text: Position Paper of the EP3R Task Forces on Trusted Information Sharing (TF-TIS)

text: October 2013

text: Position Paper of the EP3R Task Forces on Trusted Information Sharing (TF-TIS) October 2013

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.

text: First few pages of ISO/IEC 27010 http://webstore.iec.ch/preview/info_isoiec27010%7Bed1.0%7Den.pdf

text: October 2013

text: ASIS: ASIS International (American Society for Industrial Security),http://www.asisonline.org/ 4 ISSA: Information Systems Security Association, https://www.issa.org/

text: Position Paper of the EP3R Task Forces on Trusted Information Sharing (TF-TIS) October 2013 Community: Private parties interested in participation in exercises. Multiple Sharing communities: Exist at EU/ENISA level. Supporting entity: ENISA is already acting in a coordinating role regarding exercises. Membership governance and control: Members have to actively participate in exercises, not just sit and listen. Information shared: Of the ten types of information shared in Annex B, Contingency planning is deemed the most relevant to this topic and community. Confidentiality and Anonymisation: Less important; some applicability to exercise results when a player has found interesting issues to improve, or lessons might be critical or embarrassing. 2.2.3.4 Critical Information Infrastructure Protection (CIIP) Primary objective of sharing: Share experience and knowledge on protecting the Critical Information Infrastructure (CII), especially at the European level; should be supporting multimember state or even EU-wide activities on CIIP such as risk assessments, impact analysis, good practices on protective measures, etc., in addition to and cooperating with national activities/projects. Community: Private and public parties who play or should play a role in protecting the CII, being prevention, preparation or response or alike; also maybe EU-wide associations representing a particular market sector (an example is electricity: national companies should be members and also their EU associations because those associations are carrying out CIIP activities too). Multiple Sharing communities: Exist at EU/ENISA level for some subjects; exists at national levels. Supporting entity: Could be ENISA because of EU wide contacts and overviews, of experience based on art13a incidents and of general expertise from ENISA studies. Membership governance and control: Based on stakeholder analysis for a certain CII (CII provider as well as “CII user”) Information shared: Of the ten types of information shared in Annex B, all ten are thought to be relevant to this topic and community: Experience, Advice; Alerts; Analysis; Contingency planning; Warnings; Other; Peer good practice, Incidents and vulnerabilities and Physical and Personnel. Confidentiality and Anonymisation: Same approach as national level, based on the combination of the seriousness of the risk / criticality of the CII different confidence levels/procedures should be used. Comment: None

text: October 2013

text: October 2013

text: October 2013

text: October 2013

text: October 2013

text: October 2013

identifier: Position Paper of the EP3R Task Forces on Trusted Information Sharing (TF-TIS)

nummer: tf-tis

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Position Paper of the EP3R Task Forces on Trusted Information Sharing (TF-TIS)

serie: rapporter

text: EP3R 2013 – Position Paper

type: rubrik

text: October 2013

type: stycke

text: European Union Agency for Network and Information Security www.enisa.europa.eu

text: EP3R 2013 – Position Paper

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: This Position Paper was prepared and developed by the following Experts: - Manuel Barros, Anacom - Fabio Bisogni, Formit - Peter Burnett, Quarter House Ltd - Genseric Cantournet, Telecom Italia - Simona Cavallini, Formit - John Harrisson, LandITd - David Pollington, Microsoft - David Sutton, Tacit.Tel - Simon Van Merkom, Ministry of Economic Affairs , Agriculture and Innovation - Reiner Wyphol, BnetZa – Bundesnetzagentur

text: Lionel Dupré, ENISA is the editor of this report.

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Page ii

text: EP3R 2013 – Position Paper

text: Legal notice

text: Copyright Notice

text: Page iii

text: EP3R 2013 – Position Paper

text: Executive Summary

text: Within the European Public Private Partnership for Resilience EP3R Task Forces (TFs) the Information sharing TF not only had a research purpose, but also aimed to lay the groundwork and define the requirements and topics of an information sharing approach. This approach aimed to deliver trusted relationships among participants of groups within EP3R and may also be a reference point for comparable initiatives.

text: The proposed approach is based on trusted relationships in groups sharing information in a remote mode. According to the new ISO/IEC 27010:2012 standard , a key component of trusted information sharing is a ‘supporting entity’, defined as “A trusted independent entity appointed by the information sharing community to organise and support their activities, for example, by providing a

text: source anonymisation service”

text: For this reason, the Task Force defines both management/process requirements and functional requirements of a potential online tool. Requirements that generally apply to communities engaging in trusted information sharing groups were selected according to the EP3R needs. The Task Force however ensured that the requirements wherever trusted information sharing is needed, e.g. for the work of the Working Groups of the NIS Platform.

text: In order to better tailor the generally applied requirements to EP3R, the Task Force also put a special effort into understanding what information needs to be shared, what sensitivity levels are involved and the professional profiles appropriate to participation in the sharing. A particular focus of this investigation was on topics of interest not only for the EP3R but also for the other communities dealing with security and resilience of ICT and protection of Critical Information Infrastructure (CIIs) in general.

text: It became evident during this work that it was crucial to identify a suitable ‘supporting entity’ to host and manage an online trusted information sharing system. The Task Force members were unanimous that ENISA was the most obvious and most suitable choice for this. It also became clear that ENISA’s remit might cause difficulties with adopting such a role, and that a suitable legal basis would be necessary to safeguard the privacy of any information shared through such a system. Nonetheless the TF felt that this was the best way forward, as no other existing entity was considered to be so suitable.

text: The key recommendations of this report are:

text: - To establish a pilot based on the Management and Functional Requirements listed in this document which usage will allow a more structured Information Sharing mechanism; - To designate a neutral party who will host and operate this platform. The Task Force estimated that ENISA could be an option to investigate; - To encourage the use of these requirements in other projects and communities.

text: Page 1

text: EP3R 2013 – Position Paper

text: 1 Introduction

text: In 2007 the European Commission (Information Society and Media Directorate-General) published the results of its commissioned ARECI (Availability and Robustness of Electronic Communications Infrastructures) study; this seminal report had a key recommendation on trusted sharing: “Member States and the Private Sector should establish formal means for sharing information that can improve the protection and rapid restoration of infrastructure critical to the reliability of communications within and throughout Europe”. At the June 2012 EP3R workshop, members suggested that the time is right to trial an electronic system specifically designed to facilitate Trusted Information Sharing amongst members of EP3R when face-to-face meetings are not viable. ENISA suggested that a small Task force should be created to make recommendations for a system, which would initially build on the existing (but limited) amount of trust between certain members who are familiar with each other, but will allow for the gradual extension of the group to new members. In this way, it will be possible to develop multiple Trusted Information Sharing groups within the EP3R membership, overlapping where appropriate. It is hoped that this mechanism will improve the commitment and productivity of EP3R members, and should be extensible beyond EP3R to related groups and topics.

text: 1.1 Goal

text: The task force was requested to consider a number requirements that would allow the gradual building of Trusted Information Sharing at Pan-European level. They are presented below, and organised between Management / Process requirements (as Principles), and Functional Requirements, should a technical platform be implemented one day to reduce the need for Face to Face meetings.

text: Information sharing was taken by the Task Force not as an end in itself, but initially as a means to build trusted relationships among EP3R participants.

text: The principles proposed are basic and obvious, but raising them within such a platform establishes a de-facto standard for existing and future pan-European partnerships.

text: 1.2 Target audience

text: This document not only addersses the needs of any PPP which needs to implement a remote (i.e. non face to face) trusted information sharing mechanism, but any other community with similar needs. A list of possible customer communities is presented later in the document.

text: 1.3 Structure of this document

text: This document first provides an analysis of the situation which was within EP3R, and how the need of information sharing arose as a horizontal topic. Since such an analysis would be useful in other contexts, the working group gradually expanded their considerations beyond the initial work objectives by analysing how it could benefit to other communities also. The document then provides a number of formal Management and Process requirements, complemented by a set of Functional requirements. Those requirements altogether form the foundations for a sound Trusted Information Sharing Platform.

text: Page 3

text: EP3R 2013 – Position Paper

text: 2 Identifying the Needs 2.1 Information Sharing as a means, not a Purpose

text: Several references and mentions were made during the analysis phase about the other work developments made in this area (See References at the end of this document). This report actually uses many of the recommendations and issues contained in ENISA’s Good Practice Guide on Information Sharing and instantiates many basic principles into actionable ones. The Task Force stresses that while Information Sharing is a foundation for any Partnership, it is not a goal: the purpose is to implement applied Information Sharing on many topics, and the other EP3R Position Papers actually built up on the assumption that Information Sharing mechanism would be ready in 2014 to complement face-to-face meetings. Such a platform was also seen as a condition sine qua non for the sharing of more and more useful information. The value of such platform could even drive more people to consider the supported PPP as a valuable service, solely because of the trust building features associated.

text: 2.2 Topics and Communities

text: Although there are many common principles and requirements for Trusted Information Sharing, as described in ISO/IEC 27010:2012, it is important to understand, from an EP3R perspective, what information needs to be shared, what the sensitivity levels of the information that need to be shared are (if we assume we should not share highly sensitive information) and who will participate in the sharing. This will help in the creation and validation of the requirements for Trusted Information Sharing.

text: This section identifies specific Topics and Communities for sharing within any CIIP opportunities at a European level. This includes suggested future topics and communities, identified by the members of the Task Force.

