text: https://bgpmon.net/popular-destinations-rerouted-to-russia/ 2 https://www.theregister.co.uk/2018/11/13/google_russia_routing/

text: There are more than 60.000 Autonomous Systems. Each AS has a number. AS numbers are assigned in blocks by IANA to regional Internet registries (RIRs). https://www-public.imtbs-tsp.eu/~maigron/RIR_Stats/RIR_Delegations/World/ASN- ByNb.html

text: https://www.ripe.net/publications/news/industry-developments/youtube-hijacking-a-ripe-ncc-ris-case-study 6 https://bgpmon.net/chinese-isp-hijacked-10-of-the-internet/ https://www.wired.com/2014/08/isp-bitcoin-theft/ 8 https://blog.thousandeyes.com/rostelecom-route-leak-targets-ecommerce-services/ 9 https://bgpmon.net/popular-destinations-rerouted-to-russia/ 10 https://www.theverge.com/2018/4/24/17275982/myetherwallet-hack-bgp-dns-hijacking-stolen-ethereum 11 https://bgpstream.com/event/171779 12 14,000 Incidents: A 2017 Routing Security Year in Review, https://www.internetsociety.org/blog/2018/01/14000-incidents- 2017-routing-security-year-review/

text: RFC 4272 “BGP Security Vulnerabilities Analysis”, https://datatracker.ietf.org/doc/rfc4272

text: https://blog.avira.com/20-of-the-world-502-largest-websites-do-not-use-https/ 16 https://arstechnica.com/information-technology/2019/01/a-dns-hijacking-wave-is-targeting-companies-at-an-almostunprecedented-scale/ 17 https://www.idgconnect.com/idgconnect/opinion/1012872/metadata

text: http://www.irr.net/docs/rpsl.html 19 https://docs.peeringdb.com/ 20 https://www.ripe.net/ 21 https://www.radb.net/ 22 https://tools.ietf.org/html/rfc7454#section-6 23 https://tools.ietf.org/html/rfc7454#section-9

text: http://www.team-cymru.com/bogon-reference-bgp.html 25 https://tools.ietf.org/html/rfc5082 26 https://www.manrs.org/ 27 https://tools.ietf.org/html/rfc8205 28 https://www.ripe.net/participate/policies/proposals/2019-03 29 https://www.enisa.europa.eu/news/enisa-news/legacy-technologies-as-a-threat-to-eu2019s-telecommunicationsinfrastructure

identifier: 7 Steps to shore up the Border Gateway Protocol (BGP)

title: 7 Steps to shore up the Border Gateway Protocol (BGP)

text: 7 STEPS TO SHORE UP BGP

text: MAY 2019 0 7 STEPS TO SHORE UP BGP

text: ABOUT ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquires about this paper, please email press@enisa.europa.eu.

text: AUTHORS

text: Aggelos Koukounas, Eleni Vytogianni, Marnix Dekker

text: ACKNOWLEDGEMENTS

text: We would like to thank Ilias Bakatsis (until recently working at ENISA), and Andrei Robachevsky, a subject matter expert (CEI) contracted by ENISA, for their work on the preliminary analysis of BGP security. We are grateful to the 63 EU telecom providers who participated in the 2018 ENISA BGP Security survey. We thank the ETIS INFOSEC WG for the collaboration and input received through them. We are grateful for the useful comments and feedback received from Rolv Hauge (Telenor), Stefano De Crescenzo and colleagues (CISCO), Alejandro Becerra Gonzalez and colleagues (Telefonica), Stefan Pütz and colleagues (Deutsche Telekom). This paper was reviewed by the ENISA Article 13a Expert Group, comprising of national telecom regulatory authorities (NRAs) from across Europe.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Network and Information Security (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under the copyright of ENISA, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-294-3 DOI: 10.2824/66344

text: 7 STEPS TO SHORE UP BGP

text: TABLE OF CONTENTS

text: 1. INTRODUCTION TO BGP SECURITY 5

text: 1.1 PAST BGP INCIDENTS AND ATTACKS 5

text: 1.2 STATISTICS ABOUT BGP ATTACKS 6

text: 1.3 ENISA BGP SECURITY SURVEY 2018 7

text: 2. BORDER GATEWAY PROTOCOL – SECURITY VULNERABILITIES AND RISKS 8

text: 2.1 BGP SECURITY VULNERABILITIES 8

text: 2.2 POSSIBLE ATTACKS ON BGP 8

text: 2.3 BGP SECURITY RISKS 9

text: 3. BASIC BGP SECURITY MEASURES 11 A ANNEX: BGP SECURITY MEASURES CHECKLIST 14 7 STEPS TO SHORE UP BGP

text: EXECUTIVE SUMMARY

text: BGP, the Border Gateway Protocol, is a central part of the internet backbone. It is used by internet service providers to relay internet traffic across the globe. It was designed more than 25 years ago and when it was introduced the main requirement was resilience, simplicity, and ease of deployment. BGP lacks security which make it vulnerable to attacks and misconfiguration errors.

text: Famously in 2008 an ISP in Pakistan, in an effort to censor a Youtube video, diverted the whole world’s Youtube traffic to Pakistan, effectively making the website unavailable for everyone. Recently we have seen more and more attacks exploiting the weaknesses in BGP. Our survey

text: showed that

text:  In 2017, 80 prefixes for high profile destinations (Google, Apple, Facebook, Microsoft, BGP hijacks are etc), were being announced by a previously unused Russian Autonomous System common and (AS), affectively rerouting this traffic through Russia . that these  In 2018, a BGP hijack was used to divert internet traffic to the Amazon EC2 cloud, with incidents have the goal of stealing Ethereum crypto-currency. a high impact:  In 2018, a BGP hijack was used to divert traffic to Google from subscribers living in the 44 percent of west of the USA, via Russia, to China, allegedly intentionally and for espionage providers

text: purposes . answering the survey said that

text: There are many more BGP attacks and BGP misconfigurations which do not make the the impact of headlines. Many BGP hijacks even go unnoticed because they are not easily noticed by the BGP incidents end-users because there is no outage. is high,

text: affecting large

text: BGP attacks can be used for many different purposes, ranging from financial crime targeting a numbers of few users (for stealing crypto currency) to large scale espionage and disruption. If unmitigated, users and the security vulnerabilities of BGP lead to risks of large scale network outages, impacting the lasting for economy and society, privacy risks for citizens, risks for companies, risks for national security, many hours. risks of espionage, etc. These risks are increasing, because there is an increase in the number and sophistication of cyber-attacks, on the hand, and on the other hand an increased reliance on the internet.

text: In 2018 ENISA conducted a survey to assess the state of play of BGP security in Europe. Our survey collected 63 responses from large and small electronic communication providers across the EU. Our survey showed that BGP hijacks are common and that these incidents have a high impact: 44 percent of providers answering the survey said that the impact of BGP incidents is high, affecting large numbers of users and lasting for many hours.

text: In this paper we highlight the security vulnerabilities of BGP and explain why it is so important to address them. Working closely with experts from industry we derived a shortlist of 7 basic BGP security measures which are industry good practices that should be relatively simple to adopt and relatively effective. We encourage electronic communications providers and other organizations running an Autonomous System (AS) to implement these 7 measures as a minimum.

text: 7 STEPS TO SHORE UP BGP

text:  BGP Monitoring and Detection: Monitor internet traffic routes for your internet traffic, to detect anomalies, not only to guarantee resilience but also for the privacy and security of subscribers.  BGP Coordination: It is crucial to coordinate with peers, by publishing route policies and partaking in peering databases.  Prefix Filtering: It is important to filter prefixes that should never be announced or forwarded in your network, both on ingress and egress network traffic.  BGP AS Path Filtering: It is important to filter BGP AS path attributes for items that should not be allowed in BGP route announcements to into or out of your network.  Bogon Filtering: It is important to filter out bogus prefixes (also called bogons), as these prefixes should never appear in BGP announcements.  TTL Security (GTSM): It is important to implement TTL security, which makes it harder attack BGP sessions.  RPKI: It is important to implement RPKI and digitally sign route announcements to allow peers to check that announcements are authentic and authorized.

text: In Section 3, we explain these BGP security measures in more detail. In the annex of this paper, we include checklist for these measures.

