Bretagne has long been known for being at the forefront of cyber defence and cybersecurity and is perfecting its expertise in this area every day in an ever richer and dynamic ecosystem. Thanks to large companies, recognised training and state-of-the-art research centres, Bretagne has made a name for itself in the world of security, to the point of becoming a reference, especially with Rennes which has become the cyber hub of the Ministry of Armed Forces. Rennes relies on an intense digital ecosystem with more than 30,000 jobs and 4,100 companies and which itself inevitably develops general skills and know-how in cybersecurity.
Breeding ground for cybersecurity businesses
Cradle of the Cyber Centre of Excellence, created in 2014 under the aegis of the Ministry of Defence and the Bretagne region, the city of Rennes alone has more than 70 pure-player private companies in the cyber sector, accounting for 2,600 employees*, out of the 150** companies in this sector in Bretagne. This figure is constantly changing, as many companies are little by little joining this local ecosystem.
Some of these companies are non-specialised, others develop their business from a key technology or an innovative service. Companies develop audits, advice, training and security products for e-mail, applications, data, infrastructures and equipment, the cloud, connected objects, etc. Others work on threat prevention as well as on crisis management.
Several large groups have set up a cybersecurity site in Rennes, including Thales or Airbus Cybersecurity, Orange Cyberdefense, Alten, Altran Technologies and Sopra Steria. Naval Group is also working on this subject in Bretagne, in particular in partnership with the b<>com Institute for Technological Research. Not to mention Nokia which has turned its Lannion site into a global cybersecurity centre.
Bretagne SME are also benefiting from the roll-out of the sector.
In the Rennes region, alongside Ariadnext, Cailabs, Secure-IC, Syrlinks, EDSI, Kereval and Viaccess-Orca, Akerva has just opened a cyber defence centre in Rennes with ten specialists with the task of protecting the data of companies in the Grand Ouest. Wallix has also chosen Rennes to set up its second R&D centre specialising in the development of new cloud-based security services (CBSS). Amossys, which specialises in consulting, auditing, training, R&D and assessment of security products, is working on the use of Artificial Intelligence to improve cybersecurity and, on the training side, focuses on cyber training.
Near Brest, the Compagnie Européenne d’Intelligence Stratégique (CEIS, Paris) is opening an agency dedicated to cyber defence and has entered into a partnership with Diateam, a Brest specialist in IT security and innovative information systems. The two structures have co-founded the Bluecyforce group, a leading body in occupational training and training in cyber crisis exercises in the real environment in France.
Apart from these SME already well established in the national cybersecurity landscape, Rennes is also an ideal territory to foster the emergence of new start-ups. These include: Acklio, Anozrway, Buglab, ContentArmor, OneWave, Rubycat-Labs, Shadline, Woleet, Yagaan, Yes we hack and more. Rennes is also the leader in cybersecurity specialist start-ups in France after Paris.
*According to the AUDIAR study published in November 2019.
**150 companies have at least one activity related to securing content and data.
Recognised research laboratories and training
Bretagne is home to very good research laboratories with more than 40 research teams to understand better the threats we now face and to identify new technologies or methods that could help to boost the level of user security.
IRISA (Institute for Research in Computer Science and Random Systems) which works on various computer subjects (networks, security, signal and image processing, robotics, AI, etc.), brings together nearly 850 people at its three sites (Rennes, Vannes and Lannion), including 130 researchers dedicated to cybersecurity. In addition to basic research, the IRISA actions are also turning towards technology transfer and training. Alongside INRIA (Rennes), Lab-STICC (Brest) and IETR (Rennes Institute of Electronics and Telecommunications), the Ecole de Saint-Cyr Coëtquidan and the Ecole Navale de Brest also have their own research centres.
In terms of training, some 20 establishments in Bretagne offer training courses in cybersecurity, including the three military schools: Saint-Cyr Coëtquidan, Ecole des Transmissions de Rennes and Ecole Navale de Brest. To meet the needs of businesses, IMT Atlantique is going to construct a new building dedicated to cybersecurity on its Rennes campus to train engineers. Recently, the Université de Bretagne Sud is also training future cybersecurity engineers as part of the “Cybersecurity of Embedded Systems” master’s degree in Lorient.