text: 2.2.1 Initial Topics and Communities

text: The EP3R (to mid-2012) was divided into four Working Groups (WGs). This structure has encountered problems where some members have interests in several areas but are unable to engage in parallel workshops based on WG lines. The structure has been revised, and a less rigid format has been adopted, but conflicts of interest will still occur. It is believed that an electronic trusted group model will significantly mitigate this. It can also help to address the fundamental issues affecting all WGs. These include inconsistent and fluctuating attendance (due to availability) at teleconferences and workshops that affected the opportunity to build stable professional and personal relationship. As a consequence this led to the inhibition to share sensitive information due to the presence of untrusted and unknown members in a teleconference or workshop. This has made it very difficult to build trust due to the high turnover of the participants to face to face and even telephone meetings.

text: Page 4

text: EP3R 2013 – Position Paper

text: The membership of virtual Task Forces can be tightly controlled, and the dissemination of any sensitive information can be completely controlled by its author, thus helping to build trust.

text: The following eight headings help categorise the experience of the former EP3R.

text: Primary objective of sharing: The objectives of the three initial groups were specified by the Commission with the expectation that the output would add value to the membership as well as feed into the European Commission strategy and regulatory policy. These groups have run over several years as it has been difficult for members to agree the true objectives partly because it has been difficult to engage with a consistent community with only a few meetings a year.

text: Community: The former EP3R community included public and private sector, telecom operators and ISPs, hardware/software vendors, regulators and consultants. Consistent representation from this diverse community has been difficult at times partly because of conflicts with diaries for meetings. Diverse representation has also made it difficult to focus on the real issues and deliver useful outputs.

text: Multiple Sharing communities: For most of the life of the initial groups, face to face meetings have been held in parallel sessions, which make it difficult for an individual to be involved in more than one WG. Plenary sessions allow communication of findings but it is still not easy for those not in the WG to make a contribution.

text: Supporting entity: Moderators for each group have been introduced during the last two years, which has helped bring better focus on the activities. These moderators have helped to build trust within each group.

text: Membership governance and control: In EP3R, group membership was open to all, with no control over how information is shared at meetings other than a verbal agreement in some meetings to adopt the ‘Chatham House Rules’. There is a closed online portal for members but anyone who attends meetings is given a login identity and password for access.

text: Information shared: Of the ten types of information shared that are listed in Annex B, five have been observed in existing WGs: Advice; Analysis; Other; Peer good practice and some aspects of Contingency planning.

text: Confidentiality and Anonymisation: This is not possible with the current open community and consequently the output of the WGs will be at a highly generic level.

text: Comment: In 2011, ENISA changed the structure of EP3R and move away from large long-term groups to small rapid action Task Forces with clearer objectives and addressing many of the issues described in the above headings.

text: 2.2.2 Incentive for extension to other topics

text: Since Information Sharing was the major concern in the recent developments within several communities, the idea of the Task Force was to derive a list of requirements possibly applicable in other areas too.

text: Page 5

text: EP3R 2013 – Position Paper

text: 2.2.3 Suggested Future Topics and Communities

text: 2.2.3.1 Article 13a

text: ENISA recently implemented a web-based tool for the reporting of Incidents in the context of the Article 13a obligation. It relates closely to other recommendations raised in the Task Force on Incident Management. Its purpose is to share solely relevant internal emergency procedures, contact details, and incident detection specifications among CII operators to support the other Management Requirements.

text: Primary objective of sharing: This community would address the compliance needs of National Regulatory Authorities (NRAs), operators and service providers working within the scope of Article 13a.of directive

text: Sharing of findings on practical matters regarding “developing” measures, application of measures; enforcement experiences; sharing of statistics on incidents.

text: Community: This would be a closed community of telecom operators and regulators from Member States (MS) who have a duty of compliance with

text: Article 13

text: a.

text: Multiple Sharing communities: Some of these already exist at the National and European levels.

text: Supporting entity: These are appointed contacts at the National level, Regulators as well as operators (which could be operator associations or similar); ENISA at the European level.

text: Membership governance and control: These functions are key to meeting the primary objective. A possible option is that ENISA takes care of this as it is more neutral than a Member State or operator - a similar process is in use for the ENISA portal.

text: Information shared: Of the ten types of information shared in Annex B, seven are thought to be relevant to this topic and community: Experience, Advice; Analysis; Other; Peer good practice, Incidents and vulnerabilities and some aspects of Contingency planning.

text: Confidentiality and Anonymisation: These features are key to meeting the primary objective. ENISA as a central focal point could anonymise information or data and store it in a secure way. Application of a formal information classification scheme might not work because operators should then need to have employees screened up to a specified clearance level, which could exclude some members . The Traffic Light Protocol (TLP) might be a way forward, but it would be necessary to identify a mechanism to ensure that the confidentiality of TLP-marked information was not compromised through Freedom of Information (FoI) provisions. Anonymisation of the source is done by the National Regulatory Authority (NRA) when sharing at the European level.

text: Comment: Much of the information relating to

text: article 13

text: a in its raw state is likely to be sensitive and therefore must be protected accordingly. At the European level there is less concern about naming and shaming, as the NRA protects the source at the national level by providing anonymity. There is a good level of trust between NRAs across member states with transparency preferred amongst users of any platform.

text: Page 6

text: EP3R 2013 – Position Paper

text: 2.2.3.2 ‘Black Swan’ risks

text: Primary objective of sharing: This community would address the risks associated with high impact low probability events, also known as ‘Black Swan’ events, which relate to the security and resilience of the telecommunications network at the European level.

text: Community: This consists of both Public and Private parties who are closely related to the “scope” and ”environment” of the risk; so this could lead to several communities each related to a certain Black Swan. Security directors for the private sector and officials for the Public; CIIP owners and service providers, and National Competent Authorities.

text: Multiple Sharing communities: Potentially with other sector based communities such as 3 4 professional Information Security associations e.g. ASIS , ISSA etc.

text: Supporting entity: Each Black Swan could be coordinated by either the party which is likely to be most involved when the risk comes to fruition, or the party which has most expertise about the risk. Appointed contacts in either of the two parties above, at the National level; ENISA at the European level.

text: Membership governance and control: High level supplied credentials are needed; existing members will introduce a new member. This could be modeled on a University Scientific Board, such as the one created in Italy about Economic Intelligence.

text: Information shared: Of the ten types of information shared in Annex B, all ten are deemed relevant to this topic and community: Experience, Advice; Alerts; Analysis; Contingency planning; Warnings; Other; Peer good practice, Incidents and vulnerabilities and Physical and Personnel.

text: Confidentiality and Anonymisation: High confidentiality is required. The need for anonymity may be less because there is only a small group dedicated to each Black Swan, and it is in the interest of that specific group that the risk/threat/problem of “their” Black Swan is solved without much (media/parliamentary) attention. Another view is that it is not necessary because of the low likelihood which appears as unrealistic.

text: Comment: This is an important topic, particularly because it is not evident that it is being fully addressed elsewhere. Black Swans are not a specific category to be dealt with apart but the extreme part of the spectrum/continuum of threats.

text: 2.2.3.3 Exercises

text: Primary objective of sharing: Share experience and knowledge on exercises (private only, or private and public) , include scenarios ; also private parties which are member of the community might coordinate who of the private parties will participate in which exercise as player or as a simulation cell.

text: Page 7

text: EP3R 2013 – Position Paper

text: 2.2.3.5 Cybersecurity / Crime information exchange

text: Primary objective of sharing: EU equivalent of UK NISCC/CPNI and NL CPNI.nl.

text: Page 8

text: EP3R 2013 – Position Paper

text: Community: Public parties active in research on cybercrime/cybersecurity and in fighting cybercrime and private parties who have to implement the operational measures to fight cybercrime or who provide services/infrastructure which is used by cybercriminals. Multiple Sharing communities: Exists at the national level in some Member States. Supporting entity: Could be ENISA because of EU wide contacts and overviews, of experience based on art13a incidents and of general expertise from ENISA studies. Membership governance and control: Based on stakeholder analysis by national authorities include “credentials”. Information shared: Of the ten types of information shared in Annex B, seven are deemed relevant to this topic and community: Experience, Advice; Analysis; Other; Peer good practice, Incidents and vulnerabilities and Physical and Personnel. Confidentiality and Anonymisation: Same approach as national level, (CPNI-like approach).

text: Page 9

text: EP3R 2013 – Position Paper

text: 3 Implementing an Online Trusted Information Sharing System 3.1 Translating into Formal Requirements

text: 3.1.1 Purpose

text: At the early stages of the Task Force’s discussions, a number of concerns were raised by participants which led to consider the problem from a Functional Analyst’s standpoint. It became progressively obvious that the position paper produced by the Task Force would take the form of a list of requirements.

text: 3.1.2 Benefits

text: Listing requirements was a rapid way of establishing the features and rules that should be imposed on a proper Trusted Information Sharing platform. Other methodologies would have taken considerably longer, and possibly not left enough flexibility of implementation in the end.