text: This work on BGP security was done in the context of

text: Article 13

text: a of the Framework directive, which asks EU Member States to ensure that providers take appropriate security measures to protect their networks and services. For the last decade, ENISA has collaborated closely with the EU Member States and experts from national telecom regulatory authorities (NRAs) which supervise this part of the EU legislation, under the ENISA

text: Article 13

text: a Expert Group . The ENISA

text: Article 13

text: a Expert group meets 3 times per year to discuss and exchange information about security in the electronic communications sector.

text: We are grateful for the good collaboration with the NRAs. We also worked closely with security experts from the telecom sector. We are grateful for the valuable contributions from them on this topic.

text: 7 STEPS TO SHORE UP BGP 1. INTRODUCTION TO BGP SECURITY

text: The Border Gateway Protocol (BGP) is a central part of the internet backbone. BGP is an internet interconnection protocol which allows organizations to connect their network, called Autonomous System (AS), to the rest of the internet, allowing them to relay traffic across the globe to the right destination (see the diagram below). Typically ASs are managed by internet

text: BGP has some

text: service providers, network operators, telecom providers, but there are many other organizations

text: fundamental

text: who operate an AS . Every AS implements BGP to exchange routing and reachability

text: security

text: information with peer ASs. Basically each AS handles a table with known routes to peer

text: weaknesses,

text: networks and provides this information to peers using IP prefix announcements. The attributes

text: which makes it

text: in these announcements, like local preferences, origin, path length, allow each AS to make a

text: particularly

text: local decision about where to route packets.

text: vulnerable to attacks by malicious actors, as well as misconfigurations and errors.

text: BGP was designed decades ago with interoperability and ease of deployment in mind. BGP has some fundamental security weaknesses, which makes it particularly vulnerable to attacks by malicious actors, as well as misconfigurations and errors.

text: 1.1 PAST BGP INCIDENTS AND ATTACKS

text: Below we list a number of high-profile BGP incidents reported in the media. Note that not all these incidents are attacks. It is not always easy to distinguish a BGP mistake from a deliberate BGP hijack.

text:  Youtube, Pakistan, 2008: The problems and vulnerabilities of BGP gained widespread attention in 2008 when an ISP in Pakistan, in an effort to censor a Youtube video,

text: 7 STEPS TO SHORE UP BGP

text: diverted the whole world’s Youtube traffic to Pakistan, effectively making the website unavailable for everyone. What happened technically is that Pakistan Telecom started an unauthorised announcement of a prefix for Youtube, which was by mistake forwarded to the rest of the world by its upstream provider PCCW Global. Youtube was unavailable for everyone for two hours in February 2008 .  China telecom BGP hijack, 2010: In 2010 China Telecom ‘originated’ 37000 prefixes (instead of its ususal 40 prefixes) including popular websites like CNN and Amazon .  Stealing cryptocurrency via BGP exploit, 2014: In 2014 attackers hijacked a portion of online traffic from a set of 19 ISPs, with the goal of stealing cryptocurrency from a NOT ALL BGP

text: 7 ATTACKS

text: group of users .  Rostelecom, 2017: In April 2017 Rostelecom, a Russian ΙSP, leaked dozens of routes AND pertaining to IP addresses that belong to major financial services firms. The Russian INCIDENTS ISP ‘originated’ 137 prefixes, 37 of which belong to financial, e-commerce and payment ARE services, like Mastercard, Visa, Forti, Alfabank, etc For 7 minutes, global traffic to these REPORTED

text: 8 INTO MEDIA

text: services was redirected via the Rostelecom network .  Inactive AS in Russia hijacks high profile sites, 2017: In December 2017, an OR COVERED Autonomous System in Russia, which had been inactive for many years, announced IN THE NEWS. 80 prefixes for high profile domains such as Google, Apple, Facebook, Microsoft, and others .  Hackers emptying Ethereum wallets, 2018: In April 2018, attackers intercepted and altered DNS requests for myetherwall.com allowing them to empty Ethereum cryptocurrency wallets. The attack on DNS was achieved via BGP hijacking .  China telecom BGP hijacks via Russia, 2018: In 2018 China Telecom established peering points in strategic places around the world, including the US, and then proceeded to hijack traffic using BGP. Recent examples of targeted websites include Google GSuite and Google Search. In November 2018 traffic to Google Analytics was hijacked and redirected to China via Russia.  China Telecom BGP hijack of US dpt of Energy, 2019: In January 2019 China Telecom hijacked 192.208.18.0/23 for 2 hours, which is a prefix belonging to the US Department of Energy .

text: 1.2 STATISTICS ABOUT BGP ATTACKS

text: Not all BGP attacks and incidents are reported into media or covered in the news. The Internet Society published a report in 2017, based on data from BGPstream, showing that every year there are thousands such attacks. We citing some of the statistics for 2017.

text:  In 2017 there were almost 14000 BGP incident incidents (either outages or attacks, like route leaks and hijacks).  Around 3000 Autonomous Systems experienced BGP incidents, i.e. 10% of all Autonomous Systems (at the time) experienced one or more routing incidents.

text: 7 STEPS TO SHORE UP BGP 1.3 ENISA BGP SECURITY SURVEY 2018

text: In 2018, ENISA conducted a survey across the EU’s electronic communications sector, to get an up to date picture of the situation in Europe. The ENISA survey covered a broad spectrum from European providers, including domestic ISPs but also large international operators and gathered responses from 63 different organizations. The responses underline the seriousness of BGP incidents.

text: We asked providers to assess the severity of the impact of BGP incidents. Almost half (44%) of the providers experienced incidents with a “major impact” on their networks, i.e. long lasting outages affecting many subscribers. A third of the respondents experienced incidents with medium impact (long lasting, affecting few subscribers, or many subscribers short lasting). See the chart below.

text: What is the impact of BGP incidents in your experience? 25%

text: major impact

text: medium impact small impact

text: The responses to our survey show that there are differences across the EU in terms of what BGP security measures are in place. Some providers are implementing industry good practices to mitigate the BGP security vulnerabilities. At the same time certain basic BGP security measures are not in place across the board.

text: The responses show that while some providers are rarely experiencing BGP security incidents, others see BGP security incidents regularly.

text: The survey respondents were clear about the urgency of addressing BGP security. Almost twothirds of the respondents strongly agreed that BGP hijacks are a serious issue, requiring an urgent solution. See chart below.

text: Do you agree BGP hijacks are a serious issue requiring an urgent solution? 2% 5%

text: Strongly agree Somewhat agree

text: Somewhat disagree Strongly disagree

text: 63% 7 STEPS TO SHORE UP BGP 2. BORDER GATEWAY PROTOCOL SECURITY VULNERABILITIES AND RISKS

text: In this section we explain the technical security vulnerabilities of BGP and the associated security risks.

text: 2.1 BGP SECURITY VULNERABILITIES

text: BGP vulnerabilities have been known for a long time already. They are documented for instance in IETF’s RFC 4272 “BGP Security Vulnerabilities Analysis”, which was published in 2006. BGP has three fundamental vulnerabilities :

text: POSSIBLE ATTACKS ON

text: 1. BGP has no mechanism to protect integrity and authenticity of messages in peer-peer

text: BGP

text: BGP communications. - Altering valid BGP 2. BGP has no mechanism to validate the authority of an AS to announce prefixes or peer-to-peer relay route information. communications 3. BGP has no mechanism to validate the authenticity of the path attributes in prefix - BGP misorigination announcements. aka BGP hijacking - BGP path attribute

text: 2.2 POSSIBLE ATTACKS ON BGP

text: tampering We explain how these security vulnerabilities can be exploited by an adversary. Note that we - BGP Policy attacks use the term “adversary” in a lose sense here, because sometimes incidents are the result of and route leaks unintentional mistakes.

