text: EFR_Workflow_Final Page ii

text: EFR_Workflow_Final Page iv

text: Available from http://www.enisa.europa.eu/rmra/er_downloads.html

text: EFR_Workflow_Final Page 1

text: System – a collection of components organised to accomplish a specific function or set of functions (IEEE 610)

text: EFR_Workflow_Final Page 2

text: Figure 1 - System Overview

text: EFR_Workflow_Final Page 3

text: Quality Assurance Risk Management

text: Quality Assurance

text: Scenario Validation

text: Figure 2 - Modified ENISA Model of EFR Method Finally, we considered how the workflow relates to the ENISA model of the EFR method and supporting entities (Figure 3). Our additions to the diagram are shown in red where the scope of the EFR assessment method is denoted by the red dashed line. The scenario generation process is already present in the emerging risks lifecycle (labelled Scenario Building). We added a Scenario Validation step within the same lifecycle to impose a reality check on the generated scenario before taking it to the risk assessment stage. Likewise, in addition to the risk assessment module, we added a Risk Management module based on the outcome of the risk assessment, and a separate Quality Assurance module that evaluates and monitors the accuracy of the emerging and future risk information used to build scenarios, and the effectiveness of risk detection and management. The results of which will be fed back to the relevant people with the aim of creating an ongoing evaluation and improvement loop creating a more accurate and effective process model for the management of emerging and future risks.

text: EFR_Workflow_Final Page 4

text: •Workshop Scenario •Member State query •Organisation’s IS

text: •Tech vendor product development

text: •Workshops Scenario •R&D teams

text: •Member State

text: •Delphi/expert group ck

text: Validation •Desk research e w e o ie f v o

text: f r g a ic in

text: ri g a o e cc a V ’ p ’ a n

text: a rs rs m e e k Scenario •According to existing d n n is

text: methods /r a ‘o ‘o m

text: o o e th th t

text: is M• M• R•

text: •Business managers as part of normal

text: management Management •Informed by audit

text: and risk specialists

text: Generally available modules

text: Extension modules

text: Figure 3 - Proposed EFR Lifecycle

text: EFR_Workflow_Final Page 5

text: Figure 4 - Top-level Process Model In order to facilitate the execution of the EFR lifecycle, a detailed process model was developed to provide guidance on the tasks and activities to be undertaken, information support requirements and the corresponding roles and responsibilities. The above diagram (Figure 4), developed in ADOit®, illustrates the key process flow (in blue) and the top level processes that constitute the EFR lifecycle. In this process model, requests are submitted for an opinion on the emerging and future risks that might result from a combination of new technology and/or new applications being implemented. This may be from: a) Member States considering the impact of new technology/applications and the need for introducing new or amended policy; b) EC, consumer organisations, non-governmental organisations (NGOs) etc considering the impact of strategic IS/IT planning or considering the development/implementation of new and innovative applications or technology. The resulting scenarios would be developed and validated by subject matter experts and take into account current knowledge gleaned from various sources including the World- Wide Web, white papers and research papers. Trend analysis would also be commissioned periodically and the impact applied both to scenarios being developed, and on scenarios stored. Sections 3.2.2, 3.2.3 and 3.2.7 contain diagrams of the Scenario Building, Scenario Validation and Validation of Methods processes, whilst Annex B illustrates the roles included within the full set of processes. It should be noted that a full set of process diagrams in html format may be obtained from the ENISA RMRA website http://www.enisa.europa.eu/rmra/er_downloads.html and should be referred to whilst reading this report.

text: EFR_Workflow_Final Page 6

text: EFR_Workflow_Final Page 7

text: EFR_Workflow_Final Page 8

text: EFR_Workflow_Final Page 9

text: EFR_Workflow_Final Page 10

text: EFR_Workflow_Final Page 11

text: EFR_Workflow_Final Page 12

text: EFR_Workflow_Final Page 13

text: EFR_Workflow_Final Page 14

text: EFR_Workflow_Final Page 15

text: EFR_Workflow_Final Page 18

text: Preceding Succeeding Task ID Task Task Purpose Encompassed Activities Activity ID Activity Input Activities Output Activities Quality Criteria