text: 3.1.3 Management/Process Requirements

text: The following list of requirements has been found to generally apply to communities engaging in Trusted Information Sharing. M/PR1 The primary objectives for sharing information within the group should be identified and published. These objectives should emphasise the benefits of sharing in order to promote participation. M/PR2 The type of information that should be shared in order to achieve the objectives should be identified. M/PR3 Existing sharing standards should be identified and used where possible in order to speed agreement and implementation. M/PR4 A procedure for anonymising shared information is required. M/PR5 An agreement is required defining how the information shared can be used by the recipients. (For example using the Traffic Light Protocol). M/PR6 In order to support anonymisation, and to manage membership and chairmanship of the trusted sharing community, a trusted third party may be required. M/PR7 An agreement will be required to establish the ownership of shared information, and the rights of contributors to control the sharing of supplied information. M/PR8 It will be necessary to define the membership criteria for a sharing community. It may be necessary to implement more than one sharing community. M/PR9 For each sharing community the method of identifying potential members should be established, along with the processes for joining and leaving. M/PR10 Technical controls should be employed that are appropriate to the sensitivity of the information exchanged, for example, encryption may be required if the information must not be revealed outside the sharing community. M/PR11 Where information is anonymously contributed, it must be possible for the sharing community to be given confidence in the quality and source of the information, while

text: Page 10

text: EP3R 2013 – Position Paper

text: maintaining the anonymity of the originator. M/PR12 Guidance should be provided to members of the EP3R sharing community, defining their responsibilities when handling shared data. M/PR13 A commitment to sharing is required in order to remain a member of a particular community. M/PR14 A mechanism for appropriate legal measures such as NDAs may be required to protect the interests of those sharing some information. M/PR15 A mechanism for extending trust between trusted sharing communities must take account of each communities trust requirements. M/PR16 A mechanism should exist for optional association so that groups with related interests can be linked together for information exchange. M/PR17 A mechanism should exist to protect the identity of sharing group members when required.

text: Page 11

text: EP3R 2013 – Position Paper

text: 3.1.4 Purpose

text: In order to support the Management/Process Requirements identified above, a technical solution for Trusted Information Sharing must fulfil the following functional requirements. Each requirement in this section is cross-referenced to the Management/Process requirements where possible.

text: 3.1.5 Functional Requirements

text: FR1 The solution must facilitate the automated flow of information between [M/PR1, M/PR2, and among public and private sector entities in a timely, consistent, and M/PR15, M/PR16, predictable manner within a trusted environment, where information is M/PR17] received, disseminated, analysed, and protected appropriately FR2 The solution must establish clear roles and responsibilities to help all [M/PR5, M/PR12] members know how they fit into the information sharing landscape FR3 The solution must be scalable both in terms of accommodating several [M/PR2, M/PR8, potentially overlapping sharing communities, incorporating additional M/PR9, M/PR15] users/contributors from any geographical location, and in terms of the format and content of information to be shared FR4 The solution must include a highly intuitive interface, be simple to use [M/PR12] and to navigate through and be sufficiently flexible in its user interface to be personalized to suit individual users or user groups FR5 The solution should be able to provide metrics to determine who are the [M/PR13] major contributors and consumers of shared information FR6 The solution must allow users to search for and retrieve contact details [M/PR6, M/PR7, for authorized users, where permitted M/PR8, M/PR17] FR7 The solution must specifically support the anonymisation of shared [M/PR4, M/PR6, information, by providing a sharing workflow that involves a trusted third M/PR11] party or supporting entity FR8 The solution must provide appropriate operational and technical [M/PR10] capabilities to protect and secure data to ensure the integrity, availability and confidentiality of all information FR9 The solution should allow originators of information to assign a degree of [M/PR5, M/PR12, trust in the data and information they input M/PR13] FR10 The solution must ensure that all users will be uniquely identified and [M/PR9, M/PR10] authenticated before being given access FR11 The solution must ensure that all information is appropriately protected [M/PR10, M/PR17] from unauthorized access, including at system administration level FR12 The solution should allow for the examination of audit data (logs) via an [M/PR12, M/PR13] auditing mechanism that can determine whether actions performed by users meet the policy requirements of membership and can hold users accountable for their actions by recording what they do FR13 The solution must allow for the archiving of data to match the expected [General] life-cycle of the system, with full backup and restore facilities being

text: Page 12

text: EP3R 2013 – Position Paper

text: provided

text: FR14 The solution should allow for a graduated uptake of collaboration, [M/PR1, M/PR2, including a set of basic features (for quick uptake by users) and more M/PR3] advanced capabilities for users more experienced with secure collaboration FR15 If the membership is split into multiple sharing communities, the solution [M/PR8, M/PR15] should allow users of one community to be able to share information with members of others, either through a trusted moderator or directly FR16 The system should be universally accessible from all major web browsers, [General] via the Internet

text: Page 13

text: EP3R 2013 – Position Paper

text: 4 Observations and Next Steps

text: During the creation and review of this requirements document for Trusted Information Sharing, a number of important observations and recommendations were made by Task Force members, which are listed in this section. [References to other parts of the document are shown in square parenthesis] a) Effective trusted information sharing across organisations, companies, and countries will depend on the availability of a system to enable sharing and that the participants have trust in the hosting of the system. [FR8, FR11]; b) There should be an analysis of available information sharing systems against the requirements contained within this document. The Commission has a few trusted communication systems available, e.g. CIWIN implemented under EPCIP and the ENISA LISTSERV and Resilience Portal which should be included in the analysis. [Annex A, Deliverable 2]; c) Careful consideration should be given to the inclusion of regulators in trusted sharing groups to balance the benefits with possible conflicts of interest. [M/PR8] d) ENISA is suggested as the ‘supporting entity’ – see 3.1.They have already gained some experience; they have contacts in public and private sector. Organizing by a third party or an administration or operator could lead to lack of confidence or maybe activities with good intentions but which lie outside the scope of the structure; e) In addition to a trusted information sharing system (see a) there should be consideration given to the provision of a trusted voice, video and application collaboration mechanism; f) There should be a trial of this system to prove the benefits and refine the requirements using topic(s) identified in section 5.2; g) Standards should be investigated and applied where appropriate (e.g. 270## series and possibly 28001); membership and governance rules will be needed as a foundation and framework to make this happen and it is recommended that ISO/IEC 27010:2012 is studied in detail to produce a compliance statement on its suitability. Other standards should also be studied such as ISO/IEC DIS 29147 – Security techniques - Vulnerability disclosure to avoid any potential conflicts of interest. h) The trusted information system is not intended to handle national or EU classified information; i) The application of this trusted information system can be extended outside of EP3R and could include CERTs. [Annex A- Scope of Task Force]; j) A ‘terms of reference’ document should be created to bring together the management and process requirements for each trusted sharing community addressing specific topics. This may include legal protection provision for the information being shared; k) The trusted information system is not intended to be used for real time incident handling; l) The CIIP topic 5.2.4 should be broken down into sub-topics suitable to trusted information sharing groups of appropriate size homogeneity; m) There are significant reservations about the inclusion of cyber-crime within the scope of the trusted information sharing system, which is not intended to hold sensitive cyber-crime

text: Page 14

text: EP3R 2013 – Position Paper

text: information. This document has not specifically addressed the requirements of the law enforcement community related to cyber-crime; n) In the consideration of ISO/IEC 27010:2012 principles, consideration should be given to the emerging draft standard ISO/IEC DIS 29147 – Security techniques - Vulnerability Disclosure.

text: Page 15

text: EP3R 2013 – Position Paper

text: Recommendations EP3R-TF-TIS 201301 – ENISA should Implement a System Trial using the Functional and Management Requirements defined in this Position Paper

text: As described in this Position Paper, the EP3R Task Force on Trusted Information Sharing evaluated a number of Functional and Management Requirements which form altogether a consistent Functional Analysis for an Online Trusted Information Sharing Platform.

text: The Taskforce recommends the establishment of a Trial of such platform, and evaluate how a wider implementation could be done at a later stage. The purpose of such trial would be threefold: ● Assess technical implementation feasibility; ● Provide a usable pilot and assess usability of such pan European mechanism; ● Assess Participants buy-in and how trust was established between them. The Task Force identified ENISA as a ‘Supporting Entity’, notion which is defined in the ISO Standard 27010:2012, and therefore recommends that ENISA implements this pilot and runs this trial.

text: EP3R-TF-TIS 201302 – PPPs should consider the adoption of these requirements for Online Trusted Information Sharing

text: These requirements were initially drafted based on the observations made in the late EP3R, but also on the PPPs studied during the study on Cooperative Models for Effective Public Private Partnerships . Those requirements have been made generic enough to be easily adapted to different situations, and therefore the Task Force recommends that European PPPs implement these requirements also for any new Trusted Information Sharing, or adopt a platform which presents these characteristics.

text: EP3R-TF-TIS 201303 – Trusted Information Sharing for Incident Preparedness, Early Warning, Management and Post-Mortem

text: Discussions in the EP3R Task Force on Incident Management raised the needs for establishing Trusted Information Sharing to implement the systematic exchange of Incident Preparedness data, such as contact data, roles and responsibility, Emergency procedures, etc.

text: The Task Force on Trusted Information sharing again recommends that the Requirements listed in this paper are implemented on the platform used.

text: Page 16

text: EP3R 2013 – Position Paper

text: Conclusions

text: A key component of trusted information sharing is identified in the ISO/IEC 27010:2012 standard as being the need for a ‘supporting entity’, defined as:

text: “A trusted independent entity appointed by the information sharing community to organise and support their activities, for example, by providing a source anonymisation service”

text: The Task Force members recommend that ENISA is the supporting entity and operates such a platform.

