Meet the NORCICS PhDs and PostDocs – Arne Roar Nygård

Cyber Security Expertise in Reverse Engineering – An initiative to Strengthen the Norwegian Power Grid Industry

Arne Roar Nygård from Elvia, one of the major electrical grid companies in Norway, is doing an industrial PhD with funding from the National Research Council. Elvia is a partner in NORCICS, and the PhD work is closely related to the NORCICS work plan.

Digitalization is still in its research and development phase for most Power Grid stakeholders in Norway, with the vendor industry leading the innovations. Furthermore, there is an ever more complex equipment and solution production supply chain. The various parts, especially hardware, are produced in various countries and then shipped to the vendor assembly line and put together, without a proper investigation of the actual content in each part. This means that no proof of cyber security is produced as part of the supply chain, and therefore no trust can be placed on the resulting product. Norway needs to build-up knowledge and resources enabling Norway to investigate the cyber security of not only software, but more importantly, hardware.

This will need to include both establishing a PhD-program and other educational capacities within reverse engineering, but also building a laboratory environment for cyber-physical systems and reverse engineering. This laboratory environment is planned developed at NTNU in parallel with the PhD program on reverse engineering. The aim of the PhD-program is to build-up core personnel by means of PhD-education, professorship and educational programs on multiple levels. At the end of the PhD, the candidates will be tasked with building up a study program and to supervise and assist further PhD candidates on the topic. In parallel with the PhD program, the plan is to build up a reverse engineering laboratory and capacity at NTNU in close collaboration with national agencies and other stakeholders. The PhD-program and the laboratory infrastructure will form the basis for developing a sustainable capacity within reverse engineering in Norway, serving the National Critical Infrastructure in general.

The PhD project from Arne Roar Nygård with the title “Reverse Engineering for verification of security in digital value chains in a critical infrastructure” focuses on security in the digital value chain from digital sensors in the power infrastructure to the HMI of the operating control system (SCADA). Specifically, it will examine how cyber security can be ensured in a digital value chain with equipment from different vendors, and to ensure that “maps and terrain always match.” This includes a focus on implementation (people), process, and technology. Long supply chains with components from different manufacturers require a new approach and methods to ensure the security required in critical infrastructure. These issues are well described in Olav Lysne’s book “The Huawei and Snowden Questions” [ISBN: 978-3-319-74949-5].

The PhD project will help Elvia, the power industry and other Norwegian critical infrastructure, as well as authorities to verify the security of products currently being used without us knowing the vulnerabilities. This is a competence that is lacking in Norway today.

The first year of the PhD project is now fulfilled and the plan for the next three years is to contribute to active research in the area of cybersecurity in digital supply chains. The primary objective of the research project is to develop a framework for systematically using tools, techniques, methods, and procedures to secure the digital value chain from supply and throughout the component’s lifetime in the power infrastructure. In parallel with the PhD program, the plan is to build up a reverse engineering laboratory and capacity at NTNU Gjøvik in close collaboration with NORCICS, national agencies, and other stakeholders. The PhD-program and the laboratory infrastructure will form the basis for developing a sustainable capacity within reverse engineering in Norway.