text: Tasks Activities Scenario Building

text: Updated by Anas on 30.01.08

text: T.1 Decide on an To clarify exactly how future A.11 A.11 Identify possible ways of generating future Definition of future scenario A.10 Possible methods/approaches to future A.12 Usefulness approach/methodology for scenario generation should scenarios scenario generation Applicability generating future occur scenarios T.2 Decide how to apply To utilise information sourced A.9, A.7, E.12 A.9 Decide on how to apply new technology to existing Knowledge base of new technologies A.8 Potential ways of applying new technology A.13 Expert Advice information from into a knowledge base in the applications in existing applications knowledge base related to most effective way new and existing technologies, and A.7 Decide on how to apply existing technologies in Knowledge base of existing technologies A.6 Potential for using existing technology in A.13 Expert Advice developments in forthcoming application scenarios future scenarios Match to Technology Trends technology into scenario generation E.12 Decide on how to make use of relevant Updates of relevant developments in E.10 Plan for exploiting relevant developments E.13 Relevance developments in technology technology incorporated in the knowledge in technology Expert Advice base Feasibility Opinions on how the developments in technology can be exploited E.15 Assess use of relevant developments in technology Report on the exploitation of relevant E.14 Analysis of report assessing exploitation E.17 Objectivity developments in technology of relevant developments in technology Coverage Expert Advice

text: T.3 Build scenario detail To structure and present the A.28 A.28 Generate future scenarios Method for generating future scenarios A.13 Detailed future scenarios A.29 Expert advice detail of a scenario detailing information requirements, A.18 A.33 Completeness methods for information collection, and process for deriving scenarios

text: List of accepted sources of information

text: EFR_Workflow_Final Page A-1

text: EFR_Workflow_Final Page B-1

text: EFR_Workflow_Final Page B-2

text: This icon is an activity within the This icon denotes a decision step process. The words on the top left of with mutually exclusive outcomes. the process denotes inputs, and those on the top right of the process denotes outputs.

text: To the right of the process is an indication of the roles Responsible for carrying out the activity, Accountable for ensuring the activity happens, Consulted in the progress of the activity, or Informed of the outcome.

text: This icon denotes a nested process This icon is an interface process where the only occurrence of the and is included to link separate process is nested within a higher processes level process.

text: This icon refers to an information item exchanged between processes, with an associated description of the information exchanged.

text: EFR_Workflow_Final Page C-1

identifier: Emerging and Future Risks Workflow

nummer: emerging-and-future-risks-workflow

title: Emerging and Future Risks Workflow

text: and Jeremy Hilton, Pete Burnap and Anas Tawileh Cardiff University

text: Emerging and Future Risk Process 1 Introduction

text: 1.1 Background

text: ENISA requires support in continuing and expanding its work on the field of assessing and managing future and emerging risk by developing the results of the Emerging and Future Risk (EFR) method study into an emerging and future risk assessment lifecycle. This is to include: • Identification of additional elements missing in the EFR method, and are required in order to develop a workflow that supports scenario generation, validation and risk assessment • Consideration of the issues and criteria which have been identified to influence the existence of risks, such as convergence, technology, applications and market trends as well as social and human behavioural factors • Further consideration of effective risk assessment and criteria for the management of information security risks in relation of emerging and future scenarios • Identification of criteria and constraints related to the development of the workflow • Creation of the workflow for the lifecycle of the risk assessment and management of emerging and future risk including: scenario generation, validation of these scenarios, risk assessment and management, processing and quality assurance; taking into account any additional elements identified in the first bullet point above, th and any criteria and constraints identified in the 4 bullet point above • The presentation of the workflow in such a way that it can be translated into a set of automated electronic processes at an operational level, showing where possible how such translation could be conducted The terminology used in the report should be in line with the international security standards – ISO 17799, ISO 13335, Common Criteria, BSI Standards and COBIT as well as the ENISA RM/RA Glossary.

text: 1.2 EFR Process

text: This report introduces the EFR Process model that resulted from further development of the Methods for the identification of Emerging and Future Risks . It describes the approach taken to develop the processes and documents in outline the processes themselves. The process models are self documented and can be downloaded from http://www.enisa.europa.eu/rmra/er_downloads.html.

text: 1.3 Structure of this document

text: The next section, Section 2 outlines the approach taken to develop the EFR Processes. Section 3 introduces the key processes added to existing risk assessment/risk management processes, together with an explanation of the organisational roles and the icons used to describe the processes. This report provides a high level overview of the EFR process model, and it is emphasised that the process model should be referred to whilst reading this report.

text: 2 Development Approach

text: This section describes the approach taken in order to develop the EFR Processes.