text: An effective trusted information sharing mechanism will be dependent upon the right people in the right roles with the right empowerment to represent their organisations and all within a predefined and authorised exchange process. Membership and Governance rules will be needed as a foundation and framework to make this happen and it is recommended that ISO/IEC 27010:2012 is studied in detail to produce a compliance statement on its suitability. Other standards should also be studied such as ISO/IEC DIS 29147 – Security techniques - Vulnerability disclosure to avoid any potential conflicts of interest. To move the objectives of the Task Force forward the suggestion to hold a trial (Recommendation EP3R-TF-TIS 201301) should be actively pursued as this will help determine the true requirements. This trial should be conducted as part of the requirements phase of the Task Force and is not dependent on the other activities previously.

text: Page 17

text: EP3R 2013 – Position Paper

text: References

text:  ISO/IEC 27010: http://webstore.iec.ch/preview/info_isoiec27010%7Bed1.0%7Den.pdf  Trusted Information Sharing: Why would I tell you ? Perceived Influences for Disclosure Decisions by Senior Professionals: in Inter Organisation Sharing Forums http://www.warp.gov.uk/downloads/Why-would-I-tell-you.pdf  Tools to build Trust: http://www.warp.gov.uk/building-trust.html .  IAAC: A review of Information Sharing: http://www.warp.gov.uk/downloads/IAAC%20NISCC%20Sharing%20is%20Protecting%20v21 .pdf  ASIS: ASIS International (American Society for Industrial Security), http://www.asisonline.org/  ISSA: Information Systems Security Association, https://www.issa.org/

text: Related ENISA papers

text:  Good Practice Guide on Information Sharing: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/public-privatepartnership/information-sharing-exchange/good-practice-guide  Cooperative Models for Effective Public Private Partnerships: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/public-privatepartnership/national-public-private-partnerships-ppps

text: Page 18

text: EP3R 2013 – Position Paper

text: Annex A: Tasking Brief for EP3R TF1 - Trusted Information Sharing Mechanisms A.1 Background

text: It has been recognised for some time that Public-Private Sector Partnerships need to create an environment for trusted information sharing if they are to add real value to their membership and improve CIIP. ENISA has produced a number of good practice guides on how to create and run these co-operative environments . EP3R is no exception, and at the Brussels workshop of 6 June 2012, a number of participants requested action to create this environment and start trusted information sharing. The purpose of this document is to set out the requirements for an Information Sharing Task Force that will move this proposal forward. This Task Force will create a proposal for a practical application of trusted information sharing mechanisms for use by EP3R.

text: A.2 Scope of task force

text: The task force will: ● Address the needs of EP3R participants for trusted information sharing in order to deliver the mission of EP3R both now and in the future. ● Take account of existing initiatives in the field of Information Sharing ● Take account of possible future directions for EP3R and its relationship with EFMS. ● Look at the requirements for effective sharing of information by EP3R participants, including the need for confidentiality and anonymity while at the same time addressing the need to make EP3R open and transparent. Striking the right balance between these two aspects is seen as a crucial element of the scope. ● Take account of CIIP trusted sharing opportunities outside of EP3R, in any recommendations made.

text: A.3 Approach of task force

text: The task force will include EP3R moderators, and will make use of the extensive experience in trusted information sharing mechanisms of other members of EP3R. They will engage with a carefully selected group of active EP3R participants from both a public and private sector background who are known to share common issues with a strong interest in trusted information sharing.

text: A.4 Deliverables

text: 1. A list of collective requirements for trusted information sharing in EP3R will be drawn up by the task force, including potential sharing communities and associated topics for trusted sharing.

text: 2. Existing trusted information sharing mechanisms would be studied and documented.

text: 3. The resulting list of mechanisms will be compared to the collective requirements of the task force members to ensure that any proposal is requirements-led.

text: 4. A proposal with justifications will be made, recommending the most appropriate sharing mechanism. In this context, the ‘sharing mechanism’ will address the trust framework of

text: Page 19

text: EP3R 2013 – Position Paper

text: membership, governance, platform and standards for sharing (e.g. ISO 27010:2012), suitable for the wide range of existing EP3R participants.

text: A.5 Timescale

text: The above approach will create a small homogeneous motivated task force capable of delivering a high quality proposal in a 6 months timescale.

text: Page 20

text: EP3R 2013 – Position Paper

text: Annex B: Extract from ENISA Good Practice Guide – Network Security Information Exchanges

text: What information is shared ? Information that might usefully be shared in NSIEs would include: incidents, product technical vulnerabilities and risks, protocol vulnerabilities, network intrusion information, probing attacks and network configuration issues within standards. To maintain trust NSIEs need to be very sensitive in approaching commercially sensitive issues such as quality of service and availability, which are seen by some private sector members as having significant competitive advantage. Forcing detailed disclosure of such information, for instance, could seriously damage relationships, and in some countries may be considered illegal if industry members could be considered setting up a cartel. The following descriptions of what is shared have been observed: 1. Experience - Sharing experience on threats, attacks, counter measures, response, cooperation, etc; 2. Advice - Advisory support in implementing protective measures; 3. Alerts - Alert service on attacks and incidents; 4. Analysis - Information on cyber security, analysis on threats, risks, impact and vulnerabilities, incidents, security measures, etc;

text: 5. Contingency planning - Information on contingency planning, analysis on threats, risks, impact and vulnerabilities, on single point of failures, dependencies, crisis management arrangements, incidents, exercises, etc;

text: 6. Warnings - Everything from security advisories to warnings and best practices;

text: 7. Other - Any type of information which is deemed interesting and valuable in order to support increasing the NSIE members information security, is collected, disseminated and shared;

text: 8. Peer good practice;

text: 9. Incidents and vulnerabilities and also discussions around good practices and recent trends and developments;

text: 10. Physical and Personnel - Information, physical and personnel security information is collected from a wide range of sources.

text: Page 21

text: EP3R 2013 – Position Paper

text: ENISA

text: Athens Office

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu Page 22 www.enisa.europa.eu


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: World Economic Forum, The Global Risks Report 2016 - 11th Edition, pg. 11.

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 1: Data Time Frame

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 2: CII sectors affected

text: European studies Non-European studies 9 9 8 8 7 6 6 5 5 5 4 4

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 3: Incident taxonomy

text: EU STUDIES NON EU STUDIES

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 4: Average economic impact of cybercrime per organisation (millions) [16]

text: Pound = 1.3871 €; 1 Dollar = 0.90503 € and 1 Rubble = 0.01422 € Exchange rate date as of 27/10/15

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Table 1: Cybercrime as a percent of GDP [8]

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 5: CII sectors affected (same as 2)

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 6: Average annualized cost by industry sector (millions) [16]

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 7: Threats identified within the studies (same as Fig. 3)

text: EU STUDIES NON EU STUDIES

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 8: Attack/Threat types per CII sector (graphical view of Table 2)

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Table 2: Attack/Threat types per CII sector

text: Number of studies per sector

text: n o ti e al rt y h o r ac try lic tra lt ci d is b Ts sp te sp o Nr. Attack / Threat is erg an u ea IC n P in n Fo em En H Wa ero h m Fi Tra C A d A

text: Malware 7 10 7 9 9 7 1 1 1 1 2 DoS/DDoS 10 8 8 11 11 8 1 1 1 ̶ 3 Cyber Espionage 2 3 3 3 2 1 1 1 ̶ 1 4 Web-Based Attacks 5 7 4 7 7 6 ̶ 1 1 ̶ 5 Insider Threat 7 4 6 8 7 3 ̶ 1 1 ̶ 6 Hacktivism 3 3 3 5 4 ̶ ̶ 1 1 1 7 Malicious Code 5 6 5 7 7 6 ̶ ̶ ̶ ̶ 8 Phishing 6 4 4 6 6 4 1 ̶ ̶ ̶ 9 Web Application Attacks 5 2 4 4 4 2 1 ̶ ̶ ̶ 10 Ransomware 3 1 3 2 2 1 1 ̶ ̶ ̶ 11 Botnets 1 2 2 2 2 2 ̶ ̶ ̶ ̶ 12 Critical Vulnerabilities 1 1 1 ̶ ̶ 1 1 ̶ ̶ ̶

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 8: Percentage of annualized cybercrime cost, by attack type [16]

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 9: Percentage annualized cybercrime cost, by attack type [16]

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Figure 10: Assets affected

text: EU studies International 7

text: DATA OTHER INTELECTUAL PROCEDURES EQUIPMENT PROPERTY AND PROCESS DAMAGE

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Table 3: List of qualitative mandatory and non-mandatory criteria

text: Nr. Type Name DESCRIPTION

text: Mandatory Time Frame Only studies ranging from 2013 to 2015 will be considered.

text: Mandatory At least one of the following CII sectors must be included in the study: 1. Energy 2. Information, Communication Technologies (ICT) 3. Water 4. Food

text: Health 2 CIIs Sector 6. Financial 7. Public & Legal Order and Safety 8. Public Administration 9. Transport 10. Chemical and Nuclear Industry 11. Space Industry The above list inspired by ENISA’s document Methodologies for the identification of Critical Information Infrastructure assets and services.

text: Mandatory The study had to contain details on the economic impact of cyber-security 3 Economic Data/Costs incidents, including details related to the cost of incidents.

text: Mandatory The study must contain information on at least one of the incident types below, inspired by ENISA’s 2015 Threat Landscape:

text: Malware (Worms / Trojans). 2. Web-based attacks (drive by downloads). 3. Web application attacks / injection attacks. 4. Denial of Service (DoS) or Distributed Denial of Service (DDoS). Incident 4 5. Phishing. type/Attack/Threat 6. Insider threat. 7. Cyber espionage. 8. Ransoware / Rogueware / Scareware / Crimeware. 9. Hacktivism. 10. ICS/SCADA hacking. 11. Critical vulnerabilities (heartbleed, SS7, SSL, shellshock). 12. Physical damage/ theft / loss.