text:  Altering valid BGP peer-to-peer communications: BGP uses TCP/IP for the information exchange between two peers. Long-standing TCP/IP connections, such as BGP sessions, are vulnerable to tampering. An adversary can try to inject BGP messages into the TCP/IP communication between BGP peers, injecting bogus routing information. An adversary can break the connection by inserting spoofed packets. The result of this attack is altering or disrupting the originally valid peer-to-peer communications between BGP peers. This attack can be used to intercept, alter or disrupt internet traffic.  BGP misorigination aka BGP hijacking: BGP mis-origination, also known as BGP hijacking, is when an adversary claims to be the origin of prefixes of another network. If route information is accepted by peers and/or propagated then the “roadmap” of the Internet is altered. The result of this attack is that the traffic is forwarded to the wrong AS. From there the AS could still forward it to the right destination to avoid drawing attention. This attack can be used to intercept, alter or disrupt internet traffic.  BGP path attribute tampering: The BGP path attribute lists which ASs have forwarded a BGP route announcement. The path attribute lists AS numbers (ASNs) in reverse order. The primary purpose of the path attribute is to prevent loops during inter-AS routing. The path attribute is not protected in BGP and any AS which sees the announcement can change it, meaning that an AS cannot be sure that the BGP announcement traversed the networks as indicated.  BGP Policy attacks and route leaks: BGP route announcements have a specific scope, a ‘policy’, defining where the announcement should be used. The scope of a BGP announcement is usually defined by a set of local redistribution or filtering policies

text: 7 STEPS TO SHORE UP BGP

text: distributed among the ASs involved. Often, these intended policies are defined in terms

text: of the pair-wise peering business relationship between ASs (e.g., customer, transit provider, peer, upstream). An example of a BGP policy violation is a so-called route

text: leak, i.e. the propagation of a routing announcement beyond their intended scope, in violation of the BGP policies of the receiver, the sender, and/or one of the ASs along the preceding AS path. An adversary can use route leaks to deliberately inject himself

text: in the routing path between outside networks and specific destinations, with relative

text: ease and raising little suspicion. The Pakistan BGP hijack was an example of such a mistake. A route leak can be used to hijack, alter, and disrupt internet traffic.

text: 2.3 BGP SECURITY RISKS

text: The BGP vulnerabilities can be used in many different ways, from eavesdropping the traffic and

text: silently passing the data forward without disrupting it, to causing internet connection outages

text: which impact the availability of the network. BGP vulnerabilities can also be used to attack weaknesses in other protocols like DNS hijacks. We distinguish 4 main security risks caused by

text: BGP security vulnerabilities:

text:  Eavesdropping internet traffic content: If the internet traffic is unencrypted, BGP

text: attacks can be used to eavesdrop on the content of internet traffic. This can have

text: These risks lead to

text: severe consequences for subscribers, the endpoints, as well as organization on the

text: risks of large-scale

text: server-side. The impact for subscribers can include financial impact, stealing of

text: societal and

text: credentials and passwords, privacy issues, etc. If carried out carefully, subscribers will

text: economic

text: not immediately notice an attack is going on.

text: disruption (via

text:  Altering internet traffic content: If the internet traffic is unencrypted, BGP attacks

text: network outages),

text: can be used to alter internet traffic, for example redirecting subscribers to spoofed

text: privacy risks for

text: websites, tampering with SSL/TLS certificates, altering DNS responses, etc. This can

text: citizens using the

text: have severe consequences for subscribers. A good example is the recent theft of

text: internet (via

text: crypto currency by hijacking internet traffic to the Amazon’s EC2 cloud. If carried out

text: eavesdropping of

text: carefully, subscribers will not immediately notice an attack is going on.

text: internet traffic

text:  Internet traffic analysis and metadata analysis: If the internet traffic is encrypted, for

text: metadata or

text: instance with SSL/TLS, which is increasingly common, BGP attacks can still be used to

text: content), risks for

text: intercept so-called traffic metadata, i.e. information about which PCs make

text: national security

text: connections, to which domains and IPs, from where, to which domains, when, etc. This

text: (via espionage),

text: can be useful for surveillance and espionage. Capturing, even briefly, a swath of the

text: and so on.

text: internet traffic will give the adversary precious information about the kind of

text: applications people are using on their PCs, smartphones, the kind of websites they are visiting, from where, when, etc. If carried out carefully, subscribers will not immediately

text: notice that an attack is going on.  Internet connection outages: Internet traffic can be disrupted using BGP attacks. It is

text: relatively easy to cause large-scale disruptions. Such attacks are obviously visible. At the same time, considering the dependency of modern society on internet access,

text: disruptions can have severe economic and societal impact.

text: These risks, depending on the setting and the goals of the attacker, in turn lead to risks of largescale societal and economic disruption (via network outages), privacy risks for citizens using the

text: internet (via eavesdropping of internet traffic metadata or content), risks for national security (via espionage), and so on.

text: Sidenote about internet traffic encryption with TLS: Luckily SSL/TLS is becoming more and

text: more widespread and a large part of HTTP traffic now runs over TLS/SSL . Browsers even

text: 7 STEPS TO SHORE UP BGP

text: warn when a website is not HTTPS. Of course SSL/TLS would mitigate the risks 1 and 2 in the list above. It is important to note that, some websites and domains are still not using TLS . Even if this was not the case there is a lot of other internet traffic that remains unencrypted, such as for instance DNS requests. There are also weaknesses in the global certificate system of CAs called PKI that is used for TLS. This year, 2019, started with a series of DNS hijacks used to create fake TLS/SSL certificates via LetsEncrypt for instance. Experts have argued that the metadata is sometimes more telling than the actual content of communications. Finally it should be said that experts have argued that in many settings the communications metadata can be more revealing than the actual content of communications. SSL/TLS does not hide which clients are connecting to which websites, domains and applications.

text: 7 STEPS TO SHORE UP BGP 3. BASIC BGP SECURITY MEASURES

text: BGP security vulnerabilities are a high risk for Europe’s internet backbone. Without mitigating measures, attacking BGP is an easy way for an adversary to eavesdrop, intercept or disrupt Europe’s internet traffic. Attacks on BGP can cause a major impact, on the privacy of European citizens, on the national security of EU countries, and disrupt society and economy. These BGP attacks are not hypothetical as shown by some recent large scale BGP hijacks.

text: Below we shortlist 7 basic BGP security measures which are relatively easy to implement and relatively effective in mitigating BGP hijacks. We deliberately kept this list short and focused on the basics, consulting closely with the technical experts from several providers about costs, complexity and effectiveness.

text: BGP SECURITY EXPLANATION AND REFERENCES MEASURE

text: Electronic communications providers, and other organizations running ASs, should monitor and detect routing anomalies which is fundamental to understand the

text: BGP Monitoring and

text: 1 frequency and impact of BGP attacks aiming at the health of the network. They

text: Detection

text: should monitor the global routing of their traffic in order to assess not only stability and resilience, but also privacy and security of their subscribers.

text: Electronic communications providers, and other organizations running ASs, should make contact data globally accessible and make their routing policies publicly available in IRRs to coordinate with peers. They latter should publish their contact

text: 2 BGP Coordination

text: information and publish their routing policies (using Routing Policy Specification 18 19 20 Language - RPSL ) in IRRs and databases, such as PeeringDB , RIPE and RADb .

text: Electronic communications providers, and other organizations running ASs, should control the prefixes received and advertised. Prefixes in inbound and outbound 3 Prefix Filtering advertisements should be filtered using IP prefix lists, which is an easy to use mechanism that allows operators to control ingress and egress traffic, from and to customers, peers and upstream providers. Prefix filtering is described in detail in RFC 7454 document about ‘BGP Operations and Security’.

text: Electronic communications providers, and other organizations running ASs, should use BGP AS Path filtering. Path filtering is a technique network administrators can use to permit or deny prefixes from certain autonomous systems. Network BGP AS Path administrators can specify different cases in which they should accept or reject

text: Filtering prefixes with particular features in the AS path (i.e. prefixes with private AS numbers in the AS path unless the prefixes are from customers). AS-PATH filtering should be applied to customers, peers and upstream providers. AS-PATH filtering is described in detail in RFC 7454 document about ‘BGP Operations and Security’.

text: Electronic communications providers, and other organizations running ASs, should 5 Bogon Filtering filter bogus prefixes, also known as bogons, which should never appear in the Internet routing table. Some of the prefixes which should be blocked are:

text: 7 STEPS TO SHORE UP BGP

text: 1. IP prefixes allowed for public use that are unallocated and have not been assigned to a Regional Internet Registry (RIR) by Internet Assigned Numbers Authority (IANA). 2. IP prefixes used for private use and IP addresses used for loopbacks 3. RIR-allocated IP space that has not been assigned to an ISP or an enduser. It is worth noting that bogon lists are not static lists and should be kept updated. To support static router configuration, which can be difficult, a possible solution is the Bogon Route Server Project developed by TEAM CYMRU.

text: Electronic communications providers, and other organizations running ASs, should implement TTK Security, which is a lightweight security mechanism used to make BGP sessions harder to spoof. It is based on a value that the BGP receiver should check if it matches with the expected one, during the BGP session. BGP sessions

text: 6 TTL Security (GTSM)

text: should set their values to 255 and check to ensure that their adjacent BGP session packets have the same value. The mechanism should be implemented on directlyconnected BGP peerings. TTL Security (GTSM) is described in detail in RFC 5082 document about ‘BGP Operations and Security’.

text: Electronic communications providers, and other organizations running ASs, should implement RPKI. RPKI adds authentication to the routing system using digital signatures. With RPKI providers can sign the prefix containing the origin AS they

text: 7 RPKI

text: intend to use, generating in this way a Route Origin Authorization (ROA). Using ROAs for the address space they hold, providers can create cryptographically verifiable statements about their routing intent.

text: It is important to underline that this is a shortlist and not a complete guide on BGP security, with all measures and good practices. We encourage organization to follow and take into account other industry good practices and initiatives on BGP. We would like to mention some of them:

text:  MANRS, Mutually Agreed Norms for Routing Security, is a global industry initiative, supported by the Internet Society, to implement crucial fixes needed to reduce the most common routing threats .  BGPsec, specified in IETF RFC 8205, is an extension of the Border Gateway Protocol, designed to assure the authenticity of the AS path, by using digital signatures from each AS propagating announcements .  RIPE NCR recently issued a policy proposal that classifies BGP route leaks are a policy violation .

text: The global internet infrastructure, the backbone, the interconnections, the routing, the domain name system, but also the mobile network infrastructure, has evolved over time. It uses many legacy protocols, designed in the past, often vulnerable to attacks. The problem of vulnerabilities in legacy protocols is a problem that requires continuous attention and effort by providers. SS7 is another example of a legacy interconnection protocol with serious issues . It is crucial that providers keep up to date with good practices in the industry in this regard.

text: We recommend NRAs across Europe to enquire about the above-mentioned BGP security measures with electronic communication providers and other organisations running an AS, in their constituency. In the annex we provide a basic checklist they can use to collect information.

text: 7 STEPS TO SHORE UP BGP

text: We would like to thank the NRAs for their collaboration with us and we are particularly grateful for the technical experts from providers from across the EU who have been forthcoming and open about this cross-cutting cybersecurity issue. We look forward to collaborating with them in the future.

text: 7 STEPS TO SHORE UP BGP A ANNEX: BGP SECURITY MEASURES CHECKLIST

text: BGP SECURITY MEASURES CHECKLIST

text: General Information Organization name Hint: company name Contact point Hint: contact name, email for further questions on this AS Hint: Yes, please specify the AS number, or N/A if no AS.

text: In the latter case please skip the rest of this form

text: BGP Security measure Implementation status Explanation

text: 1. BGP Monitoring & Routing

text: Hint: Yes, No, Partially Hint: pls explain – and in case you do not implement, or only

text: Anomaly Detection

text: partially, explain why, which parts not, plans to implement, etc.

text: 2. BGP Coordination

text: Hint: Yes, No, Partially Hint: pls explain – and in case you do not implement, or only partially, explain why, which parts not, plans to implement, etc.

text: 3. Prefix Filtering

text: 4. BGP AS Path Filtering

text: 5. Bogon Filtering

text: 6. TTL Security (GTSM)

text: 7. RPKI

text: -N -EN -361 -19 -02 TP

text: ABOUT ENIS A

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN 978-92-9204-294-3 doi: 10.2824/66344


text: Part I – Technical Hands-on Workshop ; Part II – ENISA/EC3 Workshop

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.

text: http://www.enisa.europa.eu/activities/cert/other-work/files/operational-gaps-overlaps http://ec.europa.eu/digital-agenda/en/news/policy-critical-information-infrastructure-protection-ciip

text: http://www.enisa.europa.eu/activities/cert/support/supporting-fight-against-cybercrime http://www.team-cymru.org/ https://www.enisa.europa.eu/activities/cert/support/exercise http://au.linkedin.com/pub/cecil-goldstein/6/24a/b57 http://www.botfree.eu/ http://ec.europa.eu/dgs/home-affairs/ https://www.ncsc.nl/

text: http://www.enisa.europa.eu/activities/cert/support/exercise http://www.enisa.europa.eu/activities/cert/support/incident-management/browsable/incident-handlingprocess/information-disclosure

text: ENISA asked the n/g CERT community about their preferences prior to the training. https://www.enisa.europa.eu/activities/cert/support/exercise

text: https://www.enisa.europa.eu/activities/cert/support/exercise https://www.enisa.europa.eu/activities/cert/support/exercise

text: nd rd This workshop followed up on last year’s event and was held in the Europol premises on 2 and 3 of October in The Hague, The Netherlands. As already mentioned, the structure of this meeting changed this year compared to the meeting last year. This year it was decided to have in the first part keynotes from both ENISA and EC3 as well as presentations by the ACDC project, DG Home and the Dutch NCSC. These presentations and keynotes served as a “warm-up” exercise for the participants and to identify some upcoming relevant regulations. The second part of this meeting consisted of training sessions provided by ENISA trainers. The training used new training material produced in 2013. It was considered valuable to have this training also to initiate the discussion and to look at the training topics with both from the prespectives from CERTs and from law enforcement. There were two separate training sessions, namely: - Presenting, correlating and filtering logs and various security feeds; and - Identification and handling of electronic evidence. A third part of this meeting consisted of a round table discussion under Traffic Light Protocol (TLP) Red.

text: 4,5 4 3,5 3 2,5 Results per session 2 1,5 1 0,5 0 Honeypots SCADA&Mobile Team Cymru Training Training Some recommendations from participants for further improvement included the following thoughts: a) open source tools should be more extensively used during training; b) there should be more assurance that all participants can follow the content, there were occasions where the tempo was too quick; c) training should always be lifelike and as close to reality as possible; d) interaction with participants should be more encouraged; Team Cymru was also very pleased with the level of experience of the group. According to the trainer, Cecil Goldstein from Team Cymru, they were a good group to work with and for the most part, more experienced than they had anticipated. It is always very hard to assess the level of experience of the participants before the training. That’s why we asked Team Cymru to be flexible in

text: 4,6 4,4 4,2 4 3,8 3,6 Results per session - Part I 3,4

identifier: 8th ENISA Workshop ‘CERTs in Europe’ report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: Report

type: rubrik

type: stycke

text: European Union Agency for Network and Information Security www.enisa.europa.eu

text: 8th ENISA Workshop ‘CERTs in Europe’

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Jo De Muynck (ENISA) Lauri Palkmets (ENISA)

text: Contact

text: For contacting the authors please use cert-relations@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: The drafting of this Report would not have been possible without the feedback and cooperation kindly provided by a large number of organisations and individuals. Without endeavouring to be exhaustive, the authors would like to thank all who presented and participated in Part I and/or Part II of the workshop for their valuable input. For Part I of the workshop ENISA also would like to thank Team Cymru and ARNIEC/RoEduNet for their part in making this workshop successful. ENISA also would like to thank Europol and more in particular the European Cybercrime Centre (EC3) for hosting this event and the collaboration in organising the ENISA/EC3 Workshop (Part II).

text: Page ii

text: 8th ENISA Workshop ‘CERTs in Europe’

text: Legal notice

text: Copyright Notice

text: ISBN 978-92-9204-085-7 doi: 10.2824/30515

text: Page iii

text: 8th ENISA Workshop ‘CERTs in Europe’

text: Executive summary

text: ENISA’s traditional workshop “CERTs in Europe” has been organised every year since 2005 for the national/governmental (n/g) CERTs in Europe and is one of the most efficient and indispensable methods for ENISA to support the teams in their daily work and to assist in improving their capabilities. In 2011, ENISA started to collaborate with Europol and the first joint workshop was held in Prague that year. The next years the annual ENISA workshop was split in two parts, one part aimed only at n/g CERTs that had a more technical focus and one part aimed at both n/g CERTs and law enforcement representatives, organised together with Europol. The topic of the latter meetings were on cooperation in the fight against cybercrime. This year too, the first part of the workshop focused on hands-on technical training for n/g CERTs in Europe. Doing so, ENISA enhances CERTs capabilities in the EU Member States by provision of good operational practice and the facilitation of suitable training and exercises. Hands-on training for CERT team members on operational topics is essential to improve the capabilities of the team as a whole. Part II of the workshop, the ENISA/EC3 workshop, served as a foreseen follow up event of the workshop held last year together with Europol. It kept the same focus on cooperation between n/g CERTs in Europe and their national law enforcement counterparts. The topic this year was (automated) information sharing. In both events 106 participants were gathered. Austria, Belgium, Croatia, Czech Republic, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden and United Kingdom were the 24 EU Member States that were represented as well as Norway and Switzerland. The following organisations were also represented: CEPOL, ECB, ENISA, European Commission (DG Home), Council of Europe, CERT EU and Europol (EC3). Both events were well received. According to the feedback from the participants given in the evaluation forms, they scored the meeting of their expectations of these workshops on average 4.4 out of 5. This document serves as a means to report on the purpose of these two meetings and is not meant to serve as a set of detailed minutes, especially as a large part of these workshops was focused on trainings as well as invitation-only information sharing through the Traffic Light Protocol - TLP RED.

text: Page iv

text: 8th ENISA Workshop ‘CERTs in Europe’

text: Table of Contents

text: Executive summary iv 1 Introduction 1 2 Methodology 3 3 8 Workshop Part I – Technical Hands-on Training – 21-22.05.2013 5 4 8 Workshop Part II – ENISA/EC3 Workshop – 02-03.10.2013 8 5 Evaluation and lessons learnt 11 6 Action points 13

text: Page v

text: 8th ENISA Workshop ‘CERTs in Europe’

text: 1 Introduction

text: ENISA’s traditional workshop “CERTs in Europe” has been organised every year since 2005 for the national/governmental (n/g) CERTs in Europe and is one of the most efficient and indispensable methods for ENISA for supporting the teams in their daily work and improving their capabilities. Back in 2011 ENISA started to collaborate with Europol on this topic. The first joint workshop was held in Prague that year and had a focus on CERT cooperation with law enforcement. The need to continue with meetings on this topic was identified during this first meeting. In addition, the ENISA study on CERT Operational Gaps and Overlaps from 2011 pointed out that training and education is considered most important by the majority of the CERTs, indicating the insufficient amount of training opportunities for the CERTs currently within the community. ENISA already partially fills this void by supporting TRANSITS trainings and also by facilitating the pan-European incident response exercises which are aimed at the different CERTs, amongst others, because of their role in CIIP . These exercises are of strategic importance in enhancing the security and resilience of the CII sector, in particular by focusing on flexible strategies and processes for dealing with the unpredictability of potential cyber-attacks. ENISA also currently investigates how further technical training could be organised for the operational security specialists (CERTs) and ENISA’s role in this process. By providing this particular training to members of n/g CERTs, ENISA continues to support the CERT community. This is the reasoning behind the decision to split the annual ENISA workshop in two parts since 2012, one part aimed only at n/g CERTs and had a more technical focus and the second part aimed at n/g CERTs and law enforcement representatives, organised together with Europol. This year too, the first part of the workshop focused on hands-on technical training for n/g CERTs in Europe. Doing so, ENISA enhanced CERTs capabilities in the EU MS by provision of good operational practice and the facilitation of suitable training and exercises. Hands-on training for CERT team members on operational topics is essential to improve the capabilities of the team as a whole. Part II of the workshop, the ENISA/EC3 workshop, served as a foreseen follow up event to the workshop held last year together with Europol. It kept the same focus on cooperation between n/g CERTs in Europe and their national Law Enforcement counterparts. The topic this year was on (automated) information sharing. For reference purposes the previous workshops are listed below: - 1st CERT workshop (2005, Brussels, Belgium): Lessons learned and good practices on setting up a CERT, tools used by CERTs, cooperation and legal issues; - 2nd CERT workshop (2006, Brussels, Belgium): Setting-up and cooperation; - 3rd CERT workshop (2007, Porto, Portugal): Mitigation of Massive Cyber attacks; - 4th CERT workshop (2008, Athens, Greece): The role of CERT teams in national incident response plans; - 5th CERT workshop (2010, Heraklion, Crete, Greece): The role of n/g CERTs in national and cross-border exercises and on sharing information; - 6th CERT workshop (2011, Prague, Czech Republic): Addressing NIS aspects of cybercrime;

text: Page 1

text: 8th ENISA Workshop ‘CERTs in Europe’

text: - 7th CERT workshop part I (2012, Valetta, Malta): hands-on technical training; - 7th CERT workshop part II (2012, The Hague, The Netherlands): Addressing NIS aspects of cybercrime; - 8th CERT workshop part I (2013, Bucharest, Romania): Hands-on technical training; - 8th CERT workshop part II (2013, The Hague, The Netherlands): ENISA/EC3 Workshop on (automated) information sharing.

text: Page 2

text: 8th ENISA Workshop ‘CERTs in Europe’

text: 2 Methodology Co-locating ENISA Workshop Part I with 39 TF-CSIRTmeeting

text: Based on the participants’ feedback of the previous year ENISA decided to co-locate the Part I with another major CERT event organised in Europe. This was also one of the recommendations in another ENISA study on Cooperation between CERTs and Law Enforcement Agencies in the fight against cybercrime - A first collection of practices from 2011. The recommendation made in this report was that “cooperation between conference and meeting organisers should be encouraged and meetings should be coordinated as much as possible, to reduce travel and time costs to the minimum”. The TF-CSIRT meetings regularly gather a large number of experts from the CERT operational community in Europe. With this in mind, ENISA addressed RoEduNet, the national research and th education network in Romania, and the host of the 39 TF-CSIRT meeting in order to discuss opportunities regarding a suitable venue for this workshop. Cooperation with the RoEduNet was fruitful and they agreed to host this workshop in the hotel Radisson Blu in Bucharest. Based on ENISA CERT exercise material and Tean Cymrus training portfolio, a two day training agenda was created including for the first time ENISA trainers presenting a part of the ENISA CERT Exercises . The agenda covered two full days of in depth technical training. ENISA’s CERT-relations team worked together with Team Cymru, a not-for-profit Internet security firm that is well known in the CERT community, to deliver a high reputable training for the n/g CERTs representatives. The sessions provided in-depth technical diving into several current security topics including botnets and reverse engineering. Team Cymru Research NFP is an Illinois non-profit and a US Federal 501(c)3 organization. They are a group of technologists dedicated to making the Internet more secure. They work closely with and within Internet security communities, as well as with all kinds of other organisations – recognising the fact that almost every organization in the modern world is connected to the Internet in some way or another, and they all need help to ensure that their parts of the network remain safe and secure. Team Cymru supports the global CERT community on regular basis. The two experienced trainers from Team Cymru, Cecil Goldstein and Kevin Henry, ensured that all participants receive well prepared and accurate content and training.

text: ENISA/EC3 Workshop hosted by Europol

text: The ENISA/Europol event was hosted by Europol in 2012. As most of the participants seemed to find this venue very suitable for these type of meetings and as the European Cybercrime Centre (EC3) was established in January of 2013 Europol offered to host this meeting for a second time. The structure of this meeting changed in comparison to the meeting last year. It was decided to have 7 8 in the first part keynotes from both ENISA and EC3 as well as presentations by ACDC , DG Home and the Dutch NCSC .

text: Page 3

text: 8th ENISA Workshop ‘CERTs in Europe’

text: In the second part of this meeting trainings were provided by ENISA trainers. The training used new material produced in 2013. It was considered valuable to have this training, also to initiate the discussion and to look at the training material with both the prespective from CERTs and law enforcement. The third part of this meeting was organised as a round table discussion under Traffic Light Protocol (TLP) Code Red. Among the topics discussed were issues, cases and (good) practices on cooperation between CERTs and law enforcement. Further details are provided below.

text: Page 4

text: 8th ENISA Workshop ‘CERTs in Europe’

text: ENISA CERT Workshop part I was in many aspects unique. It was the first time that ENISA CERT training was delivered to the European CERT community by ENISA. The topics were chosen in a way that best suited most of the participants and based on the feedback of the community . The workshop was carried out in two parallel tracks, one track focused on honeypots, while the other group received trained in the area of SCADA security and mobile malware.

text: ENISA CERT training scenario 13: Incident handling during an attack on Critical Information Infrastructure

text: In this exercise, more than 20 participants were able to familiarise themselves with specifics on how to conduct incident handling during an attack against Critical Information Infrastructure (CII) and Supervisory Control and Data Acquisition (SCADA) systems. The training contained a role-playing part, with the ENISA trainer acting as “operator”. Additionally the exercise had technical features that required examining network and log information. During the course of the exercise, a broad range of indicators of compromise and material for investigation was presented. This enabled the participants to develop different approaches and paths from the start to the end to make the story more realistic. In the beginning ENISA presented a general introduction to the basics of industrial control systems, that enabled the participants to develop a general technical understanding of SCADA/CII environments and get more familiar with how to handle the organisational obstacles met in typical industrial units. The presentation was followed by a technical case study where ENISA presented evidence in a Virtual Image to build up a case in order for participants to have hands-on experience. The time allocated for the hands-on part was limited and proved to be the bottleneck of the exercise as participants noted on the feedback sheets that there should have been more time allocated to the exercise. This is a learning point for future exercises of this type.

text: Page 5

text: 8th ENISA Workshop ‘CERTs in Europe’

text: ENISA CERT training scenario 16: Mobile threats incident handling

text: The aim of this training session was to bring into this workshop a “flavour” of mobile devices and their specifications. This part of the workshop was mostly hands-on and focused on a known malware related to Zeus that was placed inside an emulated Android phone. The malware (Zitmo) was created to intercept SMS messages containing transaction authentication numbers (TAN) and forward them to a server controlled by the attackers. During the investigation participants could clearly see the malicious transaction that application initiated. There was additionally a reverse engineering part where participants used different tools to rebuild Android application source code as close to original code as possible. Apart from the technical challenge, this training covered also legal challenges impacting the ability to handle incidents, acquire and analyse data. Especially in combination with “Bring Your Own Device” (BYOD) or the usage of company owned devices for private purposes that might impact the ability to handle incidents. Some participants gave very good feedback to this exercise, but a general remark was the limited time allocated to the hands on part and that the tutor progressed too quickly as a result of this.

text: ENISA CERT training scenario 23: Honeypots

text: Honeypots provide for a proactive approach in detecting security incidents before they happen without any impact on the production environment. The objective of the training was to familiarise students with two kinds of honeypots: client-side and server-side honeypots. In the first part of the training a couple of scenarios related to the client-side honeypots posing as vulnerable browsers trying to visit compromised websites URL which had different behaviours depending on the browser. The attendees had to analyse the output of the honeypot and find which browser version was targeted by the webpage. In the second part other scenarios related to server-side honeypots

text: Page 6

text: 8th ENISA Workshop ‘CERTs in Europe’

text: were presented. In this case the honeypots behaved like vulnerable servers which were attacked and compromised. Again the attendees had to analyse the events and identify the type of attacks, attack vectors and source of the attacks.

text: A day in the life of malware-example

text: On the second day Team Cymru focused on understanding the operations and nature of malware by following the life cycle of a piece of malware from compromising a target machine and creation of a botnet, to the observation and identification of malware, its capture, extraction and subsequent analysis. In the analysis phase emphasis was given on how to understand if the analysis can provide clues and information to assist tracking the botnet. Participants were heavily engaged in the identification of the botnet through network based analysis, followed by extraction and analysis of malware using both static and dynamic processes. The exercises were conducted on virtual machines.

text: Page 7

text: 8th ENISA Workshop ‘CERTs in Europe’

text: 4 8 Workshop Part II – ENISA/EC3 Workshop – 02-03.10.2013 Keynotes

text: Both organising organisations, ENISA and Europol (EC3), gave a keynote. For ENISA, Steve Purser, Head of the Core Operations Department talked about the EU Cyber Security Strategy and the Proposal for an NIS Directive and the impact this Strategy and Directive will have. He also mentioned the importance of meetings such as this ENISA/EC3 meeting. Troels Oerting, Head of European Cybercrime Centre (EC3), talked about the importance of collaboration and of the newly set up European Cybercrime Centre and its recent activities. He also stressed the importance of cooperation and mentioned that EC3 is actively cooperating with for example the Dutch NCSC.

text: Presentations

text: a) The European Commission (DG HOME, César Alonso Iriarte and Cathrin Bauer-Bulst) gave a brief update on the legislative and practical framework for cooperation and information exchange between the public and private sectors. César Alonso Iriarte reported on the findings of his fellowship research on public-private cooperation, highlighting the need for setting up arrangements allowing to overcome potential hurdles to the activities involved in the partnership under each legal order, such as those deriving from rules on privacy, classified information, liability and competition; incentives for both sides to participate; a certain stability of the interaction; and, perhaps most importantly, a measure of trust between the participants. Cathrin Bauer-Bulst spoke about the current rules on reporting and legislative proposals in the pipeline that include reporting obligations, such as the proposal for a Network and Information Security directive recently made by DG Connect. She also gave an overview of a few coordination initiatives and of EU funding in this area.

text: Page 8

text: 8th ENISA Workshop ‘CERTs in Europe’

text: b) Elly van den Heuvel, General Manager at the Dutch National Cyber Security Center (NCSC) presented on the Dutch perspective. The NCSC is a government initiative and aims at bringing several existing initiatives together. In general, secure networks are the responsibility of various different parties in The Netherlands, and its NCSCs task to provide links between these parties. From the organisational point of view the centre falls under the responsibility of the National Coordinator for Counterterrorism and Security of the Ministry of Security and Justice. Its foundations however are organised in a public-private cooperation. Elly van den Heuvel stressed the importance of cooperation and collaboration. c) Wout de Natris and Thorsten Kraft on the Advanced Cyber Defence Centre (ACDC). ACDC aims to set up national support centres in Europe with the German botfrei.de initiative as an example. The project consists of two parts.  The first basic idea is to clean up end user systems through an alert to the affected end user system. This initiative would include the aid of a support centre and would also involve a corresponding website and free disinfection tools which would be provided through this website.  The second part of the project is about gathering, analysing and distributing data on botnet generated traffic and abuse in and through a central database. The ACDC project seeked for partners in the (mainly CERT) community.

text: Training sessions

text: One full morning was spent on a technical training given by ENISA trainers from the CERT relations team. The training used new training material produced in the year 2013, namely: - Presenting, correlating and filtering logs and various security feeds; and - Identification and handling of electronic evidence.

text: In this training the participants learned through practical examples, how to correlate different logs and several security feeds, in order to identify on-going attacks, investigate past attacks and automate the incident handling process.

text: In this part the trainees were presented with the principles of evidence gathering. A common knowledge of the requirements regarding evidence admissibility in a court of law was established. The exercise also gave an overview of malware characteristics, methods of identification and tools that may be used at the scene.

text: Round table discussion

text: The biggest part of this workshop was a round table discussion under TLP Code Red to discuss about the current issues on cooperation between CERTs and LEA in Europe. The session was moderated by ENISA. Due to the TLP Red status,it is not possible to summarise this debate in this report. However, before the round table discussion started, Jaap van Oss, head of Focal Point Cyborg of the EC3, was invited to present a proposal about the necessity to have new and innovative ways of conducting investigations between law enforcement and non-law enforcement entities (e.g. CERTs). The question at hand was if it would be possible to set up operations together with CERTs to take down

text: Page 9

text: 8th ENISA Workshop ‘CERTs in Europe’

text: botnets. On the one hand, this encourages CERTs to help law enforcement and keep them up to date and on the other, it provides law enforcement to benefit from the expertise of CERTs. EC3 offered to facilitate and guide these ‘joint operations’. The question was if there is an interest in such cooperation and if CERTs and law enforcement would be able to participate in the near future? Additionally, which information and legislation is necessary for such cooperation and what would be needed to combine/exchange information? The process would include the exchange of intelligences packages and could have three different levels of escalating mitigation measures in mind. From the discussion it became clear that for law enforcement and (most of the) CERTs represented in the room there is a clear willingness for such cooperation. To actually organise a ‘joint operation’, it is necessary to have proper coordination to overcome the legal and operational challenges. Additionally it is necessary to create a framework to exchange information. This will take time and will not be perfect the first time, but is a system that needs to grow. The difficulty is that CERTs do not have the same organisation or mandate in the different countries; these particularities must be taken into account in such cooperation efforts. Nevertheless, the relationship between law enforcement and CERTs needs to deepen.

text: Page 10

text: 8th ENISA Workshop ‘CERTs in Europe’

text: 5 Evaluation and lessons learnt

text: Spread over both events 106 participants were representing 24 EU Member States as well as Norway and Switzerland. Also CEPOL, ECB, ENISA, European Commission, Council of Europe, CERT EU and Europol (EC3) had sent representatives. The workshops were a great success. According to the feedback from the participants given in the evaluation forms, they scored the meeting of their expectations of these workshops on average 4.4 out of 5. With regards to the overall evaluation of the event ENISA is satisfied with the level of active participation in the trainings. Orally, ENISA received some very good feedback on the quality of the training from the participants directly during the events. Their satisfaction was also confirmed in their evaluation with high scores of their expectations of the workshops.

text: 8th Workshop Part I – Technical Hands-on Training

text: For Part I of the Workshop ENISA received overall a score of 4,41 out of 5, which is an excellent result, especially taking into account that this was the first time that ENISA experts gave such trainings! All participants who filled in the feedback gave very positive impression with regards to the current and future workshops.

text: Results per session - Part I

text: Page 11

text: 8th ENISA Workshop ‘CERTs in Europe’

text: this regard and to be able to adapt to a more experienced group. However, a comment we heard a lot, both orally but also written in the evaluation forms, is that people would prefer to have two tracks with different level of difficulty. This is certainly something we have to keep in mind for a next training workshop.

text: 8th Workshop Part II – ENISA/EC3 Workshop

text: The total average score the participants gave for this workshop in the evaluation was 4.21 out of 5. The presentations, keynotes and especially the round table discussion was found interesting by most participants. Regarding the trainings the opinions were more divided. This was also the most prominent feedback that was provided, namely that for the next workshop we should specify more precisely in our invitations which kind of representatives we expect. At this workshop there was a mix of more technical and managerial people. Most participants expressed their interest to participate in the follow up of this event and found the venue very suitable for these kind of meetings.

text: Results per session - Part I

text: Page 12

text: 8th ENISA Workshop ‘CERTs in Europe’

text: 6 Action points

text: There are no action points for Part I of the workshop. The following sessions hence only covers action points from the ENISA/EC3 Workshop (Part II).

text: 1. EC3, together with ENISA, will come up with a proposal of what exactly they request from the CERTs with regards to the cooperation on the takedown of botnets. This would be sent to the participants of the meeting, as well to the ENISA n/g CERTs mailing list to reach out to teams that were not represented. The CERTs should from their part analyse if this proposal is possible and provide feedback.

text: 2. An analysis should be made of the target audience for these meetings. A clear goal and agenda should be created to make sure the right people are attending. This analysis should be done by the EC3 and ENISA when preparing for next years meeting.

text: 3. The question was raised if training opportunities are useful in these CERT-LEA meetings? The answer to this question heavily depends on the analysis of the target audience. This question should be answered by ENISA and EC3when preparing for next years meeting.

text: Page 13

text: 8th ENISA Workshop ‘CERTs in Europe’

text: Page 14

text: 8th ENISA Workshop ‘CERTs in Europe’

text: TP -04 -13 -183 -EN -N

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece doi: 10.2824/30515

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu Page 15 www.enisa.europa.eu


text: 4 Analysis of data: The data collected through Definition of good practices for desk research and interviews was analysed governance: Thereafter, good practices to identify good practices in the design of a and trends in setting up governance governance framework. models have been defined and validated by national experts, before publication.

text: STRATEGIC GOVERNANCE OPERATIONAL GOVERNANCE

text: Ensures translation of Coordinates the NCSSs into actions to processes of drafting improve cybersecurity the strategy and across the society. building the governance model Aims to increase from the outset. cybersecurity across all levels and sectors of a Ensures cooperation nation’s society, for identifying and economy, and mitigating risks. government.

text: TECHNICAL GOVERNANCE POLITICAL GOVERNANCE

text: Encompasses the Provides general and definition and use of legal framework and standards and establishes processes, specifications. roles and responsibilities. Ensures inclusion of Ensures accountability, tools, technology, and transparency and certification schemes acceptance of the accompanying the NCSSs, its policies and implementation of the all related processes. strategy.

text: In place (100%) In place (89.47%) In place (73.68%)

text: Not in place (10.53%) Not in place (26.32%)

text: Focus on cooperative and Focus on participatory collaborative approaches at approaches, including Collaboration with PPPs international, inter-sectoral various stakeholder groups and regional levels

text: In place (84.21%) In place (84.21%) In place (63.16%) In place (89.47%)

text: Not in place (15.79%) Not in place (15.79%) Not in place (36.84%) Not in place (10.53%)

text: Creation of specialised Clear definition of Creation of roles and government authorities, responsibilities, definition allocation of responsibilities in bodies and agencies to Creation of PPPs of roles and tasks in case relation to international ensure governance of of incidents cooperation on cybersecurity cybersecurity

text: In place (61.11%) In place (61.11%) In place (72.22%)

text: Not in place (38.89%) Not in place (38.89%) Not in place (22.22%)

text: Don't know (5.56%)

text: Establishment of a legal Emphasis on human rights in governance/legal framework International cooperation in legal measures/legal linked to specific legal relation to legal measures framework measures

text: Political processes Involve all stakeholders in the process of developing an NCSS and a Provide political support in the governance model (choose the right development and implementation of level of representation for the different NCSS and governance models. stakeholders) Ensure adequate coordination and Set up a collaborative platform to cooperation among the relevant monitor the progress of the action players. plan.

text: Build trust between the different stakeholders. Create a monitoring plan for entities in the domain of cybersecurity.

text: Follow participatory approaches by Define a concrete accompanying putting in place platforms of exchange Action Plan to set out measures for implementing the objectives of the Ensure support from the highest strategy. political level in the creation of Public- Private Partnerships.

text: Roles and responsibilities Legal measures

text: Mandate a single body to ensure the Ensure that the governance coordination and the implementation framework is supported by and of the overall strategy. defined in accordance with the legal framework. Precisely define roles and responsibilities of the different stakeholders involved in the governance model in one document.

text: Create PPPs.

text: In place (100%) In place (57.89%) In place (100%) Not in place (42.11%) Pre-defining a governance model for the implementation Institutional support foreseen Risk identification and of the NCSS in parallel to to implement the NCSS mitigation supported by drafting the NCSS created agencies

text: In place (73.68%) In place (68.42%) In place (78.95%) Not in place (15.79%) Not in place (26.32%) Not in place (10.53%) Don't know (10.53%) Don't know (5.26%) Don't know (10.53%) Coherent approach for risk Planning of allocation of Mechanisms to ensure identification & mitigation budget and resources and accountability, transparency, across government entities integration of cybersecurity and human rights during risk and other critical into the use of these identification & mitigation infrastructure operators

text: Strategic aspects of risk identification and mitigation In Relation to the NCSS and its implementation

text: Develop the budget from bottom to top. Follow a common methodology for risk identification.

text: Include a paragraph on financials in NCSS. Thorough risk identification across different levels. Definition of accountability and transparency rules. Early on identification of risks and implementation of risk assessment mechanisms. Include legislation ensuring human rights in the NCSS. Follow a common framework in case of incidents.

text: In place (89.47%) In place (94.44%) Not in place (5.26%) Don't know (5.56%) Don't know (5.26%)

text: Awareness raising, knowledge and capacity building Awareness raising, knowledge and capacity building within the complete workforce/population within the cybersecurity relevant workforce

text: In place (89.47%) Not in place (5.26%) Don't know (5.26%)

text: Incident response mechanisms and support of CSIRTs/CERTs

text: In place (84.21%) Not in place (10.53%) Don't know (5.26%)

text: Information sharing processes during the incident response (formal and informal)

text: Awareness Raising Information Sharing

text: Tailored awareness raising and training campaigns. Centralise information sharing.

text: Incident Response

text: Formalise a coordinated approach between Taxonomy of best practices to ensure coherent CSIRTs. processes of information sharing.

text: In place (77.78%) Not in place (16.67%) Don't know (5.56%) Technical governance for cybersecurity based on international standards and technical guidelines

text: In place (55.56%) Not in place (38.89%) Don't know (5.56%) Implemented/defined use of tools and technology

text: International Standards and Technical Guidelines Develop in the NCSS and its governance model a section focused on the international standards and technical guidelines. When developing this section, specify which technical standards should be used, and define clear roles and responsibilities. Use of Tools, Technology, and Certification Schemes Have in place a body that supervises the compliance of regulated entities with the European and international requirements. Use certification schemes for ICT products, ICT services and ICT processes, especially for all the services or activities provided by essential entities. The competent authorities should be empowered to apply sanctions consisting of the suspension of a certification or authorisation concerning part or all the services provided by an essential entity. Put in place in the NCSS action plan a group of tasks focused on using tools and technologies in respect to human rights, particularly to GDPR.

identifier: A Governance Framework for National Cybersecurity Strategies

amnesord:
State of cybersecurity in the EU
National Cybersecurity Strategies

text: A GOVERNANCE FRAMEWORK FOR NATIONAL CYBERSECURITY STRATEGIES February 2023

text: ABOUT ENISA The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT For contacting the authors please use team@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS Anna Sarri, Gema Fernández Bascuñana (ENISA) Ann-Kristin Gross, Federico Chiarelli, Marina Preasca (Wavestone)

text: ACKNOWLEDGEMENTS ENISA would like to thank and acknowledge all the expert that took part and provided valuable input for this report and especially the following, in alphabetical order:

text: Andrés Jesus Ruiz Vazquez (Spain); Center for Cyber Security (Denmark), Chief Advisor; Centre for Cybersecurity (Belgium); Croatian National Security Authority, Senior Advisor, Vinko Kuculo; Cyber Security Coordination and Policy Department (the Netherlands), Gijs Peeters; Cyber Security Coordination and Policy Department (the Netherlands), Pieter van den Berg; Department for Secure Communication, Senior Advisor and Sweden’s Liaison Officer to ENISA (Sweden), Peter Wallström; Department of Environment, Climate & Communications, Staff Engineer, Cyber Security & Internet Policy Division (Ireland), James Caffrey; Digital Security Authority of Cyprus, Technical Officer, Costas Efthymiou; Digital Security Authority of Cyprus, Technical Officer, Giorgos Loninos; Federal Chancellery, Department I/8 – Cyber Security, GovCERT, NIS-Office and ZAS (Austria), Deputy Head, Christian Zec; Federal Ministry of the Interior (Germany), Sascha-Alexander Lettgen; International Server Security Authority (Greece), Head of Competent Department for Cyber Security Strategic Planning, Emmanouil Patsourakis; International Server Security Authority (Greece), Head of the Directorate for Cyber Security, Ioannis Alexakis; Malta Information Technology Agency, Katia Bonello; Malta Information Technology Agency, Martin Camilleri; Ministry of Home Affairs, Security, Reforms and Equality (Malta); Ministry of Economic Affairs and Communication, Department of National Cyber Security (Estonia), Kristjan Kaskman; Ministry of Economic Affairs and Communication, Department of National Cyber Security (Estonia), Martin Sepp; Ministry of National Defence of Lithuania; National Cybersecurity Agency (Italy); National Cyber and Information Security Agency, National Strategy and Policy Unit (Czech Republic), Tomáš Kellner; National Cyber Security Centre (Finland), Olli Lehtilä; National Security Authority (Slovakia).

text: ENISA would also like to thank for their valuable contribution to this study, all the experts that provided input, but prefer to stay anonymous.

text: LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPRYRIGHT NOTICE © European Union Agency for Cybersecurity (ENISA), 2023 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover and on cover page: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-589-0

text: DOI: 10.2824/211856

text: Catalogue number: TP-04-22-152-EN-N

text: SCOPE, OBJECTIVES & AIM

text: The EU Cybersecurity Act states that ENISA shall support the Member States in developing national strategies on the security of network and information systems, promote the correct deployment of those strategies and set up a governance framework that ensures the sustainability of national strategies (National Cybersecurity Strategy - NCSS). As part of this mandate, ENISA launched this study to perform a systematic review of the governance models relevant to the deployment of an NCSS to identify and select the most relevant instances, lessons learned, and good practices from the Member States.

text: This study aims to collect insights on the definition of processes, roles and responsibilities, the subsequent deployment of monitoring measures and what are the main challenges and good practices that the European countries put in place to ensure an effective governance framework for the implementation of current and future NCSSs of the EU Member States.

text: DEFINITIONS

text: CYBERSECURITY ACT (CSA)

text: The CSA establishes a cybersecurity certification framework and introduces rules for EU-wide certification of ICT products, processes and services. Additionally, it grants ENISA a permanent mandate and increased responsibilities and resources to support cybersecurity across the Union.

text: GOVERNANCE

text: Governance describes a complex system, defining roles, responsibilities, processes and relationships. Governance includes stakeholders from and covers the private sector, the public administration as well as the civil society and spans over different topics such as economic, social and political priorities.

text: CYBER GOVERNANCE

text: “Operation of decision-making processes” which increase and ensure “participation, transparency, and accountability in taking measures related to cyberspace together with the mechanism of international agreements, strategies, laws, measures, regulations, and standards that interlock in the best way” (Efe & Bensghir, 2019).

text: GOVERNANCE MODEL A governance model provides a framework to systemise and organise stakeholders, actions, processes, and relationships to reach defined objectives of a policy, strategy or political system. This study assesses governance models based on their political, strategic, operational and technical elements to reach the objectives of the NCSS.

text: METHODOLOGICAL APPROACH

text: SCOPE AND OBJECTIVES

text: Collection of experts and stakeholders' Desk Research: The desk research has been points of view: In this context, 19 focused on good practices adopted in the EU stakeholders from 18 EU Member Member States, while insights collected from States have been interviewed. The around the world complement the analysis. national stakeholders have all been part of the national authority or government body in charge of the cybersecurity strategy.

text: INTERVIEWED MEMBER STATES

text: 18 Member States interviewed

text: Austria Greece Belgium Ireland Croatia Italy Cyprus Lithuania Czech Republic Malta Denmark Netherlands Estonia Slovakia Finland Spain Germany Sweden

text: THE NCSSs in the EU

text: NCSS generation in the EU

text: Out of the 27 Member States: 9 Member States have 3rd or later generation NCSS; 14 Member States have a 2nd generation NCSS; 4 Member States are at their first NCSS.

text: Every EU Member State is obliged, following the NIS Directive, to develop and implement a National Cybersecurity Strategy (NCSS) to ensure fostering security of network and information systems across the Union. Each NCSS aims to set out a plan of actions to improve the security and resilience of national infrastructure systems and services. It aims to provide a high-level topdown approach to cybersecurity and to establish a range of national objectives and priorities.

text: However, the fast and ever-evolving cyberspace calls for constantly developing and adopting the NCSS and hence consistent monitoring and evaluation of the NCSS is necessary. Additionally, establishing a functioning and effective governance model for the implementation of the current and future NCSSs is essential to foster cybersecurity across the Union and to reach the national strategies' as well as the institutions' objectives in this relation.

text: The creation of a central body in charge of the successful deployment of the NCSS is uniquely 100%

text: affected by the type of government or its self-

text: of the interviewed

text: governance.

text: stakeholders have in

text: Some of the factors that play a role in the

text: place a central

text: definition of the mandate of such a body are

text: cybersecurity body.

text: related to the dimension of the country, stage of maturity and the country's self-governance.

text: DEVELOPING AN EFFECTIVE GOVERNANCE MODEL FOR NCSSs

text: STRATEGIC GOVERNANCE

text: GOVERNANCE

text: TECHNICAL OPERATIONAL

text: MODEL

text: GOVERNANCE GOVERNANCE

text: FOR NCSSs

text: POLITICAL GOVERNANCE

text: Elements of Political Governance

text: SCOPE AND OBJECTIVES

text: Overview of the implementation status across the interviewed EU Member States

text: POLITICAL PROCESSES ROLES AND RESPONSIBILITIES LEGAL MEASURES

text: Good Practices for Political Governance

text: Elements of Strategic Governance

text: SCOPE AND OBJECTIVES

text: THE NCSS AND ITS IMPLEMENTATION STRATEGIC ASPECTS OF RISK IDENTIFICATION AND MITIGATION Good Practices for Strategic Governance

text: Elements of Operational Governance

text: SCOPE AND OBJECTIVES

text: AWARENESS RAISING INCIDENT RESPONSE INFORMATION SHARING Good Practices for Operational Governance

text: Elements of Technical Governance

text: SCOPE AND OBJECTIVES

text: INTERNATIONAL STANDARDS & TECHNICAL GUIDELINES USE OF TOOLS, TECHNOLOGY AND CERTIFICATION SCHEMES Good Practices for Technical Governance

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ENISA European Union Agency for Cybersecurity

text: Athens Office Agamemnonos 14, Chalandri 15231, Attiki, Greece

text: Heraklion Office 95 Nikolaou Plastira 700 13 Vassilika Vouton, Heraklion, Greece

text: ISBN: 978-92-9204-589-0 enisa.europa.eu DOI: 10.2824/211856

type: vagledning

utgivare: enisa