text: 2.1 Phase 1

text: The first phase completed the knowledge capture required to inform the development of the workflow. It ensured a complete understanding of ENISA’s vision for emerging and future risk assessment, and how it integrates into ENISA’s other processes. Initially, the project team studied the approach taken by ENISA in fulfilling Article 3 (a) of Regulation 2004/460 – the collection of appropriate information in order to analyse current and emerging risks, as well as the formal references provided in the Technical Description of the Invitation to Tender on the processes regarding the collection and dissemination of emerging risk related information. The information collation method, security and privacy requirements in relation to ENISA and their stakeholders, and storage of information were all studied to define an architectural overview of a system within which information pertaining to emerging and future risk is shared, stored and utilised for scenario generation and validation, and risk assessment and management. Secondly, within this phase, the project team studied the architectural overview of the system and identified additional/missing elements of the required Emerging and Future Risk (EFR) method to develop a workflow through which information can be obtained and/or input from the relevant sources on demand, and used to generate and validate emerging and future scenarios which can then be analysed for vulnerabilities and potential threat agents. This took into account the issues and criteria which have been identified to influence the existence of risks, such as convergence, technology, applications and market trends as well as social and human behavioural factors in relation to the architectural overview of the system; as well as the wider context of the EFR method, based on the initial study into information collation and previous discussion with ENISA. This is illustrated below in Figure 1. Workflow Management involves two main elements:

text: a) setting up and configuring the workflow in order to integrate the chosen risk assessment and risk management approaches; b) validation of the EFR process and ongoing improvement activities. Information Management includes the lifecycle of information; from collection to dissemination, including reception of requests and awareness. Emerging and Future Risk comprises the structuring of scenarios and their validation. RM/RA Method comprises the application of the preferred risk assessment and risk treatment methods. In previous discussions with ENISA, we recognised that ENISA will build a repository of knowledge which will provide input to the EFR assessment, but ‘filtered’ according to who will be undertaking the EFR assessment. ENISA will have full access to their repository, but other external users may only have access to knowledge ENISA is able to make public. Also, it is recognised that the EFR method must be able to provide feedback as to the quality, completeness and currency of the knowledgebase users have access to. The ability to provide feedback will be part of the EFR assessment method, but taking action to improve and maintain the knowledgebase is not. Once the identification of additional/missing elements within the EFR method to facilitate the workflow was agreed by ENISA, the contracted team members worked closely with

text: ENISA to develop the criteria and constraints for the development of the workflow. On agreement of these criteria, and within the defined constraints, the team developed the workflow using the steps as described below.

text: 2.2 Phase 2

text: This phase began with an analysis of the Consensus Primary Task Model (CPTM) produced to develop the EFR method in order to understand what role would undertake each activity, what the inputs and outputs are, what the quality criteria are for the successful completion of the activity and what the information needs are. This is illustrated in Annex A. We developed these roles by analysing the activities and determining which role is

text: Accountable for the activity being successfully completed, which roles are Responsible for its completion, which roles are Consulted in the progress of the activity and with roles are Informed of the result. This is also called a RACI analysis and is illustrated in Annex

text: B. Also, by considering each activity, we identified the information support needed. Having completed the analysis of the activities, we considered the relevant standards and other best practice guidance to ensure all activities required for EFR assessment are understood. This added detail to the activities analysed previously. We also included the knowledge gained in the first phase regarding ENISA’s specific needs. From this we built candidate process models using ADOit®, customising ADOit® where necessary to represent the desired workflow correctly. The relationships between the activities in the CPTM informed the initial structure, but this was developed as we built the processes. The difference between the activities in the

text: CPTM and the process steps is that the CPTM activities state ‘what’ should be done, and the process diagram shows ‘how’ things should be done.

text: 2.3 Phase 3

text: The presentation of the workflow utilised the process modelling tool, ADONIS ADOit®.

text: 3 Process Model

text: 3.1 The EFR Lifecycle

text: The starting point for developing the EFR Process was the study on the Methods for the identification of Emerging and Future Risks (Requirements); as can be seen in the Figure

text: 3 below, Scenario Acquisition, Scenario Generation and Scenario Validation are identified as the additional modules necessary in order to create an EFR lifecycle.

text: Possible Possible approach approach Acquisition strategy Generation d o a Scenario •RFC b th d n e ti M e t Scenario d o d rd r li n o o e Assessment ti a li w w Analysis / Risk V d d a Assessment e e k Management Risk

text: 3.2 The EFR process model

text: 3.2.1 Submission of Requests

text: Users interested in assessing emerging and future risks that may arise from the implementation of specific combinations of new or existing technologies with new or existing applications submit a request to ENISA through this process. Proper authentication is required to establish whether the requestor is permitted to submit request. The submitted request includes the user’s specific requirements properly formatted to be used in the scenario building process.

