text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: See https://www.enisa.europa.eu/topics/incident-reporting/cybersecurity-incident-report-and-analysis-system-visualanalysis/visual-tool

text: July 2021

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , can be consulted at https://eur-lex.europa.eu/eli/reg/2014/910/oj

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: Note that three of the reported incidents were indicated as type D-Active threats or vulnerabilities and are not included in the analysis

text: July 2021

text: July 2021

text: July 2021

text: July 2021

text: See ENISA Annual Report Telecom Security Incidents 2019

text: July 2021

text: See CG Publication 04/2018 - Cybersecurity incident taxonomy

text: July 2021

identifier: Trust Services Security Incidents 2020 - Annual Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Trust Services Security Incidents 2020 - Annual Report

serie: rapporter

text: TRUST SERVICES SECURITY INCIDENTS 2020 Annual Report JULY 2021

type: rubrik

text: TRUST SERVICES SECURITY INCIDENTS 2020 ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Vassiliki Gogou, Marnix Dekker and Eleni Vytogianni, European Union Agency for Cybersecurity

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the experts in the ENISA Article 19 Expert Group which comprises experts from more than 30 national supervisory bodies (SBs) in the EU, EFTA, EEA and EU candidate countries. The group is currently chaired by a representative of RTR Austria.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent the state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Shutterstock. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: Catalogue Number: TP-05-21-229-EN-N ISBN: 978-92-9204-511-1 DOI: 10.2824/277632

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 SCOPE 5

text: 1.2 TARGET AUDIENCE 5

text: 1.3 CONTENT 5

text: 1.4 DISCLAIMER 5

text: 2. INCIDENT REPORTING FRAMEWORK 6

text: 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS 6

text: 2.2 INCIDENT REPORTING TOOL 7

text: 2.3 ANONYMIZED EXAMPLES OF SECURITY INCIDENTS 8

text: 3. INCIDENT ANALYSIS 11

text: 3.1 ROOT CAUSE CATEGORIES 11

text: 3.2 DETAILED CAUSES 12

text: 3.3 TYPES OF TRUST SERVICES AFFECTED 13

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES 14

text: 4. MULTI-ANNUAL TRENDS 2016-2020 15

text: 4.1 MULTI-ANNUAL TREND IN ROOT CAUSE CATEGORIES 15

text: 4.2 MULTI-ANNUAL TREND IN SEVERITY OF IMPACT 16

text: 5. CONCLUSIONS 17 TRUST SERVICES SECURITY INCIDENTS 2020

text: EXECUTIVE SUMMARY

text: The EU’s eIDAS regulation (EU Regulation 910/2014) sets rules for electronic identity schemes and trust services in Europe, national eID schemes, cross-border interoperability and 2020 recognition. eIDAS was adopted in July 2014 and came into force in 2016. One of the goals of HIGHLIGHTS eIDAS is to ensure that electronic signatures can have the same legal standing as traditional signatures and to remove barriers to electronic commerce and all types The number of of electronic transactions in the EU. The eIDAS regulation aims to: notified incidents is steadily increasing.  ensure that people and businesses can voluntarily use their own national electronic identification schemes (eIDs) to access public services available online in other EU The number of countries. incidents with large  create a European internal market for trust services by ensuring that they will work impacts has dropped. across borders and have the same legal status as their traditional paper-based equivalents. System failures account for more Article 19 of the eIDAS regulation sets out the security requirements for the trust service than half of incidents providers (TSPs) and introduces mandatory security breach reporting for trust service providers and have been the (TSPs) in the EU. The reporting obligations have three parts: dominant root cause for the last four years  Trust service providers must notify security breaches that have a significant impact to of incident reporting. the national supervisory bodies.  The national supervisory bodies must inform each other and ENISA if there are breaches which have an impact across borders.  Every year national supervisory bodies must send annual summary reports about the notified breaches to ENISA and the Commission.

text: This report, the Annual Report Trust Services Security Incidents 2020, provides an aggregated overview of the notified breaches for 2020, analysing root causes, statistics and trends. This report marks the fifth round of security incident reporting for the EU’s trust services sector.

text: In this round of annual summary reporting a total of 27 EU countries and 2 EFTA countries took part. They reported a total of 39 incidents.

text: KEY FINDINGS

text: We summarize the key findings from the 2020 incident reports:

text:  A steady increase in notified incidents: in 2020 notified incidents increased by around 18%. This suggests that authorities and TSPs are becoming more familiar with the breach reporting process and their obligations under eIDAS.  The number of incidents with a large impact has dropped: in 2020 only 3 incidents were characterized as having had a “large impact” as opposed to 2019 when 10 such incidents had been reported (translating into approximately 60% decrease).

text: Τhe ratio of reported incidents concerning qualified and non-qualified trust services

text: remains high: in 2020, 69% of total incidents had an impact on qualified trust services compared to approximately 33% of incidents reported on non-qualified trust services (with some incidents touching both categories.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: Although non-qualified trust services are widely used by citizens and enterprises, it seems that the respective trust services operators do not make much effort to report related incidents. In most cases, the notification is done by a TSP that also offers qualified services, reporting an incident that has affected both their qualified and non-qualified services.

text: The impact on subservices is mainly divided between certificate management (47% of the incidents) and certificate generation (42% of the incidents).

text: Approximately 66% (26 incidents) of the reported incidents were rated as minor

text: compared to 2019 when 60% (19 incidents) were rated as having had only a minor

text: impact. Only one incident had a very large (disastrous) impact, and only three incidents had a large impact. Furthermore, a significant increase in minor incidents has been observed, indicating that the incident reporting mechanism has become more familiar to the providers and they are reporting more incidents regardless of their severity.

text: Figure 1: Severity of impact - Trust services security incidents in the EU reported over 2016-2020

text: ENISA publishes detailed statistics about trust services security incidents in an online visual tool, CIRAS Visual. This tool allows for custom analysis of trends and patterns .

text: Currently the European Commission, Member States and the European Parliament are discussing policy changes. Last year the Commission proposed to integrate

text: Article 19

text: , the security requirements for TSPs into a revised NIS Directive. The goal of this Commission proposal, the NIS2 proposal, is to simplify EU cybersecurity legislation and to ensure that there is a similar approach across the different sectors, including the telecom sector and the trust services sector, which are currently addressed under separate pieces of legislation. This year the Commission will also make a proposal for a new eIDAS regulation.

text: ENISA will continue to support national supervisory bodies with the implementation of breach reporting under Article 19 of eIDAS and to work towards making this process efficient and effective, yielding useful data, for the supervising bodies, for the national authorities, as well as for the trust service providers and the organisations relying on these trust services

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: 1. INTRODUCTION

text: Under Article 19 of the eIDAS Regulation , Trust Service Providers (TSPs) in the EU are expected to notify the national supervisory bodies in their country about security incidents. On an annual basis, the supervisory bodies send summaries of these incident reports to ENISA. Subsequently, ENISA publishes an aggregated overview of the reported security incidents.

text: This document gives an aggregate overview of the security incident reports submitted by the supervisory bodies during 2020. This annual report marks the fifth round of security incident reporting in the EU’s trust services sector, covering security incidents during 2020.

