text: Indispensable baseline security requirements for the procurement of secure ICT products and services v.1.0 | Public | December 2016

text: http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=2326 http://ec.europa.eu/newsroom/dae/document.cfm?doc_id=2327

text: European Union Agency for Network and Information Security ENISA - The EU Cyber Security Agency

text: Follow the EU cyber security affairs of ENISA: www.enisa.europa.eu & Facebook, Twitter, LinkedIn, YouTube, RSS feeds

text: Figure 1: Four principles for supply and procurement

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: 1 Introduction

type: rubrik

text: The procurement of key ICT products or outsourced managed services may result in intentional or unintentional security risks and incidents. In 2012 the EC drew up detailed guidelines on how to make best use of ICT standards in tender specifications in the context of Action 23 of the Digital Agenda of Europe and in 2013 issued a Communication on Standardisation and Public Procurement . Use of standards promotes a level playing-field, allowing a broader range of participation, including SMEs, and avoids “lock-in” to specific brands with proprietary features. However, due to the evolution of technology in ICT and the lack of expertise to decide which standards are relevant and appropriate for the particular ICT needs, it is not always the case that ICT procurements are standards-based.

type: stycke

text: Therefore, it is important to help procurers overcome these difficulties through common and sufficiently generic minimum indispensable requirements that will cover the whole lifecycle of the procured product or service and will eventually contribute to an appropriate (and desired) minimum level of security and resilience. In this context, ENISA set up an Expert Group composed of experts nominated from Member States to identify existing best practises and requirements and to use them to identify a set of indispensable baseline security requirements. This collaborative approach will support all Digital Single Market stakeholders to develop a more unified, integrated and cost-effective approach for standardsbased procurement of secure ICT products, and helps providers in specifically dealing with security risks involved in the procurement and outsourcing processes.

text: 1.1 Purpose

text: This document can be of use to suppliers and procurement officers when planning, offering and purchasing ICT products, systems and services. It is meant as a practical, technologically neutral document with clear, simple and sector-agnostic minimum necessary indispensable requirements for secure ICT products and services. Any ICT product or service that fails to be compliant with one or more of the minimum security requirements should be considered as insecure and therefore it shall not be purchased or put in operation on the Digital Single Market (DSM). It focusses on a few indispensable conditions, commonly agreed among experts and based on standards and best practices, but does not claim to cover completely and sufficiently all possible security requirements. It is not intended to substitute existing security certifications schemes and standards: instead it is a complementary security baseline.

text: 1.2 Approach

text: Secure by design

text: Secure Verifiably by Secure

text: default Secure through life

text: Figure 1 above depicts the four principles that were stated by the Expert Group as a basis for the development of the indispensable requirements. Components of the system, the services that they and the system use, and the services the system provides shall be secure:

text: • By design – the product, or service, has been conceived, designed and implemented to ensure the key security properties are maintained: availability, confidentiality, integrity and accountability. • By default – the product, or service, is supplied with the confirmed capability to support these security properties at installation. • Throughout their lifecycle – security should be maintained from initial deployment through maintenance to decommissioning. • And that each of the above principles should be verifiable.

text: The indispensable baseline security requirements are expressed as a limited collection of principles written, as far as possible, in non-specialist terms – a set of “Commandments” listed in Section 2. In addition, Section 3 provides explanations and examples than can be used for compliance checks.

text: 1.3 Obligations for the Customer (Procurer)

text: The security requirements for the specific ICT system will have wider, or different, scope than those stated in this baseline and will be identified by a risk-assessment that takes account of the desired system objectives and the prevailing security landscape. The baseline may be sufficient but users of this guide must ensure that security requirements beyond the baseline are fulfilled effectively by appropriate measures.

text: 2 Overview of Indispensable Baseline Security Requirements

text: Note: All the requirements presented below apply also to the supplier’s subcontractors or its third party service providers.

text: The provider shall design and pre-configure the delivered product such that Security by Design functionalities are based on well-established security practices and are reduced to the strict minimum required for system operations.

text: The provider shall design and pre-configure the product according to the least privilege principle, whereby administrative rights are only used when Least Privilege absolutely necessary, sessions are technically separated and all accounts will be manageable.

text: The product shall provide and support strong authentication mechanisms for Strong Authentication all accounts. If authentication is unsuccessful the product shall not allow any user specific activities to be performed.

text: The product shall provide adequate level of protection for critical information Asset Protection assets during storage and transmission.

text: The provider shall give means to ensure that the product is genuine, cannot Supply Chain Security be tainted during operation, and its integrity are warranted throughout the product’s lifecycle.

text: The provider shall offer comprehensive and understandable documentation about the overall design of the product, describing its architecture, Documentation functionalities and protocols, their realisation in hardware or software Transparency components, the interfaces and interactions of components with each other and with internal and external services, in order to be able to implement and use the product in the most secure way possible.

text: The provider shall be able to provide evidence that a managed security by design approach has been adopted, including documented secure software Quality Management development, quality management and information security management processes.

text: The provider shall guarantee support throughout the agreed lifetime of the Service Continuity product such that the system can work as agreed and is secure.

text: The provider shall accept that all contracts refer to EU Member State law and only EU Member State law and place of jurisdiction in an EU Member State EU Jurisdiction country and only an EU Member State country, including those with subcontractors.

text: The provider shall explicitly declare, justify and document, context and Data Usage purpose wise, all data collection and processing activities that take or may Restriction take place, including relevant legal obligations stipulating them.

text: 3 Guidance on using the requirements

text: This Section provides more detailed explanation of requirements that the supplier shall address in complying with the baseline requirements.

text: 3.1 Security by Design

text: The provider shall design and pre-configure the delivered product such that functionalities are based on well-established security practices and are reduced to the strict minimum required for system operations.

text:  Functionalities that are not needed shall not be installed.  Functionalities that are installed shall have no undocumented capabilities, especially not those that run against the security and privacy interests of the operator (free from malware, spyware, hidden functionalities, un-documented backdoors or any other unapproved or unwanted functionalities such as non-authorised data forwarding).  Logging and auditing functions shall be included and supported by design. They shall be based on open interoperable standards and best practices in order to work properly with Security Information & Event Management (SIEM) and logging and monitoring systems.  The system shall log user activities as well as security relevant events and errors in a format that can be evaluated and analysed during operations or afterwards. The log files shall be protected against tampering.  All systems shall provide a widely acceptable standard system time and possibility to sync it with an external time source in order to achieve exactness of system time to the second.  The supplier shall not use technologies, protocols and functionalities that are outdated or already recognised as insecure (e.g. SSL 3.0, MD5, or RC4, among others)  The complete system with all its components, i.e. including extensions and enhancements, must be ready for mitigating known vulnerabilities.

text: 3.2 Least Privilege

text: The provider shall design and pre-configure the product according to the least privilege principle, whereby administrative rights are only used when absolutely necessary, sessions are technically separated and all accounts will be manageable.

text:  An administrator shall be able to manage all accounts (incl. technical and service accounts) without support from the provider.  Every service and every user shall have by default only the minimal rights that are required for specific activities.  Every user shall obtain its own user account.  Passwords shall be changeable in all cases by the operator.

text:  The password complexity must be configurable by the administrator:  minimal password length;  maximum password length (system must support at least up to 128 characters);  minimum number of specific characters or character groups, e.g. small and capital letters, numbers, special characters (incl. space), etc.;  minimum and maximum usage period;  prevention of re-use of previous passwords; and  maximum number of password changes per time (e.g. per day).

text: 3.3 Strong Authentication

text: The product shall provide and support strong authentication mechanisms for all accounts. If authentication is unsuccessful the product shall not allow any user specific activities to be performed.