text: 3.2.2 Scenario Building

text: In this process, relevant usage scenarios based on the specific requirements defined by the requestor are formulated and analysed. The generated scenarios are stored in the knowledge base for future reference and evaluation, and scenario details are also exported to the chosen risk assessment method. This process utilised the expert knowledge of subject matter experts, in addition to the outcomes of the trend analysis process, to achieve its purpose in generating relevant and useful scenarios that could be exploited to conduct risk assessment.

text: 3.2.3 Validation of Results

text: The purpose of this process is to ensure that the generated scenarios are valid and useful for the risk assessment exercise. Experts will review the generated scenarios and make appropriate decisions on their validity. If valid, the generated scenarios are then accepted by the EFR Stakeholder Forum. Otherwise, the scenarios may need to be reworked again.

text: 3.2.4 Trend Analysis

text: This process aims to support the scenario building process by identifying, reviewing and documenting relevant trends from the risk and scenario information previously identified and stored in the knowledgebase.

text: 3.2.5 Information Collection

text: The activities in this process are primarily concerned with the identification of information needs to support the EFR process, the identification of relevant sources of information to satisfy these needs and the acquisition and review of required information. Expert knowledge is utilised to guide the information acquisition and review activities. Acquired information is then properly formatted, indexed, classified and stored in the knowledgebase.

text: 3.2.6 Information Dissemination

text: This process provides the interface between the EFR knowledgebase developed by ENISA and its target audience. It contains activities to identify the target groups for the information, generate information according to the respective target groups, and provide information to users based on the relevant access level.

text: 3.2.7 Validation of Methods

text: Improvement of the EFR process is achieved through the continuous validation of the methods utilised in analysing scenarios and assessing and managing risks. The validations results provide the opportunity to improve the process by altering or changing the adopted methods.

text: 3.2.8 Risk Assessment

text: The primary purpose of the scenario generation process is to create valid scenarios to facilitate the assessment of emerging and future risks. The risk assessment process utilises the generated scenarios to identify the threats, vulnerabilities and impacts relevant to each scenario in order to analyse potential risks. Appropriate risk treatment decisions are then produced based on the evaluation of these risks.

text: 3.2.9 Risk Treatment

text: While the risk assessment process has produced appropriate risk treatment decisions, this process is focused on the implementation of these decisions to mitigate the impact of these risks. Possible options for risk treatment are identified based on the risk treatment decision, and an action plan is developed that contains specific actions to counter the risks. The action plan should be approved by the risk owner before it is implemented. It is important to identify and evaluate the risks that remain after the implementation of the action plan (residual risks) and a decision should be made on whether or not these risks need further analysis.

text: 3.3 Organisational Roles

text: The following set of roles have been identified: • User/Requestor: users submit requests for the identification and assessment of emerging and future risks relevant to a combination of existing/new technology with an existing/new application that matches their own requirements. They are also provided with the risk identification and assessment results for these requirements. Users’ identification and interaction with the system is facilitated through the authentication system. • Process Facilitator: ensures the smooth operation and quality of the EFR process by reviewing and evaluating relevant aspects of the process operation. • EFR Specialist: primarily concerned with the risk related aspects of the EFR process. The EFR specialist identifies the context of information needs and classifies information in the system. This role is also accountable for all risk related information collection tasks and activities. • Risk Manager: oversees the risk identification and assessment process to ensure its effective and successful operation. • EFR Manager: supervises the actions of the EFR specialist and is accountable for the successful identification of the context of information needs and classification of risk related information. • Subject Matter Expert: this role requires significant knowledge and experience in a certain subject area related to EFR identification and assessment which is usually determined based on the specific requirements of the submitted requests or the type of risks being identified or assessed. This role is typically recruited for particular assignments. • Information Officer: is concerned with the information dissemination aspects of the EFR process, including the identification of target groups, support for the generation of information for these target groups and presentation of information to users. • HR Staff: responsible for ensuring the availability of required Subject Matter Experts and other personnel to undertakes the tasks and activities included in the EFR process. • Internal Audit: undertakes required audit operations to evaluate the effectiveness of the EFR in achieving its objectives. • Authentication System: is responsible for the identification of users, verification of users’ credentials and establishing the appropriate access level granted to each user. • System administrator: undertakes all activities and tasks required to ensure the continuous and correct operation of the authentication system and other automated systems. • Knowledgebase Management System: performs all the operations related to information processing, indexing, storage, retrieval and dissemination. This includes scenario templates, emerging and future risk information, requests submitted by users, etc. • Knowledge Administrator: undertakes all activities and tasks required to ensure the continuous and correct operation of the knowledgebase management system.