text: 1.1 SCOPE

text: Incidents reported by authorities under Article 19 of the eIDAS regulation

text: 1.2 TARGET AUDIENCE

text: Experts at national authorities, experts in the sector

text: 1.3 CONTENT

text: This document is structured as follows: in section 2, the policy context is briefly summarized as is the underlying eIDAS reporting framework and an overview of the types of incidents reported is provided by anonymized examples. In Section 3, further elaboration of the reported incidents is given, by presenting the categories of root causes, the detailed causes, and the affected services. In section 4, the multi-annual trends in incidents over the years 2016-2020 are highlighted. In Section 5, conclusions and observations based on the available data are drawn.

text: 1.4 DISCLAIMER

text: This document only contains aggregated and anonymized information about incidents and does not include details about individual countries or individual trust service providers. Detailed discussions about the reported security incidents take place in the ENISA

text: Article 19

text: expert group, which is an informal group of experts from national supervisory bodies focusing on the practical implementation of

text: Article 19

text: . The group is currently chaired by a representative from RTR, the Austrian regulatory authority. ENISA acts as the secretariat and supports the group with analysis, drafting, logistics, etc.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: 2. INCIDENT REPORTING FRAMEWORK

text: In this section, we give an overview of the formats and procedures for the reporting of incidents (breaches) under Article 19 of the eIDAS regulation.

text: EIDAS ARTICLE 19 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS

text: The mandatory security breach notification process has three steps as displayed in the figure requires trust service below: providers in the EU to 1) assess risks; 1. Trust service providers notify their national supervisory body about security breaches 2) take appropriate that have significant impact. security measures to 2. National supervisory bodies inform each other and ENISA if there is a cross-border mitigate security impact. breaches; 3) notify breaches to 3. National supervisory bodies send annual summary reports about the notified breaches national supervisory to ENISA and the Commission. bodies.

text: Figure 2: Incident reporting under article 19 of eIDAS regulation

text: TRUST SERVICES SECURITY INCIDENTS 2020 2.2 INCIDENT REPORTING TOOL

text: Experts from the national authorities have access to the ENISA CIRAS incident reporting tool, where they can upload incident reports and search for and study specific incidents.

text: For the public, ENISA also offers an online visual tool, which is publicly accessible and can be used for custom analysis of the data. This tool anonymizes the country or operator involved.

text: CIRAS

text: is a free online tool where ENISA stores reported incidents and provides annual and multiannual statistics: https://www.enisa.europa.eu/ciras

text: We briefly introduce the reporting template. The template starts with a type selector and contains three parts:

text: 1. Impact of the incident - which trust services are impacted and by how much. 2. Nature of the incident - what caused the incident? 3. Details about the incident - detailed information about the incident, a short description, the types of services, the types of assets, the severity level etc.

text: Figure 3: eIDAS

text: Article 19

text: incident reporting types

text:  Type A: Service outage (e.g. continuity, availability). For example, an outage caused by a cable cut due to a mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident.

text:  Type B: Other impact on service (e.g. confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels, which are being established when a session is started, between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident.

text:  Type C: Impact on other systems (e.g. ransomware in an office network, no impact on the service). For example, a malware has been detected on several workstations and servers of the office network of a telecom provider. This incident would be categorised as a type C incident.

text:  Type D: Threat or vulnerability (e.g. discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text:  Type E: Impact on redundancy (e.g. failover or backup system). For example, the breaking of one of two redundant submarine cables would be categorised as a type E incident.  Type F: Near-miss incident (e.g. activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident. Depending on the type selected, some fields in the template are deactivated. For example, in the case of a Type A incident the fields “threat severity factors” and “severity of threat” are not active.

text: 2.3 ANONYMIZED EXAMPLES OF SECURITY INCIDENTS

text: In this section we present some of the kinds of incidents that are reported, by providing several detailed and anonymized examples.

text: Incident example 1

text: Incident type A-Core service outage Service affected eSignature Root cause System failure Technical causes Faulty software change/update Assets affected Generation and validation of signatures/seals platform Comment Unavailability of the eSignature service due to an outage of the front-end application component

text: Incident example 2

text: Incident type A-Core service outage Service affected System failure Root cause Faulty software change/update Technical causes Generation and validation of signatures/seals platform Assets affected Unavailability of the eSignature service due to an outage of the front-end application component Comment eSignature

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: Incident example 3

text: Incident type A-Core service outage Service affected eSignature, eTimestamps Root cause Natural phenomena Technical causes Natural phenomena Assets affected Generation and validation of signatures/seals platform, Time Stamping Authority (TSA) platform, Validation Authority (VA) platform Comment Consequences of heavy rain caused unavailability of registers and information systems. Synchronisation with redundant hardware of information systems was also disturbed. Additional sealing means was installed.

text: Incident example 4

text: Incident type B-Other impact on core service Service affected eSignature Root cause Malicious action Technical causes Tampering of personal data, theft or loss of data Assets affected Generation and validation of signatures/seals platform, Time Stamping Authority (TSA) platform, Validation Authority (VA) platform Comment The incident concerns the creation of a qualified certificate following a phishing attack and the creation of a false identity through online banking. The certificate was used only once to sign the terms and conditions for opening an account in another bank. That bank has been warned and closed the account. The qualified certificate has been revoked.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: Incident example 5

text: Incident type D-Active threat or vulnerability Service affected PDF signing Root cause Malicious action, third party failure Technical causes Vulnerability inherent to document format Assets affected Generation and validation of signatures/seals platform, Time Stamping Authority (TSA) platform, Validation Authority (VA) platform Comment Signed PDF files can be manipulated in a way that they look different to the signatory than to relying parties (shadow attacks, https://www.pdf-insecurity.org/). Signing services and validation services are not affected. The vulnerability has been resolved by issuing new versions of PDF viewers. Recommendations for signatories by TSPs have been updated accordingly.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: 3. INCIDENT ANALYSIS

text: The 2020 annual summary reporting, by the 27 EU Member States and 2 EFTA countries participating in this process, included in total 39 security incidents . This is the fifth round of annual summary reporting, since eIDAS came into force on the 1st of July 2016.

text: Figure 4: Number of incidents per year

text: There is a steady increase in the number of incidents reported which, over the years, leans towards becoming linear. This suggests that TSPs are becoming more familiar with the process.

text: 3.1 ROOT CAUSE CATEGORIES

text: The figure nr. 5 shows the distribution of the incidents according to their underlying root cause.

text: We categorize incidents into four categories of root causes: Systems failures, Human errors,

text: of 2020 trust

text: Malicious actions and Natural phenomena.

text: services incidents

text:  System failures continue to be the dominant root cause, accounting for just over half of total trust services incidents reported (53%, around 20 incidents). Typically, system reported have failures are due to either hardware failures or software bugs. System failures  Almost 39% of incidents were categorised as human errors.

text: as root cause

text:  Around 5% of the incidents were flagged as malicious actions.

text: We also keep track of third-party failures, i.e. when the incident really originated at a third party. For 2020, 14% of incidents were flagged as third-party failures. All these third-party failures were categorized as system failures. See figure nr. 6.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: Figure 5: Root causes of TSP security incidents in 2020 Figure 6: Third party failures - 2020

text: 3.2 DETAILED CAUSES

text: The two most common detailed causes of incidents were faulty software changes/updates and software bugs. It is important to note that an incident is often not only triggered by one cause but can involve multiple detailed causes (i.e. a chain of events). The third most common detailed cause is flaws in the organization’s policy or procedures.