The new EUR CyberSchool, which will open in September 2020, will offer cutting-edge and innovative master’s, thesis and on-going training courses in the fundamental and emerging areas of cybersecurity. The school draws on the expertise of the Universities of Rennes 1 and Rennes 2, ENS Rennes, four major engineering schools (CentraleSupélec, IMT Atlantic, INSA and ENSAI) and Science-Po Rennes. It will also have special links with CNRS and Inria. The aim will be both to unify further training around the various players in the field, such as IRISA, the Ministry of Armed Forces, DGA and Comcyber and to double the number of cybersecurity students in Rennes to 200 master’s graduates and 60 new graduate PhD students per year.
In addition, the Security Made in Breizh project, sponsored by Inria and soon to be launched on the University of Beaulieu Campus in Rennes, aims to bring together all the players in the sector (students, researchers and industrialists) in one place in order to promote exchanges, research, innovation and education and thus pool research topics, actions, resources and existing strengths. This place will have multiple goals: identify problem/solution pairings, welcome industrialists and to make this place a project hotel, develop a common laboratory, be able to offer work placements, expand on-going training, provide an educational platform and support the setting up of attack/defence exercises.
Rennes, cyber hub of the Ministry of Armed Forces
Rennes is now the heart of national cyber defence, with the Directorate General of Armaments Information Literacy (DGA-MI), Ecole de Transmissions and now ComCyber. Within five years, the armed forces will double their cyber force in Rennes, with 1,600 people.
On 2 September 1968, Celar (electronic armaments centre) opened its doors in Bruz with some 50 people, at a time when electronics were expanding in Bretagne. Fifty years later, DGA-MI has become the technical expert of the Ministry of Armed Forces, notably in the protection and defence of information systems, the support and technological validation of developments of major weapons programmes, the fight against electromagnetic attacks and the use of artificial intelligence in serving Defence. Since 2009, the workforce has been steadily increasing to its current figure of around 15,000 people, 80% of whom are engineers, mostly civilians. It also includes 600 cyber defence experts, predicted to be 800 by end of the military programming law in 2025, out of total workforce that should reach 2000 people. To accommodate these staff and their highly classified work, the centre invested in new buildings and structures with drastic safety standards.
The cyber defence command, Comcyber, created in 2017, inaugurated in early October in Rennes the first building entirely dedicated to the conduct of its operations. This 11,000 m2 building required an investment of €44M and will accommodate up to 400 cyber-combatants. Two more buildings will be built by 2025 to accommodate a global workforce of 800 people, for a total investment of €130M. The Ministry of Armed Forces is setting up the Defensive Computer Combat Analysis Centre (CALID), the Information Systems Security Audit Centre (CASSI), the Cyber Defence Reserve and Operational Preparation Centre (CRPOC) and the Army’s 807th signal company, already stationed in Rennes. The National Information Systems Security Agency (Anssi) is also announced.
Cyberdefense Factory has also just been inaugurated a few hundred metres from Comcyber. This is a branch of the Innovation Défense Lab. This site, the only one in France, will give academics and local businesses an opportunity to work together with experts from DGA-MI and other military personnel. At cruising speed, about 20 people will work on site, for periods of six to twelve months, with five to ten projects carried out at the same time. The first start-up to be welcomed is Glimpse, created by four DGA-MI engineers and specialising in “software reverse-engineering,” i.e. taking unknown software apart to understand its mechanisms. A partnership agreement has been signed between the Armed Forces and the investment company ACE Management, which will support companies working in digital security that could benefit from financing through an €80M fund dedicated entirely to cybersecurity.
Annual cybersecurity-specific event: European Cyber Week
Every year in November, the European Cyber Week brings together all the players in the cyber industry: institutional, industrial, academics and researchers. This Europe-dimension event, organised by the Cyber Excellence Hub and its partners, supported by the Ministry of Armed Forces, Bretagne region and Metropolitan Rennes, highlights research and innovation, training and recruitment and also industrial development around the theme “Artificial Intelligence, Virtualisation, Smart Cities and Cybersecurity”. In 2019, ECW is highlighting the theme of virtualisation in information systems and exposure to the cyber threat, while keeping artificial intelligence as its common thread.