text: • EFR Stakeholder Forum: reviews and accepts the generated EFR scenarios, and is consulted in risk related tasks and activities. • Industry Groups: are consulted in the review of trends. • Risk Owner: is usually the entity that is directly affected by the existence of risks. This role should identify possible risk treatment options, develop appropriate action plans, implement action plans and evaluate residual risks. It is also consulted in the identification, analysis and evaluation of risks. • Senior Management: of the entity that is directly affected by the existence of risks. The risk owner should inform its senior management of the approval and implementation of risk treatment plans and the identification of residual risks.

text: These roles have been appropriately incorporated into the EFR workflow, as depicted in the following image, taken from the ADOit Model..

text: Annex A Activity Analysis

text: Below is an extract from the scenario analysis undertaken for the whole model created in the Methods for the identification of Emerging and Future Risks (Requirements) report:

text: The task is identified in the Model Relevant to Emerging Risks Methods found at Annex C to the Methods for the identification of Emerging and Future Risks (Requirements) report. From these, relevant activities were determined and analysed, thereby identifying the inputs and outputs. Identifying the preceding and succeeding activities laid the foundation for the processes.

text: Annex B Role Analysis

text: A RACI table was developed as illustrated below by listing the activities and defining roles

text: necessary to carry out the activities: Those Responsible for actually doing the activity, those Accountable for ensuring the activity is done, those Consulted in the progress of the activity and those Informed of the outcome.

text: Tabulating the analysis enables consistency of roles which is not easy if you only have the RACI recorded within the processes. Considering a horizontal view of the table enables an understanding of the RACI relevant to the activities, whereas a vertical Role-based view enables the development of job descriptions and role skills and experience profiles.

text: Annex C Icons used within Processes

text: The icons used within the detailed processes are described in the table below.

text: Icon Description Icon Description


text:  Cyber threat intelligence (CTI) aims at helping organisations becoming better prepared by improving their knowledge about the threat landscape. Instead of relying exclusively on information generated by internal systems or feeds (what is known about the known), the effectiveness of CTI will be determined by the knowledge about the why, the how and the what that is unknown to the cybersecurity team. The value proposition of any CTI capability or program is to improve the preparedness of the organisation to protect its critical assets from unknown threats.

text: being upgraded into new versions with additional features, distribution and propagation mechanisms. Emotet for example, a malware originally designed as a banking Trojan back in 2014, has become one of the most effective malware distributors of 2019.

text: dependent on mobile devices to secure their most sensitive accounts. The use of 2fa tied to an app authenticator or via a text message is one of the examples. With more malware going fully mobile, fraudulent apps, SIMJacking and operating systems exploits make these devices the weakest link and therefore, extremely vulnerable to attacks.

text: PDF, ZIP and XLS files are still the most commonly used attachment type for spreading malware but other types are getting popular. A few campaigns distributing AgentTesla InfoStealer and NanoCore RAT were found using image file type in 2019.

text: attacks. In 2019, we saw an escalation of sophisticated and targeted ransomware exploits with the public sector, health care organisations and specific industries at the top of the list. Attackers are spending more time gathering intelligence about their victims, knowing exactly what to encrypt, achieving maximum disruption and higher ransoms.

text: Credential stuffing - the automated injection of stolen username and password combinations through large-scale automated login requests directed against a web application - will proliferate as a result from a decade of an abnormal number of data breaches and trillions of personal data records stolen.

text: in ETL 2020

text: These attacks are meant to affect the highest number of devices possible to steal personal information or block the access to data by encrypting the files.

text: Malicious actors plan this type of attacks to reach high value data such as financial information, intellectual and industrial property, trade secrets, classified information, etc.

text: Malicious actors will explore the potential of digital platforms to support targeted attacks (e.g. social media, gaming, messaging, streaming, etc.). From personal data theft for spear-phishing attacks to broad malware distribution, digital platforms with a high number of subscribers are efficient attack vectors increasingly popular among malicious actors.

text: With more automation and less human intervention, business processes can be maliciously altered to generate profit for an attacker. Commonly known as Business Process Compromise (BPC) this technique is often undervalued by process engineering specialists due to the lack of a proper risk assessment.

text: E-mail is no longer the prime and only tool and top attack vector for phishing. Malicious actors are now using other platforms to communicate and attract victims to open compromised web pages. A new trend is emerging with the use of SMS, WhatsApp, SnapChat and social media messengers.

text: With more people in teleworking and connecting their devices to corporate networks, the risk of opening new entry points for attackers will increase. With the COVID-19 pandemic, this trend will urge IT Managers to tighten security policies and make urgent changes in the IT infrastructure.