text:  Applications shall have the capability to enforce rules or policies for identification and authorisation of users that execute them.  Access to data shall only be given after successful authentication and authorisation. Without successful authentication and authorisation, the system shall not allow any activities.  Service accounts shall not be usable for interactive logon.

text: 3.4 Asset Protection

text: The product shall provide adequate level of protection for critical information assets during storage and transmission.

text:  Physical assets are the products that the provider supplies to the operator to be installed, including equipment of any kind, documentation, and premises.  Logical assets are the information generated by applications, stored, and communicated between components of the system.  Physical and logical assets shall be verifiably protected during design, manufacture, delivery, operation, and decommissioning.  No cryptographic means shall be used if there are indications that they have been vulnerable to cryptanalysis.  Sensitive data (e.g. credentials) may be stored in the system respectively transmitted only in encrypted form  Only established and well-known encryption algorithms may be used and encryption key lengths, which are considered as safe according to the state-of-art. Proprietary encryption algorithms are not allowed.

text:  The implementation must be done based on well-established encryption libraries to avoid implementation weaknesses.  The key generation must create secure keys and keys must be stored securely.

text: 3.5 Supply Chain Security

text: The provider shall give means to ensure that the product is genuine, cannot be tainted during operation, and its integrity are warranted throughout the product’s lifecycle.

text:  The authenticity checking method(s) of the product shall be capable of tracing back software and/or hardware components to their genuine sources.  The authenticity checking method of the product shall protect the properly authorized configuration information assets of the system.  The integrity checking method shall be capable of verifying the correctness of all compatibility and dependability requirements in the product.  Ongoing authenticity and integrity checks during operations shall detect and indicate any unauthorized change in the configuration of the system.

text: 3.6 Documentation Transparency

text: The provider shall offer comprehensive and understandable documentation about the overall design of the product, describing its architecture, functionalities and protocols, their realisation in hardware or software components, the interfaces and interactions of components with each other and with internal and external services, in order to be able to implement and use the product in the most secure way possible.

text:  The documentation shall be updated securely without the need for a permanent reference to external servers.  The documentation shall be updated when there are major changes to design or functionality.  Users shall be made aware of changes to documentation and encouraged to switch to the new documentation set.

text: 3.7 Quality Management

text: The provider shall be able to provide evidence that a managed security by design approach has been adopted, including documented secure software development, quality management and information security management processes.

text:  The provider should possess a current valid security certification in the relevant area or something equivalent (e.g. development, production), such as ISO27001 or corresponding).  At least, a rationale of fulfilment of requirements addressed by such security or quality assurance certifications should be available  The provider shall be able to provide the relevant information security directives which are applicable to its product/service.

text: 3.8 Service Continuity

text: The provider shall guarantee support throughout the agreed lifetime of the product such that the system can work as agreed and is secure.

text:  The provider shall guarantee:  A minimum lifecycle during which support is assured.  An ongoing research for potential vulnerabilities (e.g. a responsible disclosure program).  If critical vulnerabilities (according to their CVE rating) get known, the provider is obliged to check in a timely manner and at his own expense, whether his product is affected by the weakness and to inform the operator of the result.  Timely provisioning of security patches or other appropriate risk mitigation measures, when new vulnerabilities get known. As a first remediation step the provider should at least respond with a remediation plan at the latest within seven (7) working days. The plan shall indicate the timeframe for resolving the vulnerability.

text: 3.9 EU Jurisdiction

text: The provider shall accept that all contracts refer to EU Member State law and only EU Member State law and place of jurisdiction in an EU Member State country and only an EU Member State country, including those with subcontractors.

text:  The provider must inform the operator about non-EU laws that it is obliged to obey.  The provider shall inform the operator about all countries’ laws that apply to the operator by using its product and services.

text: 3.10 Data Usage Restriction

text: The provider shall explicitly declare, justify and document, context and purpose wise, all data collection and processing activities that take or may take place, including relevant legal obligations stipulating them.

text:  The provider shall inform the operator about non-EU laws that must be obeyed concerning data collection or forwarding.  The provider and the operator shall agree on the use of the Traffic Light Protocol (TLP) when sharing security relevant information between operator, provider, supplier(s), other operators, end users and the general public.

text: 4 Conclusions

text: This document introduced the need for a set of indispensable baseline security requirements that will be used by procurers and suppliers of ICT systems and services. The approach to developing such requirements was outlined along to the requirements themselves followed by clarifying examples of detailed issues that must be addressed. Envisioned next steps include consultation with European Cyber Security Organisation (ECSO) community as the established representative of private sector from all sectors, to initiate a broader discussion, structured feedback and improvements in order to find consensus on the applicability of this document. Subject to advice from the community, future work could include a mapping of the baseline requirements to a catalogue of relevant standards, and further detail on the verification that ICT products are secure: by design, by default, and throughout their life.

text: Contact

text: For queries in relation to this paper, please use isdp@enisa.europa.eu

text: Acknowledgements

text: ENISA would like to thank the following members of the Expert Group for their active engagement and support throughout this activity: Mr. Wolfgang Schwabl - A1 Telekom Austria AG (AT), Mr. Thomas Stubbings - TSMC (AT), Mr. Aurélien Leteinturier - ANSSI (FR), Mr. Tobias Mikolasch - BSI (DE), Mr. Martin Konecny - NBU (CZ), Ms. Gema Carbonell - CCN (ES), Mr. Rob Huisman - NINCSA (NL) and Ms. Heidi Kivekäs - FICORA (FI).

type: vagledning

utgivare: enisa


text: THE EU AGENCY FOR CYBERSECURITY

text: May 2019

text: See ENISA study on "Good Practices for Security of IoT in the context of Smart Manufacturing": https://www.enisa. europa.eu/publications/good-practices-for-security-of-iot, November 2018

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: See EC Staff Working Document on “Liability for emerging digital technologies”: http://ec.europa.eu/newsroom/dae/ document.cfm?doc_id=51633, April 2018

text: May 2019

text: ENISA online tool for IoT and Smart Infrastructures Security maintains a continuously updated list of relevant efforts mapped against the ENISA IoT Security Baseline: https://www.enisa.europa.eu/iot-tool 4 See Annex C of ENISA study on "Good Practices for Security of IoT in the context of Smart Manufacturing": https:// www.enisa.europa.eu/publications/good-practices-for-security-of-iot 5 See IEC 62443 family of standards at: https://www.iec.ch/index.htm 6 See IUNO project homepage at: https://iuno-projekt.de/ 7 See ENISA “Baseline IoT Security Recommendations” study at: https://www.enisa.europa.eu/publications/baselinesecurity-recommendations-for-iot, October 2017 8 See Code of Practice for Consumer IoT Security at: https://www.gov.uk/government/collections/secure-by-design 9 See NIST Internal Report 8228 (Draft) Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks at: https://nvlpubs.nist.gov/nistpubs/ir/2018/NIST.IR.8228-draft.pdf 10 See Annex B of ENISA study on "Good Practices for Security of IoT in the context of Smart Manufacturing" for a relevant effort: https://www.enisa.europa.eu/publications/good-practices-for-security-of-iot

text: May 2019

text: See ETSI TS 103 645 “Cyber Security for Consumer Internet of Things”: https://www.etsi.org/deliver/etsi_ts/103600_1 03699/103645/01.01.01_60/ts_103645v010101p.pdf, February 2019 12 See relevant ENISA study on “IoT Security Standards Gap Analysis”: https://www.enisa.europa.eu/publications/iotsecurity-standards-gap-analysis, January 2019

text: May 2019

text: See ENISA Infonote on Supply Chain Attacks: https://www.enisa.europa.eu/publications/info-notes/supply-chainattacks, August 2017

text: May 2019

text: Notable examples in this direction involve the NIST Cyber Security Framework and IEC 62541 (OPC UA).