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Mandatory The study must provide details on what the incidents have affected in terms of 5 Incident Result confidentiality (ex. data breaches), integrity (ex: physical damage) or availability (ex: DDoS).

text: Focus on Europe would be most welcomed, but other international studies 6 Non-mandatory Geographical coverage were also accepted.

text: Non-mandatory Assets affected Details about types of assets affected would be most welcomed.

text: Cost Computing 8 Non-mandatory Details on how incident costs were determined would be most welcomed. Methodology

text: Non-mandatory Type of cost Details on types of costs taken into account would be most welcomed.

text: Details about incident response specialised staff (level of training etc.) would be 10 Non-mandatory Staff Profile most welcomed.

text: Policies/Procedures/M Details regarding the security measures in place within the participating 11 Non-mandatory easures organisations would be most welcomed.

text: Data collection 12 Non-mandatory methodology (sources, Details about how data was collected would be most welcomed. selection, extraction)

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: Country in which No. Name of study Source Year Geographical coverage Responders the study was developed

text: CYBER-ATTACKS: OXFORD 1 EFFECTS ON UK 2014 United Kingdom 427 United Kingdom ECONOMICS COMPANIES

text: GLOBAL THREAT 2 NTT GROUP 2015 Worldwide - Japan INTELLIGENCE REPORT

text: INFORMATION PWC AND

text: SECURITY BREACHES INFOSECURITY 2015 United Kingdom 664 United States

text: SURVEY EUROPE

text: DATA BREACHES IN CEU SCHOOL OF 4 2014 Europe - Hungary EUROPE PUBLIC POLICY

text: 2014 GLOBAL REPORT PONEMON 5 ON THE COST OF CYBER 2014 Worldwide 257 United States INSTITUTE BY HP CRIME

text: 2015 COST OF DATA PONEMON 6 BREACH STUDY: 2015 Worldwide 350 United States INSTITUTE BY IBM GLOBAL ANALYSIS

text: 2014 DATA BREACH

text: INVESTIGATIONS VERIZON 2014 Worldwide 50 United States

text: NET LOSSES:

text: ESTIMATING THE 8 MCAFEE 2014 Worldwide - United States GLOBAL COST OF

text: 2014 COST OF CYBER PONEMON 9 2014 United Kingdom 38 United States CRIME STUDY: UK INSTITUTE

text: 2014 COST OF CYBER PONEMON 10 CRIME STUDY: 2014 Germany 46 United States INSTITUTE GERMANY

text: 2014 COST OF CYBER PONEMON 11 2014 France 29 United States CRIME STUDY: FRANCE INSTITUTE

text: 2014 COST OF CYBER PONEMON 12 CRIME STUDY: RUSSIAN 2014 Russian Federation 24 United States INSTITUTE FEDERATION

text: ENERGY MARKET 13 WILLIS LIMITED 2014 Worldwide 557 United Kingdom REVIEW

text: The cost of incidents affecting CIIs

text: AUGUST 2016

text: 2013 COST OF CYBER PONEMON 14 CRIME STUDY: UNITED 2013 United States 60 United States INSTITUTE STATES

text: ISTR20 INTERNET 15 SECURITY THREAT SYMANTEC 2015 Worldwide 157 United States REPORT

text: 2015 COST OF CYBER PONEMON 16 2015 Worldwide 252 United States CRIME STUDY: Global INSTITUTE BY HP

text: 2015 DATA BREACH 17 INVESTIGATIONS VERIZON 2015 Worldwide 70 United States REPORT

text: The cost of incidents affecting CIIs

text: AUGUST 2016

identifier: The cost of incidents affecting CIIs

nummer: the-cost-of-incidents-affecting-ciis

title: The cost of incidents affecting CIIs

text: Systematic review of studies concerning the economic impact of cyber-security incidents on critical information infrastructures (CII) AUGUST 2016 About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Dr. Dan TOFAN (ENISA) Mr. Theodoros NIKOLAKOPOULOS (ENISA), Ms. Eleni DARRA (ENISA)

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: The analysis in this document was produced in collaboration with EVERIS SPAIN and based on the input of the following experts: Jose VALIENTE ( General Manager and Manager of Coordination and Communication at the Industrial Cybersecurity Centre), Marcos GOMEZ HIDALGO (Operations Deputy Director Spanish National Cybersecurity Institute), Gabriel BASSETT (Senior Information Security Data Scientist Verizon), John MARC SPITLER (Senior Risk Analyst, Verizon), Suzanne WIDUP (Senior Information Security Professional, Verizon).

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2016 Reproduction is authorised provided the source is acknowledged.

text: ISBN: 978-92-9204-173-1 | doi: 10.2824/475621

text: Table of Contents

text: Executive Summary 4

text: 1. Introduction 7

text: 1.1 Background 7

text: 1.2 Scope of the document 7

text: 1.3 Target audience 8

text: 1.4 Project Methodology 8

text: 2. About the studies analysed 9

text: 2.1 Time frame 9

text: 2.2 Data collection (data sources, data selection, data extraction) 9

text: 2.2.1 Data sources 9 2.2.2 Data extraction 10

text: 2.3 Geographical coverage 10

text: 2.4 Methodologies used for determining economic impact 10

text: 2.5 CII sectors affected 11

text: 2.6 Types of incidents (taxonomy) 12

text: 3. Findings based on the content of the studies 13

text: 3.1 Findings related to the economic impact 13

text: 3.1.1 Overall losses recorded in European Union 14 3.1.2 Overall losses recorded by international studies 15

text: 3.2 Findings related to CII sectors 15

text: 3.2.1 Most affected CII sectors 15 3.2.2 Overall losses per CII sector 17

text: 3.3 Findings related to incident types 18

text: 3.3.1 Overall common threat 18 3.3.2 Specific threat per CII sector 18 3.3.3 Average cost per threat type 20

text: 3.4 Findings related to affected assets 23

text: 3.5 Conclusions from the studies 23

text: 4. Conclusions and recommendations 25

text: Annex I – Methodology description 27

text: Annex II – Analysed studies 29

text: Annex III - References and bibliography 31

text: Executive Summary

text: Critical Information Infrastructures (CIIs) provide resources upon which several functions of society depend. A potential unavailability of these, would have a debilitating effect on the security, economy and health of society as a whole. Cyber security incidents affecting CIIs are considered nowadays global risks that can have “significant negative impact for several countries or industries within the next 10 years” . As more and more businesses/industries benefit from the advantages of information technology, by witnessing a tighter cyberphysical systems integration, developed under concept like Internet of Things, cyber-attacks or incidents affecting those infrastructures are increasing dramatically, resulting in a new chapter in information security; one that can be called Security of Things. While modern economies rely on the newly developed cyber infrastructures, assuring their security has become the main priority of many actors (governments, companies etc.) as this may have implications for the protection the economies and of business.

text: A prevalent challenge has been to identify the exact magnitude of incidents in terms of cost required for full recovery, and to determine the national or EU-wide economic impact. The purpose of this document is to take a first step in responding to this challenge, through which we have tried to identify if we currently are able to determine the real impact of incidents and if not what can we do in the future to enable that.

text: Although there is a plethora of studies addressing the economic impact of incidents, each one of them examines the topic from a different perspective, focusing on certain industries, using different metrics, counting only certain types of incidents etc. The lack of a common approach and criteria for performing such an analysis has allowed the development of rarely comparable standalone studies, often relevant only in a certain context. Despite the lack of relevant studies in EU on this topic, the systematic review undertaken allowed us to identify useful findings for future work in the field, and build an early impression on the current EU and worldwide status.

text: In this respect, the review revealed that cyber-incidents are a real problem, manifested through a particular

text: set of threats affecting similar types of assets, resulting in financial loss. Among the main findings are the

text: following:

text:  Finance, ICT and Energy sectors, appear to have the highest incident costs.  The most common attack types for Financial sector and ICTs appear to be DoS/DDoS and malicious

text: insiders, with the latter affecting the Public Administration sector as well. It is very important to highlight that these two types on their own, collectively constitute approximately half the annualized cost of all cybercrime (Figure 9) [16].

text:  The most expensive attacks are considered to be insider threats, followed by DDoS and web based attacks [16].  In terms of country loss the values provided reach up to 1.6% of GDP in some EU countries [11].

text: Other studies mention figures like 425,000 to 20 million euro per company per year (Germany) [10].

text: Another study provides the average cost per company per year that can vary between 2.3 mil. and 15 mil. euro in 2015 [16]. One study also estimates the economic loss for the global economy to be from 330 to 506 billion euro (375 to 575 billion $) [8].  Data seems to be the most affected asset.