text: Attackers choose their targets carefully, perform reconnaissance against specific employees, and target those with spear-phishing attacks to obtain usable credentials to target the organisation. Once the attackers gain access to a single machine, they may employ penetration-testing tools such as Mimikatz to gather and exploit credentials with elevated privileges.

text: Threat actors are continuously innovating to make threats more effective and less susceptible to detections. The Anibus, an Android banking Trojan and bot, has been distributed by masquerading as innocuous app, primarily through Google Play Store.

text: The abnormal increase in Telnet traffic to port 445 observed in 2019 unveiled the expansion of worms and exploits such as Eternal Blue. Telnet, which is no longer used except in the realm of IoT devices, saw the greatest volumes during the period.

text: Edge devices are deployed at the boundaries between interconnected networks. We have seen a growing trend with attacks targeting these devices — such as routers, switches, and firewalls — having a significant impact to an enterprise and to the connected digital ecosystem.

text: “ISO/IEC 27032:2012”. ISO. https://www.iso.org/standard/44375.html

text: “Triple Threat: Emotet Deploys TrickBot to Steal Data & Spread Ryuk.” April 2, 2019.

text: Cybereason. https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-stealdata-spread-ryuk-ransomware

text: “Understanding the relationship between Emotet, Ryuk and TrickBot.” April 14, 2019. Intel471.

text: “Investigating WMI Attacks” February 9, 2019. SANS. https://www.sans.org/blog/investigatingwmi-attacks/

text: “RDP Abuse and Swiss Army Knife Tool Used to Pillage, Encrypt and Manipulate Data”

text: December 18, 2019. Bitdefender. https://labs.bitdefender.com/2019/12/rdp-abuse-and-swissarmy-knife-tool-used-to-pillage-encrypt-and-manipulate-data/

text: “Europe’s huge privacy fines against Marriott and British Airways are a warning for Google and

text: Facebook” July 10, 2019. CNBC. https://www.cnbc.com/2019/07/10/gdpr-fines-vs-marriottbritish-air-are-a-warning-for-google-facebook.html

text: “This is how we might finally replace passwords” May 27, 2019. C|Net.

text: “Authentication standards to help reduce the world’s over-reliance on passwords.” FIDO.

text: “How Much Cyber Sovereignty is Too Much Cyber Sovereignty?” October 3, 2019. Council on

text: Foreign Relations. https://www.cfr.org/blog/how-much-cyber-sovereignty-too-much-cybersovereignty

text: “Conceptualising Cyber Arms Races”. 2016. NATO. https://ccdcoe.org/uploads/2018/10/Art- 10-Conceptualising-Cyber-Arms-Races.pdf

text: “Journalism, 'Fake News' and Disinformation: A Handbook for Journalism Education and

text: Training” 2018. UNESCO. https://en.unesco.org/fightfakenews

text: “The Big Connect: How Data Science is Helping Cybersecurity”. June 12, 2019. Info Security

text: Group. https://www.infosecurity-magazine.com/blogs/data-science-helping-cybersecurity-1/

text: “Are You Ready For The Age Of Adversarial AI? Attackers Can Leverage Artificial Intelligence

text: Too”. January 9, 2020. Forbes. https://www.forbes.com/sites/forbestechcouncil/2020/01/09/areyou-ready-for-the-age-of-adversarial-ai-attackers-can-leverage-artificial-intelligencetoo/#2a76dee14703

text: “FBI Alerts Companies of Cyber Attacks Aimed at Supply Chains”. February 21, 2020. Bitsight.

text: “Gartner Identifies the Top Seven Security and Risk Management Trends for 2019”. March 5,

text: 2019. Gartner. https://www.gartner.com/en/newsroom/press-releases/2019-03-05-gartneridentifies-the-top-seven-security-and-risk-ma

text: “Android banking trojan.” October 3, 2019.Cyare. https://cyware.com/news/exploring-thenature-and-capabilities-of-anubis-android-banking-trojan-6ea7dec4

text: “5 Top Trends for Mobile Cyber Security in 2020“. January 9, 2020. Corrata.

text: “Malicious Attachments Remain a Cybercriminal Threat Vector Favorite”. August 27, 2020.

text: Threat Post. https://threatpost.com/malicious-attachments-remain-a-cybercriminal-threatvector-favorite/158631/

text: “10 trends shaping the future of work“. October 2019. EPSC.

text: https://op.europa.eu/en/publication-detail/-/publication/e77a1580-0cf5-11ea-8c1f- 01aa75ed71a1/language-en/format-PDF/source-121729338

text: “Global security spending to top $103 billion in 2019, says IDC”, March 20, 2019. ZDNet.

text: “Insights into skills shortages and skills mismatch. learning from Cedefop’s European skills

text: and jobs survey”. 2018. CEDEFOP. https://www.cedefop.europa.eu/files/3075_en.pdf

text: A summary of the main cybersecurity trends for the year.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: Recommendations on research topics from various quadrants in cybersecurity and cyber threat intelligence.

text: READ THE REPORT

text: Main cybersecurity incidents happening READ THE REPORT between January 2019 and April 2020.