text: May 2019

text: May 2019

text: May 2019

identifier: Industry 4.0 - Cybersecurity Challenges and Recommendations

amnesord: Artificial Intelligence and Next Gen Technologies

title: Industry 4.0 - Cybersecurity Challenges and Recommendations

text: INDUSTRY 4.0 CYBERSECURITY: CHALLENGES & RECOMMENDATIONS

text: ENISA LISTS HIGH-LEVEL RECOMMENDATIONS TO DIFFERENT STAKEHOLDER GROUPS IN ORDER TO PROMOTE INDUSTRY 4.0 CYBERSECURITY AND FACILITATE WIDER TAKE-UP OF RELEVANT INNOVATIONS IN A SECURE MANNER.

text: 1. INTRODUCTION

text: The ENISA study on "Good Practices for Security of IoT in the context of Smart Manufacturing" focuses on addressing the security and privacy challenges related to the evolution of industrial systems and services precipitated by the introduction of IoT innovations. The main objectives are to collect good practices to ensure security of IoT in the context of Industry 4.0/Smart Manufacturing, while mapping the relevant security and privacy challenges, threats, risks and attack scenarios.

text: Building on this work, this document provides the results of a gap analysis conducted in This document order to identify main challenges to the adoption of the security measures and security of

text: provides the

text: Industry 4.0 and Industrial IoT. Moreover, ENISA lists high-level recommendations to different

text: results of

text: stakeholder groups in order to promote Industry 4.0 cybersecurity and facilitate wider take-up

text: a gap analysis

text: of relevant innovations in a secure manner.

text: conducted in

text: The adoption of the high-level recommendations proposed by ENISA aims at contributing order to identify to the enhancement of Industry 4.0 cybersecurity across the European Union and at laying main challenges the foundations of the relevant forthcoming work, as well as at serving as a basis for future to the adoption developments.

text: of the security measures and

text: In this short paper, ENISA follows a holistic and comprehensive approach to the issues

text: security of

text: related to cybersecurity in Industry 4.0, whereby challenges and recommendations are associated with one of the following categories: People, Processes, and Technologies. This Industry 4.0 and ensures consistency with the relevant ENISA study1. Additionally, recommendations are also Industrial IoT. categorised in terms the target audience groups to which they are addressed (the icons for the 5 stakeholder groups identified below may be used as a guidance, i.e. the presence of an icon next to a recommendation indicates that a particular set of recommendations is aimed at the corresponding stakeholder group).

text: STAKEHOLDERS GROUPS

text: Industry 4.0 Industry 4.0 Regulators Standardisation Academia and R&D security experts operators (solution community bodies (OT and IT providers & security) manufacturers)

text: 2. PEOPLE

text: CHALLENGE: NEED TO FOSTER AND ALIGN IT/OT SECURITY EXPERTISE AND AWARENESS

text: Lack of sufficient information security expertise and awareness is a major barrier that hinders the adoption of Industry 4.0 security measures. People involved in deployments of new solutions usually have only knowledge of either IT or OT security, while Industry 4.0 and Smart Manufacturing require expertise over several areas, e.g. network security, embedded systems, OT and IT security to name a few. It is becoming increasingly difficult to find qualified specialists who are well aware of security issues.

text: The emergence of Industry 4.0 introduces new technologies into traditional OT environments

text: The emergence

text: and thus people familiar with OT that work in such environments need to adapt. These people

text: of Industry 4.0

text: have knowledge on how to operate such environments for years and are nowadays faced with

text: introduces new

text: adapting the way they work and embrace new Industry 4.0 capabilities. Being unfamiliar with

text: technologies

text: such technologies, employees lack new competences that are essential for secure utilization of Industry 4.0 solutions within the Smart Manufacturing systems. Such new competences into traditional would include, among others: OT environments operational security knowledge and skills required to monitor, prevent, and detect and thus people anomalies due to security violations;

text: familiar with OT

text: security aspects of new protocols used by Industry 4.0 solutions;

text: that work in such

text: skills to utilize security functionalities of the components and services (which may seem

text: environments

text: overly complicated to users if not adequately explained); methods of secure integration with legacy systems; need to adapt. information systems security over complex supply chains.

text: Moreover, large manufacturing companies often are lagging in training employees who work with OT equipment and instead employ security solutions for Industry 4.0 systems without first ensuring take-up by employees. In addition, nowadays there are a limited number of state-ofthe-art cybersecurity trainings dedicated to IT/OT convergence and Industry 4.0 systems and in any case, such trainings in most cases do not cover all essential aspects of these areas, are often very expensive and not always tailored to specific industry needs.

text: RECOMMENDATION: PROMOTE CROSS-FUNCTIONAL KNOWLEDGE ON IT AND OT SECURITY

text: Raising awareness on basic industrial control security as well as on the secure way for transitioning to Industry 4.0 and Smart manufacturing is of paramount importance. To address the lack of IoT and Industry 4.0 security talent, it is essential is to cultivate such knowledge both within and across organisational boundaries. Persons in charge of security within Industry 4.0 organizations should invest in state-of-the-art dedicated cybersecurity trainings that cover all necessary aspects specific to IT/OT convergence and Smart manufacturing. Lastly, trainings and courses at schools and universities (considering localisation to reach a wider audience) will further promote a better understanding of Industry 4.0 security among younger generations and thus in the long-term will contribute to raising awareness.

text: To promote cross-functional knowledge on IT and OT security, ENISA recommends: Encourage cross-functional security and safety knowledge exchange between IT and OT experts respectively. Launch security education and training in industries transitioning to Industry 4.0, including knowledge of state-of-the-art, best practices, methodologies and tools for secure convergence of IT and OT systems. Establish tailor made training courses focused on Industry 4.0 security to increase effectiveness of the training and assist OT and IT security experts to address relevant cybersecurity issues more efficiently. Develop competency profiles to provide IoT and Industry 4.0 specific awareness and education training for all staff. Introduce programs at schools and universities to address the lack of security and safety knowledge across the industry and to empower the next generation of IT and OT security experts. Organise cyber-culture and cyber-hygiene induction courses for OT personnel and conversely safety-culture and safety-hygiene courses for IT personnel, also involving all staff. Introduce to OT people the notion of security and to IT people the notion of safety, with special mentions to cases where the two notions may align or not.

text: CHALLENGE: INCOMPLETE ORGANISATIONAL POLICIES AND RELUCTANCE TO FUND SECURITY

text: Industry 4.0 operators, which are at various stages of Industry 4.0 adoption, often do not have Industry 4.0 appropriate governance structures in place for secure implementation of new technologies

text: operators,

text: and secure maintenance of the existing ones. Defined security programs are rarely in place

text: which are at

text: and in general comprehensive programs that consider security and safety in tandem are

text: various stages

text: lacking. It is also often noted that security related roles and responsibilities of employees are not clearly defined and there is minimal planning to consider safety engineers within the of Industry 4.0 cybersecurity ecosystem. This results in companies’ lack of resilience and vulnerability to adoption, often potential security breaches. do not have

text: appropriate

text: This is because to date cybersecurity was traditionally not perceived as a Board-level topic,

text: governance

text: since its impact on increasing revenue or optimizing cost remains generally unclear. This

text: structures in

text: results in the fact that the majority of technological transformations mostly focus on increased

text: place for secure

text: functionality and business value rather than cybersecurity, i.e. hindering the potential negative impact of associated risks. A typical example of this is the ongoing migration of manufacturing implementation companies towards Cloud. In general, companies decide to opt for Cloud solutions to of new benefit from cost efficiency and ubiquitous access to information. During this migration,

text: technologies

text: security should be considered as a high priority issue –and accordingly it should play an

text: and secure

text: equally important role in decision-making as cost efficiency– especially when manufacturing

text: maintenance

text: companies choose public clouds and thus increase the risk of exposing their data and

text: of the existing

text: operations, while at the same time improving their resilience.