text: Figure 7: Detailed causes of trust services security incidents - 2020

text: TRUST SERVICES SECURITY INCIDENTS 2020 3.3 TYPES OF TRUST SERVICES AFFECTED

text: Most of the reported incidents (69%) had an impact on electronic signatures (see the chart below). Electronic seals were affected in about one tenth (11%) of all cases, as were electronic timestamps (another 11%).

text: Figure 8: Impact of incidents - 2020

text: If we look back at the past four years of reporting, we see a similar pattern: 83% of the reported incidents had an impact on electronic signature services, while 29% affected electronic seals and 20% affected timestamping services.

text: For each incident we keep track of the underlying subservices affected. Most incidents impact the generation of signatures/seals/timestamps (42%) or certificate management (47%)

text: Figure 9: Impact of incidents on subservices

text: Finally, we also keep track of the underlying assets affected by incidents. In most cases the assets affected are the Certification Authority (CA) platform (33%) and the platform for the generation and validation of signatures/seals platform (31%). See the impact on technical assets in the chart below.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: Figure 10: Technical assets affected

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES

text: This year nearly 70% of total trust services security incidents had an impact on qualified services (i.e. qualified signature certificate creation, qualified seal certificate creation, etc.), while only a third of the incidents affected a non-qualified service. Again, it is important to note that one incident report could involve multiple trust services, which explains why the percentages in the graph 8 below add up to more than 100%.

text: Figure 11: Reported Incidents affecting Qualified v Non-qualified services

text: Note that in most cases, the TSP notifying an incident is also offering qualified services and that in most cases the impact on non-qualified services is reported as part of an incident report for a qualified trust service. This suggests that there is a gap in the reporting and that, while

text: Article 19

text: is also concerned with non-qualified services, only the TSPs offering qualified trust services are reporting incidents, and mostly do so concerning incidents that impact qualified services.

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: 4. MULTI-ANNUAL TRENDS 2016-2020

text: ENISA has been collecting and aggregating trust services incident reports since 2016. In this section, we look at multi-annual trends over the last 5 years, covering the period from 2016 to 68%

text: 2020. The total dataset contains 104 reported incidents. of total trust

text: services 4.1 MULTI-ANNUAL TREND IN ROOT CAUSE CATEGORIES incidents

text: Over the last few years of trust services security incident reporting ̶ as displayed in the graph reported since below ̶ the most common root cause has been system failures. These add up to 68% over the

text: 2016 have

text: period since 2016. For this specific root cause, the most common detailed causes were

text: hardware

text: hardware failures (35%) and software bugs (33%).

text: failures (35%)

text: Note that we observe the same pattern in electronic communication services , where system and software failures account for almost two thirds (67%) of total incidents (722 out of 1093 incidents). bugs (33%) as

text: main root

text: Figure 12: Root cause categories ̶ Trust services security incidents in the EU reported over 2016-

text: causes

text: Around a fifth of the reported incidents (18%) were caused by malicious actions and another fifth were flagged as human errors.

text: In the trust services sector, natural phenomena are not a common root cause. In comparison, the telecom sector is quite different because it has extensive over-the-ground IT infrastructure which is vulnerable to natural phenomena such as storms.

text: TRUST SERVICES SECURITY INCIDENTS 2020 4.2 MULTI-ANNUAL TREND IN SEVERITY OF IMPACT

text: In the multi-annual trend concerning the severity of impact, the EU Cybersecurity incident taxonomy is again followed where the severity of the impact has the following values: no impact, minor, large and very large impact .

text: While comparing the statistics for severity since 2016 (Graph 10 below), it is quite clear that the number of incidents with large impacts is decreasing significantly although it was rather stable for the previous four years. It is interesting to see that there was a rather linear increase in minor incidents since last year.

text: This is again an indication that the incident reporting mechanism has become more familiar to trust services providers and also more effective; providers are reporting more incidents regardless of their severity. In contrast to 2018, there were no very large (i.e. disastrous) incidents during 2019 and 2020.

text: Figure 13: Severity of impact ̶ - Trust services security incidents in the EU reported over 2016-2020

text: TRUST SERVICES SECURITY INCIDENTS 2020

text: 5. CONCLUSIONS

text: We conclude with the main findings and some more general observations about this process and the broader policy context.

text: MAIN FINDINGS

text:  A steady lower level of severity confirms that TSPs are become more familiar with the incident reporting process and that they are reporting more incidents, even if they are less severe.  Qualified trust services versus non-qualified trust services: The ratio of reported incidents concerning qualified trust services over non-qualified ones remains high. In 2020, 69% of total incidents had an impact on qualified trust services when compared with approximately 33% of incidents reported on non-qualified trust services. Although non-qualified trust services are widely used, not so much effort is made by operators on related incident reporting. In most cases, notifications are performed by a TSP offering all types of services (qualified and non-qualified), reporting an incident that has affected both their qualified and non-qualified services.  System failures (53%) remain the dominant root cause and the second most dominant are human errors with 39%.

text: GENERAL OBSERVATIONS

text:  PDF signing vulnerabilities in 2020: in 2020 authorities discussed and reported on several vulnerabilities with PDF signatures. In 2020, the so-called “shadow attacks” emerged as a new class of attacks, where signed documents contain hidden content, which an attacker can reveal after the document has been signed. These vulnerabilities affect a wide range of software products. These vulnerabilities, which are not under the control of a TSP and therefore can hardly be supervised, were reported as type D-incidents/vulnerabilities during 2020.  Supervision of non-qualified services: The supervision of, and incident reporting by, non-qualified services remains a concern. As already mentioned, non-qualified trust services are widely used. A good example is website (TLS) certificates, which are a staple of online/internet security. Globally around 80% of websites use web certificates. The fact that under

text: Article 19

text: there are hardly any reports about incidents with nonqualified trust services suggests there is still under-reporting in this area, although one MS reported 11 incidents during 2020.  EU policy changes: eIDAS regulations and eIDAS incident reporting have been in place for more than four years now and eIDAS is currently under review. The Commission will make a proposal for a revised eIDAS regulation in 2021. In 2020, the Commission also made a proposal for a revised NIS Directive, i.e. NIS2, which proposes the integration of eIDAS

text: Article 19

text: to the NIS Directive. Both policy proposals are expected to deliver important improvements. These policy changes present an opportunity to address some of the gaps in policy, for example, the issue of supervision of and reporting by the providers of non-qualified services. We look forward to supporting the Commission and the EU Member States with implementing eIDAS security incident reporting in an efficient and effective manner

text: -N -EN -229 -21 -05 TP

text: ABOUT ENIS A

text: ISBN: 978-92-9204-511-1 DOI: 10.2824/277632


text: JULY 2019

text: JULY 2019

text: JULY 2019

text: JULY 2019

text: JULY 2019

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , can be consulted at https://eur-lex.europa.eu/eli/reg/2014/910/oj

text: JULY 2019

text: JULY 2019

text: JULY 2019

text: Note that two of the reported incidents were indicated as level 2 severity (insignificant impact) and included in the analysis

text: JULY 2019

text: JULY 2019

text: JULY 2019

text: JULY 2019

text: JULY 2019

identifier: Trust Services Security Incidents 2018 - Annual report

title: Trust Services Security Incidents 2018 - Annual report

text: TRUST SERVICES SECURITY INCIDENTS 2018 Annual Report JULY 2019 0

text: TRUST SERVICES SECURITY INCIDENTS 2018

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of crossborder communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquires about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Aggelos Koukounas, Eleni Vytogianni, Marnix Dekker