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: The current state of play of cyber threat intelligence in the EU.

text: READ THE REPORT

text: Presents key elements of software security and provides a concise overview of the most relevant existing approaches and standards in the secure software development landscape.

text: READ THE REPORT

text: Good practices for security of smart cars, namely connected and (semi-) autonomous vehicles to enhance car users’ experience and improve car safety .

text: READ THE REPORT

text: ioT security with a particular focus on software development guidelines.

text: READ THE REPORT

text: in ETL 2020

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

identifier: ENISA Threat Landscape - Emerging trends

nummer: emerging-trends

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: ENISA Threat Landscape - Emerging trends

serie: rapporter

text: From January 2019 to April 2020

type: rubrik

text: Emerging trends

text: ENISA Threat Landscape

text: Overview

text: _What to expect

text: With the start of a new decade, we can expect significant changes in the way we perceive and understand cybersecurity or the security of

type: stycke

text: cyberspace. Cyberspace as defined in ISO/IEC 27032:2012 is a “complex environment resulting from the interaction of people, software and services on the Internet by means of technology devices and networks connected to it, which does not exist in any physical form”. The

text: protection of this complex environment will become even more challenging as we connect more people, devices, systems and run more processes and services in the network. We are also more dependent from its reliability, integrity, availability and trustworthiness to work, relate and do many of our day-to-day activities. With this growing dependency, more opportunities will arise for malicious actors to use cyberspace to manipulate, intimidate, deceive, harass and defraud individuals and organisations. The protection of individuals, business and organisations while using cyberspace will tend to shift during the next decade, from the traditional network and information security (NIS) to a wider concept including content and services.

text: During the last decade the ‘fourth industrial revolution' has significantly accelerated the pace of change, transforming what people do, how they do it, what skills are required, where work is performed, how work relations are structured, and how work is organised, distributed and rewarded.

text: Because of the current COVID-19 pandemic, we initiate the decade with a new norm and profound changes in the physical world and cyberspace. With social distancing or confinement, people will tend to

text: use the virtual space to communicate, relate and socialize. This new norm will introduce new challenges across the digital value-chain and in particularly, the cybersecurity industry.

text: There are too many variables to consider when making cyber risk management effective. An important factor is the technological diversity most organisations experience today. Another aspect is the sophistication of tools, tactics techniques and procedures (TTPs) used by adversaries to conduct attacks. Malicious actors are adapting and adjusting the TTPs to their victim’s environment as needed and collaborating with others to reach their goals.

text: Defining a risk posture, managing data, applying relevant metrics, and responding to change are obstacles to creating an effective cyber risk

text: governance strategy. New approaches will be required during the next decade to stay away from silo analysis and move closer to a matrixtype of interconnected factors, variables and conditions. This

text: constitutes a significant challenge for many organisations trying to protect their infrastructure, operations and data against stronger, better resourced and equipped adversaries.

text: Emerging trends

text: __ cybersecurity challenges

text: Ten

text: 01_Dealing with systemic and complex

text: risks. Cyber risk is characterised by the speed and scale of its propagation as well as the potential intent of threat actors. The interconnectedness of various systems and networks enables cyber incidents to spread quickly and widely, making cyber risks harder to assess and mitigate.

text: 02_Widespread of adversarial AI detection.

text: The detection of threats exploiting AI to launch an attack or avoid detection will constitute a major challenge for the future of cyber defence systems.

text: Reduction of unintentional errors With 03_ .

text: the growing number of systems and devices connected to the network, unintentional errors continues to be one of the most exploited vulnerability in cybersecurity incidents. New solutions aiming at the reduction of these errors will provide an important contribution to reducing the number of incidents.

text: Supply chain and third party threats. The 04_

text: diversified supply chain that characterizes the technology industry today provides new opportunities for threat actors to take advantage of these complex systems and exploit the multiple vulnerabilities introduced by a heterogeneous ecosystem of third party providers.

text: 05_Security orchestration and automation.

text: Cyber threat intelligence and behavioural analytics will gain importance with the automation of processes and analysis. Investing in automation and orchestration will allow cybersecurity professionals to invest in the design of more robust cybersecurity strategies.