text: Besides the common findings identified above, each study has produced its own set of findings, mostly

text: relevant in their particular context:

text:  Cybercrime continues to be on the rise, with the cost varying and depending on the organisational size [5][9][16].  Countries are likely to tolerate malicious activity as long as it stays at acceptable levels, less than 2% of national income [8]; but measuring the exact impact proves to be difficult.  Business disruption represents the highest external cost, followed by costs associated with information loss [16].  The urgency to prepare and invest in incident response usually occurs only after an event with a significant impact [2].  The best data related to cybercrime comes from the financial sector, which is regulated, pays serious attention to cybersecurity, and can easily measure loss [8] being also one of the most targeted industry.  Companies are in need of qualified personnel, but in some cases they lack completely. Employing under-qualified employees implies a higher risk [1][3].  Governments need to collect and publish data on cybercrime, and help countries and companies to make better choices about risk and policy [8].  The most affected CII sectors seem to be financial, ICT and energy.  A large majority of organisations still have not implemented basic security controls [2].  Attackers are streamlining and upgrading their techniques, while companies struggle to fight old tactics [15].  In most cases, attackers are able to compromise an organization within minutes [6][17], while time to recover takes considerably longer [17].  The large majority of vulnerabilities were exploited one year or more after the vulnerability was revealed; patch management is therefore still one of the weakest links [2][17].

text: In terms of conclusions reached among the most notable one is that the measurement of the real impact of incidents in terms of the costs needed for full recovery proved to be quite a challenging task. Determining

text: cost values that are as close as possible to reality is a key to determining the real economic impact of incidents on EU’s economy. Knowing the real impact can help define proper, coherent and cost effective (beneficial) mitigation policies. As a short note, the NIS directive states that “[…] incidents can impede the

text: pursuit of economic activities, generate substantial financial losses, undermine user confidence and cause

text: major damage to the economy of the Union”, without making any use of figures in support of this. We have

text: also noticed the lack of a unified and standardised approach in developing such studies, often driven by business factors rather than actual interest of stakeholders or realistic needs.

text: The importance of the topic along with the gaps identified along our analysis justify the supplying of some

text: recommendations specific per type of stakeholder:

text:  First of all, the development of such studies in the future, should be done throughout a unified analysis, based on a well-structured methodology, and considering all critical variables that define the EU cyber-space. Although there are quite a lot of organisations developing such studies, there is a need for consistent and accurate studies that will reflect as much as possible the real situation. ENISA could be an actor capable of doing such work, but only with suitable resources and a clear mandate in this area.

text: these studies in terms of future decision making, policy development, business continuity etc. But

text: again, some filters must be applied to place the study in context and identify the findings that are indeed relevant.  Study makers (organisations that develop such analysis whether being governmental, consultancy

text: companies, cyber-security related companies) can also benefit from this review by improving their

text: frameworks/methodologies, providing more details and transparency on how information was collected and processed, dimension, constituency and representativeness of the sample size, economic sectors covered, types of cyber-threats/incidents covered, challenges identified during the study (that can help understand certain lack of information within the study).

text: 1. Introduction

text: 1.1 Background

text: Cyber security incidents (incidents) affecting critical information infrastructures (CII) are considered nowadays global risks that can have “significant negative impact for several countries or industries within the next 10 years” . Critical Information Infrastructures (CIIs) are those systems that provide the resources on which all functions of society depend upon, of which a possible incapacitation or destruction, would have a significant effect on the security, economy and/or health of society as a whole. The more businesses benefit from the advantages of information technology, by entering into the era of the also called cyberphysical Systems, Internet of Things and Internet of Services (Industry 4.0), cyber-incidents affecting those infrastructures have increased more than ever. Modern economies rely on the newly developed cyber infrastructures, and assuring their security has become the main priority of many actors (governments, companies etc.) as this may also be similar with protecting the economies or businesses.

text: To tackle the new risks, the first logical step to do is probably to develop risk assessments, to better understand the challenges. Nevertheless an important step in developing a risk assessment is to identify the economic impact of such incidents, as they may affect large businesses, economies, and the wider population.

text: Although there are plenty of studies that address this issue, the development standards of these can differ significantly. The lack of a common methodology and criteria, has allowed the development of a number of standalone studies, rarely comparable among themselves. Although we could not identify economic impact values as defined in our methodology, we could derive findings and trends that can be useful for future work, and can form an early view on the general situation in EU and worldwide. We may say that more or less all studies point a common direction; they indicate that cyber-incidents are a real problem, manifesting themselves through particular types of threats, affecting similar types of assets, and having an economic impact. A challenging task is to identify the magnitude of the impact, in relation to the needed cost for a full recovery, and the economic impact for Europe.

text: A poignant need occurred for the development of a solid analysis framework that would cover all different aspects of the economic impact of cyber incidents, without merely relying upon interview estimations in quantifying actual costs.

text: Therefore, considering the above and in the context of the upcoming EU NIS Directive, the need for conducting a systematic review of the literature regarding the proposed theme (the objective of this report), has become even more relevant – so to clarify the current situation and provide a general overview on the methodological aspects, had to be considered when drawing up such a study.

text: 1.2 Scope of the document

text: The aim of the study is to assess the economic impact of incidents that affect CIIs in EU, based on existing work done by different parties, and set the proper ground for the future work of ENISA in this area. In detail, our aim is to:

text:  Identify relevant studies in the field

text:  Define a proper methodology for reviewing the studies  Extract relevant findings based on the proposed methodology  Deliver the results in form of a systematic review.

text: 1.3 Target audience

text: The direct beneficiaries of this work are CII owners and operators, and public authorities within member states (MS) dealing with CII protection – as it will help them understand the magnitude of the impact that cyber-attacks can have on economies, businesses and population. Further to these, the study is also of a benefit to security practitioners (CISOs etc.), corporate leadership (CEOs), and organisations developing studies such as the ones reviewed here (study makers).

text: 1.4 Project Methodology

text: This current review has been developed based on the following approach:

text: - Base choice of studies based on coherent mandatory and optional criteria, as described in the methodology within Annex I; - Identify relevant studies (Annex II) – 17 studies identified (6 EU and 11 non-EU); - Extract key findings of the studies (desktop research and interviews); - Develop conclusions and recommendations.

text: 2. About the studies analysed

text: Just a small number of the identified studies have met the defined mandatory criteria. Despite the fact that the primary focus was to locate studies within the EU, this proved quite a challenge since their number is quite low compared to the ones describing the situation with an international focus. The total number of studies that have been taken into consideration for this report was 17, with 6 of them being from the EU, and 11 outside the EU.

text: 2.1 Time frame

text: The timeframe covered by the chosen studies is shown in the figure below (Figure 1). The studies have been covering the calendar year before their publication.

text: 2.2 Data collection (data sources, data selection, data extraction)

text: Having proper, coherent and accurate data sources is a prerequisite for concrete results. The data extraction method is also important, as the extraction process must enable the identification of meaningful information. The data selection process may assist on improving findings by filtering out any unnecessary information.

text: 2.2.1 Data sources

text: The majority of the studies have engaged experts as the main source of information. The complete set of sources can be found below:

text: - EXPERTS: experts within companies, academia, public institutions, independent experts, or other kind

text: of people that have a connection to the field (11 studies have followed this approach).

text: - INTERNAL DATA: used mostly by cyber-security vendors who have the ability to collect data/logs from

text: their clients (2 studies).

text: - PUBLIC INFORMATION: publicly available information on incidents (2 studies).

text: - PARTNERS: sources such as specialised security companies, CERTs etc. (2 studies).

text: Data sources have been found to be mixed, in the form of internal data and partners, or experts and public information.

text: Studies that have engaged experts as a source, provide mostly information about countries covered, number of organisations involved and number of incidents studied. The ones that used internal data as a source, provide mostly the number of records analysed (logs), number of countries covered and in some cases the number of partners that have also provided logs. Studies that use public information as a source, provide the number of incidents studied and the geographical coverage (countries).

text: The number of contributing experts vary between 150 and 2150, depending on the geographical coverage and other factors. The number of organisations covered by the studies are between 24 and 350. A number of studies are also based on data from partners, where the real number of organisations covered cannot be determined. In terms of countries covered the numbers range from 1 to 150. The analysed incidents, are between 140 and 80.000, and some studies mention logs/records analysed with the figure of billions tied to them.

text: 2.2.2 Data extraction

text: The methods utilized for data extraction are the following:

text:  Surveys/questionnaires: are the prevalent tool, mostly in cases where experts were engaged (11

text: studies).

text:  LOG/INFO ANALYSIS: have been used by the specialised security companies that have access to logs

text: and actual cyber-attacks data (4 studies).

text:  PUBLIC INFORMATION COLLECTION: public data (media, open sources etc.) is extracted by

text: publishers by different means (2 studies).

text: 2.3 Geographical coverage

text: Despite the initial purpose being of analysing the situation at EU level, this turned out to be challenging due to the lack of targeted studies. Although there is a large number of such publications, most of them have an international dimension, and among the ones that are indeed targeting European countries, very few provide all necessary details in order to be considered qualitative. Among the 6 studies covering EU, only 1 has covered all Europe and has results based on only real incidents; with the other 5 covering just regions or countries. The remaining 11 studies, cover other geographic areas (9 international, 1 US, 1 Russia).

text: Also, an interesting fact is that 14 out of the 17 studies, were carried out by American organisations.

text: 2.4 Methodologies used for determining economic impact

text: Determining the cost of an incident is an essential element, crucial in obtaining a qualitative study. Almost all of the studies that have been taken into account, have based their economic impact determination methodology on the answers they got from the respondents. From the studies, 12 use the surveys as their primary source for costs. There are also 2 other cases, where internal frameworks are used (often based on calculations made by partners/insurance companies) and 3 others that are using public information, or a combination of the methods above.