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the experts in the ENISA Article 19 Expert Group which comprises national supervisory bodies (SBs) from all EU and EFTA countries. The group is currently chaired by a representative of RTR Austria.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: Catalogue Number: TP-AK-19-001-EN-N, ISBN: 978-92-9204-299-8, DOI: 10.2824/540225

text: TRUST SERVICES SECURITY INCIDENTS 2018

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5 2. INCIDENT REPORTING FRAMEWORK AND EXAMPLES OF INCIDENTS 6 3. ANALYSIS OF REPORTED INCIDENTS 8

text: 3.1 ROOT CAUSE CATEGORIES 8

text: 3.2 DETAILED CAUSES 9

text: 3.3 SERVICES AFFECTED 9

text: 3.4 SECURITY INCIDENTS WITH CROSS BORDER IMPACT 10

text: 3.5 LEVEL OF SEVERITY 11

text: 3.6 SEVERITY 2017 AND 2018 12

text: 4. CONCLUSIONS 13 TRUST SERVICES SECURITY INCIDENTS 2018

text: EXECUTIVE SUMMARY

text: Electronic trust services are a range of services around digital signatures, digital certificates, electronic seals, timestamps, etc. which are used in electronic transactions, to make them secure. eIDAS, an EU regulation, is the EU wide legal framework ensuring interoperability and security of MALICIOUS these electronic trust services across the EU. One of the goals of eIDAS is to ensure that ACTIONS electronic transactions can have the same legal standing as traditional paper based transactions. eIDAS is important for the European digital market because it allows businesses and citizens to Malicious actions work and use services across the EU. The eIDAS regulation was adopted in July 2014 and came have been into force in 2016. increasing rapidly

text: since last year

text: Article 19 of eIDAS introduces mandatory security breach notification requirements for TSPs in

text: (7% of the total in

text: the EU:

text: 2017) and now

text:  Trust service providers notify the national supervisory body about security breaches with account for almost significant impact. two fifths of the  National supervisory bodies inform each other and ENISA if there is cross-border impact. reported incidents  National supervisory bodies send annual summary reports about the notified breaches (39% of the total). to ENISA and the Commission.

text: This document, the Annual Report Trust Services Security Incidents 2018 gives an aggregated overview of these breaches, showing root causes, statistics and trends. It marks the third round of security incident reporting for the EU’s trust services sector. The annual summary reporting for 2018 totalled 18 incident reports, i.e. incidents with significant impact on the trust services. A total of 28 EU countries and one 1 EFTA country take part in annual summary reporting. We expect a further increase

text: Total number of notified

text: of notified incidents, due increased adoption of trust services market and growing familiarity with this breach security breaches 2016 reporting process: 2018

text: 20 The key statistics relating to the 2018 incidents are: 18 10 14  Malicious actions and system failures are the 1 dominant root causes of reported incidents: In 0 the case of system failure, the corresponding 2016 2017 2018 percentage (39% of the total) is consistent with

text: TRUST SERVICES SECURITY INCIDENTS 2018

text: the previous year (36% of the total in 2017). Malicious actions have been increasing rapidly since last year (7% of the total in 2017) and now account for almost two fifths of the reported incidents (39% of the total).  A few but critical security breaches with cross border impact: Just under a quarter of the reported incidents had a cross border impact. Although the ratio is small, the seriousness of the incidents was high as 75% of them were classified as level 4 (severe) and 5 (disastrous) in terms of severity. The latter highlights the importance of cross-border collaboration and information sharing among the MS.  Qualified e-signatures certificates creation the most affected service: Roughly, half of the incidents reported affected the qualified creation of qualified certificates for e-signatures.  Most of incidents had significant impact, just one was disastrous: Half of the incidents were submitted as “severity level 3” (significant impact) but only a minor 5% of the total incidents reported (one incident) was characterized as disastrous.

text: Incidents affecting services (detailed)

text: Certificate validation 17% Timestamp creation 22% Website authentication certificate creation 22% Signature certificate creation 44% Seal certificate creation 22% Other service 17% Certificate validation 5% Timestamp creation 5% Signature creation (on behalf of the signer) 17% Web. authentication certificate creation/verification 5% Signature certificate creation/verification 5% 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% 50%

text: ENISA will provide advice and input on the upcoming eIDAS review by the Commission, due mid-2020. The Agency will also continue to support the national supervisory bodies with implementing the breach reporting under

text: Article 19

text: eIDAS and to work towards making this process efficient and effective, yielding useful data, for the supervising bodies, for the authorities of other sectors, as well as for the trust service providers and the organisations relying on these trust services.

text: TRUST SERVICES SECURITY INCIDENTS 2018 1. INTRODUCTION

text: According to Article 19 of the eIDAS Regulation , Electronic Trust Service Providers in the EU have to notify the national supervisory bodies in their country about security incidents. Annually the supervisory bodies send summaries of these incident reports to ENISA. Subsequently ENISA publishes an aggregated overview of these security incidents. This document gives an aggregate overview of the security incident reports submitted by the supervisory bodies over 2018.

text: This annual report marks the third round of security incident reporting in the EU’s trust services sector, covering the security incidents of 2018.

text: This document only contains aggregated and anonymized information about incidents and does not include details about individual countries or individual trust service providers. Detailed discussions about the reported security incidents take place in the ENISA

text: Article 19

text: expert group, which is an informal group of experts from national supervisory bodies focusing on the practical implementation of

text: Article 19

text: . The group is currently chaired by a representative from RTR, the Austrian regulatory authority. ENISA acts as the secretariat and supports the group with analysis, drafting, logistics, etc.

text: TRUST SERVICES SECURITY INCIDENTS 2018 2. INCIDENT REPORTING FRAMEWORK AND EXAMPLES OF INCIDENTS

text: Article 19 of eIDAS requires trust service providers in the EU to assess risks and take appropriate security measures to mitigate security breaches.

text: Article 19

text: also introduces mandatory security breach notification requirements these providers:

text:  Trust service providers notify the national supervisory body about security breaches with significant impact.  National supervisory bodies inform each other and ENISA if there is cross-border impact.  National supervisory bodies send annual summary reports about the notified breaches to ENISA and the Commission.

text: Article 19 of eIDAS requires trust service providers in

text: We give some specific examples of incidents to give an idea of the kind of incidents, which were

text: the EU to

text: notified to the national supervisory bodies:

text: assess risks and take

text:  A human error in issuing qualified certificates

text: appropriate

text: Duration: months

text: security

text: Services affected: qualified creation of qualified certificates for e-signatures, Cause:

text: measures to

text: human error

text: mitigate

text: Level of severity: 3 – significant

text: security breaches.

text: A TSP issued two qualified certificates whose subject contained the name of the registration officer instead of the persons to whom the certificates should have been issued. There was no impact on personal data except the registration officer’s name. The certificates were revoked and the TSP informed all registration authorities about possible sources of error in the process of issuing a qualified certificate. Moreover, the registration platform was changed so that it is no longer possible that a registration officer issues a qualified certificate to him/herself.

text:  Attack by DDoS against hardware provider IP addressing Duration: minutes Services affected: qualified creation of qualified certificates for e-signatures, e-seals,

text: TRUST SERVICES SECURITY INCIDENTS 2018

text: website authentication and qualified creation of qualified e-timestamps Cause: malicious actions Level of severity: 4 – severe

text: A DDoS attack against hardware provider IP addressing caused saturation phenomena in the links with the international carriers resulting in high use of the links with the national carriers. The incident had a cross border impact. The provider informed all affected customers and afterwards contacted the hardware provider to open a ticket.