text: Reduction of false positives. This long waited 06_

text: promise is key in the future of the cybersecurity industry and in the fight against the alarm fatigue.

text: Zero-trust security strategies. With an 07_

text: increasing pressure on IT systems from new business requirements such as remote working, digitalization of the business model and data sprawl, zero trust is seen by many decision makers as the solution de facto to secure corporate assets.

text: Enterprise cloud migration errors. With 08_

text: many businesses migrating their data to cloud-based solutions, the number of configuration errors will increase exposing data to a potential breach. Cloud service providers will address the issue by implementing systems that identify these type of errors automatically.

text: Hybrid threats. New modus operandi adopt virtual

text: and physical world threats. The spread of disinformation or fake news for example, is a key fixture of the hybrid threat landscape. The EUvsDisinfo is a flagship project of the European External Action Service’s East StratCom Task Force established to address the disinformation threat.

text: 10_The attractiveness of the cloud infrastructure as a target will grow. The

text: increasing reliance on public cloud infrastructure will surge the risk of outages. Misconfiguration of cloud resources is still the number one cause for cloud attacks, but attacks aiming directly at the cloud services providers gaining popularity among hackers.

text: Emerging trends

text: _ Cybersecurity spending

text: According to Gartner , many boards of directors will demand improved data and understanding of the returns after years of intensive investment in cybersecurity. This is mainly due to a growing spend in cybersecurity proportionately to the investment made in new technologies. According to a report from IDC , spending on cybersecurity reached $103 billion (ca. €87,5 billion) in 2019, which is 9.4% higher than the previous year. Security managers will soon be scrutinised for the results obtained from years of investment and are essential to maintain improved data about the results obtained.

text: _ Cyber threat intelligence will help defining cybersecurity strategies _ Knowing the threat landscape

text: With more cybersecurity automation and orchestration seen as a growing

text: trend, cybersecurity teams will spend less time in monitoring activities and more in readiness and preparedness tasks. A well-

text: designed CTI capability can provide contextualised and actionable knowledge about threats to inform strategic, operational and tactical stakeholders across the organisation. In practical terms, a CTI capability should aim at responding to the following questions considering the stakeholders’ requirements and the organisation’s context and environment:  What is the attack surface?  What are the most valuable assets and the cyber terrain?  What are the most critical vulnerabilities?  What are the most used attack vectors?  How adversaries typically behave and operate?  How does the threat landscape looks like for:  the sector and type of business the organisation operates?  the technological environment adopted by the organisation?  Who and what needs to be done to mitigate risks from these threats?

text: _ Shortage in cybersecurity skills

text: The lack of highly-skilled tech professionals is already issue for Europe’s digitalisation ambition. According to a study , over 70% of European firms report that lack of skills is hampering their investment strategies, while 46% of firms report difficulties in filling vacancies due to skills shortages in key areas such cybersecurity.

text: Emerging trends

text: __ trends with cyber

text: Five

text: threats 01_Malware is getting an upgrade. Malware family strains are Threats will become fully mobile. Users are increasingly 02_ 03_Attackers are using new file types such as disc image files (ISO and IMG) for spreading malware. DOC, 04_Increase in targeted and coordinated ransomware 05_Credential-stuffing attacks will widespread. “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.”

text: Emerging trends

text: __Ten emerging trends in attack vectors

text: 01_Attacks will be massively distributed with a short

text: duration and a wider impact

text: 02_Finely targeted and persistent attacks will be

text: meticulously planned with well-defined and long-term objectives

text: 03_Malicious actors will use digital platforms in targeted

text: attacks

text: 04_ The exploitation of business processes will increase

text: 05_ The attack surface will continue expanding

text: 06_Teleworking will be exploited through home devices

text: 07_Attackers will come better prepared

text: 08_Obfuscation techniques will sophisticate

text: 09_ The automated exploitation of unpatched systems and

text: discontinued applications will increase

text: Cyber threats are moving to the edge

text: References Related

text: ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Main incidents in the EU and worldwide ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: RelatedOther publications

text: Advancing Software Security in the EU ENISA good practices for security of Smart Cars Good Practices for Security of IoT - Secure Software Development Lifecycle “The threat landscape is becoming extremely difficult to map. Not only attackers are developing new techniques to evade security systems, but threats are growing in complexity and precision in targeted attacks.”

text: About

text: _ The agency

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contributors

text: Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

text: Editors

text: Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

text: Contact

text: For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-354-4 DOI: 10.2824/552242

type: vagledning

utgivare: enisa