluation, resolution strategies, default actions), and a Data Model that covers the capabilities needed to describe different types of filtering and channel protection controls. Following state-of-the-art design patterns, the model enables the generation of abstract versions of the security controls’ languages and a model-driven approach for translating abstract policies into device-specific configuration settings. By validating its effectiveness in real-world scenarios, we demonstrate that SCM enables the automation of various and complex security tasks, including accurate and granular security control comparison, policy refinement, and incident response. Lastly, we present opportunities for extensions and integration with other frameworks and models.

The transition towards cooperative intelligent trans-port systems (C- ITS) requires coordinated efforts from all stakeholders. In this context, the European C- Roads project aims to deploy and harmonize C- ITS at a continental scale to facilitate interconnected and autonomous road networks, enabling efficient traffic management, improved road safety, and reduced emissions. This work provides a third-party point of view on the challenges posed by cyberattacks against these systems. It contextualizes and investigates threat models for C-Roads use cases, introducing key concepts, analyzing the inherent literature on threat modelling, and presenting application-specific scenarios. It discusses results and future directions, highlighting the importance of collaborative efforts from all the involved actors to shape the future of transportation.

Evaluating risks against IT Systems is a complex yet crucial process that requires significant resources and competencies. This paper proposes RiskMan, an expert system for the automatic assessment of cyber risks that computes a risk score using information gathering and vulnerability assessment tools, public databases, and leaks from the dark web without involving cybersecurity experts. Moreover, RiskMan uses AI-driven techniques to determine risks also when only partial information is available.