The Belgian Defense increasingly relies on software, both in the form of applications and cyber-physical systems. When these software programs exhibit defects, vulnerabilities, and weaknesses, attackers can exploit them to compromise critical systems or extract sensitive information. To mitigate this risk and ensure that software is reliable and trustworthy, certification and accreditation activities have traditionally been integrated into the software lifecycle. However, software assurance through certification and accreditation suffers from resource-intensive and time-consuming processes. A structured and largely automated/agile approach is needed, taking into account software updates. The ARCOS initiative indicates that the US defense is moving towards higher levels of cybersecurity maturity, involving a thorough assessment of all software and systems approved for classified or unclassified military networks

AMC3 aims to realize this vision and apply it to the Belgian defense sector. The objectives of AMC3 are (1) to modernize the Defense cybersecurity certification processes and (2) to automate the process, drastically reducing human workload. Given the increasing number of IT and OT systems used by the Belgian Defense and the growing complexity of these systems, effective cybersecurity risk management requires the internal accreditation process to be based on the automation of significant parts of the process. AMC3 provides automatic (formal) simulation-based verification and monitoring, producing evidence while preserving traceability to automatically build the argumentation for assurance cases. As a significant portion of accreditation relies on the software/system manufacturer’s contribution, it is crucial to involve both the defense industry and the defense itself in internal developments. The internally developed MASFAD system will serve as a case study for experimentation and validation throughout the project. The goal is to validate the AMC3 methodology, particularly the interaction/collaboration between the development team and the military accreditation cell. The project aims to develop an automated certification and accreditation methodology, assemble a set of tools supporting this methodology, and validate it on two typical defense-related use cases. The first use case is an internally developed Advanced Persistent Threat (APT) detection tool to protect government and military networks, while the second is a weapon system software.

The three AMC3 phases are: (1) developing a methodology for automatic certification with efficient validation techniques, (2) considering incremental certification for updates, and (3) automating certification control at runtime and conducting technical/cost analysis. Two case studies will be used: MASFAD, an IDS from ERM, deployed as a digital twin on a simulated but relevant defense network; and FNH SAM, proposed by FN Herstal for phase 3, a production software for weapon management. These case studies will respectively help develop the methodology and perform a techno-economic analysis to estimate the cost-benefit of implementing the methodology in an industrial solution.

Insights from the MASFAD case study will directly impact certification and accreditation processes within the Belgian Defense, enhancing the cyber-resilience of classified and unclassified military networks. The collaboration with FNH applies the AMC3 methodology to FN® SAM, potentially influencing the Belgian Defense as FN® SAM was conceptually evaluated in 2021 and is pre-deployed in 2023, with a full deployment planned later to manage the entire Belgian Defense weapons fleet. AMC3 results will be gradually deployed into the operational solution of FN® SAM to enhance the overall solution’s security. A cost/benefit analysis will be conducted to facilitate the adoption of the AMC3 methodology.

The results of AMC3 will be a validated methodology and its prototype platform, proven in terms of scalability and cost-effectiveness through two industrial case studies. These innovations enable the adoption of more agile and sufficiently rigorous methodologies to certify newly developed or updated software. The beneficiaries of this new methodology include Defense actors (direct or supply chain) and their suppliers, as well as the entire socio-economic fabric facing automatic certification. For maximum impact, results will be disseminated to Belgian (CCB) and international certification bodies, including Horizon Europe projects working on automatic certification.