text:  Network cable damage caused unavailability of trust services for roughly a day Duration: hours Services affected: qualified creation of qualified e-timestamps Cause: third party failures, Level of severity: 4 - severe

text: Damage to a network cable, was caused by fire of a nearby electric cable, and led to unavailability of trust services for almost 100 subscribers. The incident had no impact on personal data. Users and internet service providers were informed after incident detection.

text: TRUST SERVICES SECURITY INCIDENTS 2018 3. ANALYSIS OF REPORTED INCIDENTS

text: The 2018 annual summary reporting, by the 28 EU Member States and 1 EFTA country participating in this process, included in total 18 security incidents . This is only the third round st of annual summary reporting, because eIDAS came into force only recently, on the 1 of July 2016.

text: Reported incidents over the period 2016 - 2018

text: 15 18 14

text: 2016 2017 2018

text: We expect the number of notified security breaches to continue to increase as the trust services market continues to grow and providers become more familiar with the breach reporting process.

text: 3.1 ROOT CAUSE CATEGORIES

text: For 2018 the most common root causes of security incidents were system failures (7 incidents, 39% of the total) and malicious actions (7 incidents, 39% of the total). The latter is significantly higher than in 2017 when malicious actions accounted for just one incident. Only a tenth of the incidents are third party failures, another tenth are human errors.

text: Root causes of trust services security incidents - 2018 11%

text: System failures

text: 11% 39%

text: Malicious actions

text: Human errors

text: Third party failures

text: 39% TRUST SERVICES SECURITY INCIDENTS 2018 3.2 DETAILED CAUSES

text: The four most common causes of incidents are software bugs, hardware failures, DDoS attacks and policy/procedure flaws.

text: Detailed causes of trust services security incidents - 2018

text: Theft or loss of equipment 1

text: Theft or loss of data 2

text: Policy or procedure flaw 3

text: Overload 1

text: Faulty software change/update 1

text: Power cut 1

text: Hardware failure 3

text: Denial of service attack 3

text: Software bug 4

text: Cryptanalysis 1

text: Human error in issuing qualified certificates 1

text: 0 1 2 3 4

text: 3.3 SERVICES AFFECTED

text: In this section we look which services were impacted by incidents.

text: 3.3.1 Trust services affected in detail

text: Most of the reported incidents affected the qualified signature certificate creation (44% of total incidents). This is consistent with last year. Website authentication certificate creation, seal certificate creation and timestamp creation were the second most affected services among the qualified ones. (22% of total incidents for each service). Approximately a fifth of the reported incidents (17% of total) affected the validation of e-signatures/e-seals.

text: Incidents affecting services (detailed)

text: TRUST SERVICES SECURITY INCIDENTS 2018 3.3.2 Qualified versus non-qualified

text: This year, approximately three quarters of the total incidents had an impact on qualified services (i.e. qualified signature certificate creation, qualified seal certificate creation, etc.). The corresponding percentage for non-qualified services is just over a quarter. Note that one incident report could involve multiple trust services, which explains why the percentages in the charts here add up to more than 100%.

text: Incidents affecting services (Qualified/Non-qualified)

text: 90% 78% 80% 70% 60% 50% 40% 28% 30% 20% 10% 0% Qualified services Non qualified services

text: 3.4 SECURITY INCIDENTS WITH CROSS BORDER IMPACT

text: Approximately one quarter of the security incidents (4 incidents, 22%) had an impact across borders, in the other EU Member States. In most cases of cross border impact, supervisory bodies informed other MS by initiating the cross-border incident notification procedure.

text: Cross-border impact - Trust Services security incidents

text: Cross-border impact No cross-border impact

text: Half of the incidents with cross-border impact were rated as severe (level 4) and a quarter of them were reported as disastrous (level 5) indicating the importance of cross-border collaboration and information sharing. Incidents without cross-border impact were less critical as only 30% of them were submitted as severe while most of them (57%) were classified as level 3 (significant impact) in terms of severity.

text: TRUST SERVICES SECURITY INCIDENTS 2018 Cross border impact No cross border impact

text: 3 - significant 4 - severe 5- disastrous 2 - insignificant 3 - significant 4 - severe

text: 14% 25% 25% 29%

text: 50% 57%

text: 3.5 LEVEL OF SEVERITY

text: In 2018 half of the reported incidents had severity level 3 (significant impact), while a third of the incidents were severe. Only one incident was reported as disastrous.

text: Reported incidents - Level of severity (2018)

text: 9 incidents 50%

text: 6 incidents

text: 2 incidents 10% 1 incident

text: 1 - no impact 2 - insignificant 3 - significant 4 - severe 5 - disastrous

text: TRUST SERVICES SECURITY INCIDENTS 2018 3.6 SEVERITY 2017 AND 2018

text: We compare the statistics for severity with the previous round of reporting, covering 2017. The number of incidents with a significant impact is stable at 50%. There were less disastrous incidents, but more severe incidents.

text: Reported incidents - Level of severity (2017-2018)

text: 33% 30%

text: 21% 20%

text: 11% 10% 7% 6% 0%

text: 2017 2018

text: TRUST SERVICES SECURITY INCIDENTS 2018 4. CONCLUSIONS

text: Two years after the adoption of the eIDAS regulation, the electronic trust services market is growing, as is the number of applications and processes relying on electronic identities. eIDAS is becoming an enabler for the single digital market. Web certificates (for HTTPS, i.e. SSL/TLS) are now the norm, thanks to innovative projects, like ‘Let’s encrypt’, and the joint work of the web browser manufacturers. The collaboration between the supervisory bodies across the EU is delivering results. ENISA looks forward to continuing to support the supervisory bodies across ENISA looks the EU as well as the Commission, with the security aspects of implementing eIDAS. forward to

text: continuing to

text: We make some general observations below: support the

text: supervisory

text:  Cross eIDAS collaboration and information sharing: Under eIDAS there is a bodies across cooperation network of authorities for national electronic identity systems, and there is the EU as well as a group of national supervisory bodies for the electronic trust services market. But from the Commission, a security perspective these areas are closely related. Security issues with an with the security electronic identity system, often have an impact on trust services, for example, many aspects of certificate authorities use electronic identities for authentication. Similarly, security implementing issues with electronic trust services, often have an impact on eID systems, for eIDAS example, many eID systems are built with trust services. Collaboration and information sharing related to incidents, threats, good practices, etc. is important.  Situational awareness: We believe situational awareness about vulnerabilities and threats will help the supervisory bodies to do a more effective supervision. ENISA will continue to facilitate information sharing between the relevant authorities and supervisory bodies.  Connecting the security supervision of NISD, eIDAS, and European Electronic Communication Code (EECC): The start of 2019 saw a very successful campaign of cyberattacks. The attack, referred to as DNSpionage, used weaknesses in TLD to poison DNS, to obtain fake web certificates, and subsequently man-in-the-middle traffic between employees and the targeted organizations. Media reports suggest the attackers have been highly successful in capturing large amounts of information from these organizations. This attack touches different areas, under different EU laws. This attack shows why it is so important to establish a close connection with regular information exchange and updates between eIDAS, the EECC and the Digital infrastructures part of the NIS Directive.  Security supervision of non-qualified web certificates: A crucial part of the trust services market are the web certificates, used for HTTPS and other TLS encrypted channels. However, it is not easy to supervise this area. Providers of these certificates are not obliged to register with a national supervisory body and many organizations use providers outside the EU. The ex-post (light-touch) supervision regime for digital service providers, under the NIS Directive, could be an option.

text: The Commission will be reviewing the eIDAS regulation in 2020. We look forward to supporting this eIDAS review and contributing with advice.

text: -N -EN -001 -19 -AK TP

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity (ENISA) is working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. Since 2019, it draws up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN 978-92-9204-299-8 doi: 10.2824/540225


text: JULY 2020

text: JULY 2020

text: JULY 2020

text: JULY 2020

text: See https://www.enisa.europa.eu/topics/incident-reporting/cybersecurity-incident-report-and-analysis-system-visualanalysis/visual-tool

text: JULY 2020

text: Regulation (EU) No 910/2014

text: of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive

text: , can be consulted at https://eur-lex.europa.eu/eli/reg/2014/910/oj

text: JULY 2020

text: JULY 2020

text: JULY 2020

text: Note that three of the reported incidents were indicated as incidents with no impact but included in the analysis

text: JULY 2020

text: Theft or loss of equipment 1

text: Policy or procedure flaw 4

text: Faulty hardware change/update 4

text: Faulty software change/update 5

text: Hardware failure 9

text: Malware and viruses 1

text: Software bug 7

text: Other 4

text: JULY 2020

text: webCertificate 6%

text: eTimestamp 21%

text: eSeal 25%

text: eSignature 87%

text: Generation Certificate Validation Undefined types Preservation management

text: JULY 2020

text: Qualified services Non qualified services

text: Incidents 2 Incidents

text: ) ns 25 io ill M 20

text: ur ho er

text: User hours is a metric used to quantify the impact of an incident; it is the product of the number of users affected with the duration of the incident in hours. For example, 1M User Hours means 1M users were affected for one hour, or 2M users for half an hour, etc

text: JULY 2020

text: See ENISA Annual Report Telecom Security Incidents 2019 6 CG Publication 04/2018 - Cybersecurity incident taxonomy

text: JULY 2020

text: JULY 2020

text: https://threatpost.com/what-you-need-know-about-diginotar-hack-090211/75611/ 8 https://www.wired.com/story/sea-turtle-dns-hijacking/

text: JULY 2020

text: https://minerva.crocs.fi.muni.cz/ 10 https://www.nds.ruhr-uni-bochum.de/media/ei/veroeffentlichungen/2019/02/12/report.pdf

identifier: Trust Services Security Incidents 2019 Annual Analysis Report

title: Trust Services Security Incidents 2019 Annual Analysis Report

text: TRUST SERVICES SECURITY INCIDENTS 2019 Annual Analysis Report JULY 2020 0

text: TRUST SERVICES SECURITY INCIDENTS 2019 ABOUT ENISA

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquires about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Aggelos Koukounas, Eleni Vytogianni, Marnix Dekker - ENISA

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the experts in the ENISA Article 19 Expert Group which comprises experts from more than 30 national supervisory bodies (SBs) in EU, EFTA, EEA and EU candidate countries. The group is currently chaired by a representative of RTR Austria.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Shutterstock. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. Catalogue Number: TP-AK-20-001-EN-N ISBN: 978-92-9204-351-3 DOI: 10.2824/047833

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5 2. INCIDENT REPORTING FRAMEWORK 6

text: 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS 6

text: 2.2 EXAMPLES OF SECURITY INCIDENTS 6

text: 3. INCIDENT ANALYSIS 8

text: 3.1 ROOT CAUSE CATEGORIES 8

text: 3.2 DETAILED CAUSES 9

text: 3.3 TYPES OF TRUST SERVICES AFFECTED 10

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES 10

text: 3.5 NUMBER OF INCIDENTS (OUTAGES) AND USER HOURS 11

text: 4. MULTI-ANNUAL TRENDS 2016-2019 12

text: 4.1 MULTI-ANNUAL TREND ROOT CAUSE CATEGORIES 12

text: 4.2 MULTI-ANNUAL TREND SEVERITY OF IMPACT 12

text: 5. CONCLUSIONS 14

text: 5.1 KEY TAKEWAYS 14

text: 5.2 OBSERVATIONS 14

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: EXECUTIVE SUMMARY

text: Electronic trust services are a range of services around digital signatures, digital certificates, electronic seals, timestamps, etc. which are used in electronic transactions, to make them

text: 2019 ANNUAL

text: secure. eIDAS, an EU regulation, is the EU wide legal framework ensuring interoperability and

text: REPORT

text: security of these electronic trust services across the EU. One of the goals of eIDAS is to ensure that electronic transactions can have the same legal standing as traditional paper based The number of notified transactions. eIDAS is important for the European digital market because it allows businesses incidents almost and citizens to work and use services across the EU. The eIDAS regulation was adopted in July doubled. 2014 and came into force in 2016. Article 19 of eIDAS introduces mandatory security breach notification requirements for TSPs in the EU: System failures account  Trust service providers notify the national supervisory body about security breaches for more than half of the with significant impact. incidents  National supervisory bodies inform each other and ENISA if there is cross-border impact. System failures have  Every year national supervisory bodies send annual summary reports about the been the dominant root notified breaches to ENISA and the Commission. cause in the last 4 years This document, the Annual Report Trust Services Security Incidents 2019 gives an aggregated of incident reporting. overview of these breaches, showing root causes, statistics and trends. It marks the fourth round of security incident reporting for the EU’s trust services sector. The annual summary reporting for 2019 totalled 32 incident reports. A total of 27 EU countries and 2 EFTA countries take part in annual summary reporting.

text: The key statistics relating to the 2019 incidents are:  A significant increase in notified incidents: In 2019 the notified incidents almost doubled with respect to last year, increasing by nearly 80%. This is not necessarily a sign of security getting worse. From discussions with supervisory bodies we conclude that this increase in notifications is a sign that trust service providers are becoming more familiar with the breach reporting process and their obligations.

text:  System failures is the dominant root cause: Most incidents (63%, 20 incidents) are caused by system failures. Over the last 4 years of annual incident reporting in this sector, system failures have consistently been the most common root cause of reported incidents. Τypically, these cases are hardware failures and software bugs. Human errors account for almost 30% of incidents reported in 2019 while only 9% of incidents were flagged as malicious actions.

text: Figure 1: Total reported incidents vs system failures

text: 35 32 30 25 20 18 20 14 15 10 8 10 5 1 1 0 2016 2017 2018 2019

text: System failures Total incidents

text: TRUST SERVICES SECURITY INCIDENTS 2019

text:  Most reported incidents concerned qualified trust services: More than three quarters of total incidents (78%) had an impact on qualified trust services. In general, non-qualified trust services are widely used. However in the set of all reported incidents, only a small number of security breaches concerns a non-qualified trust service (20%, 13 incidents). In most cases (80%, 52 incidents) the notification is done by a TSP also offering qualified services, reporting an incident which has affected both their qualified and non-qualified services

text:  Most of the incidents were minor. Almost a third had large impact: 31% of incidents reported in 2019 were rated as having large impact. In contrast to the two previous years, there was no incident with “very large” (disastrous) impact. We also observe a significant increase of the “minor” incidents. This is another indication that the incident reporting mechanism has become more familiar to the providers; they are reporting more incident regardless of their severity.

text: Figure 2: Severity of impact Trust services incidents in the EU - reported over 2016-2019

text: This year ENISA publishes statistics about trust services security incidents in an online visual tool. This tool allows for custom analysis of trends and patterns .

text: ENISA will continue to support the national supervisory bodies with implementing the breach reporting under Article 19 of eIDAS and to work towards making this process efficient and effective, yielding useful data, for the supervising bodies, for the authorities of other sectors, as well as for the trust service providers and the organisations relying on these trust services.

text: Based on the experience of 4 years of eIDAS security incident reporting, the

text: Article 19

text: group has provided advice and input to the Commission review of the eIDAS regulation (ongoing in 2020).

text: TRUST SERVICES SECURITY INCIDENTS 2019 1. INTRODUCTION

text: According to Article 19 of the eIDAS Regulation , Electronic Trust Service Providers (TSPs) in the EU have to notify the national supervisory bodies in their country about security incidents. Annually the supervisory bodies send summaries of these incident reports to ENISA. Subsequently, ENISA publishes an aggregated overview of these security incidents. This document gives an aggregate overview of the security incident reports submitted by the supervisory bodies over 2019.

text: This annual report marks the fourth round of security incident reporting in the EU’s trust services sector, covering the security incidents of 2019. This document is structured as follows: In section 2 we briefly summarize the policy context, the underlying eIDAS reporting framework and we give an idea about the type of incidents reported; we mention some specific but anonymised examples. In Section 3, we dive into the reported incidents, by presenting the root cause categories, the detailed causes and the affected services. In section 4 we look at multiannual trends over the years 2016-2019. In Section 5, we draw some conclusions and make some observations.

text: This document only contains aggregated and anonymized information about incidents and does not include details about individual countries or individual trust service providers. Detailed discussions about the reported security incidents take place in the ENISA

text: Article 19

text: expert group, which is an informal group of experts from national supervisory bodies focusing on the practical implementation of

text: Article 19

text: . The group is currently chaired by a representative from RTR, the Austrian regulatory authority. ENISA acts as the secretariat and supports the group with analysis, drafting, logistics, etc.

text: TRUST SERVICES SECURITY INCIDENTS 2019 2. INCIDENT REPORTING FRAMEWORK

text: Article 19 of eIDAS requires trust service providers in the EU to 1) assess risks 2) take appropriate security measures to mitigate security breaches, and 3) notify/report security eIDAS

text: Article 19

text: incidents/breaches. requires trust

text: service providers in 2.1 OVERVIEW OF INCIDENT REPORTING PROCESS the EU to:

text: The mandatory security breach notification process has 3 steps:

text: 1) Assess risks

text:  Trust service providers notify the national supervisory body about security 2) Take appropriate breaches with significant impact. security measures  National supervisory bodies inform each other and ENISA if there is cross- to mitigate security border impact. breaches,  National supervisory bodies send annual summary reports about the notified

text: 3) Notify breaches

text: breaches to ENISA and the Commission.

text: to the national supervisory bodies.

text: Figure 3: Incident Reporting Framework for Trust Services

text: 2.2 EXAMPLES OF SECURITY INCIDENTS

text: We give some anonymized examples of incidents to give an idea of the kind of incidents notified to the national supervisory bodies this year:

text:  [Service affected: eSignature – generation, Detailed cause: Software bug]: Vulnerability in the software of the fingerprint sensor of some well-known mobile devices. The secure elements of the device did not meet the security requirements as a second authentication factor for creating remote signatures. For this reason, the affected secure elements was temporarily excluded as a second authentication factor until there was a software update which fixed the problem.

text: TRUST SERVICES SECURITY INCIDENTS 2019

text:  [Service affected: eSignature – generation, Detailed cause: Faulty software change/update]: Certificate templates have been misconfigured. The QC statement "qualified certificate" is missing from the profile. Electronic signatures created with these certificates are not qualified signatures. Thousands of certificates were generated with this profile defect over a period of more than a year. The users concerned are in several EU countries.

text:  [Service affected: eSignature – generation, Detailed cause: Policy/procedure flaw]: Certificate issued to a wrong name because a registration officer didn’t comply with TSP’s procedures. The certificate was revoked when the mistake was discovered.

text:  [Service affected: eSignature, eTimestamp, Detailed cause: Theft or loss of equipment]: The TSP was the victim of theft of equipment. Laptops used by main site system administrators were stolen. A report was made on the spot and a notification to the insurer was sent. The credentials were all revoked and no admins account was used before the revocation. Additional training on physical security has been implemented for staff.

text:  [Service affected: eSignature, eSeal, webCertificate, Detailed cause: software bug]: Abnormal behaviour of services, during connection to the Database. Monitoring systems detected a general slowdown accessing CA services. The anomaly was immediately detected by internal monitoring and rescheduling activities started. As a result of overloading of requests, there were problems related to accessing the DB which caused delays and timeouts. In the indicated time slot, the user could not access the CA services, while it obtained occasional timeout during authentication.

text: TRUST SERVICES SECURITY INCIDENTS 2019 3. INCIDENT ANALYSIS

text: The 2019 annual summary reporting, by the 27 EU Member States and 2 EFTA countries participating in this process, included in total 32 security incidents . This is the fourth round of annual summary reporting, because eIDAS came into force only recently, on the 1st of July 80%

text: is the increase of reported

text: Figure 4: Trust Services Reported incidents incidents

text: compared to 35 32 the previous 30 year.

text: We observe an increase of nearly 80% in terms of reported incidents compared to the previous year. We expect the number of notified security breaches to continue to increase as the trust services market continues to grow and providers become more familiar with the breach reporting process.

text: 3.1 ROOT CAUSE CATEGORIES

text: According to data received by member states, system failures are the dominant root cause accounting for nearly two thirds of total incidents reported (63%, 20 incidents). Typically, these cases are hardware failures and software bugs. Almost 30% of incidents were categorised as human errors and a minor 9% of total incidents were flagged as malicious actions. There was no incident due to natural phenomena.

text: Figure 5: Root causes of TSP security incidents - 2019

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: The above graph depicts the distribution of the incidents according to their root cause. There are four main (4) categories of root causes: systems failures, human errors, malicious actions and natural phenomena. In some cases the root cause of the incidents have been reported to be also related to third-party failure. The latter is an additional cause category which can only be selected in combination with one of the above root causes. In total over 2019, 25% of incidents were flagged as third-party failures related. The division, is shown in the chart below. Figure 6: Root causes vs. third party failures – 2019

text: 3.2 DETAILED CAUSES

text: The three most common causes of incidents are hardware failures, software bugs and faulty software change/update. Note that an incident is often not only triggered by one cause but can involve multiple detailed causes, a chain of events. This explains why the total number in the chart here add up to more than 32 which is the number of reported incidents for 2019. Figure 7: Detailed causes of trust services security incidents - 2019

text: TRUST SERVICES SECURITY INCIDENTS 2019 3.3 TYPES OF TRUST SERVICES AFFECTED

text: Most of the reported incidents (87%) had impact on electronic signatures. Electronic seals and timestamps were affected by one fourth (25%) and one fifth (21%) of the incidents respectively. Overall, 83% of the reported incidents in the last four years had affected electronic signature services. Both with electronic seals (29%) and timestamps services (20%) remained at the top three services affected over the years of reporting.

text: Figure 8: Impact of the incidents

text: Below we show the impact of the incidents on the subservices. The services related to the generation of signatures/seals/timestamps (56%) and certificate management (47%) are the most affected subservices.

text: Figure 9: Impact of incidents on subservices

text: 60% 56%

text: 50% 47%

text: 12% 9%

text: 3.4 QUALIFIED SERVICES VERSUS NON-QUALIFIED SERVICES

text: This year, approximately three quarters of total incidents (78%) had an impact on qualified services (i.e. qualified signature certificate creation, qualified seal certificate creation, etc.). The corresponding percentage for non-qualified services is almost a quarter. Note that one incident report could involve multiple trust services, which explains why the percentages in the charts here add up to more than 100%.

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: Figure 10: Reported Incidents affecting services (Qualified vs Non-qualified)

text: 78% 25% 3.5 NUMBER OF INCIDENTS (OUTAGES) AND USER HOURS

text: Below we focus on the incidents with impact on the availability of the services (outages) and we look at the user hours lost . Interestingly only a few human errors (2 incidents) account for almost the half of the lost users hours (48%, 20 M user hours). The other half is caused by system failures (13 incidents, 52%, 22 M user hours).

text: Figure 11: Total user-hours lost vs root cause

text: ( 22M lo 20M TRUST SERVICES SECURITY INCIDENTS 2019 4. MULTI-ANNUAL TRENDS 2016-2019

text: ENISA has been collecting and aggregating incident reports since 2016. In this section, we look at multiannual trends over the last 4 years, covering the period from 2016 to 2019. This dataset contains 65 reported incidents in total.

text: of incidents are 4.1 MULTI-ANNUAL TREND ROOT CAUSE CATEGORIES due to system

text: Over the 4 years of trust services security incident reporting, the most common root cause is

text: failures. The

text: system failures (60%). For this root cause, the most common causes were hardware failures

text: most common

text: (35%) and software bugs (33%). This is also the trend in the electronic communication services

text: causes were

text: where system failures account for almost two thirds (67%) of total incidents (722 out of 1093

text: hardware failures

text: incidents).

text: (35%) and software bugs

text: Figure 12: Root cause categories Trust services incidents in the EU - reported over 2016-2019

text: Around a fifth of the reported incidents (18%) were due to malicious actions and another fifth were flagged as human errors. Natural phenomena is not a common root cause in this sector. This sector operates differently than the telecom one. With large-scale aboveground infrastructure for the mobile networks, the telecom sector is more vulnerable to natural phenomena.

text: 4.2 MULTI-ANNUAL TREND SEVERITY OF IMPACT

text: We compare the statistics for severity with the previous rounds of reporting. We follow the EU Cybersecurity incident taxonomy where the severity of the impact has the following values: no impact, minor, large and very large impact .

text: The number of incidents with large impact is almost stable the last three years. It is interesting to see that there was a significant increase of the “minor” incidents last year. This is an

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: indication that the incident reporting mechanism has become more familiar and effective; providers are reporting more incident regardless of their severity. In contrast to the previous year, there was no very large (disastrous) incident during 2019.

text: Figure 13: Severity of impact Trust services incidents in the EU - reported over 2016-2019

text: TRUST SERVICES SECURITY INCIDENTS 2019 5. CONCLUSIONS 5.1 KEY TAKEWAYS

text: The key takeaways from the 2019 incidents are:  A significant increase of notified incidents: In 2019 there is a raise of nearly 80% in terms of reported incidents compared to the previous year. This was actually expected and is attributed to the increased adoption of trust services market and growing familiarity with this breach reporting process.

text:  System failures is the dominant root cause: Most incidents (63%, 20 incidents) are caused by system failures. Looking back at the 4 years of annual incident reporting in this sector, we observe that every year, system failures are the most common root cause of reported incidents. Typically, these cases are hardware failures and software bugs. Human errors have been the cause for almost 30% of incidents reported in 2019 while a minor 9% of total incidents were flagged as malicious actions.

text:  Most reported incidents concerned qualified trust services: More than three quarters of total incidents (78%) had an impact on qualified services while the corresponding percentage for non-qualified services is almost a quarter.

text: 5.2 OBSERVATIONS

text: Beyond the numbers in the incident reports, we make two general observations below about the overall process, based on our experience with eIDAS incident reporting and discussions in the

text: Article 19

text: group:

text:  Supervision of, and incident reporting by, non-qualified services: Non-qualified trust services are widely used. A good example is website (TLS) certificates, which are a staple of online/internet security. Globally around 80% of websites use web certificates. LetsEncrypt alone had issued a billion website certificates in February 2020.

text: There have been scores of major security incidents with web certificates, also in Europe. Take for example, the Diginotar incident of 2011 (Certificate authority hacked, fake certificates for google.com), which led to a major disruption of Dutch egovernment and eavesdropping of Iranian citizens, or, more recently, the DNSpionage attacks of 2018-2019, in which DNS poisoning and fake certificates were used to eavesdrop on public and private sector organizations in the EU.

text: However, in the set of reported incidents, only a small number of security breaches affect a non-qualified trust service (20%, 13 incidents). In most cases (80%, 52

text: TRUST SERVICES SECURITY INCIDENTS 2019

text: incidents) the notification is done by a TSP also offering qualified services, reporting an incident which has affected both their qualified and non-qualified services.

text: This suggests there is under-reporting of security breaches with non-qualified trust services. It is good to mention here that under eIDAS, non-qualified services are subject to ex-post supervision. This means that only after a security breach, the supervisory can take action and assess the security of the trust services. This explains that supervisory bodies are not always aware of, or in contact with, the trust service providers and their services. When an incident happens, the supervisory body often learns about it in media reports, and does not get informed about incidents directly.

text:  Reporting about vulnerabilities and attacks-in-the-wild: There is a clear need to exchange information not only about actual incidents with impact at a TSP’s trust service, but also about attacks and vulnerabilities. Since the ROCA case happened, information sharing between supervisory bodies has improved. There were more recent examples of such cases, like the Minerva attack and the attacks bypassing the signature validation in pdf . These cases highlight, once more, the need for raising awareness and exchange information with a broad group of entities, i.e. research communities, CSIRTs, national supervisory bodies, owners of potentially affected eID schemes, etc. Good information exchange and communication between competent authorities enables timely assessment of the situation and makes it easier to respond and prevent or mitigate incidents.

text: ENISA facilitates the information sharing between national authorities by providing the technical means to the supervisory bodies for sharing this kind of information. We are also adapting and extending the CIRAS incident reporting tool to better support this kind of cross-border communication better. We are currently piloting with the owners of the national eID schemes, who need to notify incidents under article 10 of the eIDAS. And there are other types of incidents which are noteworthy and interesting to exchange information about, like near-misses, or incidents prevent by activation of security measures like revocation of devices or certificates.

text: The eIDAS Regulation and the eIDAS incident reporting have been in place for more than 4 years now. We have been improving the incident reporting process, together with the

text: Article 19

text: group. This year, under eIDAS

text: Article 49

text: , the European Commission is reviewing the eIDAS Regulation itself, in order to report to the European parliament and to the Council. This eIDAS review is an opportunity to address some of the above-mentioned issues and gaps. We look forward to supporting the Commission and the EU Member States with implementing eIDAS security incident reporting in an efficient and effective manner.

text: -N -EN -001 -20 -AK TP

text: ABOUT ENIS A

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

text: ISBN: 978-92-9204-351-3 DOI: 10.2824/047833