text: Regarding the particular techniques to calculate or present the economic data, studies have used different ways to retrieve the incident costs and economic losses:

text:  Cost by threat: calculating the economic losses for a particular threat in a whole country.  Cost by country: calculating the cost for all sectors and for all incidents, and therefore, for the whole country.  Cost by sector: specifying the economic losses for a particular sector (e.g. energy).  Cost by region: calculating the losses for all the sectors and incidents in an entire region.

text: Besides this, some of the studies provide the exact costs and others use the range technique. Chapter 3 includes the findings regarding this.

text: 2.5 CII sectors affected

text: One of the mandatory quality criteria that we have defined within our methodology, was that the studies should address at least one of the CII sectors identified within EU (see Annex I – Methodology description). Out of 12 sectors defined within the methodology, 9 were addressed by the selected studies.

text: It is worth noting that none of these studies provide economic impact data related to the nuclear sector for example. Conversely, the financial sector is included in 15 out of the 17 studies (Figure 2).

text: 2.6 Types of incidents (taxonomy)

text: A specific incident taxonomy was defined in the methodology so that we can capture studies that contain information about specific types of incidents.

text: None of the studies provides data related to ICS/SCADA Hacking and Physical Damage/Theft/Loss threats. Conversely, DoS/DDoS is the most common threat, mentioned in 13 out of 17 studies (Figure 3).

text: 3. Findings based on the content of the studies

text: The objective of this section is to analyse in detail the content of the studies, and identify common findings and future trends.

text: 3.1 Findings related to the economic impact

text: After analysing various studies it was found that each study expresses economic impact in a different way. While some studies show annual economic impact per country, other studies provide cost per incident or per organisation. Besides this, some of them use real cost but others use approximations based on different techniques or internal frameworks. On top of that, cost were expressed in different currencies, for which we have converted all figures to a common currency . Given the above, the task of identifying common denominators for those studies becomes almost impossible.

text: The following table within Ponemon’s “2015 Cost of Cyber Crime Study: Global” report, summarises the average economic impact of cybercrime per organisation in 7 developed countries worldwide (Figure 4).

text: In June 2014 the McAfee study “Net Losses: Estimating the Global Cost of Cybercrime” [8] depicts an estimation of the economic impact of cybercrime for some countries, as a GDP percentage. This study finds that the most affected countries are Germany, Netherlands and Norway (Table 1).

text: COUNTRY % COUNTRY %

text: Germany 1.60% United Kingdom 0.16% Netherlands 1.50% Colombia 0.14% Norway 0.64% South Africa 0.14% United States 0.64% Vietnam 0.13% China 0.63% France 0.11% European Union 0.41% United Arab Emirates 0.11% Singapore 0.41% Russia 0.10% Brazil 0.32% New Zealand 0.09% India 0.21% Australia 0.08% Ireland 0.20% Nigeria 0.08% Zambia 0.19% Turkey 0.07% Malaysia 0.18% Italy 0.04% Canada 0.17% Japan 0.02% Mexico 0.17% Kenya 0.01% Saudi Arabia 0.17%

text: 3.1.1 Overall losses recorded in European Union

text: UK was the most studied country in EU, as we have identified in 3 studies. According to one study UK companies losses reach up to 37 billion euro per year (27 billion pounds) [1]. As a comparison, this was

text: approximately the investment of the European Commission in Innovation, Research and Development during a three-year period for the entire H2020 program. Another study underlines that the economic

text: impact can vary between 1.01 (£544,000) to 26.19 million euro (£14 million) annual cost per company. Cost from 104,000 (£75,000) to 4.35 million euro (£3.1 million) per affected company are also mentioned [3]. Germany is also in the focus of one of the studies with losses varying from 425,000 to 20 million euro per company per year [10]. France is also affected by losses from 445,000 to 18,9 million euro economic impact

text: per company per year [11].

text: 3.1.2 Overall losses recorded by international studies

text: Among the international studies, 8 examine the worldwide situation, with 1 of them focusing on the United States [14], and 1 more on the Russian Federation [12]. The majority of the studies provide an estimated economic loss range. However, some of them detail data for specific threats, and global economic impact on specific sectors or countries.

text: The most comprehensive estimation regarding economic loss is presented in the McAfee study [8]. Estimated economic loss for the global economy varies from 330 to 506 billion euro (375 to 575 billion $), with focus on three different types of attacks: hacktivism, malware and cyber espionage.

text: The study “Energy Market Review” by Willis Limited [13] focused only on the energy sector, and presents an impressive highlight about the economic losses: around 545 million euro (400 million GBP) in the United Kingdom’s energy sector. Globally, it is estimated that cyber-attacks against oil and gas infrastructures will cost 1.69 billion euro (1.87 billion $) by 2018.

text: Another report [5] offers a range estimation for economic loss for 257 companies worldwide. The lowest cost for a company would be 0.45 million euro (0.56 million $), and the highest loss 55.2 million euro (61 million $).

text: The study 2015 Data Breach Investigations Report [7], by Verizon, shows a different approach to the economic loss estimation. They introduce the term “record” to refer to a set of valuable information and it builds the economic loss based on the number of records compromised plus other relevant aspects (“multiple contributing factors”). This report presents a range of economic impacts depending on the number of records compromised, with the lowest average impact of 16.400 euro (18.120 $) for 100 records and the highest average impact of 14.1 million euro (15.6 million $) for 100 million records. The most sectors affected are Public Administration, Finance, Health and ICTs.

text: The study 2015 Internet Security Threat Report [15], by Symantec, shows the value of stolen data in the black market. Symantec affirms that there are 317 million new malware variants being sold in the black market and used to steal information. Information – such as e-mails, credit cards, and passport copies – is sold in the black market, with the price varying from 0.45 euro cent (0.50 $) to 3,168 euro (3,500 $).

text: The study 2013 Cost of Cyber Crime Study: United States [14] by Ponemon, shows that the average annualised cost of cybercrime for 60 US-based organisations is 10.4 million euro (11.6 million $) per year, with a range from 1.7 to 52 million euro (1.3 to 58 million $). In the previous year, the average annualised cost had been 8 million euro. This represents an increase of 26%, or 2.3 million euro (2.6 million $).

text: The average annualised cost for 24 Russian organisations is 1.7 million euro (120.2 million rubbles) per year, with a range from 334,000 euro (25 million rubbles) to 6.3 million euro (442 million rubbles) per company each year [12].

text: 3.2 Findings related to CII sectors

text: For performing the current review, we have taken into consideration certain types of critical information infrastructures (CII) that exist in the context of the EU legislation – making their presence mandatory.

text: 3.2.1 Most affected CII sectors

text: The following figure, shows the affected sectors in Europe, as reported by the European studies.

text: Figure 5 shows the number of studies that covered each specific sector. The financial sector seems to be the most examined, by being mentioned in 14 studies (2 were sector specific), followed by ICT and Energy. Other affected sectors are: Public Administration, Health and Transport.

text: The sectors with rather poor coverage within the studies are: Aerospace, Nuclear, Chemistry, Research and Development, and Water.

text: 3.2.2 Overall losses per CII sector

text: The Ponemon’s “2015 Cost of Cyber Crime Study: Global” [16] gives us an average annualized cost by industry sector from 252 companies worldwide (Figure 6).

text: The data shows that financial services and energy related sectors suffered the strongest economic impact due to cybercrime.

text: Another study oriented towards one specific sector, “Energy market review” [13], by Willis Limited have found that UK economic loss in the energy sector for 2014, was 545 million euro (400 million GBP).

text: The Ponemon “2015 Cost of Data Breach Study: Global Analysis” [6] have examined the worldwide cost per capita in different sectors in 2015, and concluded that the average cost is approximately 154 $. The study covers only data breaches, and it has found that heavily regulated areas have a substantially higher per capita data breach cost, than less regulated or no regulated areas.

text: The Ponemon “2014 Cost of Cyber Crime Study: Germany” [10], shows the average annualised cost by industry sector in Germany, comparing data from three different fiscal years. Financial services and utilities & energy experience higher costs in all three annual studies. In addition, the education & research and public

text: sectors have experienced a significant cost increase in the last year. On the other hand organisations in hospitality, media and retail appear to have a lower overall economic impact over the last three years (2012- 2014).

text: 3.3 Findings related to incident types

text: This section describes the overall common incident types, the specific incidents per sector, and an average cost per incident type. In most cases the incident types can be considered as threats.

text: 3.3.1 Overall common threat

text: DoS/DDoS seems to be the most common type of threat, mentioned in 13 out of 17 studies. The second most frequent threats are: Malware (12), Insider threat (8), Phishing (9), Web-based attacks (8), and cyberespionage (5) (Figure 7).

text: Surprisingly the studies do not contain information about ICS/SCADA, although it has been in the public focus in the last years. Physical damage/theft/loss has also recorder 0 references within the studies.

text: 3.3.2 Specific threat per CII sector

text: Within this section incident types are mapped to CII sectors, visualising the specific threats reported per sector (Table 2).

