N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V RESEARCH AREAS D ATA S E C U R I T Y A N D D ATA P R I VA C Y The work carried out by LIST has made it possible to: LIST has extensive expertise in the foundations of data security and data privacy. Such expertise includes cryptographic algorithms and protocols as well as standard and emerging privacy enhancing technologies. Examples are statistical disclosure control and differential privacy. To this end, LIST consistently publishes new scientific results at conferences and in journals. Driven by the nature of RTO, LIST has used this expertise in areas of practical application. Notably, LIST is working on the design of efficient authenticated and key agreement protocols for IoT devices, the trustworthiness of machine learning solutions with a focus on data-oriented aspects (e.g. data poisoning and adversarial examples), and security and privacy issues for 5G ecosystems with a focus on API security. In addition, LIST is also working on the security and privacy aspects of Distributed Ledger Technologies (DLTs) and blockchain solutions, as well as the application of such technologies in domains such as dangerous goods transportation and housing. • Evaluate the security and privacy issues (and more generally trustworthiness) of existing ICT systems, • Enhance the current systems with new algorithms (e.g. homomorphic encryption), protocols (e.g. privacy-preserving machine learning) and processes (e.g. how contact tracing is done), • Apply new technologies such as machine learning and DLT/blockchain to new application scenarios in a responsible and accountable manner, • File a patent (LU100580 – 12/2017) about a solution dedicated to the protection and valorisation of Internet user profiles. CY B E R SYSTE M S E C U R IT Y A N D R E S I L I E N C E On the other hand, LIST works on intelligent infrastructures with their IoT devices that are integrated into an edge-, fog- and cloud-computing concept, for which high-assurance of resilience against various types of attacks is crucial. In this sense, LIST identifies and specifies the key components, their functions and services, as part of an orchestration framework that are needed to ensure pre-defined security levels, and which take the heterogeneous setup of potential IoT infrastructures into account. Additionally, novel cryptographic mechanisms that will implement the privacy-by-design concept in the domain of intelligent infrastructures and IoT networks are evaluated and proposed. Blockchain/DLT are seen as the potential base of resilient infrastructures that targets distributed applications in an environment of partners which are not necessarily fully trusted. We are investigating use cases that could benefit most from the fundamental properties of blockchain/DLT and trying to create resilient solutions based upon the latest existing frameworks. Research performed within this thematic is twofold. On the one hand, activities are centred around a full-spectrum cybersecurity awareness. LIST works on an approach to the modelling of the services, organisations, and infrastructures to enable security-related knowledge sharing, integration and better resilience of critical infrastructures and their related essential services. This approach relies on information security management outputs to enable continuous real-time incident prevention, detection, reaction, and mitigation. This allows increasing resilience to cybersecurity threats and potential cascading events, while ensuring a continuous alignment to cybersecurity requirements and finally feeding back information security risk analyses. This approach is based on the development of distributed technological artefacts, massive data exploitation and the use of artificial intelligence technologies for real-time cybersecurity protection. 41