## 6 Use Case: Cyber and Physical Attacks against a Water Critical Infrastructure
### Preliminary Results  
The implementation and deployment of our proposed platform in water critical infrastructures provide the following improvements [43, 45]:  
* Event Reduction. Water utilities experienced ta reduction of at least two thirds of the security events collected by their cyber and physical sensors. As a result, security administrators do not feel overwhelmed by the huge amount of data to be analyzed.
* Accuracy Improvement. The detection and analysis capabilities have been greatly improved with the use of a wide variety of sensors feeding the core components of the platform with contextual data regarding cyber and physical events in near-real time. As a result, at least one third of the false events are discarded, making the detection process more accurate, as CLAP correlates security data from multiple sources and multiple layers. More precisely, water utilities experienced higher detection of cyber-attacks/incidents and lower false-positive rates (at least 50% better than the current state). This is particularly valuable on the detection of new and unknown threats in the system infrastructure. In addition, the use of a tool such as XL-SIEM maximizes the activity of the C-level managers in the control center, by presenting the alerts on a user-friendly interface and alert management platform.
* Latency Reduction. Using tools such as the NTSA, we are reducing considerably the effort and time required by a security administrator during the detection and analysis of events (especially for zero-days threats). NTSA spots attacks/incidents at least ten times faster than the current technology used by the water utility. In most cases, effort is reduced to less than half, since the use of machine learning algorithms improves considerably the detection of unknown patters and the analysis of abnormal behavior. Overall, the platform enables C-level managers to react in (near) real-time (i.e., in less than 1 min) to security alerts.
* Response Time Reduction. The platform offers (near) real-time response (i.e., in less than 10 s) for interactive users even in the case of a complex correlation of large data volumes (i.e., tens of Terabytes) and/or high data rates (i.e., one or more Terabytes).
* Human Exposure Reduction. Most of the detection activities require manual intervention for their analysis. This is time consuming, error prone, and demand a great effort from security analysts. Preliminary results show that the developed platform helps reducing effort and time during the detection and analysis of unknown malicious events while at the same time renders the process more accurate. We have experienced an effort reduction of at least 50% compared to the manual process performed without the use of CLAP to analyze the detected events.  
In addition to the aforementioned improvements, the situational awareness dashboard provided for visualization purposes allows the highlighting of security data related to the particular events and assigns a risk level based on its severity. This helps not only security administrators, but also C-level managers in understanding the risks and possible actions to take to keep them within acceptable levels. Furthermore, using a multi-level risk management process, the platform can improve the risk assessment associated with each generated alarm depending on the involved sensor. When two or more sensors refer to the same security event, the risk level is higher compared to the same event detected by a single sensor.