text: 3.3.3 Average cost per threat type

text: To identify the incidents having the greatest financial impact that may affect an organization, it is necessary to calculate the average cost per threat. It is imperative to understand that the economic impact is highly associated to the industry type of each company; information that was difficult to source, since most studies would not provide this. An exception to this rule is Ponemon’s “2015 Cost of Cyber Crime Study: Global” [16], that has covered this area.

text: The following figure shows the percentages of annualized cybercrime cost by attack type, across several countries (Figure 8).

text: The same study also gives an overview on the worldwide average annual cost of attacks, weighted by attack frequency (Figure 9).

text: 3.4 Findings related to affected assets

text: There was an effort to identify assets that are affected by incidents, which again was a challenge, considering that not all studies provided such information (Figure 10).

text: 7 6 5 5 5 4 4 3 1 0

text: Data appears to be the most affected asset; where data may mean any kind of information, e.g. confidential information, personal identifiable data, logs and other types. Data is usually considered one of the most important assets of a company, so this finding is not surprising. Another affected asset category seems to be intellectual property, which can be considered also data in some circumstances. Equipment was also found to be affected in 6 of the analysed studies. Of course there could be more asset types within an organisation, but those were the only ones mentioned within the studies.

text: 3.5 Conclusions from the studies

text: Based on the overall findings and the prospective audience, most of the studies have developed a number of conclusions. Below is a grouped summary of these conclusions, some of them taken “as is” from the studies analysed.

text: Economic

text:  The highest economic impact is produced by malicious insiders, denial of services and web-based attacks.  Cybercrime continues to be on the rise for organisations, with the cost varying and being depended to the organisational size [5][9][16].  Cost of cybercrime can reach values as high as 15 mil. euro per organisation/year, or 1.6% of the GDP for some countries [16].  Countries will tolerate malicious activity as long as it stays at acceptable levels, less than 2% of national income [8].

text:  Business disruption represents the highest external cost, followed by the costs associated with information loss [16].  Cybercrime slows down the pace of global innovation by reducing the rate of return to innovators and investors [8]. Those types of costs are often not taken into account when assessing the economic impact.  The urgency to prepare and invest in incident response usually occurs only after an event with a significant impact [2].  The cost of cybercrime will continue to increase as more business functions move to online platforms, and more companies and consumers around the world connect to the Internet [8].  Incident detection is the most costly internal activity followed by recovery [16]. Cleaning up in the aftermath of cybercrime is expensive, often more expensive than the crime itself [8].  Deployment of enterprise security governance practices moderates the cost of cybercrime [16].  The incentives in cybercrime encourage attack and discourage defence. Cybercrime produces high returns at low risk and low cost for the hackers [8].  The best data related to cybercrime comes from the financial sector, which is regulated, pays serious attention to cybersecurity, can easily measure loss [8] being also one of the most targeted industry.  The time taken to identify and contain a data breach directly affects the cost [5].

text: Organisational

text:  Companies are in need of qualified personnel, but in some cases they lack completely. Employing under-qualified employees implies a higher risk [1][3].  Companies that fail to adequately protect their networks will be at an increasing competitive disadvantage [8].

text: Policy

text:  Board involvement, the purchase of cyber-insurance, and business continuity management policies, can reduce the cost of a data breach [5].  Governments need to collect and publish data on cybercrime, and help countries and companies to make better choices about risk and policy [8].

text: Technical

text:  The most affected CII sectors seem to be financial, ICT and energy.  A large majority of organisations still don’t have implemented basic security controls [2].  Attackers are streamlining and upgrading their techniques, while companies struggle to fight old tactics [15].  The incident discovery phase (time to discover) takes longer than the time to compromise [17].  In most of cases, attackers are able to compromise an organization within minutes [6][17].  Hackers and criminal insiders cause most of the data breaches [5].  Exploiting browser, OS, and other third-party software (e.g., Flash and Java) vulnerabilities to infect end-user systems is a common first step for attackers [7].  Deploying security/threat intelligence sharing systems seems to be efficient [15][16][17].  The large majority of vulnerabilities were exploited one year or more after the vulnerability was revealed; patch management still one of the weakest links [2][17].  Short-life malware: 95% of malware types showed up for less than a month, and four out of five didn’t last beyond a week [17]. A vast majority of the malware samples are unique to an organisations.

text: 4. Conclusions and recommendations

text: Despite the abundance of studies that attempt to address the economic impact of cyber incidents, it was found that the lack of common approach, objectives and thematic areas, cannot effectively contribute to an EU wide study. However, it has been possible to identify trends that can be useful for giving a general impression on EU and international level, and assist on future work.

text: Study findings agree that cyber-incidents are a real problem, manifest through a particular set of threats, to

text: an extend affect similar types of assets, resulting to a financial loss. Among the main findings we can find:

text:  Finance, ICT and Energy sectors, appear to have a much higher incident cost, in comparison with the rest of sectors.  The most common attack types for Financial sector and ICTs appear to be DoS/DDoS and malicious

text: insiders, with the later one affecting the Public Administration sector as well. It is very important to highlight that these two types on their own, make approximately half the annualized cost of all cybercrime (Figure 9) [16].

text:  The most expensive attacks are considered to be insider threats, followed by DDoS and web based attacks [16]. The ranking slightly changes when it comes to different countries, as you will see later in the document.  In terms of country loss the values provided reach up to 1.6% of GDP in some EU countries [11]. Other studies mention losses reaching up to 37 billion euro (27 Billion pounds) per year (UK) [1],

text: while for Germany figures like 425,000 to 20 million euro per company per year [10]. Another study

text: provides the average cost per company per year that can vary between 2.3 mil. and 15 mil. euro in 2015 [16]. One study also estimates the economic loss for the global economy to be from 330 to 506 billion euro (375 to 575 billion $) [8].  Data seems to be the most affected asset. In this context data may mean any kind of information – from confidential information and personal identifiable data, to logs and other types.

text: In terms of conclusions reached among the most notable is that the measurement of the real impact of incidents in terms of the costs needed for full recovery proved to be quite a challenging task. Determining

text: cost values that are as close as possible to reality is a key to determining the real economic impact of incidents on EU’s economy. Knowing the real impact can help define proper, coherent and cost effective (beneficial) mitigation policies. As a short note, the current draft of the NIS directive states that “[…]

text: incidents can impede the pursuit of economic activities, generate substantial financial losses, undermine

text: user confidence and cause major damage to the economy of the Union”, without making any use of figures

text: in support of this. We have also noticed the lack of a unified and standardised approach in developing such studies, often driven by business factors rather than actual interest of stakeholders or realistic needs.

text: ENISA could be an actor capable of doing such work, but only with suitable resources and a clear mandate in this area.  As regards all types of readers that may be interested in such studies, they would have to place the study in context, prior adopting findings or drawing their own ones. By doing this it is possible to better understand the gaps, or parts uncovered by the study, and better understand the overall findings of the study and their relevance within the actual context. A few details that would assist on this mission are the: o number of companies that participated in the study (sample size) o geographical area analysed o organisations who carried out the study and possible business interests o methodology used to extract and collect the data o industries affected o types of threats / incidents taken into account  An important category of readers are the cyber-security professionals (CISOs, security analysts, security engineers, security architects etc.). Beyond understanding the context, they should also focus on extracting useful information for their businesses, such as: major threats, recovery costs, affected industries and assets, best practices etc.  Policy makers and corporate management (CEOs and CFOs) have also something to benefit from

text: Annex I – Methodology description

text: To properly carry out the systematic review a methodology was defined in terms of steps and criteria that must be followed in order to collect accurate and coherent data. The methodology is based on previous work of ENISA in terms of incident reporting, CIIs, threat landscapes and other relevant fields.

text: As previously mentioned, there are a number of studies publicly available that cover different types of statistics about cyber incidents, but not all of them are relevant to ENISA’s work. In order to select the suitable studies to be analysed some quality criteria had to be applied. In the table below you will find 12 defined criteria, of which 5 are mandatory and 7 are non-mandatory. For a study to be taken into account all 5 mandatory criteria should have been accomplished.

text: Annex II – Analysed studies Annex III - References and bibliography

text: [1] Cyber-Attacks: Effects on UK companies, Oxford Economics, 2014 [2] Global Threat Intelligence Report, NTT Group, 2015 [3] Information Security Breaches Survey, PWC and Infosecurity Europe, 2015 [4] Data Breaches in Europe, CEU School of Public Policy, 2014 [5] Global Report on the Cost of Cyber Crime, Ponemon Institute, 2014 [6] Cost of Data Breach Study: Global Analysis, Ponemon Institute, 2015 [7] Data Breach Investigations Report, Verizon, 2014 [8] Net Losses: Estimating the Global Cost of Cybercrime, McAfee, 2014 [9] Cost of Cyber Crime Study: UK, Ponemon Institute, 2014 [10] Cost of Cyber Crime Study: Germany, Ponemon Institute, 2014 [11] Cost of Cyber Crime Study: France, Ponemon Institute, 2014 [12] Cost of Cyber Crime Study: Russian Federation, Ponemon Institute, 2014 [13] Energy Market Review, Willis Limited, 2014 [14] Cost of Cyber Crime Study: United States, Ponemon Institute, 2013 [15] ISTR20 Internet Security Threat Report, Symantec, 2015 [16] Global Report on the Cost of Cyber Crime, Ponemon Institute, 2015 [17] Data Breach Investigations Report, Verizon, 2015

text: ENISA ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece TP-04-16-479-EN-N

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-173-1 doi: 10.2824/475621 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu