This thesis investigates the performance of the DeepCASE[13] alert-filtering system when incorporated into a multi-system security detection environment and compares its efficacy to other state-of-the-art alert-filtering tools, such as the Integration Layer in[30]. The main research question addressed is: How does the DeepCASE system perform in a setup with multiple security detection systems, and how does its performance relate to other state-of-the-art alert-filtering systems? This research is of critical importance given the growing complexity of cybersecurity environments, where various detection systems frequently create overwhelming amounts of alerts. Key Findings: • Metrics for Evaluating Alert-Filtering Systems: SQ1 looked into relevant metrics for determining the efficiency and efficacy of alert-filtering systems. It was shown that general performance metrics can be misleading in complex environments. Granular metrics, such as false negative and true positive rates, yield more meaningful evaluations. In this study, the false negative rate was ranked first, followed by workload reduction, as key indicators for evaluating DeepCASE. • DeepCASE Performance with Multiple Detection Systems: SQ2 evaluated DeepCASE’s per- formance in a multi-system setting. DeepCASE achieved promising results, with a 0% false negative rate and an 87% reduction in workload. These findings demonstrate its usefulness in managing alerts across several security detection systems while maintaining accuracy. • Improvements for Multi-System Integration: SQ3 looked at potential improvements to Deep- CASE’s performance in a multi-system environment. We tested with a variety of tactics, including alert aggregation and incorporating security analyst expertise. It was discovered that incorporating security analysts’ expertise via the ”IL Preprocessing approach” considerably increased performance, resulting in a 0% false negative rate and an impressive 96% workload reduction. This emphasizes the significance of expert-driven preparation in improving alert filtering. It should also be noted that out of all of the attempted alert aggregation approach, the 1-Minute window alert aggregation also managed to provide some improvement, achieving 0% false negative rate with a 90% workload reduction. • Comparison with State-of-the-Art Systems: SQ4 compared DeepCASE’s performance to a state- of-the-art alert-filtering system, namely the Integration Layer. DeepCASE performed remarkably well, outperforming the Integration Layer when not all of the latter’s preprocessing approaches were used. However, the paper notes that a properly optimized integration layer may have different outcomes. DeepCASE is highly effective in situations involving multiple security detection systems, significantly reduc- ing workload while retaining zero false negatives. However, expert-driven preprocessing techniques signifi- cantly improve its performance. While it compares favorably to other cutting-edge systems, further research is needed to fully understand the potential of these systems when completely tuned. This thesis advances our understanding of how alert-filtering systems can be evaluated and adjusted in complex, multi-system situations, giving useful insights for improving cybersecurity operations.

The power grid is becoming more intertwined with communication technologies, forming what is known as the smart grid. This integration allows for more efficient management of the power grid, which can help reduce emissions. However, the increasing connectivity with communication technology also expands the attack surface for cybercriminals or cybercriminal organisations. In 2015, a Ukrainian power station was attacked via a cyberattack, leading to an outage that affected almost 1.4 million people. The growing interconnection between the power grid and communication technologies can thus have severe impacts. Therefore, this research introduces an interdependent communication network and power grid to investigate how failures in the communication network affect the power grid's robustness. For generating communication networks, we use Python’s NetworkX package, and for the power grid, we use pandapower’s IEEE 118-bus test system. We analyse the robustness of the smart grid by examining two different communication networks: a mesh network and a double-star network. We simulate attacks on the communication network by initiating failures based on random selection, degree, betweenness, and closeness centrality, with an increasing number of node failures. We also distinguish between two failure behaviours: one that includes communication network failure propagation (e.g., the spread of malware or the failure of dependency nodes within the communication network) and one without this failure propagation behaviour. In general, the smart grid shows higher robustness with a mesh communication network. However, under different failure behaviours, attack strategies, and numbers of nodes attacked, this can vary. Prioritisation should focus on reducing communication network failure propagation, as this significantly impacts the robustness of the smart grid. Even though degree centrality and betweenness centrality have the most impact on double-star networks, for mesh networks, closeness centrality should also be considered, especially in scenarios without network failure propagation.

In 2019 a quantum computer performed a highly complex operation in 4 minutes, which would have taken the most powerful supercomputers of today around 10,000 years. Performing calculations unimaginably faster than is currently possible may bring great opportunities, but may implicate a threat to digital communications. Digital communication is kept secure through cryptography, which uses mathematical problems to protect sensitive information and communication from malicious acts of cybercrime. Cryptography is widely adopted across the cyberspace. The world’s fastest classical computers of today are unable to break cryptography’s underlying mathematical schemes, ensuring confidentiality and integrity of everyone’s data. However, it is predicted that future quantum computers could theoretically break current cryptography in just a few hours. The moment that a powerful enough quantum computer exists (called Y2Q) thus implicates that cryptography systems will become unusable as digital services are no longer secure. This could have catastrophic consequences for society’s critical digital infrastructures, such as those provided by Dutch banks. This problem is very relevant for banks, because of the sector’s abundance of sensitive data and information streams that rely on cryptography, as well as their critical role in society’s functionality (facilitating payments).
Because of the serious disruptions in critical financial infrastructures that the quantum threat could ignite, decision-makers within banks will be needing governing tools to mitigate risks. Adopting new quantum-resistant cryptographic algorithms, known as post-quantum-cryptography (PQC) is absolutely critical in facilitating safety and security from the quantum threat. However, there is currently little or no governance, or guidance, for the management of this transition towards PQC and guidance is urgently needed. The formulation of these guidance-measures is one of the main challenges regarding the transition towards security in the quantum-era. Therefore, this research focusses on ensuring the Dutch banking sector’s safety and security of its digital infrastructures, from the cryptography-related cyber threats posed by quantum computing technology – from not merely a technological perspective, but with a holistic approach, considering the involved socio-technical challenges. In order to provide guidance to decision-makers from Dutch banks, this thesis aims to answer the following research question:
How can the Dutch banking sector ensure the safety and security of its digital infrastructures, from the cryptography-related cyber threats posed by quantum computing technology?

In order to answer the main research question, the Technology Roadmap (TRM) framework will be used. This framework provides the vital link between a first idea phase (i.e., banks’ digital infrastructures face a threat from quantum computing technologies) and the concrete implementation phase (i.e., how do we ensure protection from this threat?). The TRM is a diagram which consists of features, services, systems, resources, and drivers in relation with one another, that together facilitate an overview of what is required for the banks to become quantum-safe. Constructing this roadmap required three main methods:
(1) Exploratory research to identify in which parts of the banks’ processes and operations the vulnerabilities to the quantum threat are the highest. This included describing key concepts within cryptography, PQC-developments, and banking services, as well as stakeholder- and dependency-mapping of the Dutch banking environment.
(2) Semi-structured interviews with security architects, payment security specialists, and cryptography specialists from Dutch banks. Herein the perceptions of the Dutch banks on the impact, challenges, resources, capabilities, preparedness, and governance were obtained.
(3) TRM development based on thematic analysis of qualitative data derived from semi-structured interviews in which the perceptions were translated into elements fit for the TRM.
Lastly, the TRM was validated and revised by presenting it to experts and asking for critique, which enabled the final TRM to be developed. after which conclusions and recommendations could be drawn up.
The core banking services were analyzed in terms of the role that cryptography plays to ensure the security of these services, which helped to identify in which parts of the banks’ processes and operations the vulnerabilities to the quantum threat are the highest. The exploratory analysis identified the critical processes that entail the certain infrastructures that need to transition towards PQC. These being within the online payment process, the physical card transaction process, and the ATM transaction process. Within these processes the main vulnerabilities lie in: data channels through external public networks and service providers relating to payment gateways, payment processors, local store webservers, online merchant webservers, card association networks and Point-of-Sale (PoS)-terminals. Less vulnerable infrastructures, due to their primary use of symmetric cryptography, are: ATM networks, internal storage and communication infrastructures, inter-bank data exchange, and ATM controllers.
Through combining these insights with findings from the thematic analysis of perceptions derived from the semi-structured interviews, the TRM was developed which presented a 3-phase transition plan that aims to ensure the Dutch banking sector safety and security of its digital infrastructures from cryptography-related cyber threats posed by quantum computing technology. Phase 1 of this transition plan entails the development of a response plan for a potential privacy breach and the development of central cryptographic inventory, through management priority, internal alignment, and experimentation with to-be-standardized PQC algorithms. After PQC algorithms have been standardized, Phase 2 involves the adoption of PQC algorithms in online payment networks, requiring banks to draw up a PQC requirement list for vendors and external service providers. With a hardware replacement strategy in place, Phase 3 entails the replacement of all relevant hardware related to payment processes (payment cards, PoS-terminals, and ATM controllers), updating less prioritized software and network infrastructures, and overcoming technical challenges related to PQC algorithms' larger key-sizes. It is important to note that the implementation of PQC is not a one-time event, but rather an ongoing, ever-evolving, and uncertain process. The continuous development of quantum computing technology means that banks must remain vigilant and adaptable to stay ahead of potential threats, and may need to accelerate certain phases within the transition on a relatively short notice. Additionally, the success of this transition relies heavily on organizational awareness, as well as close collaboration between various stakeholders, vendors, service providers, regulators, and other financial service organizations.

Based on this conclusion, this research has made several recommendations to the Dutch banking sector:

Accomplish management priority. Management priority is crucial for allocating resources to execute the first steps that have to be taken to ensure quantum-safety. Therefore, the banking sector should shift the focus of management toward addressing the quantum threat and transitioning towards post-quantum cryptography (PQC) as a top priority, integrating quantum-readiness into the key strategic goals of the bank by means of organizational awareness. Organizational awareness can be created through workshops, seminars, and events that are aimed at educating management on the business implications of the quantum threat, as well as presenting them with solutions on addressing this threat.
Execute initial risk-free actions. Banks can already take certain risk-free actions in preparation for the PQC-transition, which will strengthen the preparedness of the banks. These actions include:
- Developing a privacy breach response plan
- Developing a centralized cryptographic inventory
- Doubling key-lengths for symmetric-key cryptography algorithms
- Developing a hardware replacement strategy
Extend continuous collaborative research to PQC. Dutch banks should proactively utilize their existing collaborative structures with other vendors, service providers, regulators, and other financial service organizations., to share their experiences and jointly develop strategies for addressing the quantum threat. This will benefit the Dutch financial market as a whole, as sharing experiences with executing the risk-free actions or experimenting with PQC-algorithms is highly relevant for creating a comprehensive understanding of the practical implications and technical challenges associated with becoming quantum-safe.