text: ones.

text: Furthermore, it is worth highlighting that ensuring security of a system or solution, both in the context of Industry 4.0 vendors and operators, requires funding and commitment from toplevel management. However, as there is no clearly discernible link to generate profits from investing in cybersecurity, it is often the case that due consideration to cybersecurity is given when a security breach directly leads to financial losses. Striking the proper balance between the costs and the need for security remains an open challenge.

text: INDUSTRY 4.0 CYBERSECURITY: CHALLENGES & RECOMMENDATIONS RECOMMENDATION: FOSTER ECONOMIC AND ADMINISTRATIVE INCENTIVES FOR INDUSTRY 4.0 SECURITY

text: It is clear that lack of security has the potential to significantly affect business continuity. Industry 4.0 is no exception given the criticality of related operations and the associated impact on safety as well. In this respect, best practices for business continuity can serve as a driver for investing in cybersecurity solutions and accordingly for supporting the unobstructed operation of Industry 4.0 processes.

text: Investments in cybersecurity should not be driven only by fear of losing money. It is equally if not more important, for industries and organisations to not look at cybersecurity only as a cost, but to also start seeing it as an important business opportunity. Cybersecurity can be an important competitive advantage for businesses, since it leads to having secure, reliable and trustworthy products and services. Accordingly, cybersecurity is an enabler of business Investments in opportunities, not a hindering factor and certainly not another item on a checklist. cybersecurity

text: should not be

text: Nonetheless, economic and administrative stimuli are also required to incentivize investments

text: driven only

text: in Industry 4.0 security, given that maturity and mentality of organisations and businesses

text: by fear of

text: needs to grow further when it comes to identifying the role and importance of security.

text: losing money.

text: To foster economic and administrative incentives for Industry 4.0 security, ENISA It is equally

text: recommends: if not more

text: Establish administrative structures for top-level management to discuss and exchange

text: important, for

text: views with cybersecurity experts and CISOs.

text: industries and

text: Launch funding schemes for SMEs and other bodies to support their transition to a secure

text: organisations

text: Industry 4.0 ecosystem, including financial support for cooperative actions.

text: to not look at

text: Incentivize innovation and R&D activities for securing IT and OT environments, components and systems. cybersecurity Ensure a homogeneous and stable legal environment for Industry 4.0 cybersecurity to only as a cost, allow companies to plan long-term, sustainable business strategies including the aspect of but to also start security.

text: seeing it as

text: Consider the development of certification schemes for Industry 4.0 security (taking into

text: an important

text: account the inherent particularities when defining the target of evaluation), since they

text: business

text: promote harmonisation of the market, increase consumer trust and open up new business opportunities. opportunity.

text: Promote Public Private Partnerships (PPPs) focused on Industry 4.0 cybersecurity to benefit from multi-stakeholder dialogues and much needed synergies.

text: 3. PROCESSES

text: CHALLENGE: LIABILITY OVER INDUSTRY 4.0 PRODUCTS’ LIFECYCLE IS POORLY DEFINED

text: Liability for Industry 4.0 cybersecurity is an open issue (a gap also identified for most of emerging technologies) as accountability for Industry 4.0 cybersecurity incidents remains unclear. There is a large number of stakeholders involved in the supply chain and in the use lifecycle of Industry 4.0, therefore apportioning liability in the aftermath of a security incident becomes challenging as currently, only general provisions of liability are applicable.

text: The major difficulty in finding a clear solution for liability stems for the inherent complexity of The major the ecosystem. The majority of Industrial IoT devices are usually built from a large number difficulty in of components manufactured by multiple vendors, in disperse locations (possibly subject

text: finding a clear

text: to different administrative and legal constraints) and including vendors of the software

text: solution for

text: embedded in the devices. The complexity of the supply chain further exacerbates relevant

text: liability stems

text: concerns. Apportioning liability thus remains an open challenge.

text: for the inherent

text: In the context of cybersecurity, an Industry 4.0 device manufacturer is broadly expected complexity of the to implement functionalities in its product that would enable a proper level of security. In ecosystem. a similar fashion, the role of Industry 4.0 operators would see them using these available security features and perform all security upgrades provided by the manufacturer. In reality, the situation is more complicated. The long lifespan of Industry 4.0 solutions (especially in comparison to IT systems) and the financial commitments related to their long-term maintenance (e.g. software patching), both aggravate the requirements on manufactures, users and operators of such solutions. Shared ownership of connected, Industry 4.0 solutions, unclear or unspecified role assignments and lack of provisions in procurement contracts and service level agreements further complicate the issue of liability.

text: RECOMMENDATION: CLARIFY LIABILITY AMONG INDUSTRY 4.0 ACTORS

text: The Industry 4.0 paradigm introduces emerging technologies and services in manufacturing and the industrial ecosystem in general. Given the cyber-physical nature of this paradigm, security and safety are tightly intertwined. Therefore, it is of particular importance to address liability concerns not only to protect end-users and consumers of such products and services, but also to stimulate corresponding investments through a comprehensive and stable legal framework. The European Commission has recently published a Staff Working Document that sets the scene for liability issues in emerging technologies such as IoT and Artificial Intelligence . This will serve as a reference point for forthcoming work.

text: The question of where liability may fall lies between the different and diverse stakeholders of the Industry 4.0 supply chain, such as developers, manufacturers, providers, vendors, aftermarket support operators, third party providers and the end users, to name a few.

text: To clarify liability among Industry 4.0 actors, ENISA recommends: Address liability issues in the context of European and national legislation and case law, especially where gaps in existing legislation are identified. Adjust procurement language to clarify liability among stakeholders in supply chains, e.g. specify Industry 4.0 cybersecurity requirements as part of SLAs (Service Level Agreements) and contracts during procurement. Assess the potential of cyber-insurance policies to transfer residual cyber risk and reduce the impact of cybersecurity incidents, for which an entity might be held liable. Raise awareness of end users and consumers on their rights concerning liability legislation. Specify in a clear manner the legal obligations of Industry 4.0 operators when it comes to liability.

text: CHALLENGE: FRAGMENTATION OF INDUSTRY 4.0 SECURITY TECHNICAL STANDARDS

text: The current landscape of standards and policy initiatives related to IoT and Industry 4.0 cybersecurity is quite large, covering security aspects at both a horizontal and vertical (application specific deployments, e.g. automotive, health, and consumer) manner. In the context of IoT, many high-level reference documents have been published, as well as baselines, good practices, checklists and general guidance . Concerning connected industrial systems and manufacturing systems in particular, there are also useful sources that may serve as guidelines for relevant stakeholders .

text: However, when it comes to Industry 4.0 and Smart Manufacturing the situation is slightly

text: The

text: different. Given the nascent nature of these areas, comprehensive initiatives to address

text: fragmentation

text: security in a holistic manner are lagging behind. Nonetheless, it is important to refer to some

text: 5 of Industry

text: notable examples that already exist (such as IEC 62443 or the efforts under IUNO/Industrie

text: 6 4.0 security

text: 4.0 to name a few). Accordingly, interested parties currently utilize documentation that is only partially applicable to the broad spectrum of Industry 4.0 and Smart Manufacturing. standards and

text: initiatives is

text: The fragmentation of Industry 4.0 security standards and initiatives is of particular importance

text: of particular

text: for the manufacturing sector. Large manufacturing companies commonly have sites spread

text: importance

text: across the world. Accordingly, the lack of uniform standardization efforts at a global level

text: for the

text: results in a situation when sites that belong to one organization cannot collaborate and share

text: manufacturing

text: security expertise and solutions with each other, as they are subject to different schemes. Moreover, secure collaboration across companies is also hindered. At the same time, it is sector. Large promising that cross-mapping initiatives have started to evolve, e.g. ENISA Baseline Security manufacturing 7 8 Recommendations for IoT , UK Government Code of Practice for Consumer IoT Security , NIST companies Internal Report 8228 . Whereas, such initiatives contribute to increasing homogeneity in the

text: commonly have

text: area of IoT security, further work to expand them in the Industry 4.0 ecosystem is desirable .

text: sites spread across the world. INDUSTRY 4.0 CYBERSECURITY: CHALLENGES & RECOMMENDATIONS

text: Moreover, there is a need for systematic recipes for implementing the recommendations proposed in Industry 4.0 security standards and guidelines. Current lack of pragmatic ways to achieve this objective is leading to significant diversities of systems and services security in the manufacturing sector.

text: RECOMMENDATION: HARMONIZE EFFORTS ON INDUSTRY 4.0 SECURITY STANDARDS

text: To address the fragmentation of current technical standards for Industry 4.0 cybersecurity, it is necessary to harmonize relevant efforts wherever there are significant gaps and overlaps. One option towards this direction involves the introduction of baseline standards dedicated to Industry 4.0 security. Along these lines, it is encouraging that such efforts have recently emerged in the context of IoT .

text: Alternatively, it is beneficial to explore initiatives and guidelines that map security standards from many different sources to provide a complete point of reference and thus ensure all necessary security controls are considered. At any rate, standardization activities should be based on the input of the different actors of the Industry 4.0 ecosystem to ensure fair and comprehensive representation of relevant requirements and eventually wider adoption.

text: To harmonize efforts on Industry 4.0 security standards, ENISA recommends: Launch standardization activities addressing the entire spectrum of Industry 4.0 security. Conduct analyses on current standards for Industry 4.0 security to examine potential gaps, i.e. whether existing standards adequately address Industry 4.0 security requirements . Promote multi-stakeholder dialogues between Industry 4.0 actors to ensure consensus in the development of relevant technical standards. Develop and maintain mapping schemes between standardization activities (such as 2 8 7 the ones by ENISA , NIST , UK DCMS ) to explore cross-standard commonalities and synergies.

text: CHALLENGE: SUPPLY CHAIN MANAGEMENT COMPLEXITY Supply chain management

text: Supply chain management in the manufacturing sector is a well-known challenge

text: in the

text: acknowledged by the majority of involved actors and stakeholders. Although the supply

text: manufacturing

text: chain characteristics depend on the company (for example, a large corporation may be able

text: sector is a well-

text: to control a significant part of the supply chain as it manufacturers its own components), typically companies rely on others to take over part of this work. Recently, the situation known challenge has become even more complicated as Smart Manufacturing introduced new capabilities acknowledged (End-to-End visibility, predictive analysis, automation and data-driven decision-making) that by the majority have an additional impact on the supply chain. Accordingly, supply chains have become

text: of involved

text: more dynamic, flexible, interdependent and demanding in terms of performance. However,

text: actors and

text: increased inter-dependence of supply chains results in broader impact caused by existing

text: stakeholders.

text: security risks and introduction of new ones.

text: Scalability is one of the most significant concerns, as a large number of people, organizations and processes are involved. In such cases, companies need to make numerous decisions (e.g. select vendors, agree on methods of collaboration, establish organizational processes),

text: on which the security of the final product will depend. Having an effective control over the supply chain is essential, as not being able to track every component to its source further erodes confidence in a product’s security. The notion of trustworthiness is also noteworthy, since companies need to delineate the amount of trust they place on their partners as well as to manage any residual risks.

text: The plethora of supply chain actors, who may be subject to different national legislative frameworks, also means that security incidents may occur at various tiers and stages. Such incidents may be related to the exchange of goods, services or information and consequently may result in a propagation of errors and risks across the whole supply chain . Detecting the source of a problem becomes extremely challenging and possible cascade effects could be very hard to predict. At any rate, it is evident that a security breach at any point of the supply chain would have a negative impact on the final product’s security.

text: The complexity of the supply chain exacerbates the utilization of security standards and solutions that are applicable across the different actors involved. Therefore, it is often that diverse requirements apply to different actors and processes making this an even more cumbersome issue.

text: RECOMMENDATION: SECURE SUPPLY CHAIN MANAGEMENT PROCESSES

text: Cybersecurity is a shared responsibility. When we talk about IoT and Industry 4.0, with complex supply chains and several actors involved, this becomes an even more pressing reality. In securing Industry 4.0, collaboration is everything. There are many players, many interdependencies, and many facets. Trust is the root of a secure supply chain, since the amount of trust that an organisation places on another that will eventually feed into the risk assessment process and the introduction of appropriate security controls.

text: Addressing the complexity and the risks involved in large supply chains is a matter of identifying how much trust one can afford to place, and what residual risks it can accept in order to define appropriate levels of security. Supply chain

text: management

text: Another important consideration involves holistic management of security across the supply chain.

text: in the

text: Securing the interaction between two entities is not adequate, when such an interaction is only

text: manufacturing

text: part of a longer supply chain. End-to-end security is a prerequisite for Industry 4.0 to succeed.

text: sector is a well-

text: To fully understand and secure supply chain management processes, ENISA recommends: known challenge Conduct risk assessment at periodic intervals to identify potential Industry 4.0 supply chain acknowledged

text: risks. by the majority

text: Define amount of trust placed on each supplier and review this definition at periodic

text: of involved

text: intervals, also considering cyber threat intelligence to monitor ongoing and emerging

text: actors and

text: threat landscape.

text: stakeholders.

text: Rely on suppliers whose products comply with recognised security standards and certification schemes. Apply trust models instead of concrete technical security controls (e.g. certificates). Ensure security of digital supply chain by following secure software development lifecycle for Industry 4.0 products and services.

text: 4. TECHNOLOGY

text: CHALLENGE: INTEROPERABILITY OF INDUSTRY 4.0 DEVICES, PLATFORMS AND FRAMEWORKS

text: With the introduction and integration of Industry 4.0 devices, platforms and frameworks to With the existing systems comes the issue of interoperability. In industrial environments, securing

text: introduction

text: interconnectivity between diverse devices is often challenging, especially when considering

text: and integration

text: devices that are long out of support. It is thus essential to promote secure solutions for

text: of Industry

text: ensuring smooth integration of Industry 4.0 devices with legacy systems and among each other, e.g. gateways to ensure transparent communication in the case of different networking 4.0 devices, or other protocols. platforms and

text: frameworks

text: Additionally, lack of interoperability relates to dedicated, proprietary protocols that are in

text: to existing

text: use by Industry 4.0 devices. In case of utilization of devices and platforms from different

text: systems comes

text: vendors, ensuring interoperability may not always be possible. Ensuring interoperability

text: the issue of

text: between devices / platforms is not only about seamless operation, but also about security. It is

text: interoperability.

text: therefore essential to address the problem of proprietary protocols that are not always secure and adopt common frameworks in order to improve functionality and security of Industry 4.0 solutions.

text: Lastly, the notion of interoperability does not only refer to communication protocols and different application frameworks. In the complex supply chains of Industry 4.0, the notion of security interoperability emerges, meaning that it is very challenging to ensure a common, baseline of security across platforms, devices, protocols and frameworks. The weakest link of the chain can have detrimental effects on the entire chain, therefore ensuring a unifying common cybersecurity layer across all these elements is a very challenging issue.

text: RECOMMENDATION: ESTABLISH INDUSTRY 4.0 BASELINES FOR SECURITY INTEROPERABILITY

text: The challenge of security interoperability is pertinent to the Industry 4.0 ecosystem especially considering integration with legacy systems. Most of the interoperability and security challenges derive from the interconnection of devices (both critical and non-critical manufacturing components) from different manufacturers and different communication protocols. Ensuring and fostering interoperability of Industry 4.0 devices, platforms and frameworks, as well as security practices is therefore essential.

text: To establish Industry 4.0 baselines for security interoperability, ENISA recommends: Encourage the use of interoperability frameworks that promote a common security language and use of protocols for Industry 4.0 components. Identify specific security levels between cooperation partners and companies across the supply chain to cover all three cybersecurity facets, namely people, processes and technologies. Promote open and accessible interoperability laboratories and testbeds for security.

text: INDUSTRY 4.0 CYBERSECURITY: CHALLENGES & RECOMMENDATIONS CHALLENGE: TECHNICAL CONSTRAINTS HAMPERING SECURITY IN INDUSTRY 4.0 AND SMART MANUFACTURING

text: Difficulties in ensuring security in Industry 4.0 result also from lack of technical capabilities of connected industrial devices and systems, especially considering integration with legacy infrastructures. Constraints in embedded systems brings about a major challenge, especially Difficulties when referring to low end ICSs and PLCs, as they face many issues with a direct impact on

text: in ensuring

text: their security. Indicatively one can consider the following limitations:

text: security in

text: Limited processing capabilities and the need to ensure long time of operation while

text: Industry 4.0

text: maintaining a suitable size and competitive price of the device considerably affects implementation of comprehensive security features in the design phase. result also from No consideration for fundamental protection mechanisms when designing Industry 4.0 lack of technical devices adversely influences their security. Patching and software updates over-the-air capabilities are in most cases not feasible solutions when it comes to low-end devices, as they do not

text: of connected

text: support such functionality.

text: industrial

text: Lack of more advanced security measures such as encryption or authentication for

text: devices and

text: example, lower the protection level of devices that are closest to the industrial process.

text: systems,

text: A quite common approach of only securing the network is insufficient, e.g. if an attacker breaks into the network, the devices are vulnerable to attacks. especially

text: considering

text: Finally, while considering gaps related to limited technical capabilities, it is worth mentioning integration the fact that dedicated cybersecurity tools for Industry 4.0 systems are generally too few or

text: with legacy

text: too expensive. Tools for network monitoring, automatic asset discovery, and configuration

text: infrastructures.

text: and change management at the OT environment have increased the security level of such systems and have raised their availability. Such tools however are not yet fully prepared for handling new Industry 4.0 devices, thus creating a gap in terms of security. Addressing such challenging issues by developing security solutions adapted for the Industry 4.0 world is needed.

text: RECOMMENDATION: APPLY TECHNICAL MEASURES TO ENSURE INDUSTRY 4.0 SECURITY

text: Given the complexity and scalability of the ecosystem, there is no one size fits all solution for IoT and Industry 4.0 security. It is a matter of combining solutions and ensuring that these solutions cater for flexibility and extensibility without sacrificing security, also taking into account the factor of usability. The notion of flexibility in this context also refers to the economics of cybersecurity, namely that adopted solutions should come as a result of a systemic cost-benefit analysis, where evidently the benefit is that of secure and reliable products and services.

text: Identifying baseline security recommendations for Industry 4.0 components, services and processes based on risk analysis is a first step to approach a solution to the challenging technical constraints of this domain. ENISA has published relevant guidelines from ENISA both horizontally for the IoT ecosystem6, but also in the vertical sector of Industry 4.01.

text: In terms of applying technical measures to ensure Industry 4.0 security, ENISA recommends: Define a security architecture for Industry 4.0 taking into account a methodological risk assessment. Apply principles of security-by-design and privacy-by-design and by-default for all Industry 4.0 components, devices, services, protocols, communications and processes. Assess the maturity of implemented cybersecurity solutions periodically, also considering cyber threat intelligence to monitor ongoing and emerging threat landscape. Monitor the cybersecurity posture of industries concerning Industry 4.0 deployments, also catering for legacy systems and infrastructures. Enable continuous updatability & upgradability of Industry 4.0 components and services throughout their lifecycle, with failsafe and effective operation as guiding principle. Keep track of developments in cybersecurity standards and best practices for Industry 4.0 cybersecurity and ensure proper implementation of relevant security measures subject to risk assessment also considering removing unnecessary functionality.

text: RECOMMENDATIONS INDEX

text: INDUSTRY Promote cross-functional knowledge on IT and OT security 4.0 SECURITY Secure supply chain management processes EXPERTS (OT AND Establish Industry 4.0 baselines for security interoperability IT SECURITY) Apply technical measures to ensure Industry 4.0 security

text: Promote cross-functional knowledge on IT and OT security

text: INDUSTRY 4.0

text: Clarify liability among Industry 4.0 actors

text: OPERATORS

text: Foster economic and administrative incentives for Industry 4.0 security

text: (SOLUTION

text: Secure supply chain management processes

text: PROVIDERS &

text: Establish Industry 4.0 baselines for security interoperability

text: MANUFACTURERS)

text: Apply technical measures to ensure Industry 4.0 security

text: Clarify liability among Industry 4.0 actors Foster economic and administrative incentives for Industry 4.0 security

text: REGULATORS

text: Harmonize efforts on Industry 4.0 security standards Establish Industry 4.0 baselines for security interoperability

text: STANDARDISATION Harmonize efforts on Industry 4.0 security standards COMMUNITY Establish Industry 4.0 baselines for security interoperability

text: ACADEMIA AND Promote cross-functional knowledge on IT and OT security R&D BODIES Establish Industry 4.0 baselines for security interoperability

text: ABOUT ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For media enquires about this paper, please use press@enisa.europa.eu.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ACKNOWLEDGEMENTS

text: ENISA would like to thank all the experts that have been acknowledged in the ENISA study “Good practices for security of IoT in the context of Smart Manufacturing” (November 2018) for their input and feedback in this publication.

text: AUTHORS

text: Dr. Apostolos Malatras Christina Skouloudi Aggelos Koukounas

text: COPYRIGHT NOTICE

text: © European Union Agency for Network and Information Security (ENISA), 2019 Reproduction is authorised provided the source is acknowledged. Catalogue number: TP-03-19-407-EN-N ISBN: 978-92-9204-293-6 DOI: 10.2824/143986

text: Vasilissis Sofias Str 1 151 24 Maroussi, Attiki, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu


text: In 47% of them, the victim was a bank.

text: E-mail and passwords were at the top of the list.

text: Information disclosure root causes. Source: Ponemon, IBM Security

text: Types of sensitive or regulated data stored. Source: Thales

identifier: ENISA Threat Landscape 2020 - Information Leakage

nummer: information-leakage

text: From January 2019 to April 2020

text: Information

text: leakage

text: ENISA Threat Landscape

text: Overview

text: A data breach occurs when data, for which an organisation is responsible, is subject to a security incident resulting in a breach of confidentiality, availability or integrity. A data breach frequently causes an information leakage, which is one of the major cyber threats, covering a wide variety of compromised information from personal identifiable information (PII), financial data stored in IT infrastructures to personal health information (PHI) kept in healthcare providers’ repositories. When security breaches are encountered in the headlines of bulletins, blogs, newspapers, and technical reports, the focus is mostly either on adversaries or on the catastrophic failure of the cyber-defence processes and techniques. Nevertheless, the undisputable truth is that, despite the impact or scope of such an event, the breach is usually caused by an individual’s action or by an organisational process failure. __Findings confirmed data disclosures in 2019 2.013_ During the first half of 2019, the organisations experienced an 5,6 11% increase in disclosures compared with 2018. of all incidents in the financial sector were 14%_ data disclosures billion data records were exposed globally in 4,1_ the first half of 2019 million is the highest cost incurred by €5,46_ healthcare sector

text: Kill chain

text: Information leakage Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Incidents

text: _ Top data leak incidents  In January 2019, the independent researcher Troy Hunt found 773 million users’ e-mail addresses and passwords in the cloud-storage service MEGA. Hunt named this breached dataset as ‘Collection#1’ and notified the service ‘Have I been Pwned?’ so it could notify the account owners to change their login passwords for accessing MEGA platform. In the same month, rogue individuals released personal details, private communications, and financial information of hundreds of German politicians, with targets representing every political party but the far-right AfD (Alternative für Deutschland).  In February 2019, more than 61 million accounts were culled from 16 websites and put up for sale on the dark web. Site owners of Whitepages, Dubsmash, Armor Games, 500px and ShareThis saw their users' stolen data sold for less than US $20.000 (ca. €17.000) in Bitcoin.  In March 2019, hundreds of millions of Facebook and Instagram users saw that their credentials were exposed by the social media company's poor password storage management.  In April 2019, 12,5 million medical records of pregnant women were exposed in India, because of a leaky government server belonging to a healthcare agency. The medical information exposed was related to the pre-conception and pre-natal diagnostic techniques act, an Indian law passed which that banning pre-natal sex determination in an attempt to prevent Indian families from aborting unborn girls and skewing the sex ratio towards boys.  In May 2019, DoorDash, a food delivery service, suffered a data breach that affected almost 5 million users. The subsequent investigation determined that information such as names, e-mail addresses, delivery addresses, order history, phone numbers and passwords had been accessed. The company said that the last four digits of some consumers' credit cards and bank account numbers had also been accessed.  In June 2019, the American Medical Collection Agency (AMCA) began notifying clients of a system hack that breached the billing and medical data of some of its clients, including 11,9 million records of Quest Diagnostics, which is one of the largest blood testing companies in the United States. According to a recent Securities and Exchange Commission 8K filing, a hacker had gained access to the AMCA’s system for nearly eight months between 1 August 2018 and March 30 2019. 24% Malicious or criminal attack System glitch 51% Human error 25%

text: Incidents

text: _ Top data leak incidents  In July 2019, the financial corporation Capital One suffered an information leakage that affected 100 million credit card applications, 140.000 social security numbers and 80.000 bank account numbers. Capital One reported that no credit card account numbers or login credentials were exposed. However, the breach exposed names, addresses, postal codes, phone numbers, e-mail addresses and birth dates.  In August 2019, 160 million records of MoviePass were left unencrypted. Because the company's database wasn't passwordprotected, it left customers' credit card numbers and other details exposed. The database remained online for several days. Meanwhile, a massive leak exposed 27,8 million biometric staff records held by the British Metropolitan Police, banks and defence contractors. The database was administered by Suprema, a company that collaborates 20,21 with the British police.  In September 2019, more than 218 million ‘Words with Friends’ player accounts were hacked. The users’ database included data from Android and iOS players who had installed the game before September 2. The hacker team ‘Gnostic players’ accessed information such as players' names, e-mail addresses, login identities and more.  In October 2019, Adobe left 7,5 million Creative Cloud customer records on an insecure database. The information leakage included the users’ email addresses and payment status.  In November 2019, Facebook gave inappropriate access to the profile data of its 70.000 customers to about 100 app developers. One of them stole the personal data and later used these data to scam them.  In December 2019, a Dutch politician faced 3 years in prison for hacking 100 women’s iCloud accounts and leaking nude pictures. The politician was found to have hacked the women's personal iCloud accounts with credentials found in earlier public database breaches. During the same month, the details of over 10,7 million Metro- Goldwyn-Mayer (MGM) resort guests were disclosed on a hacking forum. The leaked information included full customer name, home addresses, phone numbers, e-mail addresses, and birth dates. Security is more than 10% of the IT budget Security is 10% or less of the IT budget 52% 40% 29% 19% Ever Within past year 14 Breach incident rates by level of security spent. Source: CNET

text: Attack vectors

text: _How The primary attack vector in information leakage is insiders. This term is used to describe a person with an interest in ‘exfiltrating’ important inside information on behalf of a third party. Other common attack vectors used by this threat are misconfigurations, vulnerabilities and human errors. None of the below 2% Container/Docker images 7% Blockchain 8% Big data environments 15% DevOps 17% Internet of things platform 22% Platform-as-a-service (PaaS) 36% Infrastructure-as-a-service… 38% Social media 41% Mobile payments 43% Software-as-a service (SaaS) 78% 0% 20% 40% 60% 80% 100% “A data breach frequently causes an information leakage, which is one of the major cyber threats, covering a wide variety of compromised information” in ETL 2020

text: Mitigation

text: _Proposed actions  Anonymise, pseudonymise, minimise and cipher data in accordance with the provisions of the EU GDPR, the California Consumer Privacy Act (CCPA), and the China’s Multi-level Protection of Information 28,29,30,31 Security (MLPS 2.0). Always check the regulation commitments for counterpart entities who do not fall under bi- or multi-lateral 32, 33,34 initiatives.  Store data only on secure IT assets. 35,36  Limit user access privileges under the need-to-know principle. Revoke access privileges of anyone who is not an employee. 35,37  Educate and train your organisation’s personnel periodically.  Use technology tools to avoid possible data leakages, such as vulnerability scans, malware scans and data loss prevention (DLP) tools. Deploy data and portable system and device encryption, and 36,38 secure gateways.  A business continuity plan (BCP) is crucial for dealing with a data breach. This plan outlines the type of data being stored and their location, and what potential liabilities could arise when implementing data security and recovery actions. A BCP entails an effective incident response, which aims to address, manage, and rectify the damages caused by such an incident. “In many cases, companies or organisations are not aware of a data breach happening in their environment because of the sophistication of the attack and sometimes the lack of visibility and classification in their information system.” in ETL 2020

text: References

text: 1. “What is a data breach and what do we have to do in case of a data breach?” European Commission. https://www.ncsc.gov.uk/news/reckless-campaign-cyber-attacks-russian-militaryintelligence-service-exposed.

text: 2. “The humn factor of cyber security.” CSO. https://www.csoonline.com/article/3504813/the- human-factor-of-cyber-security.html

text: 3. Howard Poston. “Common causes of large breaches (Q1 2019).” May 1, 2019. INFOSEC Institute. https://resources.infosecinstitute.com/common-causes-of-large-breaches/#gref

text: 4. J. Clement. “Average cost of data breaches worldwide from 2014 to 2019.” August 13, 2019. Statista. https://www.statista.com/statistics/987474/global-average-cost-data-breach/

text: 5. “2019 Data Breach Investigations Report.” 2019. Verizon. https://enterprise.verizon.com/resources/executivebriefs/2019-dbir-executive-brief.pdf

text: 6. “Cyber Threatscape Report.” 2019. iDefense – Accenture. https://www.accenture.com/_acnmedia/pdf-107/accenture-security-cyber.pdf

text: 7. “Cybercrime will cost businesses over $2 trillion by 2019.” May 12, 2015. Juniper Research https://www.juniperresearch.com/press/press-releases/cybercrime-cost-businesses-over-2trillionby-2019

text: 8. “How much would a data breach cost your business?.” 2019. IBM. https://www.ibm.com/security/data-breach

text: 9. G. Dautovic. “Top 25 Financial Data Breach Statistics for 2020.” March 11, 2020. Fortunly. https://fortunly.com/statistics/data-breach-statistics#gref

text: 10. Davey Winder.“Data Breaches Expose 4.1 BIllion Records In First Six Months of 2019.” August 20,

text: 2019. Forbes. https://www.forbes.com/sites/daveywinder/2019/08/20/data-breaches-expose-41billion-records-in-first-six-months-of-2019/#40479be4bd54

text: 11. “Cost of a Data Breach Report.” 2019. Ponemon Institute – IBM. https://databreachcalculator.mybluemix.net/executive-summary/

text: 12. Troy Hunt. “The 773 Million Record “Collection #1.” Data Breach” January 17, 2019. Troy Hunt. https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/

text: 13. Lewis Morgan. “List of data breaches and cyber attacks in February 2019 – 873,919, 635 records leaked.” February 26, 2019. IT Governance. https://www.itgovernance.co.uk/blog/list-of-databreaches-and-cyber-attacks-in-february-2019-692853046-records-leaked

text: 14. Rae Hodge. “2019 Data Breach Hall of Shame: These were the biggest data breaches of the year.” December 27, 2019. CNET. https://www.cnet.com/news/2019-data-breach-hall-of-shamethese-were-the-biggest-data-breaches-of-the-year/

text: 15. Catalin Cimpanu. “Indian govt agency left details of millions of pregnant women exposed online.” April 1, 2019. ZDNet. https://www.zdnet.com/article/indian-govt-agency-left-details-ofmillions-of-pregnant-women-exposed-online/

text: 16. Shelby Brown. “DoorDash data breach affected 4.9M customers, drivers, merchants.” September 26, 2019. CNET. https://www.cnet.com/news/doordash-data-breach-affected-4-9million-customers-workers-and-merchants/

text: 17. Jessica Davis.“11.9M Quest Diagnostics Patients Impacted by AMCA Data Breach.” June 3, 2019. HealthITSecurity https://healthitsecurity.com/news/11.9m-quest-diagnostics-patients-impacted-byamca-data-breach

text: 18. Alfred Ng, Mark Serrels. “Capital One data breach involves 100 million credit card applications.” July 30, 2019. CNET. https://www.cnet.com/news/capital-one-data-breach-involves-100-millioncredit-card-applications/

text: 19. Shelby Brown. “Data breaches timeline: EasyJet cyberattack exposes over 9M people, and more.” May 19.2020. CNET. https://www.cnet.com/how-to/equifax-mgm-resorts-beyond-every-majorsecurity-breach-and-data-hack-update/

text: 20. Josh Taylor. “Major breach found in biometrics system used by banks, UK police and defence firms .” August 14.2019. The Guardian. https://www.theguardian.com/technology/2019/aug/14/major-breach-found-in-biometrics-systemused-by-banks-uk-police-and-defence-firms

text: 21. Guy Fawkes.“Report:Data Breach in Biometric Security Platform Affecting Millions of Users.” June 16, 2020. vpnMentor. ttps://www.vpnmentor.com/blog/report-biostar2-leak/

text: 22. “Cost of a Data Breach Report.” 2019. Ponemon - IBM Security. https://www.ibm.com/downloads/cas/ZBZLY7KL?_ga=2.148238199.1762516747.1577395260- 1128561362.1577395260

text: 23. Oscar Gonzalez. “Zynga data breach exposed 200 million Words with Friends players.” October 1, 2019. CNET. https://www.cnet.com/news/people-rarely-change-their-passwords-after-a-databreach-study-says/

text: 24. John E Dunn.“Adobe database exposes 7.5 million Creative Cloud users.” October 28, 2019. Naked Security. https://nakedsecurity.sophos.com/2019/10/28/adobe-database-exposes-7-5million-creative-cloud-users/

text: 25. “Insider Sold 68K Customer Records to Scammers: Trend Micro.” November 8, 2019. CISOMAG. https://www.cisomag.com/insider-sold-68k-customer-records-to-scammers-trend-micro/

text: 26. Catalin Cimpanu. “Dutch politician faces three years in prison for hacking iCloud accounts and leaking nudes.” December 3, 2019. ZDNet. https://www.zdnet.com/article/dutch-politician-facesthree-years-in-prison-for-hacking-icloud-accounts-and-leaking-nudes/

text: 27. Corinne Reichert. “MGM Resorts confirms data breach of 10.7 million guests.” February 19, 2020 https://www.cnet.com/news/mgm-resorts-confirms-data-breach-of-10-million-guest-accounts/

text: 28. “

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation).” April 27, 2016. European Parliament, Council of the European Union. https://eurlex.europa.eu/legal-content/EN/ALL/?uri=celex%3A32016R0679

text: 29. “AB-375 Privacy: personal information: businesses, Assembly Bill No. 375, Chapter 55.” June 29,

text: 2018. California Legislative Information. https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

text: 30. Shrub Chandrasekaran, Justin Fishman. “China’s Cybersecurity Future and its Impact on U.S. Business.” October 31, 2019. Jolt Digest. https://jolt.law.harvard.edu/digest/chinas-cybersecurityfuture-and-its-impact-on-u-s-business

text: 31. Reed Smith LLP.“MLPS 2.0: China’s enhanced data security multi-level protection scheme and related enforcement updates .” October 9, 2019. Lexology. https://www.lexology.com/library/detail.aspx?g=36c6932b-bf41-4e08-b430-e3bc839a2328

text: 32. “Data protection if there’s no Brexit deal.” September 13, 2018. GOV. UK, Department for Digital, Culture, Media & Sport. https://www.gov.uk/government/publications/data-protection-if-theres-nobrexit-deal/data-protection-if-theres-no-brexit-deal

text: 33. Eduardo Ustaran, “Brexit and data protection: Laying the odds.” September 21, 2018. Privacy Perspectives, iapp. https://iapp.org/news/a/brexit-and-data-protection-laying-the-odds/

text: 34. Ibrahim Hasan. “Data protection and Brexit.” September 5, 2016. Gazette. https://www.lawgazette.co.uk/legal-updates/data-protection-and-brexit/5057412.article

text: 35. Eric Dosal. “5 Tips to Prevent Data Leakage at Your Company.” March 15, 2018. Compuquip Cybersecurity.https://www.compuquip.com/blog/5-tips-to-prevent-data-leakage-at-your-company

text: 36. “10 ways to protect sensitive business data.” October 28, 2019. QuoStar. https://www.quostar.com/blog/10-tips-to-help-prevent-a-data-leak/

text: 37. “Annual Cybersecurity Report.” 2018. Cisco https://www.cisco.com/c/dam/m/digital/elqcmcglobal/witb/acr2018/acr2018final.pdf?dtid=odicdc000016&ccid=cc000160&oid=anrsc005679&ec id=8196&elqTrackId=686210143d34494fa27ff73da9690a5b&elqaid=9452&elqat=2

text: 38. “Cybercrime tactics and techniques: Q2 2018.” 2018. Malwarebytes Labs https://resources.malwarebytes.com/files/2018/07/Malwarebytes_Cybercrime-Tactics-and- Techniques-Q2-2018.pdf

text: 39. Mona Mangat.“81 Eye-Opening Data Breach Statistics for 2020.” January 27, 2020. phoenixNAP. https://phoenixnap.com/blog/data-breach-statistics

text: 40. “2020 Data Threat Report – Global Edition.” 2020. Thales Group. https://www.thalesesecurity.com/2020/data-threat-report

text: 41. Oscar Gonzalez. “Zynga data breach exposed 200 million Words with Friends players.” Pctober 1, 2019. C|net.https://www.cnet.com/news/words-with-friends-hack-reportedly-exposes-data-ofmore-than-200m-players/

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyberthreat intelligence in the EU. READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242 Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu