text: Phishing target attacks. Source: Proof Point

text: Office 365 Phishing e-mail, credit Dropsuite

identifier: ENISA Threat Landscape 2020 - Phishing

nummer: phishing

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: ENISA Threat Landscape 2020 - Phishing

serie: rapporter

text: From January 2019 to April 2020

type: rubrik

text: Phishing

text: ENISA Threat Landscape

text: Overview

text: Phishing is the fraudulent attempt to steal user data such as login credentials, credit card information, or even money using social engineering techniques. This type of attack is usually launched through e-mail messages, appearing to be sent from a reputable source, with the intention of persuading the user to open a malicious attachment or follow a fraudulent URL. A targeted form of phishing called ‘spear phishing’ relies on upfront research on the victims so that the scam appears more authentic, thereby, making it one of the most successful types of attack on enterprises’ networks. An emotional response justifies many people actions when they are phished and is exactly what hackers are looking for. In a training context, that is what a phishing simulation should try to achieve. Training e-mail users is one of the often used measures for preventing phishing, but results are not convincing since threat actors are constantly changing their modus operandi. The domain-based message authentication, reporting, and conformance (DMARC) standard ensures that e-mail from fraudulent domains is blocked, diminishing the rate of success of  phishing, spoofing and spam attacks. In the future, e-mail continues to be the number one mechanism for phishing but not for long. We are already seeing an increase in the use of social media messaging, WhatsApp and others to conduct attacks. The most relevant change will be in the methods used to send the messages, which will become more sophisticated with the adoption of adversarial Artificial Intelligence (AI) to prepare and send the messages. Phishing and spear phishing are major attack vectors of other threats such as  unintentional insider threats .

text: 26.2_billion of losses in 2019 with Business E-mail Compromise (BEC) attacks 42,8%_of all malicious attachments were Microsoft Office documents increase in phishing scams in only 1

text: month during the COVID-19 pandemic 30%_of phishing messages were delivered on Mondays 32,5%_of all the e-mails used the keyword ‘payment’ in the e-mail subject

text: Kill chain

text: Phishing Reconnaissance Weaponisation Delivery Exploitation Step of Attack Workflow Width of Purpose Command & Actions on Installation Control Objectives The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker. MORE INFORMATION

text: Trends

text: _Most targeted types of services are webmail and software-as-a-service According to some projections, phishing attacks targeting software-as-aservice (SaaS) and webmail services surpassed those against payment services for the first time in Q1 2019, making them the most targeted sector at 36% of all phishing attacks. This new record follows the trend in 2018 when SaaS and webmail services had just overtaken the financial sector . Although the figure had dropped to 30,8% by the end of 2019, the 2,3 services mentioned above still remained at the top of the list , with Microsoft 365 services being the phishers’ top target. _Business Email Compromise (BEC) attacks continued to be a problem A recent study identified that 88% of worldwide organisations experienced spear phishing attacks and 86% of them faced BEC attacks. In 2019, one of the most targeted service was Microsoft 365 and the main focus was on harvesting credentials. Once these credentials had been acquired, the attacker was able to collect more organisational data, a process that could last for weeks or months18 and could then lead to spear-phishing attacks. The attacker would impersonate an employee, chief executive officer (CEO) or even a trusted supplier to divert funds or re-route payments to third-party accounts. In Q1 2019, companies were targeted by BEC attacks 120% more frequently than a year earlier , resulting in losses as high as US $26,2 billion (ca. €22,2 billion). _More than two thirds of phishing sites adopted HTTPS There has been a steep increase over the past few years in the number of phishing sites that have adopted HTTPS. In the last quarter of 2019, 74% of phishing sites were using HTTPS , a significant increase compared with just 32% only 2 years earlier. Although technologies such as HTTPS and SSL are designed to secure communications between a client and a server, the presence of a lock in an icon at the browser’s address bar may create the illusion that a website can be trusted. Threat actors may also use legitimate sites they have hacked to host phishing content, therefore making it challenging for the end-user to identify a site as unsafe . Other factors contributing to the steep rise in HTTPS usage are the plethora of free certificate services such as Let’s Encrypt and the fact that modern browsers mark every HTTPS site as secure, without any further checks. 6% SaaS/Web mail 8% Telecom 34% Cloud storage/File hosting 22% Payment Financial institution 4% Social media 4% 22% Ecommerce, retail

text: Trends

text: _Phishing-as-a-Service (PhaaS) on the rise These types of services are typically subscription-based or in the form of a kit, available to download for a fee, and remove the technological barriers to entry, as they allow a less technically skilled individual to carry out a targeted attack. A report from a security researcher identified 5.334 unique phishing kits available by June 2019. What was even more concerning was the relatively low cost of these solutions, around US $50- $80 for a monthly subscription. The same report declared that 87% of the kits included evasion mechanisms such as HTML character encoding and content encryption. Interestingly, some of these services were hosted on legitimate cloud services with proper domain name system (DNS) names and certificates. Statistics from just one of these dark-net marketplaces show how successful these attacks are allowing the attacker or group to steal around 65.000 accounts per month. _Trends in incidents  There was a change in the effectiveness of phishing attacks using cloud storage, DocuSign, and Microsoft cloud services.  Impostor attacks include schemes like business e-mail compromise (BEC) and identity deception techniques based on social engineering to make phishing campaigns more effective.  Microsoft 365 services phishing was the top scheme, but the focus remains on credential harvesting.  Over 99% of e-mails distributing malware required human intervention following links, opening documents, accepting security warnings, and other behaviours - to be effective. __Top phishing themes in 2019  Generic Email Credential Harvesting  Office 365 Account Phishing  Financial Institution Phishing  Microsoft OWA Phishing  OneDrive Phishing  American Express Phishing  Chalbhai Generic Phishing  Adobe Account Phishing  Docusign Phishing  Netflix Phishing  Dropbox Account Phishing  LinkedIn Account Phishing  Apple Account Phishing  Postal/Shipping Company Phishing  Microsoft Online Document Phishing (Excel and Word)  Windows Settings Phishing  Google Drive Phishing  PayPal Phishing 32 Source: Proof Point

text: Trends

text: _COVID-19 used as a phishing lure Cybercriminals are taking advantage of the public fear of the COVID-19 pandemic, which first appeared in late 2019. It has been reported that phishing attacks involving the virus increased by 667% in a 1-month period (between the end of February 2020 and the end of March 2020), and these types of schemes alone represented a notable 2% of all phishing scams. New scams involved phishing e-mails designed to look as if they originated from the United States Centre of Disease Control (CDC) , the World Health 7 8 Organisation or even from university health teams . They either falsely claimed to showcases of infection in the victim’s area or shared medical experts’ opinions to lure the victim to follow a malicious link. For this 8,9 reason, the FBI and WHO have issued warnings. Because many people in quarantine were working from home, often using outdated security systems , cybercriminals were seeking to exploit emerging opportunities and vulnerabilities . _ENISA’s response to the COVID-19 pandemic The outbreak of COVID-19 has brought an immense change in the way we conduct our lives. In this increasingly connected world, we can fortunately continue our professional and private lives virtually. During this unprecedented time, the EU Agency for Cybersecurity (ENISA) shared its cybersecurity recommendations on a variety of topics including working remotely, shopping online, and e-health as well as providing updates on key security advice tailored to the sectors affected. ENISA reviews the threat landscape during the pandemic and produces advice on how to mitigate the risks from the most critical threats. Special attention given to phishing due to the escalation in the number of attacks. ENISA YouTube video about COVID-19. Source ENISA

text: Incidents

text: _Targeted sectors The healthcare sector was heavily targeted by phishing (or spearphishing) attacks in 2019. A security researcher considered phishing as the main attack vector of the year, through the use of social engineering  tactics to deliver e-mails infected with malware or with links pointing to infected websites. Other sectors were also targeted by phishing attacks such as governments and other public administration entities. For example, in November and December 2019, several diplomats and officials from the Ukrainian government received spear-phishing e-mails directing then to compromised websites. _Attack vectors Spear phishing remains an extremely prevalent initial access technique used by malicious actors. These use a variety of social engineering tactics to induce recipients to open attachments or navigate to a infected website. Spear-phishing messages typically contain malicious macroenabled Microsoft Office documents, or a link to such documents. After a user selects ‘Enable Content’, the embedded macro will typically begin the execution of a chain of obfuscated scripts that ultimately results in the download of stage one or dropper malware. JavaScript and PowerShell appear to remain the most popular scripting languages for this purpose. __Examples _A phishing attack to Lancaster University students’ resulted in the loss of personal data _Hackers phished login credentials of 2500 Discord users _Online fitness service provider victim of a phishing attack _Patients affected in UConn Health phishing attack _A car manufacturer subsidiary lost US $37 million (ca. €31 million) due to a BEC scam

text: Mitigation

text: _Proposed actions  Educate staff to identify fake and malicious e-mails and stay vigilant. Launch simulated phishing campaigns to test organisation’s infrastructure as well as the responsiveness of the staff.  Consider the use of a security e-mail gateway with regular (possibly automated) maintenance of filters (anti-spam, anti-malware, policybased filtering).  Consider applying security solutions that use machine-learning techniques to identify phishing sites in real-time.  Disable automatic execution of code, macros, rendering of graphics and preloading mailed links at the mail clients and update them frequently.  Implement one of the standards for reducing spam e-mails: SPF (Sender Policy Framework) , DMARC (Domain-based Message Authentication, Reporting & Conformance) and DKIM (Domain Keys Identified Mail).  Ideally, use secure e-mail communication using digital signatures or encryption, for critical financial transactions or when exchanging sensitive information.  Implement fraud and anomaly detection at the network level for both inbound and outbound e-mails.  Avoid clicking on random links, especially short links found in social media.  Do not click on links or download attachments if you are not absolutely confident about the source of an e-mail.  Avoid over-sharing personal information on social media, e.g. duration of absence from office or home, flight information etc. as it is actively used by threat actors to collect information about their targets.  Check the domain name of the websites you visit for typos, especially for sensitive websites, e.g. bank websites. Threat actors usually register fake domains that look similar to legitimate ones and use them to ‘phish’ their targets. Looking only for an HTTPS connection is not enough.  Enable two-factor authentication whenever applicable to prevent account takeovers.  Use a strong and unique password for every online service. Re-using the same password for various services is a serious security issue and should be avoided at all times. Using strong and unique credentials for every online service limits the risk of a potential account takeover to only the affected service. Using a password manager software will make managing of the whole set of passwords easier.  When wiring money to an account, double-check the bank recipient’s information through a different medium. Unencrypted and unsigned e-mails should not be trusted, especially for sensitive use-cases such as this.  Check how contact, registration, subscription and feedback forms work on your website and add verification rules if necessary so that they cannot be exploited by attackers.

text: References

text: 1. “What Is Phishing?”.Cisco. https://www.cisco.com/c/en/us/products/security/emailsecurity/what-is-phishing.html

type: stycke

text: 2. “Phishing Activity Trends Report Q1”. 2019. APWG. https://docs.apwg.org/reports/apwg_trends_report_q1_2019.pdf

text: 3. “2018 Phishing Trends& Intelligence Report” 2018. Phishlabs. https://info.phishlabs.com/hubfs/2018%20PTI%20Report/PhishLabs%20Trend%20Report_2018digital.pdf

text: 4. “Microsoft remains phishers’ #1 target for the fifth straight quarter” August 22, 2019. Vade Secure. https://www.vadesecure.com/en/phishers-favorites-q2-2019/

text: 5. “Threat Spotlight: Coronavirus-Related Phishing”. March 26, 2020. https://blog.barracuda.com/2020/03/26/threat-spotlight-coronavirus-related-phishing/

text: 6. “Coronavirus phishing emails: How to protect against COVID-19 scams” 2020. https://us.norton.com/internetsecurity-online-scams-coronavirus-phishing-scams.html

text: 7. “Covid-19 Drug Advice From The WHO Spoofed to Distribute Agent Tesla Info-Stealer”. 2020. IBM. https://exchange.xforce.ibmcloud.com/collection/Covid-19-Drug-Advice-From-The-WHO- Disguised-As-HawkEye-Info-Stealer-2f9a23ad901ad94a8668731932ab5826

text: 8. “Abnormal Attack Stories #6: Coronavirus Credential Theft” March 13, 2020. https://abnormalsecurity.com/blog/abnormal-attack-stories-6-coronavirus-credential-theft/

text: 9. “FBI Sees Rise in Fraud Schemes Related to the Coronavirus (COVID-19) Pandemic”. March 20,

text: 2020. FBI. https://www.ic3.gov/media/2020/200320.aspx

text: 10. “Beware of criminals pretending to be WHO”. 2020. WHO. https://www.who.int/about/communications/cyber-security

text: 11. “Global police agencies issue alerts on Covid-related cyber-crime”. April 6, 2020. SC Magazine. https://www.scmagazineuk.com/global-police-agencies-issue-alerts-covid-related-cybercrime/article/1679473

text: 12. “Catching the virus cybercrime, disinformation and the COVID-19 pandemic”. April 3, 2020. EUROPOL. https://www.europol.europa.eu/publications-documents/catching-virus-cybercrimedisinformation-and-covid-19-pandemic

text: 13. “New FireEye Email Threat Report Reveals Increase in Social Engineering Attacks”. June 25,

text: 2019. FireEye. https://www.fireeye.com/company/press-releases/2019/new-fireeye-email-threatreport-reveals-increase-in-social-engin.html

text: 14. “HTTPS Protocol Now Used in 58% of Phishing Websites”. June 24, 2019. Trend Micro. https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/httpsprotocol-now-used-in-58-of-phishing-websites

text: 15. Let’s Encrypt. https://letsencrypt.org/

text: 16. “2020 ‘State of the Phish’: Security Awareness Training, Email Reporting More Critical as Targeted Attacks Spike”. January 23, 2020. Proof Point. https://www.proofpoint.com/us/securityawareness/post/2020-state-phish-security-awareness-training-email-reporting-more-critical

text: 17. “Human factor report”. 2019. Proof Point. https://www.proofpoint.com/sites/default/files/gtd-pfpt-us-tr-human-factor-2019.pdf

text: 18. “Phishing Activity Trends Report Q3”. 2019. APWG. https://docs.apwg.org/reports/apwg_trends_report_q3_2019.pdf

text: 19. “Business Email Compromise Results in $26B in Losses Over the Last Three Years”. September 12, 2019. Proof Point. https://www.proofpoint.com/us/corporate-blog/post/businessemail-compromise-results-26b-losses-over-last-three-years

text: 20. “Business Email Compromise The $26 Billion Scam” September 10, 2019. FBI. https://www.ic3.gov/media/2019/190910.aspx

text: 21. “Evasive Phishing Driven by Phishing-as-a-Service”. July 1, 2019. Cyren. https://www.cyren.com/blog/articles/evasive-phishing-driven-by-phishing-as-a-service

text: 22. “Phishing made easy: Time to rethink your prevention strategy?”. 2016. Imperva. https://www.imperva.com/docs/Imperva-HII-phishing-made-easy.pdf

text: 23. “Q3 2019: Email Fraud and Identity Deception Trends”. 2019. Agari. https://www.agari.com/insights/ebooks/2019-q3-report/

text: 24. “FBI: BEC Losses Soared to $1.8 Billion in 2019”. February 12, 2020. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/fbi-bec-losses-soared-to-18/

text: 25. “Email: Click with Caution”. June 2019. Cisco. https://www.cisco.com/c/dam/en/us/products/collateral/security/email-security/email-threatreport.pdf

text: 26. “Experts report a rampant growth in the number of malicious, lookalike domains”. November 18, 2019. https://securityaffairs.co/wordpress/94021/hacking/lookalike-domains-tlscertificate.html

text: 27. “Proofpoint Q3 2019 Threat Report — Emotet’s return, RATs reign supreme, and more”. November 7, 2019. Proof Point. https://www.proofpoint.com/us/threat-insight/post/proofpointq3-2019-threat-report-emotets-return-rats-reign-supreme-and-more

text: 28. “Human Factor Report.” 2019. Proof Point. https://www.proofpoint.com/sites/default/files/gtd-pfpt-us-tr-human-factor-2019.pdf

text: 29. “2019 Phishing and fraud report” 2019. F5 Labs. https://www.f5.com/content/dam/f5-labsv2/article/pdfs/F5Labs_2019_Phishing_and_Fraud_Report.pdf

text: 30. “Report: Microsoft, PayPal, and Netflix Most Impersonated Brands in Phishing Attacks in Q1 2019” May 8, 2019. Trend Micro. https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/reportmicrosoft-paypal-and-netflix-most-impersonated-brands-in-phishing-attacks-in-q1-2019

text: 31. “Spam and phishing in Q3 2019”. November 26, 2019. Kaspersky. https://securelist.com/spam-report-q3-2019/95177/

text: 32. “Phishing Activity Trends Report”. 2019. APWG. https://docs.apwg.org/reports/apwg_trends_report_q4_2019.pdf

text: 33. “Toyota Subsidiary Loses $37 Million Due to BEC Scam” September 20, 2019. CPO Magazine. https://www.cpomagazine.com/cyber-security/toyota-subsidiary-loses-37-million-due-to-becscam/

text: 34. Open SPF. http://www.openspf.org/

text: 35. “Domain-based Message Authentication, Reporting & Conformance “. DMARC. https://dmarc.org/

text: References

text: 36. “DomainKeys Identified Mail (DKIM)”. DKIM. http://www.dkim.org/

text: 37. “Cyber incident”. July 22, 2019. Lancaster University. https://www.lancaster.ac.uk/news/phishing-attack

text: 38. “Hackers publish login credentials of 2500 Discord users” July 22, 2019. Cyware Social. https://cyware.com/news/hackers-publish-login-credentials-of-2500-discord-users-8d3ea2c7

text: 39. “Bodybuilding.com Breach: Proof That An Organization's Biggest Cyber Risk Is Its People” April 24, 2019. Forbes. https://www.forbes.com/sites/jameshadley/2019/04/24/bodybuilding-combreach-proof-that-an-organizations-biggest-cyber-risk-is-its-people/#1ea113751bef

text: 40. “Phishing Attack Exposes 600k Health Records” June 19, 2019. Secure World. https://www.secureworldexpo.com/industry-news/healthcare-data-breach-example-2019

text: 41. “326,000 Patients Impacted in UConn Health Phishing Attack”. February 25, 2019. Health IT Security. https://healthitsecurity.com/news/326000-patients-impacted-in-uconn-health-phishingattack

text: 42. “Cybercrime Tactics and Techniques: the 2019 state of healthcare”. 2019. Malwarebytes. https://resources.malwarebytes.com/resource/cybercrime-tactics-and-techniques-the-2019state-of-healthcare/

text: 43. “Significant Cyber Incidents”. 2019. CSIS. https://www.csis.org/programs/technology-policyprogram/significant-cyber-incidents

text: 44. “More Than 99% of Cyberattacks Need Victims' Help”. September 9, 2019. Dark Reading. https://www.darkreading.com/cloud/more-than-99--of-cyberattacks-need-victims-help/d/did/1335769

text: 45. “office-365-phishing-attacks-deconstructed” https://dropsuite.com/office-365-phishingattacks-deconstructed/

text: 46. ENISA. https://www.enisa.europa.eu/topics/wfh-covid19

text: “An emotional response justifies many people actions when they are phished and is exactly what hackers are looking for.” in ETL 2020

text: Related

text: ENISA Threat Landscape Report The year in review A summary on the cybersecurity trends for the period between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report List of Top 15 Threats ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020. ENISA Threat Landscape Report Research topics Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence. ENISA Threat Landscape Report Sectoral and thematic threat analysis Contextualised threat analysis between January 2019 and April 2020. READ THE REPORT ENISA Threat Landscape Report Emerging trends Main trends in Cybersecurity observed READ THE REPORT between January 2019 and April 2020. ENISA Threat Landscape Report Cyber Threat Intelligence overview The current state of play of cyberthreat intelligence in the EU. READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242 Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

type: vagledning

utgivare: enisa


text: Converged Security Practices Proactive Prevention Strategies Cloud Solutions AI and Deep Learning IP camera systems Liability Multi-factor authentication with biometrics IoT Intelligent Sensors

text: Siloed Security Practices Detection Strategies On-premise Solutions Video Management Systems (VMS) and (DVR) Risk 2-factor authentication Non-Intelligent Sensors

text: Source: Boonedam blog

text: Step of Attack Workflow

text: Width of Purpose

text: The Cyber Kill Chain framework was developed by Lockheed Martin, adapted from a military concept related with the structure of an attack. To study a particular attack vector, use this kill-chain diagram to map each step of the process and reference the tools, techniques and procedures used by the attacker.

text: MORE INFORMATION

text: Source: ORACLE & KPMG

text: “Physical Security Guide”. Kisi. https://pages.getkisi.com/physical-security-guide

text: Jonathan Wackrow. “Security Convergence: Addressing Evolving Cyber and Physical Security

text: Threats”. 2019. Teneo. https://www.teneo.com/vision-book/2019/security-convergenceaddressing-evolving-cyber-and-physical-security-threats/

text: Pierluigi Paganini. “Modern Physical Security Awareness Is More Than Dumpster Diving

text: [Updated 2019]”. August 27, 2019. Infosec Institute. https://resources.infosecinstitute.com/modern-physical-security-awareness-is-more-thandumpster-diving/#gref

text: Pierre Bourgeix. “2019: What's In & Out in Physical Security”. 2019. Boon Edam.

text: Danny Bradbury. “Killer USB Breach Highlights Need For Physical Security”. April 23, 2019.

text: Infosec Magazine. https://www.infosecurity-magazine.com/infosec/usb-breach-physical-security- 1-1-1/

text: “PCI DSS Quick Reference.” July 2018. PCI Security Standards Council.

text: “76% Security Professionals Face Cybersecurity Skills Shortage: Report.” May 7.2020. CISOMAG.

text: ‘2019 Landscape Report: Hosted Security Adoption In Europe.’ 2019. Morphean.

text: Catalin Cimpanu. “Crooks use digger to steal ATMs in Northern Ireland as ATM physical attacks

text: rise across the EU.” April 16, 2019. ZDNet. https://www.zdnet.com/article/crooks-use-digger-tosteal-atms-in-northern-ireland-as-atm-physical-attacks-rise-across-the-eu/

text: Jovi Umawing. “Everything you need to know about ATM attacks and fraud: Part 1.” May 29,

text: 2019. Malwarebytes Labs. https://blog.malwarebytes.com/101/2019/05/everything-you-need-toknow-about-atm-attacks-and-fraud-part-1/

text: ‘ATM Explosive Attacks - Dutch ATMs to be shut down overnight to counter ATM explosive

text: attacks.’ December 19, 2019. European Association for Secure Transactions (EAST). https://www.association-secure-transactions.eu/dutch-atms-to-be-shut-down-overnight-tocounter-atm-explosive-attacks/

text: ‘2019 Payment Security Report’, 2019 Data Breach Investigations Report. Verizon.

text: “2019 Payment Threats and Fraud Trends Report.” December 9, 2019. European Payments

text: “2019 Eye on Privacy Report.” 2019. MediaPRO. https://pages.mediapro.com/Eye-on-Privacy- Report-2019-LP.html

text: ‘Report: 2020 State of Privacy and Security Awareness.” 2020. MediaPRO.

text: “Oracle and KPMG Cloud Threat Report.” 2019. ORACLE & KPMG.

text: in ETL 2020

text: A summary on the cybersecurity trends for the period between January 2019 and April 2020.

text: READ THE REPORT

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: Recommendations on research topics from various quadrants in cybersecurity READ THE REPORT and cyberthreat intelligence.

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: Main trends in Cybersecurity observed

text: READ THE REPORT

text: between January 2019 and April 2020.

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu

identifier: ENISA Threat Landscape 2020 - Physical manipulation/ damage/ theft/ loss

nummer: physical-manipulation-damage-theft-loss

text: ENEN From January 2019 to April 2020

text: Physical manipulation/ damage/ theft/ loss

text: ENISA Threat Landscape

text: Overview

text: Physical tampering, damage, theft and loss has drastically changed in the past few years. The integrity of devices is vital for technology to become mobile and for most implementations of the Internet of Things (IoT). IoT can enhance physical security with more advanced and complex solutions. This way, IP security-based systems with smart sensors, Wi-Fi cameras, smart security lighting, drones and electronic locks can provide surveillance data that are evaluated by Artificial Intelligence (AI) and Machine Learning (ML) mechanisms to identify threats and respond with minimum delay and maximum accuracy. However, intelligent buildings, mobile devices and smart wearables can be exploited to bypass physical security measures.

text: In 2019, ATM and POS related physical attacks continued in Europe and worldwide, but the resulting losses were lower than the average over the past decade. The good news is that the companies, IT managers and decision makers are leaning towards hybrid cyber and physical security plans, although in the past physical security was not a priority.

text: _New and outdated security practices

text: Kill chain

text: Reconnaissance Weaponisation Delivery Exploitation

text: Physical damage/loss/ theft

text: Command & Actions on Installation Control Objectives

text: Trends

text: _Physical access is the biggest backdoor

text: In April 2019, Vishwanath Akuthota, pleaded guilty to vandalism, having destroyed equipment with an electric charge using a malicious USB device. The devices destroyed were owned by the College of Saint Rose in Albany, New York, the college Akuthota had graduated from. For the purpose of this attack, he accessed 66 workstations and numerous monitors and digital podiums. The ‘USB killer’ key he used was purchased online. The college spent more than US $50.000 (ca. €42.452) replacing the equipment and more than US $7.000 (ca. €5.943) in paying the employee who dealt with this incident. Akuthota faced 10 years imprisonment and a maximum fine of US $250.000 (ca. €212.257).

text: _Physical security lacks corporate attention

text: During 2019, various surveys of physical security took place. Some of these surveys focused on CEOs, IT managers and decision-makers across several industries, and the results give a good idea on how physical security is handled within companies. CEOs across industry sectors appeared to lean towards a combined cyber and physical security plan to protect their assets against threats, considering factors such as insider threats, the importance of infrastructure and the integrity of the company’s networks. In these combined security plans, the most emphasis, budget and personnel were given to investments in cybersecurity (i.e. 83-86% of the respective resources), while 14-17% of the company’s resources were spent on physical security. In Europe, the majority of IT managers (77%) stated that the physical security of their company’s assets was outdated.

text: _Physical security as-a-service

text: A trend in 2019 was enhancing physical security by enabling hosted security solutions. The majority of IT managers’ security plans had already shifted towards cloud-and IoT-enabled scheme or they were planning to make this shift in a 12-month period. The decision-makers reported that they were already evaluating video surveillance-as-a-service (VSaaS) and access control as-a-service (ACaaS) solutions to improve incident detection and minimum response times and reduce false positive rates. VSaaS and ACaaS improved both physical security and cybersecurity, although just a few of the IT managers identified physical security as their priority.

text: _ATMs’ physical security failed the test of time

text: Just as was observed in 2018, in this reporting period, ATMs were vulnerable to tampering and physical damage with the ultimate goal of stealing the cash within. In Ireland nine incidents were reported in Q1 2019 alone. Some of the attackers were very dramatic using stolen diggers, breaking down walls, and scooping the ATMs into vans or cars. In other cases, the attacks were completed within minutes using explosives, chain lassoing, and ram-raiding. In the Netherlands, 71 ATM bombing attacks (Plofkraken in Dutch) took place in one November’s weekend alone, compared with 43 similar attacks during the whole of 2018. ABN AMRO bank was forced to remove 470 vulnerable ATMs, and the Dutch Banking Association (NVB) decided to shut down all cash machines nationwide every night between 11 p.m. and 7 a.m. during December. 2019 is the fourth consecutive year that physical attacks on ATMs haves increased.

text: Trends

text: _ ATM tampering

text: During 2019, the main expressions of ATM tampering were card trapping, cash trapping and transaction reversal fraud. The big picture for the year is that ATM and petrol pump tampering decreased, thanks to the increase in EMV payments. The EMV standard, named after the three companies that introduced it (i.e. Europay, Mastercard, and Visa), describes the specifications for smart cards, payment terminals and ATMs. EMV cards (aka Chip and PIN or chip cards) integrated circuit chips. The adoption of EMV cards disrupted card-present fraud, at least partially. Unfortunately, EMV cards have not yet been widely implemented outside Europe and even within Europe, only a few countries have adopted geo control, an EMV card’s anti-fraud utility.

text: _ Incidents

text:  Killer USB breach highlights need for physical security. Vishwanath Akuthota, an alumnus of the College of Saint Rose in Albany, New York, pleaded guilty for vandalising equipment using a malicious USB device.  Crooks use digger to steal ATMs in Northern Ireland. The number of physical attacks on ATMs is rising across the EU.  Dutch Plofkraken. Explosive attacks (known as ‘Plofkraken’) Dutch ATMs. Mostly focused on ABN AMRO bank’s machines because of a vulnerability. It led the bank to remove about 470 of its cash machines across the Netherlands.

text: __Findings of breaches were caused by physical actions

text: of cybersecurity incidents started or

text: ended with a physical action th most implemented malicious action on assets

text: 5 _

text: was physical attacks on ATMs of data breaches across all sectors

text: included a physical attack as the main method of IT managers use cloud-based video

text: surveillance or access control of employees consider leaving sensitive

text: information in publicly accessible areas the most serious threat to data security of over 1.000 employees surveyed reported

text: behaving in ways and adopting practices identified as risky for physical security

text: Mitigation

text: _Proposed actions

text:  Use encryption in all information storage and flow that is outside the security perimeter (devices, networks, cloud services, etc.).  Use asset inventories to keep track of users’ devices and remind owners to check availability.  Ensure limited access to areas containing sensitive information or equipment.  Implement well-documented physical security policies and integrate physical security measures with digital ones to achieve a holistic approach.  Use insurance policies to cover losses to both physical and cyberrelated risks.  Develop user guides for mobile devices (smartphones, tablets, laptops, etc.) and follow best practices.  Establish well-communicated procedures for the physical protection of assets, including loss, damage and theft.  Ensure that devices are disposed after personal or sensitive information had been securely deleted.  Reduce the response time for theft, damage and loss incidents.  Implement multi-factor authentication combining user credentials with biometrics, smart cards or other physical tokens.  Inspect devices periodically for alterations or replacements.  Implement processes to detect authorized visitors or employees and assign proper access rights.  Implement access monitoring systems, access control systems, strong access credentials, and smart access devices (e.g. smart locks, smart keys) for areas housing sensitive equipment.

text: _Most preferable alternatives for user’s credentials in MFA

text: Finger print

text: Secure ID

text: 5% 20%

text: SMS/Smartphone

text: Facial recognition

text: 8% PIV/CAC cards

text: Iris/retina scanning

text: Yubikey smart card

text: Tokens 17% Don’t know

text: References

text: “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.”

text: Related

text: ENISA Threat Landscape Report The year in review ENISA Threat Landscape Report List of Top 15 Threats ENISA Threat Landscape Report Research topics ENISA Threat Landscape Report Sectoral and thematic threat analysis ENISA Threat Landscape Report Emerging trends ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: About

text: _ The agency

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contributors

text: Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker.

text: Editors

text: Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA).

text: Contact

text: For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-354-4 DOI: 10.2824/552242


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Governance Framework for European standardisation

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: 2 3 In response to the European Union’s Cybersecurity Strategy , the CSCG has published a White Paper with recommendations on digital security. The CSCG’s recommendations underline the importance of Cybersecurity standardisation to complete the European internal market and to raise the level of Cybersecurity in Europe in general. CSCG Recommendation #1 proposes a review of the current governance framework. This document analyses the good practices within the governance framework of the European Union and proposes recommendations for stakeholders. It has been written by CSCG and ENISA experts as a response to the Recommendation #1 and forms a logical entity together with the response to the CSCG Recommendation #2, Definition of Cybersecurity – Gaps and overlaps in standardisation, published by ENISA at the same time.

text: http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667 ETSI CEN CENELEC Cybersecurity Coordination Group, http://www.cencenelec.eu/standards/Sectors/DefenceSecurityPrivacy/Security/Pages/Cybersecurity.aspx Recommendations for a Strategy on European Cybersecurity Standardisation ftp://ftp.cencenelec.eu/EN/EuropeanStandardization/Sectors/DefenceSecurityPrivacy/Cybersecurity/CSCG_WhitePa per2014.pdf

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: Please refer to ENISA paper Definition of Cybersecurity – Gaps and overlaps in standardisation, published jointly with this one. http://www.networkworld.com/article/2318241/lan-wan/security-s-inseparable-couple.html

text: v1.0 | December 2015

text: v1.0 | December 2015

text: ENISA paper published together with this one A disruptive technology is one that displaces an established technology and shakes up the industry or a groundbreaking product that creates a completely new industry.

text: v1.0 | December 2015

text: Sustaining technology relies on incremental improvements to an already established technology. Global System for Mobile Communications Intelligent Transport System

text: v1.0 | December 2015

text: v1.0 | December 2015

text: http://www.cencenelec.eu http://www.iso.org/va http://www.etsi.org

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: v1.0 | December 2015

text: https://ec.europa.eu/digital-agenda/en/european-multi-stakeholder-platform-ict-standardisation https://ec.europa.eu/digital-agenda/news/commission-decision-28-november-2011-setting-european-multistakeholder-platform-ict https://ec.europa.eu/digital-agenda/en/rolling-plan-ict-standardisation

text: v1.0 | December 2015

identifier: Governance framework for European standardisation

nummer: policy-industry-research

title: Governance framework for European standardisation

text: Aligning Policy, Industry and Research

text: V1.0 DECEMBER 2015 About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: This report has been written by an expert group formed by members of the ETSI/CEN/CENELEC Cybersecurity Coordination Group (CSCG) including ENISA. The main contributors include:  Charles Brookson – Zeata Security Ltd  Scott Cadzow  Ralph Eckmaier  Jörg Eschweiler  Berthold Gerber  Alessandro Guarino – UNI  Kai Rannenberg – Goethe University Frankfurt, DIN  Jon Shamah  Sławomir Górniak – ENISA

text: Contact

text: For contacting the authors please use isdp@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: ENISA would like to thank the numerous experts from Standards Development Organisations, industry, foundations and others who reviewed this paper for their contributions.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged.

text: ISBN 978-92-9204-154-0 DOI 10.2824/358519

text: Table of Contents

text: Executive Summary 5

text: 1. Introduction 7

text: 2. Particularity of Cybersecurity 8

text: 3. Objectives of coordinated approach towards Cybersecurity standardisation 10

text: 4. Review of current governance framework 12

text: The big picture 12

text: European Cybersecurity Standardisation Governance 13

text: 4.2.1 European Standardisation Organisations 13 4.2.2 European Union Bodies 14 4.2.3 Policy and standardisation: how the EU interacts with the ESOs 15

text: 5. Good practices in Cybersecurity standardisation 17

text: Stakeholders 17

text: 5.1.1 European Standardisation Organisations (ESOs) 17 5.1.2 National standardisation/normalization bodies 17 5.1.3 Policy and administration 17 5.1.4 Industry and research 17 5.1.5 Consumer and community 18 5.1.6 Education 18

text: Procedures 18

text: Cybersecurity Coordination Group (CSCG) 19

text: 6. Recommendations for stakeholders 20

text: Executive Summary

text: Cybersecurity differs from other areas because the systems to which best practices (including formal guidelines and standards) are to be applied are by nature socio-technical systems, where people and technological elements are strictly intertwined. The social part of the systems comprises a plurality of actors and stakeholders. In technical domains primarily a restricted and controllable set of actors is to be found. All these different actors can have conflicting interests in protecting their security – the ongoing debate on the confidentiality of individual users of Cyberspace versus the necessities of national security is only the most striking example.

text: The role of standardisation and policy, in their interaction with Cyberspace and Cybersecurity is similarly complex and this is possibly best exemplified with regard to privacy legislation. From these considerations it follows that a purely technical, classical standardisation approach is likely to fail in such a domain as Cybersecurity. With people being part of the system to be secured, purely technical standards and guidelines have to be complemented by organisational, societal ones. In standardisation policy a multidisciplinary approach would be very useful but it appears hard to achieve.

text: In order to avoid market fragmentation, limited take up of standards, and by consequence, failure to achieve a secure Cyberspace and the application of standardised measures for Cybersecurity, a coordinated approach is needed. The overall objective of this coordinated approach towards Cybersecurity standardisation should meet the following individual objectives, observed by all stakeholders involved:

text:  Cybersecurity standards should be developed through consensus among all stakeholders, including European Standardisation Organisations (ESOs), European institutions and industry;  Cybersecurity standards should be approved under the auspices of a recognised body;  The distribution of mandated work for the development of Cybersecurity standards should be coordinated by the recognised bodies;  Recognised bodies should make their development work programme public and coordinate with other recognised bodies to eliminate duplication and possible overlaps.

text: Specific requirements concerning Cybersecurity standardisation outlined above, with their far-reaching consequences, call for new and more efficient modalities of interaction among the main actors – the European Standardisation Organisations, the European Commission, the industry – and other stakeholders.

text: 1. Introduction

text: In the Cybersecurity strategy of the European Union, the EU reaffirms the importance of all stakeholders in the current Internet governance model and supports the multi-stakeholder governance approach. Indeed, the multi-stakeholder approach is fundamental to the development of successful standards, particularly in the area of Cybersecurity where public sector requirements are implemented to a large extent by private sector service providers.

text: In the field of promoting a Single Market for Cybersecurity products, the Cybersecurity strategy underlines the importance of the ETSI CEN CENELEC Cybersecurity Coordination Group (CSCG) and ENISA, by stating: ‘the Commission will support the development of security standards’; ‘Such work should build on the ongoing standardisation work of the European Standardisation Organisations (CEN, CENELEC and ETSI), of the Cybersecurity Coordination Group (CSCG) as well as on the expertise of ENISA, the Commission and other relevant players’.

text: The Cybersecurity Coordination Group (CSCG) of CEN, CENELEC and ETSI is the only joint group of the three officially recognised European Standardisation Organisations with a mandate to coordinate Cybersecurity standards within their organisations. The CSCG was created in late 2011 to provide strategic advice on standardisation in the field of IT security, Network and Information Security and Cybersecurity.

text: In response to the European Union’s Cybersecurity Strategy, the CSCG has published a White Paper with recommendations on digital security. The CSCG’s recommendations underline the importance of Cybersecurity standardisation to complete the European internal market and to raise the level of Cybersecurity in Europe in general.

text: CSCG Recommendation #1 states:

text: The European Commission should mandate the CSCG to create a governance framework for the coordination of Cybersecurity standardisation within Europe. The CSCG recommends that the European Commission should consult the CSCG on all harmonisation and standardisation issues related to Cybersecurity. Within the European Cybersecurity initiative, the CSCG shall be the relevant point of contact for a cooperative network for the exchange of best practices, assisting its members in building coordinated capacity and steering the organisation of harmonised standardisation projects. The CSCG also recommends that the European Commission should establish a legal framework throughout the EU, enabling the complete and seamless implementation of harmonised and mature Cybersecurity standards.

text: Although the fulfilment of this recommendations in such a form would be formally impossible due to the legal framework put in place, this document analyses the good practices within the governance framework of the European Union and proposes recommendations for stakeholders.

text: 2. Particularity of Cybersecurity

text: It is not easy to provide a unique definition of the term ‘security’ . In common language technology related to security has been difficult to unequivocally identify. Linguistic barriers are present; the terms ‘security’, ‘safety’ and ‘privacy’ often are used in common language as synonyms. There are scoping issues too, as national security, personal security, corporate security etc. are also considered. Taking this into account in the technology domain of information security, a rough consensus has been derived around the CIA (Confidentiality, Integrity and Availability) paradigm. Thus applying this CIA paradigm we can protect a document from revealing information to an eavesdropper, we can detect if a document has been manipulated, and we can control access to a document. When scenarios are presented, the actors in the CIA paradigm are also broadly agreed by a rough consensus as Alice and Bob, who wish to exchange their documents without the adversary Eve gaining any useful information or in any way adversely impacting the activities of Alice and Bob .

text: However whilst the CIA paradigm works well in a document structured world, and can be applied with some success in multi-party transactions, it may have reached its limit as we move towards a new level of infrastructure, the internet being the representative and the most pervasive instantiation of such a change. Complementing the CIA paradigm with other attributes, such as identification and non-repudiation of documents and files appears necessary.

text: The public Internet and the underlying IT infrastructure (nowadays mainly operated by telecommunications companies owned by private or private-public shareholders) has become a critical infrastructure for both businesses and individual users. Growing dependence on networked digital systems has brought with it an increase in both the variety and quantity of Cyberthreats. The different methods governing secure transactions in the various Member States of the European Union sometimes make it difficult to assess the respective risks and to ensure adequate security. In a classical document based CIA paradigm the roles of Alice, Bob and Eve are relatively simple to isolate. The movement to a world where we move away from classical documents towards shared data, shared computing resources, shared networking resources and shared processing there is an increasing fuzziness in determining the role of each of Alice, Bob and Eve.

text: Cybersecurity is not an entity that is simple to classify. It is not the application of cryptography to encrypt a document, or to authenticate a user of a computer system. Cybersecurity as a domain looks at the security of infrastructures, devices, services and protocols, as well as security tools and techniques to ensure security. The role of a Cybersecurity expert is to offer security advice and guidance to users, manufacturers and network and infrastructure operators.

text: Cybersecurity may be classified as the set of techniques required to provide security assurances in Cyberspace. The characteristics of Cyberspace thus need to be examined in order to provide a true Cybersecurity framework.

text: One key characteristic of Cyberspace is that it is an infrastructure that is shared by all business domains, all social domains, all countries and all citizens. Increasingly the users of Cyberspace are not human but are

text: machines thus Cyberspace is the infrastructure that underpins the Internet of Things, Intelligent Transport, eHealth and several other applications. The end result is that Cyberspace is the critical infrastructure of all things and thus will be host to criminal and terrorist actions just as much as the host to citizens, industry and government. This key characteristic, of criminals sharing infrastructure with their victims, of governments sharing with their citizens, of nation states sharing infrastructure with the neighbours and competitors is new and distinguishes Cyberspace and Cybersecurity from previous generations.

text: Cybersecurity differs from other areas because the systems to which best practices (including formal guidelines and standards) are to be applied are by nature socio-technical systems, where human beings and technological elements are strictly intertwined. The social part of the systems is comprised of multiple actors and stakeholders. In technical domains primarily a restricted and controllable set of actors can be encountered. All these different actors can have conflicting interests in protecting their security – the ongoing debate on the confidentiality of individual users of Cyberspace versus the necessities of national security are only the most striking example.

text: The role of standardisation and policy, in their interaction with Cyberspace and Cybersecurity is similarly complex and this is possibly best exemplified with regard to privacy legislation. From these considerations it follows that a purely technical, classical standardisation approach is likely to fail in such a domain as Cybersecurity. With people being part of the system to be secured, purely technical standards and guidelines have to be complemented by organisational, societal ones. In standardisation policy a multidisciplinary approach is an essential requirement that has yet to become accepted. Key disciplines to be involved include engineering, sciences, law, political sciences etc.

text: 3. Objectives of coordinated approach towards Cybersecurity standardisation

text: The notion of a standard is derived from its definition as: ‘a document, established by consensus and approved by a recognized body, that provides, for common and repeated use, rules, guidelines or characteristics for activities or their results, aimed at the achievement of the optimum degree of order in a given context’ (ETSI from ISO/IEC Guide 2:1996, definition 3.2).

text: Parties taking part in a standardisation process and its stakeholders are described in the ENISA paper Definition of Cybersecurity – Gaps and overlaps in standardisation . Industry has a specific role there, as industrial de-facto standards are widespread. Within the private sector, industrial interest in standardisation activities in the area of NIS tends to be driven by areas of work that are in line with the core interests of product developers or service providers (for example authentication, billing, etc.). Aligning public sector goals with standardisation priorities of the private sector remains challenging.

text: Where information security is concerned, there is clearly room for improvement in identifying and responding to evolving risks and technology developments. In particular, the time lag between the appearance of a new technology or technically driven business model and the availability of applicable standards is still too long.

text: In the coordination of the approach to standards for Cybersecurity the developers of standards should be encouraged to work to achieve consensus on technical matters in the context of recognized bodies. The overall objective of a coordinated approach towards Cybersecurity standardisation should therefore meet the following individual objectives:

text:  Cybersecurity standards should be developed through consensus;

text:  Cybersecurity standards should be approved in a recognised body;

text:  The distribution of mandated work for the development of Cybersecurity standards should be coordinated by the recognised bodies;

text:  Recognised bodies should make their development work programme public and coordinate with other recognised bodies to eliminate duplication and to minimise overlap.

text: Failure to achieve these objectives is likely to have a negative impact on the achievement of a secure Cyberspace (see section 2) and the application of standardised measures for Cybersecurity.

text: The identification of a recognised body for standardisation in the Cybersecurity domain has to remain flexible because technology development does not take place in strictly controlled environments. Disruptive technologies have the capability to change markets and where such technologies change Cyberspace or the use of it, the role of recognised bodies that develop standards for such modified markets is likely to change too. In contrast, many of the current recognised bodies maintain what have

text: been termed ‘sustaining technologies’ but as standards are often at the leading edge of the market there is already a degree of fluidity of participants in the principal standards bodies as they seek to develop a 9 10 disruptive technology (e.g. GSM , ITS ) to a sustaining technology and to bypass many of the oft-quoted problems of disruptive technologies (e.g. immaturity, low reliability, low performance).

text: Large scale involvement in standardisation is often a reflection of market potential of a specific product or service. The nature of Cyberspace that enables assets to be networked together both in non-real-time and real time is enabled by a relatively small set of technologies. The capabilities offered by the small set of technologies have enabled the growth of Cyberspace itself. However the Cyberspace and the economic activity it supports requires a response of comparable magnitude to enable its protection.

text: 4. Review of current governance framework

text: A governance framework in the discussed area is a set of rules and practices applied to assure that European Cybersecurity standardisation activities are aligned with EU strategies and that they stay on track to achieve the goals and implemented in a correct way, allowing for measuring of performance. It should make sure that stakeholders’ interests are taken into account and define roles and responsibilities and procedures for proper supervision, control and information flows.

text: While it is important to understand how Cybersecurity frameworks can assist in IT and information security governance, and what regulatory processes are in place to affect governance, it is equally important to address the issues that inhibit Cybersecurity governance. There is a need for individual care and corporate/governmental driven Cybersecurity governance. Organizations such as businesses and governmental entities should recognize and take steps to minimize risks associated with the use of Information Technology (IT). IT governance is the involvement of all stakeholders in the management process of an organization while security governance involves the board of directors, executives and business owners. Regulatory compliance and increased risk influence IT managers to consider security as a part of their operations and dictates the development of internal governance policies. While there are several tools to assist in the process of governance, organizations have not consistently adopted these tools due to the absence of a formally worldwide adopted sanction. Additionally, factors exist that may influence the process of Cybersecurity governance and include factors such as adoption of Cybersecurity governance frameworks and organizational users understanding their role in the era of IT.

text: The big picture

text: Governance of Cyberspace in general is a complex problem, and Cybersecurity is only one of the objectives that it should achieve. It somewhat developed in an ‘organic way’, with relatively few controls and centralised supervision. There are limited controls on the provision of address space, on the establishment of the core DNS servers that enable much of the internet to operate, and on the allocation and ownership of TLDs. This model – it must be kept in mind – has allowed the development of the Internet as we know it today and its myriad applications, both commercial and non-commercial. Security was not a concern in the development of the technology that underpins all this but we have reached a point where its necessity, for States, corporations, and individual users alike, is obvious to all.

text: Information security governance – as distinct from security management – builds the accountability framework and assures the necessary oversight on risk mitigation. The process of security governance deals with aligning security strategies to the organisational strategic objectives, which in the case of nation-states are usually stated in their laws, regulations and Cybersecurity strategies and in the case of business organisations and corporations consist of their business goals. Standards have always been a fundamental tool in information security governance, and the governance of Cyberspace more generally, as they are an obvious tool to transparently build an organisational accountability structure.

text: Standardisation of technology – especially communications protocols – has been key to the huge development of the Internet, but historically it was not managed, or governed in accordance with a general plan or policy. The technologist that developed each brick in the Internet technological substrate voluntarily let the specification open and accessible. The TCP/IP protocol suite is a prime example: all machines today speak, or are expected to speak, IP. The masters of the IP world are the technologists of the IETF, the IESG, the IAB, and the Area Directors in the IETF’s Working Groups. The IP world has much less of the political control that the older PSTN operators where numbering, naming and addressing was

text: often rigidly controlled through bodies such as ITU-T and global trade agreements. A major European contribution was of course the http protocol, developed at CERN, and its creators' choice of leaving its specifications open and royalty-free. The practical upshot of this is that industry is encouraged to develop ‘open’ markets through standards with occasionally an impetus given to market development by regional or global agreements regarding the freedom of movement of goods and services being used to promote harmonised standards. While these few examples of decentralised governance were hugely successful, they did not address security (Cybersecurity) in any way. Economic mechanisms – and political considerations – make it unthinkable to redesign the technological substrate of the Internet, security can only be retrofitted on the existing systems.

text: When it comes to governance of information security standardisation – which is the subject of this work and its scope – it can be argued that a purely decentralised model is not likely to work and achieve its goals. The particularities of Cybersecurity explained in the preceding chapter, especially the socio-technical nature of the systems to protect, the plurality of actors and stakeholders, and the expansion of Cyberspace – the ‘IP-world’ - to such systems as infrastructures and industrial plants, lead to the conclusion that regulatory efforts are needed. In the European context moreover, coordination among 28 member states with different regulation legislative systems, a certain level of EU-wide policy can be positive, also considering the goals of the Digital Single Market initiatives.

text: The rest of this chapter will review the current framework of information security governance in the European Union, the actors involved, and how they interact and produce standards.

text: European Cybersecurity Standardisation Governance 4.2.1 European Standardisation Organisations

text: The definition of ‘European Standardisation Organisations’ (ESOs) encompasses the main transnational bodies engaged in standard development and recognised also by the European Commission.

text: • CEN (The European Committee for Standardisation) is the ESO with the broadest scope of subjects and has a membership composed of the National Bodies. CENELEC (the European Committee for Electro-technical Standardisation) is the specialised entity under which – among other things – Cybersecurity standardisation falls. As mentioned, the constituency of CEN-CENELEC is composed of National Standardisation Bodies, representing both EU and EFTA countries, and other stakeholders. The National Bodies that form the membership of CEN and CENELEC are usually also part of the ISO worldwide standardisation system and transposition of ISO work items to CEN deliverables is assured under the Vienna agreement , whilst IEC work items are transposed to CENELEC deliverables under the provisions of the Dresden agreement. • ETSI (European Telecommunications Standards Institute) is also a transnational organisation, however with a narrower scope, as the acronym reveals. ETSI historically develops mainly ICT standards and among its most successful technical standards are the original GSM specifications for digital cellular networks. The constituency of ETSI is quite different than CEN-CENELEC's. Industry can be directly represented as the membership is not based on national representatives. The development process is usually nimbler and more focused; the great majority of standards developed are technical in nature. ETSI is also open to non-European members, an important aspect to be considered when global application of standards is desired. There is no equivalent at

text: ETSI for the CEN-ISO and CENELEC-IEC agreements but rather a set of co-operation agreements with other SDOs that encourage re-use of existing standards work in the ETSI work programme.

text: The development process inside the ESOs is based on consensus among all the stakeholders involved, although across the ESOs the stakeholders determining the suitability of a standard for publication is a function of the ESO and the deliverable type. The internal governance of the ESOs represents the first side of the wider European governance framework for Cybersecurity standardisation, the other being the interaction between ESOs and the Commission when standardisation is developed in support of policy.

text: Internally to each ESO a further subdivision into specialist bodies occurs and this is seen across each of a number of technology sectors that address sector specific (vertical domains) and sector independent (horizontal domains) standardisation requirements. Examples include:

text: • ETSI TC CYBER – Coordination group for all horizontal activity related to Cybersecurity and privacy protection; has remit and power to promulgate new technical standards and to align output of ETSI where internal conflicts exist. • ETSI ITS WG5 – Responsible for vehicle to vehicle and vehicle to infrastructure communication security in the domain of Intelligent Transport Systems

text: To mitigate the risk of duplication of effort and facilitate communication between the ESOs and with the European Commission, in 2011 a coordinating body was established, the Cybersecurity Coordination Group, putting together representatives from the ESOs, the Commission, and relevant stakeholders – ENISA among them.

text: 4.2.2 European Union Bodies

text: While the ESOs are completely independent in their activities regarding which standards to develop and how to do it including the timing and priorities of their activities, the EC has been interested in how standardisation could support European policy goals since the early 1980s, establishing contacts and cooperation with the standardisation organisations.

text: Among the Directorates Generals of the Commission, DG GROWTH (Internal Market, Industry, Entrepreneurship and SMEs) holds the main responsibility for standardisation policy in general and initiating the standardisation requests to the ESOs.

text: In the field of Cybersecurity however, several other DGs are involved in policy shaping:

text: • DG Connect (Communications Networks, Content and Technology) is responsible for the Digital Single Market; • DG Home (Immigration and Home Affairs): Cybersecurity is one of the facets of National and European Security. DG Home is responsible for the European Agenda on Security, cybercrime and cooperates with EC3 (European Cybercrime Centre at EUROPOL ; • DG Justice: Cybercrime is a fast growing area of crime, one of the main threats to society and driver for development of Cybersecurity measures. Areas covered by this DG also include privacy and data protection.

text: 4.2.3 Policy and standardisation: how the EU interacts with the ESOs

text: Regulation 1025/2012 is the current legal basis for the interaction between the Commission and the ESOs. It lays the basis for the development of voluntary standards in support of European legislation and policies. It also serves as the legal framework for the use of standardisation in products and services.

text: The Regulation affords the Commission the key role in standardisation governance, both in the planning phase and the implementation phase. The annual planning cycle results in the EU Work Programme for standardisation, in which it is explained how the Commission intends to leverage standardisation to foster legislation and polices. The implementation phase is carried out mainly via ‘Standardisation Requests’ (previously known as mandates) issued to the three European Standardisation Organisations. The requests are issued, following a consultation phase with relevant stakeholders and the go-ahead by the Committee on Standards, and formally via a Commission Implementing Decision. The requests can be accepted or refused by the ESOs; however they are usually accepted. Once accepted, the ESOs are bound to develop specific standardisation deliverables – most importantly European Standards – in a specified timeframe. While the adoption of the final standards is voluntary, national standardisation organisations are required to transpose the newly developed European standards into national standards, superseding if necessary previous national ones.

text: The standardisation process follows the principles, laid out in the Regulation. The process must be transparent and promote broad participation among stakeholders interested. Work programmes are publicly available – this does not apply however to the internal processes and documents during the development itself. Also it must be noted that while final published ETSI standards are available freely, this is not usually the case for CEN-CENELEC.

text: A final note on the ICT technical standards, so important in Cyberspace, and not developed usually by the recognised ESOs: the Regulation provides a mechanisms by which these standards can be referenced and incorporated into the European process. Under its

text: article 12

text: a notification system for all stakeholders, (including European standardisation organisations and European stakeholder organisations) has been established.

text: Figure 1: Development of European standards

text: 5. Good practices in Cybersecurity standardisation

text: In this chapter, good practices in terms of standardisation in Cybersecurity are identified, with regard to stakeholders, and in preparation of aligning procedures.

text: Cybersecurity is a community effort, so one important goal is to make stakeholders interested parties in standardisation. Therefore in Section 5.1 a listing of stakeholders is given. It is also important to get the interested parties to the table, making participation possible and efficient for them. Procedures play a major role in this, so they are discussed in Section 5.2.

text: Stakeholders

text: This section gives a short description on stakeholders that should participate in standardisation activities and their typical properties. In principle all types of stakeholders may come in with ‘products’, which they would like to see considered in standards. Products may be commercial products or services that commercial stakeholders like to promote in the respective markets, but products can also be concepts and ideas that their originators would like to proliferate.

text: 5.1.1 European Standardisation Organisations (ESOs)

text: ESOs are the main transnational bodies engaged in standard development and recognised by the European Commission. For description, please refer to Section 4.2.

text: Among them, CEN, the European Committee for Standardization, is an association that brings together the National Standardization Bodies of 33 European countries.

text: 5.1.2 National standardisation/normalization bodies

text: National standardisation bodies are organizations (unique per country) whose tasks include coordination of national standardisation activities and participation in international bodies like CEN or ISO as representatives of the countries. Usually they don’t take part in technical preparation of standards, which is performed by national technical societies.

text: 5.1.3 Policy and administration

text: Policy and administration stakeholders often participate in standardisation to maintain the relation between standards and related regulation (e.g. regulation on electronic signatures), but also with less formalized guidance documents issued by the respective administrative agencies (e.g. documents on IT security baseline protection). This would especially hold for Cybersecurity expert agencies such as MS Agencies with competence on network and information security

text: In some cases policy and administration stakeholders participate in standardisation from the perspective of protecting their ‘own’ Cybersecurity, i.e. the security of their users and their infrastructure.

text: 5.1.4 Industry and research

text: Some industry stakeholders participate in standardisation to maintain the relation between standards and their products and services. In this role they tend to prefer fast standardization to follow market trends and not too detailed standardisation to keep the design sovereignty with regard to their products.

text: Some industry stakeholders participate in standardisation, as they are major users of the respective standards and possibly related technologies and services. Often they need to protect their earlier investments and are therefore not interested in too dynamic and radical changes in standards.

text: Research stakeholders often participate in standardisation to contribute with new concepts and ideas to promote them and to gather feedback on them. Often they are interested in publishing their gatherings and their experiences.

text: 5.1.5 Consumer and community

text: Consumers usually do not have the resources to participate in standardisation themselves. Therefore most consumer stakeholders in standardisation are representatives of consumer organisations. The situation is similar for communities. In many cases neither consumer stakeholders nor community stakeholders have major resources for this activity.

text: 5.1.6 Education

text: Education stakeholders participate in standardisation for different reasons: Some standards treat education and training, so education stakeholders contribute with experiences, concepts and ideas similarly to other domain stakeholders for other reasons. In addition education is often, especially in universities, closely related to research, so for some education stakeholders combining their education and research interests makes sense and often only the combination makes a convincing case to incur the investments and costs needed for standardisation.

text: Procedures

text: Appropriate procedures play a major role in efficient delivery and uptake of ICT security standards. The set of good practices presented below provides for a good base for an appropriate governance framework.

text:  Preference for the existing EU approach

text: The current organisational frameworkis appropriate toconstitute a base for all standardisation activities within the EU. Procedures described in Section 4 are based on the legal requirements (specifically Regulation 1025/2012) and proved to be effective if correctly applied. This correct application however is crucial to ensure that standards that are developed are really needed by stakeholders and of good quality.

text:  Good representation from stakeholders

text: It is crucial to ensure good representation of stakeholders mentioned in section 5.1. in the standardisation process. As adoption of standards is in most cases a voluntary measure, lack of participation of specific entities or lack of consensus among them might result in a low uptake of specific standards.

text:  Transparency of procedures

text: Promulgation of standards should be as transparent as possible. The need of a standard should be notified to the appropriate body (i.e. appropriate DG of the European Commission), the same transparency should be applied to the process of standardisation request and further development of standards. No stakeholder should be specifically excluded from this process. History of standards creation should be available to be consulted.  Process as open as possible to independent experts and SMEs / all interested parties

text: The standardisation process should not exclude independent experts and SMEs, who often cannot afford expensive trips to plenary meetings of large standardisation bodies. Appropriate means to ensure their presence in the procedures should be put in place.

text:  Availability of published standards

text: Although it is not possible to ensure availability of all standards without cost at international level (i.e. ISO standards), it is important to make sure that information about new standards is widely spread. The standards created under European framework should be ‘advertised’ among stakeholders even at the stage of their creation and their availability shoud be ensured.

text:  Bottom-up approach to creation of Cybersecurity standards

text: Cybersecurity standards should be created based on the needs of stakeholders. Appropriate entities (i.e. DGs of the European Commission) should collect the relevant information on the need of standardisation activities through ongoing public consultations with the industry, research and supervisory bodies.

text: Cybersecurity Coordination Group (CSCG)

text: The ETSI CEN/CENELEC Cybersecurity Coordination Group is a European-level group of standardisation experts fostered by the three European Standardisation Organisations, CEN-CENELEC and ETSI. Inside the CSGS, which holds regular periodical meetings throughout the year are represented the ESOs, the European Commission and ENISA.

text: CSCG is well placed to foster communications among the relevant actors, namely the ESOs and the policy level, helping on one hand the ESOs to suggest possible standardisation activities in support of European policies and interests and on the other hand to the policymakers to tap the expertise pool provided by the Cybersecurity experts, even before formalising Standardisation Request, in an ongoing collaboration. CSCG is also well-placed for coordinating efforts between the ESOs, eliminating overlapping and duplication of efforts.

text: 6. Recommendations for stakeholders

text: The particularities of Cybersecurity standardisation outlined above, with their far-reaching consequences, call for new and more efficient modalities of interaction among the main actors – the European Standardisation Organisations, the European Commission – and other stakeholders.

text: In some areas there are standards missing; in other areas there may be the danger of overlapping work potentially leading to problems in interoperation of technical artefacts and synchronisation of standardisation initiatives

text: Currently interaction among ESOs and among different Work Groups working on overlapping or similar activities is almost always based on bilateral “liaisons” carried out by specific officers or experts designated inside each group and reporting periodically. Also, there is a clear lack of coordination of standardisation activities in the area of Cybersecurity. A more flexible and less rigid model of collaboration could improve communication, information sharing and efficiency.

text: Cybersecurity standardisation in support of European policies necessarily involves the European Commission as hub and input source for the actual standardisation development. Currently the governance framework is based on a somewhat rigid “request-response” protocol, where Standardisation Requests are directed from the EC to the ESOs which chose to fulfil it or not.

text: This governance modality is also quite rigid and a more nimble, continuous dialogue should yield more efficient results, both in terms of celerity and adherence to the high-level policies of the European Union and European interests more generally.

text: A model that could be advised consists in a coordinated approach to the development of standards. Appropriate DGs of the European Commission should collect the needs from stakeholders on a permanent basis (participation of ESOs in the process can be considered – industry initiatives initiated through ETSI, national ones through CEN/CENELEC). Standardisation requests should firstly be consulted with a coordination body, such as CSCG, which would maintain a database of standards and ongoing standardisation activities. The input from such a coordinating body would be used to justify a concrete standardisation request.

text: This need for nimbler, more structured communication, continuous collaboration and coordination in Cybersecurity standardisation could be satisfied by a permanent forum where the Commission (the relevant DGs), the three European Standardisation Organisations, the agencies involved – ENISA among them – are present.

text: The already established Cybersecurity Coordination Group could very well fulfil this role, as it involves representatives both from the National Standardisation Bodies member of CEN-CENELEC as well as from the more industry-oriented ETSI members. Moreover, the Commission is already involved, for now the GROWTH Directorate-General, as well as ENISA.

text: At the end of 2011, the European Multi Stakeholder Platform (MSP) on ICT standardisation was set up. Based on a European Commission Decision to advise on matters related to the implementation of ICT standardisation policies, it deals with: potential future ICT standardisation needs in support of European legislation, policies and public procurement; technical specifications for public procurements, developed by global ICT standards-developing organisations; cooperation between ICT standards-setting organisations; and the Rolling Plan , which provides a multi-annual overview of the needs for preliminary or complementary ICT standardisation activities in support of the EU policy activities. It is recommended that the CSCG should be involved in the work of MSP, as advisory body.

text: It is moreover recommended that a specialised Cybersecurity group be created inside the CEN-CENELEC system. A group of this kind already exists in the other ESO, ETSI.

text: Facilitating communications among ESOs and the EC would mean that ESOs could be much more proactive in proposing new standardisation even before the developing of formal requests. Also they would be much more involved and knowledgeable in the developing of Cybersecurity policies and so in a better position for their main activity in support of Europe. In short, a permanent forum/platform to mediate and facilitate information sharing among ESOs themselves and ESOs and the policy level would let to better and faster standard developing in support of EU policy.

text: There are three organisational models for coordination that can be adopted: The first model is a centralised coordination group with more authorities; the second model is a centralised focus group. The primary difference between the models is the degree of influence on the work programmes of the ESOs and thus the impact on the governance models of each ESO. The third model is a coordination group in its current status.

text: 1. A centralised coordination group with authority to direct the cyber security standardisation activity across the ESOs would address the following concerns:  Weak interaction of ESOs both internally and to each other: The existing model of interaction relies upon bilateral “liaisons” carried out by specific officers or experts designated inside each group and reporting periodically. Such liaisons tend not to be able to veto or promote work in the liaised to body and the relative informality does not give any guarantee of communication, information sharing and efficiency.  EU governance framework reliance on a “request-response” protocol: There is no obligation on the ESOs to accept standardisation requests from external bodies and in practice any work item raised has to be raised within the specific governance structures of the particular ESO and each ESO has a different model. The Cybersecurity Coordination Group fulfils this role but augmented by alterations in the governance rules of the ESOs to accept guidance from an external group. The existing Joint Presidents Group and the Global Standards Coordination groups would then recognise the coordination body as an adjunct to the existing ESOs with special responsibility in this domain. 2. The second model is to form a centralised focus group that is maintained externally to the current ESOs as a discussion forum. Unlike the coordination group this would not require any alteration to the governance models of the ESOs but should be recognised by the Joint

text: Presidents and Global Standards Coordination groups as a formally managed body of the EU with special expertise in the Cybersecurity domain. The purpose of a focus group should be similar to that of the coordination group but working on a series of gentleman's agreements on the distribution of standards activity in this domain. This should be considered as a more formal body that the existing CSCG but may be drawn from the same body of experts. 3. The third model is to keep the group in its current organisational shape and to address any further organisational issues after a gap analysis and an overlap analysis have shown, what work needs to be done and is needed most urgently.

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece Catalogue Number TP-01-15-933-EN-N

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-154-0 DOI: 10.2824/358519 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu