text: Toolset - v2.0, March 2022

text: The authors are listed in alphabetical order by surname. Subject matter expert selected from the List of Network and Information Security (NIS) Experts compiled following the ENISA Call for Expressions of Interest (CEI) (ref. ENISA M-CEI-17-C01).

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/legalcooperation#Aspects 4 ENISA, 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU Member States/EFTA countries, https://www.enisa.europa.eu/publications/2020-report-on-csirt-le-cooperation (published on 26 January 2021).

text: Toolset - v2.0, March 2022

text: Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material/legalcooperation#Aspects

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: This exercise is useful for incident responders and members of Law Enforcement of all experience levels. It is particularly helpful for national

text: Targeted Audience

text: CSIRT members and Law Enforcement officers involved in cybercrime investigations

text: Total Duration 85 minutes

text: This is a group exercise. Each trainee is a member of CSIRT, LE or the Judiciary who is involved in the prevention, mitigation and investigation of the cybersecurity incident/crime. Their goals are to address key ramifications

text: resulting from the theft of confidential data, identify synergies that could be exploited by cooperating with the other communities, and potential interferences in case of lack of cooperation/coordination

text: Task 1 Identify and describe the organisational profile

text: Describe measures that CSIRT and/or LE can take to prevent the

text: Task 2

text: Use the SoD Matrix to analyse possible duties (tasks), synergies and potential

text: Task 3

text: interferences between CSIRT, LE and the Judiciary

text: List possible measures that CSIRT and/or LE can take during the incident

text: Task 4

text: response/crime investigation while performing different duties

text: Group discussion on balancing the incident mitigation (asset protection) and

text: Task 5

text: criminal investigation (evidence collection and preservation)

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Tactic “Organizational information gathering consists of the process of identifying critical TA0017 - Organizational organizational elements of intelligence an adversary will need about a target in order to best Information Gathering attack. Similar to competitive intelligence, organisational intelligence gathering focuses on understanding the operational tempo of an organization and gathering a deep understanding of the organization and how it operates, in order to best develop a strategy to target it.”

text: Tactic “People Information Gathering consists of the process of identifying critical personnel elements TA0016 - People of intelligence an adversary will need about a target in order to best attack. People intelligence Information Gathering gathering focuses on identifying key personnel or individuals with critical accesses in order to best approach a target for attack. It may involve aspects of social engineering, elicitation, mining social media sources, or be thought of as understanding the personnel element of competitive intelligence.”

text: MITRE Corporation, Organizational Information Gathering, https://attack.mitre.org/versions/v7/tactics/TA0017/ (retrieved on 13 October 2020). MITRE Corporation, People Information Gathering, https://attack.mitre.org/versions/v7/tactics/TA0016/ (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Tactic "Organizational weakness identification consists of identifying and analyzing weaknesses and TA0020 – vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to Organizational target or intermediate target organizations of interest." Weakness Identification

text: Tactic "People weakness identification consists of identifying and analyzing weaknesses and TA0019 – People vulnerabilities from the intelligence gathering phases which can be leveraged to gain access to Weakness Identification target or intermediate target persons of interest or social trust relationships."

text: Technique “Business processes, such as who typically communicates with who, or what the supply chain T1301 - Analyze is for a particular part, provide opportunities for social engineering or other”. business processes

text: Technique "Business relationship information may be used by an adversary to shape social engineering T1283 – Identify attempts (exploiting who a target expects to hear from) or to plan for technical actions such as business relationships exploiting network trust relationship"

text: Technique “Social media provides insight into the target's affiliations with groups and organizations. T1295 - Analyze social Certification information can explain their technical associations and professional associations. and business Personal information can provide data for exploitation or even blackmail.” relationships, interests, and affiliations

text: Technique "An adversary may assess a target's operational security (OPSEC) practices in order to T1296 – Assess identify targeting options. A target may share different information in different settings or be targeting options more of less cautious in different environments." 'OPSEC'

text: Technique "The attempt to identify people of interest or with an inherent weakness for direct or indirect T1269 – Identify people targeting to determine an approach to compromise a person or organization. Such targets may of interest include individuals with poor OPSEC practices or those who have a trusted relationship with the intended target."

text: Technique "An adversary may identify sensitive personnel information not typically posted on a social T1274 – Vulnerable media site, such as address, marital status, financial history, and law enforcement infractions. sensitive personnel This could be conducted by searching public records that are frequently available for free or at information a low cost online."

text: Tactic “Persona development consists of the development of public information, presence, TA0023 - Persona Development history and appropriate affiliations. This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy throughout an operation using that persona or identity.”

text: Tactic "Establishing and maintaining infrastructure consists of building, purchasing, co- TA0022 - Establish & Maintain opting, and maintaining systems and services used to conduct cyber operations. An Infrastructure adversary will need to establish infrastructure used to communicate with and control assets used throughout the course of their operations."

text: MITRE Corporation, Organizational Weakness Identification, https://attack.mitre.org/versions/v7/tactics/TA0020/ (retrieved on 13 October 2020). MITRE Corporation, People Weakness Identification, https://attack.mitre.org/versions/v7/tactics/TA0019/ (retrieved on 13 October 2020). MITRE Corporation, Analyze business processes, https://attack.mitre.org/versions/v7/techniques/T1301/ (retrieved on 13 October 2020). MITRE Corporation, Identify business relationships, https://attack.mitre.org/versions/v7/techniques/T1283/ (retrieved on 13 October 2020). MITRE Corporation, Analyze social and business relationships, interests, and affiliations, https://attack.mitre.org/versions/v7/techniques/T1295/ (retrieved on 13 October 2020). MITRE Corporation, Assess targeting options 'OPSEC, https://attack.mitre.org/versions/v7/techniques/T1296/ (retrieved on 13 October 2020). MITRE Corporation, Identify people of interest, https://attack.mitre.org/versions/v7/techniques/T1269/ (retrieved on 13 October 2020). MITRE Corporation, Vulnerable sensitive personnel information, https://attack.mitre.org/versions/v7/techniques/T1274/ (retrieved on 13 October 2020). MITRE Corporation, Persona Development, https://attack.mitre.org/tactics/TA0023/ (retrieved on 13 October 2020). MITRE Corporation, Establish & Maintain Infrastructure, https://attack.mitre.org/versions/v7/tactics/TA0022/ (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Tactic "Initial Access consists of techniques that use various entry vectors to gain their TA0001 – Initial Access initial foothold within a network. Techniques used to gain a foothold include targeted spearphishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords."

text: Technique “Adversaries may send spearphishing emails with a malicious link in an attempt T1566 - Phishing: Spear phishing to elicit sensitive information and/or gain access to victim systems. Link Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in the email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.”

text: Technique “An adversary may rely upon specific actions by a user in order to gain execution. T1204 - User Execution Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behaviour from forms of Phishing.”

text: Technique “Adversaries may use methods of capturing user input to obtain credentials or collect T1056 – Input Capture information. During normal system usage, users often provide credentials to different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).”

text: Technique “Adversaries may use an existing, legitimate external Web service to exfiltrate data T1567 – Exfiltration Over Web rather than their primary command and control channel. Popular Web services acting Service as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to the compromise. Firewall rules may also already exist to permit traffic to these services.

text: MITRE Corporation, Initial Access, https://attack.mitre.org/version/v7/tactics/TA0001/ (retrieved on 13 October 2020). MITRE Corporation, Phishing:Spearphishing Link, https://attack.mitre.org/versions/v7/techniques/T1566/002/ (retrieved on 1 December 2021). MITRE Corporation, User Execution, https://attack.mitre.org/versions/v7/techniques/T1204/ (retrieved on 1 December 2021). MITRE Corporation, Input Capture, https://attack.mitre.org/versions/v7/techniques/T1056/ (retrieved on 1 December 2021). MITRE Corporation, Exfiltration Over Web Service, https://attack.mitre.org/versions/v7/techniques/T1567/ (retrieved on 2 December 2021).

text: Toolset - v2.0, March 2022

text: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.”

text: Technique “Adversaries may schedule data exfiltration to be performed only at certain times of T1029 – Scheduled Transfer day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability.”

text: Technique “An adversary may compress and/or encrypt data that is collected prior to exfiltration. T1560 – Archive Collected Data Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.”

text: Technique “Adversaries may search local system sources, such as file systems or local T1005 – Data from the local databases, to find files of interest and sensitive data prior to Exfiltration.” system

text: MITRE Corporation, Scheduled Transfer, https://attack.mitre.org/versions/v7/techniques/T1029/ (retrieved on 2 December 2021). 24 MITRE Corporation, Archive Collected Data, https://attack.mitre.org/versions/v7/techniques/T1560/ (retrieved on 2 December 2021). 25 MITRE Corporation, Data from Local System, https://attack.mitre.org/versions/v7/techniques/T1005/ (retrieved on 2 December 2021). 26 GitHub, CIRCL / AIL-framework, https://github.com/CIRCL/AIL-framework (retrieved on 13 October 2020). 27 GitHub, enisaeu / Reference-Security-Incident-Taxonomy-Task-Force,https://github.com/enisaeu/Reference-Security-Incident-Taxonomy- Task-Force (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Eric M. Hutchins E. M., Clopperty M. J., Amin R. M., Lockheed Martin Corporation Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven- Defense.pdf (retrieved on 20 October 2020)

text: Toolset - v2.0, March 2022

text: Targeted Audience This exercise is useful for incident responders and members of Law Enforcement of all experience levels. It is particularly helpful for national CSIRT members and Law Enforcement officers involved in cybercrime investigations. Total Duration 85 minutes Scenario This is a group exercise. Each trainee is a member of either a CSIRT team and/or Law Enforcement that is involved in the prevention, mitigation and investigation of cybersecurity incidents. Their goal is to address the key ramification of a ransomware attack against the municipal hospital. Task 1 Notification of the incident Task 2 Setting up the task force, division of duties Task 3 Possible duties (tasks), synergies and potential interferences between CSIRT, LE and the Judiciary Task 4 Incident handling, evidence collection, cooperation Task 5 International cooperation and information sharing Task 6 Post-incident preventive measures

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Tactic "Technical information gathering consists of the process of identifying critical technical TA0015 – Technical elements of intelligence an adversary will need about a target in order to best attack. Information Gathering Technical intelligence gathering includes, but is not limited to, understanding the target's network architecture, IP space, network services, email format, and security procedures."

text: Tactic "Technical weakness identification consists of identifying and analysing weaknesses and TA0018 – Technical vulnerabilities collected during the intelligence gathering phases to determine best approach Weakness based on technical complexity and adversary priorities (e.g., expediency, stealthiness)." Identification

text: MITRE Corporation, Organizational Information Gathering, https://attack.mitre.org/versions/v7/tactics/TA0017/ (retrieved on 13 October 2020). MITRE Corporation, People Information Gathering, https://attack.mitre.org/versions/v7/tactics/TA0016/ (retrieved on 13 October 2020). MITRE Corporation, Technical Information Gathering, https://attack.mitre.org/versions/v7/tactics/TA0015/ (retrieved on 13 October 2020). MITRE Corporation, Technical Weakness Identification, https://attack.mitre.org/versions/v7/tactics/TA0018/ (retrieved on 13 October 2020). MITRE Corporation, Establish & Maintain Infrastructure, https://attack.mitre.org/versions/v7/tactics/TA0022/ (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Technique “Adversaries may send spearphishing emails with a malicious link in an attempt to T1566 - Phishing: Spear phishing elicit sensitive information and/or gain access to victim systems. Spearphishing with Link a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in the email, instead of attaching malicious files to the email itself, to avoid defences that may inspect email attachments.”

text: Technique “An adversary may rely upon specific actions by a user to gain execution. Users T1204 - User Execution may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link. These user actions will typically be observed as follow-on behaviour from forms of Phishing.”

text: MITRE Corporation, Phishing:Spearphishing Link, https://attack.mitre.org/versions/v7/techniques/T1566/002/ (retrieved on 13 October 2020). 35 GitHub, enisaeu / Reference-Security-Incident-Taxonomy-Task-Force,https://github.com/enisaeu/Reference-Security-Incident- Taxonomy-Task-Force (retrieved on 13 October 2020). 36 MITRE Corporation, User Execution, https://attack.mitre.org/versions/v7/techniques/T1204/ (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Technique “Adversaries may encrypt data on target systems or on large numbers of systems T1486 - Data Encrypted for Impact in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted. In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.”

text: Technique “Adversaries may abuse task scheduling functionality to facilitate initial or T1053 - Scheduled Task/Job recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.”

text: Technique "Adversaries may use Valid Accounts to interact with a remote network share T1021/002 - Remote Services: using Server Message Block (SMB). The adversary may then perform actions as SMB/Windows Admin Shares the logged-on user.

text: SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

text: Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels."

text: MITRE Corporation, Data Encrypted for Impact, https://attack.mitre.org/versions/v7/techniques/T1486/ (retrieved on 13 October 2020). MITRE Corporation, Scheduled Task/Job, https://attack.mitre.org/versions/v7/techniques/T1053/ (retrieved on 13 October 2020). MITRE Corporation, Remote Services, https://attack.mitre.org/versions/v7/techniques/T1021/002/ (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: Within the organisation

text: The exact flow of notification varies depending on the Member State legislation.

text: Toolset - v2.0, March 2022

text: Outside the organisation

text: Toolset - v2.0, March 2022

text: Duty (task) Synergies and potential interferences Comments

text: Toolset - v2.0, March 2022

text: Sharing information with the CSIRT

text: Use of the data unofficially obtained by the CSIRT

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: This exercise is useful for incident responders and members of the Law Enforcement of all experience levels. It is particularly helpful for national

text: Targeted Audience

text: minutes Total Duration Note that this use case is a supplemental use case and not directly covered in a training session.

text: This is a group exercise. Each trainee is a member of either the CSIRT team and/or Law Enforcement who is involved in the prevention, mitigation and Scenario investigation of cybersecurity incidents. Their goal is to address the key ramification of a DDoS and malware blended attack against a large size airport in a European capital city

text: Task 1 Notification of the incident

text: Task 2 Setting up task force, division of duties

text: Possible duties (tasks), synergies and potential interferences between CSIRT,

text: Task 3

text: LE and the Judiciary

text: Task 4 International cooperation and information sharing

text: Task 5 Post incident preventive measures

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Technique “Technical information gathering consists of the process of identifying critical TA0015 – Technical information technical elements of intelligence an adversary will need about a target in order gathering to best attack. Technical intelligence gathering includes, but is not limited to, understanding the target's network architecture, IP space, network services, email format, and security procedures”.

text: Technique “Adversaries may send spearphishing emails with a malicious attachment in an T1566.001 – Spearphishing attempt to elicit sensitive information and/or gain access to victim systems. attachment Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution”.

text: Technique “Adversaries may exploit remote services to gain unauthorized access to internal T1210 - Exploitation of Remote systems once inside of a network. Exploitation of a software vulnerability occurs Services when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.”

text: Technique “Adversaries may perform Network Denial of Service (DoS) attacks to degrade or T1498 – Network Denial of Service block the availability of targeted resources to users. Network DoS can be performed by exhausting the network bandwidth services rely on. Example resources include specific websites, email services, DNS, and web-based

text: MITRE Corporation, Technical information gathering, https://attack.mitre.org/versions/v7/tactics/TA0015/ (retrieved on 2 December 2021). MITRE Corporation, Spearphishing attachment, https://attack.mitre.org/versions/v7/techniques/T1566/001 (retrieved on 2 December 2021). MITRE Corporation, Exploitation of remote services, https://attack.mitre.org/versions/v7/techniques/T1210/ (retrieved on 13 October 2020) MITRE Corporation, Network Denial of Service, https://attack.mitre.org/versions/v7/techniques/T1498 (retrieved on 13 October 2020).

text: Toolset - v2.0, March 2022

text: applications. Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction , hacktivism, and extortion”.

text: Technique “Credential Access consists of techniques for stealing credentials like account TA0006 – Credential Access names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals”

text: MITRE Corporation, Credential Access, https://attack.mitre.org/versions/v7/tactics/TA0006/ (retrieved on 2 December 2021).

text: Toolset - v2.0, March 2022

text: Within the organisation

text: Outside the organisation

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: Toolset - v2.0, March 2022

text: AIL Analysis Information Leak BCP Business Continuity Plan C&C Command and Control Server CSIRT Computer Security Incident Response Team DDoS Distributed Denial of Service EDR Endpoint Detection and Response EFTA European Free Trade Association EMAS Europol Malware Analysis Solution ICT Information and Communication Technology IP Internet Protocol ISP Internet Service Provider LE Law Enforcement LEA Law Enforcement Agency MS Member State NIS Directive on Security of Network and Information Systems OPSEC Operations Security Q&A Question and answer Q1 First quarter PoC Point of Contact RSIT Reference Security Incident Taxonomy SIEM Security Information and Event Management SoD Segregation (or separation) of Duties SSH Secure Shell VPN Virtual Private Network VPS Virtual Private Server

text: Toolset - v2.0, March 2022

text: • Informed (I): Who is informed when performing this duty? (For instance, if CSIRT should report a crime to LEA; this means that LEA

text: is informed) (if applicable)

text: s ADDITIONAL COMMENTS (including Duties related to (supporting) or Training topics (e.g. technical skills etc. information on possible synergies and cybercrime fighting activities Ts ecut es potential interferences) IR os dg CS LE Pr Ju

text: Prior to incident/crime

text: Delivering training

text: Participating in training 3. Collecting cyber threat intelligence

text: Analysing vulnerabilities and threats

text: Issuing recommendations for new vulnerabilities and threats

text: Advising potential victims on preventive measures against cybercrime

text: During the incident/crime

text: 7.Discovering of the cyber-security incident/crime 8.Identifying and classifying the cyber-security incident/crime 9.Identifying the type and severity of the compromise 10. Collecting data that may be evidence/evidence 11. Providing technical expertise 12. Preserving the evidence that may be crucial for the detection of a crime in a criminal trial 13. Advising the victim to report / obligation to report a cybercrime to law enforcement (LE) 14. Informing the victim of a cybercrime 15. Informing other stakeholders/authorities (operators of vulnerable systems, data protection authorities, telecommunications authorities, etc.)

text: Toolset - v2.0, March 2022

text: Acting as a single point of contact (PoC) for any communication with other EU Member States for the incident handling 17. Mitigating a cybersecurity incident 18. Conducting the criminal investigation 19. Leading the criminal investigation 20. In the case of disagreement, having the final say for a criminal investigation 21. Authorizing the investigation carried out by the LE 22. Ensuring that fundamental rights are respected during the investigation and prosecution

text: Post incident/crime

text: Advising on systems recovery

text: Protecting the constituency 25. Preventing and containing cyber-security incidents from a technical point of view 26. Analysing and interpreting collected evidence 27. Requesting testimonies from CSIRTs and LE 28. Admitting and assessing the evidence 29. Judging who committed a crime 30. Assessing cyber security incident damage and cost 31. Reviewing the response and updating policies and procedures

text: Toolset - v2.0, March 2022

text: rs ADDITIONAL COMMENTS to Duties related to (supporting) (including information on possible s s Training topics (e.g. technical cybercrime fighting activities skills etc.) synergies and potential IRT osecu interferences) CS LE Pr Judge

text: Prior to incident/crime

text: Prosecutor depending on the specific 10. Collecting data that I case may be informed or consulted, may be evidence/Evidence S R Digital forensics C in other words requested to provide collection guidance.

identifier: Aspects of Cooperation between CSIRTs and LE - Toolset 2021

title: Aspects of Cooperation between CSIRTs and LE - Toolset 2021

text: Toolset, Document for trainees V2.0 - MARCH 2022 0 ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: For contacting the authors please use CSIRT-LE-cooperation@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Domenico Ferrara (ENISA), Silvia Portesi (ENISA), Koen Van Impe

text: This training material is an updated version of the training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, available at https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-trainingmaterial/legal-cooperation#Aspects, whose authors (in alphabetical order by surname) are: Philip Anderson, Sandra Blanco Bouza, Smaragda Karkala (ENISA), Gregoire Kourtis, Alexandra Michota (ENISA), Catalin Patrascu, Silvia Portesi (ENISA), Václav Stupka, and Koen Van Impe.

text: ACKNOWLEDGEMENTS

text: ENISA would like to thank:

text: • The participants in the two training sessions organised by ENISA in August and October 2021 to pilot the ENISA training material developed in 2020 Aspects of Cooperation between CSIRT and LE - Handbook, Document for trainers, and Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, available at https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/onlinetraining-material/legal-cooperation#Aspects • The persons and organisations listed in the Acknowledgements section of the training material developed in 2020 Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees available at https://www.enisa.europa.eu/topics/trainings-forcybersecurity-specialists/online-training-material/legal-cooperation#Aspects.

text: ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: Cover image © Shutterstock, shutterstock.com

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-550-0, DOI: 10.2824/14089

text: ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 4

text: 1.1 THEMATIC AREA 4

text: 1.2 LEARNING OUTCOMES 5

text: 1.3 COURSE DURATION AND TRAINING OUTLINE 5

text: 1.4 COURSE CONTENTS 5

text: 2. USE CASES 7

text: 2.1 USE CASE 1: THEFT OF CONFIDENTIAL DATA 7

text: 2.1.1 Objectives 7 2.1.2 Scenario 8 2.1.3 Tasks 15 2.1.4 Lessons Learned 17

text: 2.2 USE CASE 2: RANSOMWARE 17

text: 2.2.1 Objectives 17 2.2.2 Scenario 18 2.2.3 Tasks 23 2.2.4 Lessons Learned 27

text: 3. BIBLIOGRAPHY 28 A ANNEX: SUPPLEMENTAL USE CASE 30

text: USE CASE 3: DDOS AND MALWARE BLENDED ATTACK 30

text: Objectives 30 Scenario 31 Tasks 35 Lessons Learned 37

text: B ANNEX: MAIN ABBREVIATIONS 38 C ANNEX: SEGREGATION OF DUTIES (SOD) MATRIX 39 ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

text: 1. INTRODUCTION

text: 1.1 THEMATIC AREA

text: This training material is an updated version of the ENISA training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees , that was developed based particularly on the ENISA 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU MS/EFTA countries (an updated and expanded version of it is expected to be published in Q1 2022). Some of the 2020 report's conclusions are that, in terms of incident response and cybercrime, the position and role of the Computer Security Incident Response Teams (CSIRTs) and Law Enforcement (LE) in the national institutional framework varies from country to country. Similarly, the structure and the organisation of the Judiciary also depends on the country.

text: In addition, between the three communities - CSIRTs, LE and Judiciary - different approaches and different levels of cooperation exist. While the operational cooperation, especially in the daily interactions and informal communication, seems to be well-established, sometimes it seems that more structured cooperation could be achieved to have less fragmented information flow between the three communities. Also, there is a more significant gap in the interaction between CSIRTs and the Judiciary, compared to the cooperation established between LE and the Judiciary. CSIRTs would rather often interact with the Judiciary in case they are called as an expert witness in court.

text: Moreover, LE is not solely involved in the detection and investigation of cybercrimes. A key component of their role is the preventive aspects of cybercrime, and it is in this role that cooperation with other communities, particularly the CSIRT community, becomes apparent to support preventive strategies. Preventive aspects of incidents/cybercrimes can also be seen as the initial ground for establishing cooperation between the CSIRTs and the LE communities, which can then extend to other phases of the incident/crime investigation. On the other hand, CSIRTs play an important role in informing (potential) victims of cybercrime and providing them with information on how to report a crime to the Police.

text: CSIRT and LE communities also need to closely cooperate to mitigate the risks of having evidence compromised or destroyed.

text: Regarding the incident handling and cybercrime investigation, several competences are required. While each community has developed its own set of skills and knowledge, they can all benefit from the competences of the other communities.

text: Furthermore, the 2020 report on CSIRT and LE cooperation also concluded that despite the initiatives that are already in place to facilitate training within each community, or joint trainings engaging two communities (e.g. CSIRTs and LE, or LE and the Judiciary), it seems that there is a need for more training and exercises addressing the three communities together.

text: This training material, as mentioned, is an updated version of the ENISA training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees published in January 2021 . The updates have been made based on the feedback received during the two training sessions organised by ENISA to pilot the training material. These pilot sessions took place as virtual events in August and in October 2021 and representatives from CSIRTs, LE, Judiciary and some EU Agencies participated in these pilots.

text: Finally, the 2020 report on CSIRT and LE, the handbook and this toolset are a set of deliverables complementing each other as follows:

text: • The report analyses roles, duties, competences, synergies and potential interferences across the three communities (CSIRTs, LE and Judiciary). • The handbook helps the trainer explain these concepts through scenarios. • The toolset contains exercises for trainees based on these scenarios.

text: 1.2 LEARNING OUTCOMES

text: As a result of attending this training, the trainee should be able to: • demonstrate knowledge of interactions across the three communities (CSIRTs, LE and Judiciary); synergies, interferences and challenges • use the Segregation of Duties (SoD) matrix to collect the data to identify the key responsibilities for their communities (CSIRTs, LE, and Judiciary) and link them with the skills required to fulfil these duties • better understand the legal and organisational framework defining the competences of CSIRTs, LE, and the Judiciary, in their activities related to fighting cybercrime • understand different decision-making processes among the communities • capture potential synergies and possible overlaps • overcome possible interferences of cooperation between CSIRTs and LE and their interaction with the Judiciary • ensure structured integration of liaison officers for coordination between the different communities • perform uniform and effective communication between CSIRTs, LE and the Judiciary toward victim and relevant stakeholders • coordinate basic first responder actions at victim site (collecting evidence without tampering it, informing partners of which evidence is gathered) • explain technical terms to non-technical participants, e.g. to the Judiciary • better translate legal constraints to CSIRTs • identify appropriate approaches and tools to help support effective collaboration • identify and develop a common plan to enhance cooperation

text: 1.3 COURSE DURATION AND TRAINING OUTLINE

text: 3 hours and 5 minutes, including one break.

text: 1.4 COURSE CONTENTS

text: The training includes three scenarios where trainees learn when and how CSIRT members cooperate with LE when dealing with cyber security incidents. The three scenarios cover:

text: - Theft of confidential data - Ransomware - Distributed Denial of Service (DDoS) and malware blended attack

text: The use case 1 (theft of confidential data) and use case 2 (ransomware) are updated with the feedback from the pilot sessions. The use case 3 is added as a supplementary case.

text: Training sessions should cover only one-use case and use the material from the other use case to steer further discussion or re-iterate on certain topics.

text: The training agenda consists of

text: • An introduction to the training (25') • Explanation of the frameworks and models used in the training (25') • Introduction to the use cases (15') • Study of one-use case (85') • The closure and overview of the learning outcomes (10') • A final section with room for questions and feedback (10')

text: One break of 15' is foreseen before the start of the study of the use case. The trainer can optionally add additional breaks. The total course duration is 185 minutes, including one break.

text: 2. USE CASES

text: 2.1 USE CASE 1: THEFT OF CONFIDENTIAL DATA

text: Figure 1: Overview of use case 1

text: Overview of the use case 1

text: 2.1.1 Objectives

text: In this exercise, the trainees will learn when and how CSIRT, LE, and Judiciary representatives can cooperate. In particular, the objectives of the exercise are to:

text: • Understand and appreciate the specifics of CSIRT/LE activities

text: • Analyse roles of different actors and how they can cooperate

text: • Identify synergies that can be exploited

text: • Grasp the complexity of cooperation

text: ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE 2.1.2 Scenario

text: 2.1.2.1 Setting the stage

text: This scenario describes an incident where carefully selected individuals working for different Member States (MS A, MS B, and MS C) subscribe to a fake event. The event website mimics an event organized by an EU Commissioner and contains malicious documents. Once installed on the victim’s computer, the malware included in the document exfiltrates domain, Virtual Private Network (VPN) access login credentials and selected documents with sensitive information. The credentials and the sensitive information are then monetized by the attacker via a semi-public website.

text: The internal security team of the Ministry of Education of MS A, to which one of the victims belongs, detects the incident. The internal security team of the Ministry of Education of MS A notifies the MS A national CSIRT, which in turn contacts Law Enforcement (of MS A).

text: The location where the exfiltration of data took place is in European MS D - whereas the website making the exfiltrated data available is located in Country Z, a non-EU/EFTA country.

text: In this use case, we use the concept of lanes to describe two distinct events that are part of the same security incident. The concept of lanes is used to demonstrate to the students that different security events which at first seem unrelated, can in fact be related to the same security incident. It is an opportunity for students to understand that separate investigations, started from different security events, will eventually merge because they deal with the same security incident. Students should cover both lanes to grasp the full details of the security incident.

text: Figure 2: Graphical representation of scenario 1 – Attack

text: Figure 3: Graphical representation of scenario 1 – Overview of interactions

text: 2.1.2.2 Before the breach

text: Reconnaissance

text: The attackers in this scenario spent a considerable amount of time on the reconnaissance of their potential new victim. They used online research of the Ministry of Education of MS A to find individuals of interest. They mapped out with whom these individuals typically collaborate, in particular with individuals at other ministries in MS A but also at Ministries of Education in other countries and with the European Commission. The attackers supplemented this information with the publicly available calendar information from the Commissioner.

text: The attackers used the following tactics and techniques:

text: The attackers then used one of the appointments in the Commissioner’s calendar to set up a fake round table event to collect future views on a specific topic, hosted by the Ministry of Education of MS B. The attackers identified which individuals in the Ministry of Education of MS A would be the most interested in this topic. Then, the attackers set up fake personas to impersonate representatives of the Ministry of Education of MS B, and they created a website mimicking the event registration website of the Ministry of Education of MS B.

text: Initial access

text: Armed with a list of targets selected during reconnaissance, the attackers used the personas impersonating staff working for the Ministry of Education of MS B to send out invitations for the fake event. The event website requested that visitors enter personal information, and it contained documents, such as a call for proposals or Q&A, which were prepared by the attackers to include malicious code.

text: Execution

text: The event website included text to lure the visitors into opening the documents because they contained “essential” information on the event. The malicious documents were Office documents, with a blurred image and a text stating that to see the content, the user needed to “Enable Decryption via Enable Content”, which enabled Word macros. Once the macro was enabled, it downloaded and ran the malicious executable file.

text: Credential access and collection

text: The malicious executable was, in fact, a variant of a well-known keylogger specifically designed to collect credentials entered by a user when starting a VPN client. The captured credentials were regularly sent out to an external website. Apart from a keylogger, the malware was also able to collect files on the local system of the victim. It searched for specific types of files with particular names which were sent out to an external website.

text: 2.1.2.3 Initial response

text: Breach notification

text: Lane 1

text: During a weekly review of network activity, the security operations team of the Ministry of Education of MS A noticed that there was a substantial amount of outbound traffic to an external website located in MS D. Their initial investigation showed that the internal source of the traffic was on a network segment used by individuals working on sensitive material.

text: The security team of the Ministry of Education of MS A alerted its internal CSIRT and started collecting information on the affected assets.

text: Lane 2

text: At the same time, the CSIRT team of the Ministry of Education of MS A got an alert from one of their public crawlers. The team received an internal notification from the Analysis Information Leak framework (AIL) framework showing that there was a hit on the name of the Ministry of Education of MS A for a website located on a Virtual Private Server (VPS) in Country Z. The website was protected with a password and required payment to access it. It provided some screenshots and extracts of texts to show what type of information was available for potential “customers”.

text: Upon inspection of the screenshot of the alert, the CSIRT of the Ministry of Education immediately spotted that the document contained sensitive information which should not be publicly accessible.

text: The response of the CSIRT

text: The CSIRT handler on duty for the Ministry of Education of MS A classified the incidents according to the ENISA Reference Security Incident Taxonomy (RSIT) as “Information Content Security”, “Leak of confidential information”.

text: The CSIRT requested the security operations team to safeguard the logs of the affected assets in their Security Information and Event Management (SIEM) and use Endpoint Detection and Response (EDR) tooling to capture live system memory and collect important system artefacts.

text: Unfortunately, the EDR had not been deployed to all assets. In the meantime, the security operations team was able to isolate the system process responsible for the exfiltration of the data. Additionally, they still saw active network activity to the external website. This activity meant that the exfiltration was ongoing.

text: The CSIRT notified the CISO and the Secretary-General of the Ministry of Education of MS A of the possible security incident. A crisis team was formed, including the Press Officer, the legal department, the HR department and a representative of the General Secretariat of the Ministry of Education of MS A.

text: At this stage, it was unknown which type of data was exfiltrated. Still, because of the volume of data already exfiltrated and the type of assets (workstations and individuals involved), the CSIRT of the Ministry of Education of MS A suggested filtering traffic to the IP in MS D until further investigation. Additionally, according to the representative of the Ministry of Education of MS A, the screenshot in the AIL alert was of a document which had not been published and which was processed on one of the affected assets.

text: The CSIRT of the Ministry of Education of MS A immediately instructed the network team to filter all traffic to and from the IP in MS D.

text: The CISO of the Ministry of Education of MS A, together with the head of CSIRT of the Ministry of Education of MS A, contacted the national CSIRT of MS A to report the incident and LE of MS A to file a complaint.

text: Criminal investigation in MS A

text: LE officials of MS A were informed of the case details, including the fact that this concerned sensitive information and that there was a very high suspicion that data had been exfiltrated to a server in MS D.

text: LE conducted an investigation and went on-site to the Ministry of Education of MS A to review the available log material.

text: The CSIRT of the Ministry of Education of MS A provided LE with their collected reports on network traffic, together with the screenshots and information of the leaked documents on the server in Country Z, a non-EU/EFTA country.

text: The CSIRT of the Ministry of Education of MS A informed LE that the activity was still ongoing and that they implemented a network filter.

text: Investigation analysis

text: Because of the network filter, the malware was unable to contact the server in MS D. This triggered a failsafe mechanism, and it started encrypting all the files on the workstation.

text: The CSIRT of the Ministry of Education of MS A informed LE that the evidence on the workstation was most likely no longer usable. The logs in the SIEM were still available.

text: Lane 1

text: LE analysed the network traffic with support from the national CSIRT of MS A. The logs clearly showed the volume of traffic to the server in MS D.

text: LE of MS A reached out to their contacts in MS D (with the support of Europol) requesting to seize the server and collect the evidence. Unfortunately, the hosting company, a bulletproof hoster, did not respond to the request. LE then attempted to get a warrant for the server.

text: Together with the information from the MS A national CSIRT, the LE created a timeline of events.

text: Lane 2

text: Based on the alert data of the CSIRT of the Ministry of Education of MS A, LE identified the hosting company where the website was offering the sensitive information. LE contacted their peers in Country Z (with the support of INTERPOL) to formally request the server be seized and investigated. They used the evidence received from the agency to support their case.

text: Criminal investigation in MS D

text: Lane 1

text: LE in MS D was able to identify the individuals that registered and set up the website and VPS. An investigation of the activity on the server showed that it was accessed multiple times via IP addresses belonging to VPN nodes, but also included one residential IP address from MS D. This most likely occurred after a glitch of the VPN killswitch exposed the IP of the user behind the VPN. The activity on the server corresponded with the victim’s VPN login attempts of stolen credentials.

text: Most of the logs included VPN node accesses, but also had one residential IP address from MS D, most likely after a glitch of the VPN service which exposed the IP of the user behind the VPN. The activity on the server corresponded with VPN login attempts of stolen credentials.

text: The server also had temporary copies of some of the sensitive documents, sorted according to the collection date.

text: The server in MS D, however, did not show any activity related to the server in the Country Z.

text: Lane 2

text: LE was unable to collect the server in Country Z because, by the time the hosting company received the request, the owners of the server had destroyed their VPS server.

text: However, LE was able to identify the individuals that purchased the VPS at the hosting company.

text: LE investigation did take different screenshots of the website before the server’s destruction. These screenshots showed the nature of the site’s documents, along with the methods used to request money to access the website.

text: LE / Prosecutor requested a warrant and seizure of the electronic devices of this individual.

text: LE investigation of the computers of the individuals in MS D showed that their devices contained traces of the sensitive documents. An examination of the Secure Shell (SSH) history, browser and e-mail activity also revealed frequent access to the server in Country Z.

text: The investigation also showed frequent open-source IM (instant messaging) conversations with another individual in MS D, not linked to the website in MS D but seemingly with a form of control on the server in Country Z.

text: The forensic investigation of these electronic devices showed that this individual had configured and set up the server in Country Z. The e-mail conversation stored on the devices showed an exchange of the content of the documents and methods of payment.

text: ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE 2.1.3 Tasks

text: 2.1.3.1 Task 1: Identify and describe the organisational profile

text: Identify and describe the organisational profile; specifically, the main subjects (actors) involved in the scenario, in particular, CSIRT/LE and Judiciary actors using the table below.

text: Figure 4: Subjects/Roles template

text: Specific role Community (CSIRT, LE, Subjects related to the Comments Judiciary, other) scenario

text: 2.1.3.2 Task 2: Describe measures that CSIRT and/or LE can take to prevent the incident/crime

text: Although the actual preventive measures for the prevention of the incident, such as implementing proper security controls and network segmentation, were already in place there are a couple of additional activities where CSIRT and/or LE can play an active role.

text: Taking into account the SoD matrix in Annex B and especially the phase “prior to incident/crime”, which activities can you identify?

text: Use the template below to list the duties related to “prior to the incident/crime” phase (column 1) and the suggested measures (column 2). The last column (column 3) can be used to note additional comments.

text: Figure 5: Duty/Suggested measure template

text: Duty (task) Suggested measure Comments

text: 2.1.3.3 Task 3: Use the SoD Matrix to analyse possible duties (tasks), synergies and potential interferences between CSIRT, LE and Judiciary

text: Select some duties from column 1 of the SoD in Annex B and in relation to some of these duties, briefly describe the measures that could be taken by each community in the scenario.

text: The template below can be used by listing the duties (tasks) in column 1 (duties to be taken from column 1 of the SoD matrix in Annex B) and the synergies and potential interferences in column 2. Column 3 can be used to add comments.

text: Figure 6: Duties, synergies and potential interferences - Template

text: 2.1.3.4 Task 4: List possible measures that CSIRT and/or LE can take during the incident response/crime investigation while performing the different duties

text: List possible measures that CSIRT and/or LE can take during the incident response/crime investigation while performing the different duties.

text: Column 1 should be used to list the duties (tasks) taken from the SoD matrix in Annex B, in particular duties during the incident/crime (duties 7 to 22 of the SoD matrix in Annex B). Column 2 should be used for the suggested measures related to each duty with specific reference to the scenario. Column 3 can be used for comments.

text: Figure 7: Duty/suggested measure template

text: Duty (task) Suggested measure Comments

text: 2.1.3.5 Task 5: Discussion on lessons learned from this scenario

text: Discuss the issue of balancing the incident mitigation (asset protection) and the criminal investigation (evidence collection and preservation) with reference to the scenario.

text: One of the responses of the CSIRT of the Ministry of Education of MS A involves filtering outgoing network activity to the attackers, effectively preventing the further exfiltration of sensitive information. This filtering is an understandable activity, certainly as a short-term containment measure. The side-effect of this measure, however, triggers the malware and results in encrypted workstations, and as such a loss of evidence.

text: Discuss the pros and cons of short-term containment actions to protect the victim, but which might alert the attacker that they have been detected. In general, this depends on the type of incident and the victim.

text: As a reference, the courses of action matrix from Lockheed Martin can be use. This action matrix includes two significant categories of actions: - passive (Discover and Detect)

text: - active (Deny, Disrupt, Degrade, Deceive and Destroy)

text: Note that this discussion is not about the chain of custody as such, but rather which options to choose for either taking an active or passive approach in containing an incident.

text: 2.1.4 Lessons Learned

text: Theft of confidential data is rather complex and demands different skills, including technical and legal.

text: Although for training purposes the scenario is presented as less complicated than real cases might be, it still allows each party to understand the complexities in terms of actors involved, roles played, duties (tasks) performed, synergies to exploit, and risks of interference.

text: 2.2 USE CASE 2: RANSOMWARE

text: Figure 8: Overview of use case 2

text: Overview of use case 2

text: 2.2.1 Objectives

text: In this exercise, the trainees will learn when and how CSIRT members cooperate with LE. In particular, the objectives of the exercise are to:

text: • Explain CSIRT and LE cooperation in a health sector-related ransomware scenario • Raise the trainees’ awareness regarding the differences between the legal systems of various countries and the consequences of these differences • Understand and appreciate the specifics of CSIRT/LE activities • Practice setting up and coordinating a task force for dealing with large scale attacks

text: • Provide information on how to cooperate and share information • Practice how to identify and propose post-incident reactive and preventive measures

text: 2.2.2 Scenario

text: 2.2.2.1 Setting the stage

text: A ransomware attack has been discovered in a large municipal hospital on the hospital patient records servers. All computers are locked and display a message indicating that the files have been encrypted; the hacker is demanding 11 bitcoins (approx. €100,000) to provide the decryption key. The image on the computer screens also states that if the payment is not received within five days, the price will increase. Within ten days, the patient data will be erased on the servers and leaked to a public website, and a notification will be sent to the national data privacy agency.

text: You are a member of a task force established to help the hospital’s network and information security team to deal with the incident. You have been assembled; it is now 05:45. It appears that all significant servers are affected. An initial assessment shows that the hospital email system and patient record systems are inaccessible, and the hospital intranet sites are also unavailable.

text: Figure 9: Graphical representation of scenario 2 – Attack

text: Figure 10: Graphical representation of scenario 2 – Overview of interactions

text: 2.2.2.2 Organisational profile

text: The hospital is the largest municipal hospital in your area. Last year the hospital took care of almost 1 million patients and had about 5,000 employees. As such, the hospital relies on a network with up to 10,000 connected devices, which includes workstations, diagnostic tools and servers storing patients’ data. In recent years, hospital management was somewhat reluctant to invest in cybersecurity, and even though most computers are relatively well taken care of, some, especially that operating specialised equipment, are running legacy systems like Windows XP, due to compatibility issues. The network is not segmented, and critical systems are in the same network as specialised equipment, as well as all workstations. The hospital has no clear rules on data management and backup. Patient data that are stored in the hospital’s information systems are backed up and protected from ransomware. Still, a lot of relevant data about currently hospitalised and treated patients are not stored in the information systems, but on the doctors’ workstations, which are not being backed up.

text: 2.2.2.3 Before the breach

text: The COVID-19 pandemic is still very much going on, which leads to heavy pressure on your country’s hospital system. Some cybercriminals decided to take advantage of this situation and started targeting medical facilities with their ransomware campaigns. The hospital’s security team issued and distributed a directive that explained this threat to the employees and informed them how to be cautious and prevent their devices from getting infected with malware.

text: Reconnaissance

text: The attackers in this scenario spent a considerable amount of time on the reconnaissance of their potential new victim. They researched the online available information of the hospital to

text: find out its departments and individuals of interest. None of this required any specific access. This type of research is also typically called OSINT, Open-source intelligence. The attackers used the following tactics and techniques:

text: The attackers compiled a detailed picture of the hospital infrastructure based on the information from:

text: - The hospital public website, with the full names and roles of the medical staff; - IT security job descriptions, disclosing the type of security devices that are in use; - Procurement documents, disclosing details on the current network infrastructure and network layout as well as information for maintenance framework contracts for legacy medical equipment.

text: The identification of the legacy medical equipment gave the attackers opportunity to compile a set of default access credentials, potential vulnerabilities of these devices as well as a list of typically network exposed services. Note that they did not take the approach of using for example, Shodan to look up vulnerable Internet exposed medical systems, although this would most likely have given them an easier access into the hospital network.

text: The attackers identified which individuals in the hospital would be the most interested to target with initial infection. Then, the attackers created the malware mimicking a tool for the analysis of the diseases symptoms and setup a website to distribute the malware. Afterwards the link to this website was distributed via phishing e-mails, specifically send to the targeted individuals.

text: 2.2.2.4 Initial response

text: Breach notification

text: When a receptionist in the X-ray department tried to log in at the start of her shift, she could not open the files and a message indicating that the files have been encrypted appeared on her screen. She notified a supervisor who then called the hospital’s IT helpdesk to report what happened, who in turn notified the hospital’s network and information security team.

text: The response of the CSIRT team

text: The hospital’s network and information security team handler received the alert from the hospital staff and identified it as a high priority threat. The handler classified it according to the ENISA RSIT as an incident of “Information Content Security”, “Unauthorised modification of information”, caused by the ransomware.

text: From an initial analysis, it appeared that the ransomware was called UnluckyLocky, a new type of ransomware with limited online information. Therefore, it was assumed that there was no known decryption key. The handler uncovered a news report online that described another hospital that seemed to have been infected by a similar attack with ransomware named Gotcha. The news article suggested that the response to the incident was slow and that almost all the computers and servers were infected. Additionally, the public was made aware of the incident as it had a significant impact on the hospital not being able to offer essential services. The incident went on for six days during which time even the hospital’s most basic functionality was forced to stop.

text: The handler then attempted to identify the source of the ransomware with the limited publicly available information on UnluckyLocky published by the respected security company.

text: The handlers analysed the activity that was related to the affected system and user, and used the logs from the web proxy server and e-mail server to further investigate the source of this problem.

text: They were able to find out that the source was a malicious website that informed about the COVID-19 pandemic and offered for download a tool for analysis of the decease symptoms.

text: The handler was able to download a sample of the malware.

text: The malware was executed by the user who downloaded it from the website, after clicking a link received via a phishing e-mail.

text: Upon execution, the malware first enumerated and encrypted the data within the target computer system and any connected storages. This rendered most of the data unavailable to the user while still allowing the user to operate the essential functions of the computer system. The malware also regularly prompted a window warning the user that the system was encrypted and decryption keys would be provided upon payment of the ransom.

text: The malware also regularly launched a task that attempted to spread the malicious code via email messages sent to stored addresses and through executing software on remote computers via legitimate network tool (psexec). For the latter the attackers made use of the default credentials of the legacy systems, as well as abusing misconfigurations in these systems.

text: The handler proceeded to analyse the extent of the issue by randomly checking workstations within the hospital for signs of the malware. He found out that the malware managed to spread across the whole hospital, rendering some of the critical data and equipment unavailable.

text: The hospital’s network and information security team was overwhelmed by the attack, so they reached out to the national CSIRT, part of the national cybersecurity authority.

text: Note: In this scenario, you are a member of the national CSIRT that is helping the hospital with this security breach.

text: Criminal investigation

text: The hospital notified this attack to the national CSIRT, which contacted the national cybersecurity authority who then reported this incident to Law Enforcement. The Police cyber unit started the investigation. They immediately contacted the national CSIRT, which provided general information, a sample of the ransomware and a link to the source website. A sample was sent to Europol through the Europol Malware Analysis Solution (EMAS) sandbox for crossmatching.

text: The Police found out that the website was hosted by a web hosting provider based in one of the EU MSs. The Police ordered the provider, via European investigation order, to provide stored subscriber and traffic data related to the relevant account.

text: Provided data revealed that the malicious content was uploaded from a country outside the EU. Even though the Police immediately requested legal assistance (including Europol), based on past experiences with this particular country, it was virtually impossible to get any cooperation in such cases from the official authorities.

text: Note that in this use case we do not focus on investigations on the C&C (command and control) servers that are typically used by ransomware. Information found on these servers can be used during incident response, for example to decrypt the data, as well as to identify the other potential victims and the criminals behind the attack.

text: Information sharing

text: Even though it was unlikely that LE would get assistance through official channels, in the third country there is a well-functioning CSIRT community which is regularly and openly sharing information. The national CSIRT involved in dealing with the incident offered to help the LE by requesting traffic data.

text: 2.2.3 Tasks

text: 2.2.3.1 Task 1: Notification of the incident

text: As stated above, the hospital’s network and information security team notified the national CSIRT, part of the cybersecurity authority of the incident. Who else should be notified within and outside of the hospital? Are there any legal obligations for the hospital to report such incidents to public institutions? Use the template below to list individuals, authorities and other parties that should be informed about the incident. Column 1 should be used to list the parties to be notified and column 2 to identify whether the notification is required or recommended. Column 3 can be used for comments.

text: Figure 11: Notification list – Template

text: Who to notify Required / recommended Comments

text: 2.2.3.2 Task 2: Setting up the task force, division of duties

text: The national cybersecurity authority decided that a task force should be established to deal with the crisis. Who should be involved in this task force (e.g. which organisations or [inter]national authorities, the expertise level of members of the task force)? Are there any rules on this in your country?

text: Use the template below to list individuals/organisations that should be involved in the task force. Column 1 should be used to list the parties to be involved, column 2 to identify what kind of expertise can they contribute and column 3 to identify which tasks they can be involved in and what role should they play. Column 4 can be used for comments. Afterwards, discuss whether there are any relevant rules or best practices on this in your country.

text: Figure 12: Task force members list - template

text: Organisation Expertise Tasks/role Comments

text: While in some Members States the victim is part of the task force, in some other Member States not. Discuss this point and how it works in your country.

text: The university that cooperates with the hospital offered their volunteer ICT experts (students and employees) who can help to deal with the crisis. Can they be involved? In which activities (e.g. reinstallation of hospitals computers, incident handling, attempting to break the encryption, track the source of the attack, etc.)?

text: Explain which activities related to the incident handling can volunteers be involved and how. Column 1 should be used to name the activity and column 2 to describe the involvement.

text: Figure 13: Involvement of volunteers – Template

text: Activity Description

text: Figure 14: Duties, synergies and potential interferences – Template

text: 2.2.3.3 Task 3: Possible duties (tasks), synergies and potential interferences between CSIRT, LE and the Judiciary

text: Select some of the duties from column 1 of the SoD in Annex B and with some of these duties, briefly describe the measures that could be taken by each community in the scenario.

text: The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B) and the synergies and potential interferences in column 2. The last column, column 3, can be used to add comments.

text: Figure 15: Duties, synergies and potential interferences – Template

text: 2.2.3.4 Task 4: Incident handling, evidence collection, coordination

text: Experts in the task force found out by using sandbox analysis that the ransomware is not only encrypting data from the information systems but is also exfiltrating patient data outside the organisation. CSIRT members immediately proposed to block communication to the C&C server to prevent further disclosure of sensitive information. LE, however, suggested to wait with this measure and try to track the data in an attempt to locate the attacker, since they’re suspecting

text: that the attacker is based in the EU even though s/he used servers located in third countries to disseminate the malware.

text: Explain, how you would deal with this issue, what should have priority – protection of sensitive data or locating the attacker, and whether there are any official rules on this in your country?

text: The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B) and the measures to be taken to deal with the issue in column 2. The last column of the template below, column 3, can be used to add comments.

text: Figure 16: List of suggested measures to deal with mutual interferences – Template

text: Duty Suggested Comments (task) measure

text: 2.2.3.5 Task 5: International cooperation and information sharing

text: As stated above, the CSIRT can provide support to the LE, they can for instance ask the third country network operators to unofficially provide traffic data that could help to identify the attacker.

text: Explain whether LE would be able to provide the CSIRT with necessary identifiers and traffic data acquired from the web hosting provider for this purpose. Also, whether the unofficial data collected by the third country network operator that leads to identifying the attacker would be usable as evidence in court by LE.

text: Figure 17: Information sharing and use – Template

text: Information sharing and use

text: 2.2.3.6 Task 6: Post incident preventive measures

text: Explain based on information you have about the incident and hospitals systems, what kinds of post incident preventive measures would you recommend to the Network and Information Security Team to implement.

text: The template below can be used to categorise proposed measures in column 1 (whether these measures are organisational, technical or legal by nature), and list and describe the proposed measures in column 2 and 3. The last column of the template below, column 4, can be used to identify who should implement these suggested measures.

text: Figure 18: List of preventive post-incident security measures – Template

text: Category (e.g. organisational, Measure Description To be implemented by technical, legal)

text: 2.2.4 Lessons Learned

text: Ransomware cases are rather complex and demand many different skills, including technical and legal, as well as the ability for other communities to share information and cooperate.

text: 3. BIBLIOGRAPHY

text: ENISA (2018), Review of Behavioural Sciences Research in the Field of Cybersecurity, https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspectsof-cybersecurity (retrieved on 13 October 2020)

text: ENISA Training Resources page: https://www.enisa.europa.eu/topics/trainings-forcybersecurity-specialists/online-training-material (retrieved on 14 October 2020)

text: CSIRTs by Country –Interactive Map, https://www.enisa.europa.eu/topics/csirts-in-europe/csirtinventory/certs-by-country-interactive-map (retrieved on 13 October 2020)

text: ENISA, 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU Member States/EFTA countries, https://www.enisa.europa.eu/publications/2020report-on-csirt-le-cooperation (26 January 2021)

text: ENISA, An overview on enhancing technical cooperation between CSIRTs and LE (2019), https://www.enisa.europa.eu/publications/support-the-fight-against-cybercrime-tools-forenhancing-cooperation-between-csirts-and-le (retrieved on 13 October 2020)

text: ENISA, Cooperation between CERTs and Law Enforcement Agencies in the fight against cybercrime - A first collection of practices (2012), https://www.enisa.europa.eu/publications/cooperation-between-certs-and-law-enforcementagencies-in-the-fight-against-cybercrime-a-first-collection-of-practices (retrieved on 15 October 2020)

text: ENISA, Cooperation between CSIRTs and Law Enforcement: interaction with the Judiciary (2018), https://www.enisa.europa.eu/publications/csirts-le-cooperation (retrieved on 13 October 2020)

text: ENISA, Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity (2018), https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspectsof-cybersecurity (retrieved on 13 October 2020)

text: ENISA, Electronic evidence - a basic guide for First Responders (2014), https://www.enisa.europa.eu/publications/electronic-evidence-a-basic-guide-for-first-responders (retrieved on 15 October 2020)

text: ENISA, Good Practice Guide for Addressing Network and Information Security Aspects of Cybercrime (2012), https://www.enisa.europa.eu/publications/good-practice-guide-foraddressing-network-and-information-security-aspects-of-cybercrime (retrieved on 15 October 2020)

text: ENISA, Improving Cooperation between CSIRTs and Law Enforcement: Legal and Organisational Aspects (2017), www.enisa.europa.eu/publications/improving-cooperationbetween-csirts-and-law-enforcement (retrieved on 13 October 2020)

text: ENISA, Information sharing and common taxonomies between CSIRTs and Law Enforcement (2015), https://www.enisa.europa.eu/publications/information-sharing-and-common-taxonomiesbetween-csirts-and-law-enforcement (retrieved on 15 October 2020)

text: ENISA, Reference Incident Classification Taxonomy, https://www.enisa.europa.eu/publications/reference-incident-classification-taxonomy (retrieved on 13 October 2020)

text: ENISA, Reference Security Incident Taxonomy Working Group, https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force (retrieved on 13 October 2020)

text: ENISA, Roadmap on the cooperation between CSIRTs and LE (2019), https://www.enisa.europa.eu/publications/support-the-fight-against-cybercrime-roadmap-oncsirt-le-cooperation (retrieved on 13 October 2020)

text: ENISA, ENISA Threat Landscape – 2020, https://www.enisa.europa.eu/topics/threat-riskmanagement/threats-and-trends (retrieved on 10 November 2020)

text: ENISA, Tools and Methodologies to Support Cooperation between CSIRTs and Law Enforcement (2017), www.enisa.europa.eu/publications/tools-and-methodologies-to-supportcooperation-between-csirts-and-law-enforcement (retrieved on 13 October 2020)

text: ENISA, Training material on CSIRT-LE cooperation area (2019), https://www.enisa.europa.eu/news/enisa-news/training-material-to-enhance-cooperation-acrosscsirts-and-law-enforcement (retrieved on 13 October 2020)

text: ENISA, Trainings for Cybersecurity Specialists, (handbooks and toolsets) https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-trainingmaterial (retrieved on 13 October 2020)

text: Reference Security Incident Classification Taxonomy (RSIT taxonomy), https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task- Force/blob/master/working_copy/humanv1.md (retrieved on 13 October 2020)

text: A ANNEX: SUPPLEMENTAL USE CASE

text: USE CASE 3: DDOS AND MALWARE BLENDED ATTACK

text: Figure 19: Overview of use case 3

text: Overview of use case 3

text: This use case should be conducted in groups so that different results and approaches of each group can be compared. Then, the advantages and disadvantages of individual solutions should be discussed.

text: Objectives

text: The current exercise scenario aims to familiarize the trainees with technical, procedural and legal aspects of incident management. In particular, the objectives are to:

text: • Raise awareness about what types of cyber incidents might affect an airport and what can be the impact of such incidents • Learn about the role of the CSIRT, Law Enforcement, and National Cybersecurity Authority • Understand the importance of efficient coordination between main stakeholders during a large scale/high impact incident

text: • Practice setting up and coordinating task force for dealing with large scale attack • Understand the importance of information sharing during cybersecurity attacks • Practice how to identify and propose post-incident reactive and preventive measures • Learn about preventive measures against such type of incidents

text: Scenario

text: Setting the stage

text: A large size airport in a European capital city is under massive DDoS attack, combined with a malware attack, causing key systems outages and malfunctioning (i.e. systems assuring functions like flight scheduling, passengers’ check-in, baggage routing, etc.).

text: Already the situation has had significant adverse effects on the airport’s operations and safety. Undetected attacks resulted in the change of the flight plans provoking delays and influencing the aircrafts cleaning and fuelling process, as well as the time required to load the luggage, affecting the world-wide traffic.

text: You are a member of a task force established to help the airport company to deal with the incident. An initial assessment shows that the IT team has yet to come up with a course of action for stopping the attack and restoring the services. The pressure from the media, authorities, and passengers is rapidly growing.

text: Figure 20: Graphical representation of scenario 3 – Attack

text: Figure 21: Graphical representation of scenario 3 – Overview of interactions

text: Organisational profile

text: The affected airport is one of the biggest air traffic hubs in Europe, with an average of more than 100,000 passengers passing through per day.

text: The management of the airport invested only in perimetral security in recent years (firewalls, gateways, etc.). At the same time, internal network suffers from lack of proper segmentation, and some of the critical systems are running old operating systems due to legacy and compatibility constraints.

text: The airport is running its own on-prem data centre doubled by a disaster recovery site, but the Business Continuity Plan (BCP) plan wasn’t tested in the last two years.

text: Before the breach

text: The attackers gathered information online about the airport company and identified useful data: the IP addresses space, systems and applications, management and key personnel names and contact details, etc.

text: Reconnaissance was also done at the physical perimeter of the airport by attackers disguised as passengers.

text: Attackers managed to plant a rogue 3G Raspberry Pi device in the airport network. The device is used to sniff the network traffic for systems discovery and credentials extraction (plain-text credentials sent over the network or easy-to-crack hashes).

text: While the attacker created a diversion with the DDoS attack, some of the internal systems of the airport were infected with a customized malware delivered using two different infection vectors: spear-phishing emails sent from the rogue device to avoid email gateway filtering, and Windows SMB exploits launched from the same device.

text: Initial response

text: Breach notification

text: A lot of people are reporting at the check-in desks that their flights seem to have disappeared from the schedule display systems or they have long delays. At the same time, people can’t obtain information from other online sources because the internet is inaccessible from the airport Wi-Fi network and even if they use their 3G/4G/5G connection the airport website and other related platforms are unavailable.

text: It becomes clear that the IT infrastructure and applications are affected by an incident, and a cyber-attack is suspected. The network team starts to investigate, and they report that a huge DDoS attack is conducted against the airport’s internet-facing systems.

text: The security team is also reporting that a high number of database operations were executed in a short interval of time using credentials of a user that is claiming to know nothing about the situation.

text: The airport management board decides to notify the aviation sectorial CSIRT and to file a complaint to the Police. The sectoral CSIRT share the information with the other relevant CSIRTs, in particular the national CSIRT, which is part of the national cybersecurity authority.

text: Response of the CSIRT team

text: The CSIRT Team uses lessons learned from recent similar attacks against airports and starts the Incident Response process with actions meant to contain the incident as much as possible.

text: The user account responsible for altering the airport databases is disabled, and the user workstation is isolated from the network and sent to the digital forensics laboratory. All recent activity of the user is tracked because there’s plausible suspicion that the user was the victim of a spear-phishing attack which resulted in his workstation being infected with malware.

text: Additionally, the CSIRT team is working with the airport IT personnel, the ISP, airport IT vendors, and international partners to try to come up with a mitigation plan for the DDoS attack. Multiple scenarios are studied, but for the moment it is decided to ask the ISP to filter the traffic coming from outside of the country the airport is located in.

text: Next, the technical investigation of the incident is started: • Analysis of logs from perimeter security solutions (firewall, web and email gateway, proxy, etc.) • Analysis of the recent activity of the user causing the malicious actions of the database and conduction of a forensically-sound investigation of his/her workstation • Try to identify rogue devices in the network

text: Criminal investigation

text: The national cybersecurity authority informed the LE of this incident. The local Police cyber unit started the investigation by:

text: • Analysing security video cameras from the airport in the last month to try to identify attackers planting rogue devices • LE/Prosecutor requesting a warrant and seizure of the electronic devices of the possible suspects

text: To be complete, in real cases such visual identification might take some time and is not always that straightforward, but we now just assume this happened for the good flow of the use case.

text: Information sharing

text: The CSIRT is conducting an information exchange about the incident with other CSIRTs (especially the ones in the aviation sector/sectorial CSIRTs), trying to find out if similar attacks were conducted recently and gather information about investigation results and mitigation measures.

text: In cooperation with the airport management, the CSIRT will share the gathered information with the national LE and will offer their further support to continue the investigations and facilitate information exchange nationally and internationally.

text: ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE Tasks

text: Task 1: Notification of the incident

text: The airport security team needs to quickly do an initial assessment of the situation and notify the incident according to existing procedures and legal framework.

text: As previously mentioned, the National Competent Cybersecurity Authority or the National CSIRT is notified.

text: To whom else and when should the incident be reported?

text: Figure 22: Notification list – Template

text: Required / Who to notify Comments recommended

text: Task 2: Setting up the task force, division of duties

text: While in the context of a criminal investigation the prosecutor/judge is in charge of assigning the roles for dealing with the investigation of the cybercrime, the national CSIRT may establish a task force to respond to the incident and deal with the crisis generated by the incident.

text: Analyse the legal and organisational framework by defining the competences of CSIRTs, LE, and the Judiciary in their activities related to fighting cybercrime, and capture potential synergies and possible overlaps. Analyse the possible interferences in the cooperation between CSIRTs and LE and their interaction with the Judiciary. To collect data and roles and duties, use the SoD matrix in ANNEX B.

text: The role of the IT contractors of the airport should be decided: will they be part of the task force?

text: Figure 23: Task force template

text: Task 3: Possible duties (tasks), synergies and potential interferences between CSIRT, LE and Judiciary

text: Select some of the duties from column 1 of the SoD in Annex B and with some of these duties, briefly describe the measures to that could be taken by each community in the scenario.

text: The template below can be used by listing the phase (e.g. during the incident/crime) in column 1, the duties (tasks) in column 2 (to be taken from column 1 of the SoD matrix in Annex B), and the synergies and potential interferences in column 3. The last column of the template below, column 4, can be used to add comments.

text: Figure 24: Duties, synergies and potential interferences – Template

text: Synergies and potential Phase Duty (task) Comments interferences

text: Task 4: International cooperation and information sharing

text: Briefly explain how Interpol, Europol and Eurocontrol can collaborate with CSIRTs/LE/Judiciary during the international criminal investigation.

text: The template below can be used to list the name of the organisation in column 1, the name of the organisation it collaborates with in column 2 and the kind of collaboration they have in column 3.

text: Figure 25: Information sharing and use – Template

text: Names of the organisation it Name of the organisation Kind of collaboration collaborates with

text: Task 5: Post-incident preventive measures

text: Explain based on information you have about the incident, what kinds of post-incident preventive measures you would recommend to the airport information security team to implement and how you would formulate the outcome as a gap analysis and a remediation roadmap.

text: The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B), and the proposed preventive security measures in column 2.

text: Figure 26: Suggestion on preventive security measures – Template

text: Duty (Task) Proposed preventive security measures

text: Lessons Learned

text: DDoS and malware blended attack cases are rather complex and sophisticated. They demand many skills as it’s not easy to identify what is the primary attack vector or what is the ultimate target of the attacker. The scenario allows each party to understand its role under the legal framework of each member state.

text: B ANNEX: MAIN ABBREVIATIONS

text: Abbreviation Description

text: Some explanations regarding the SoD matrix:

text: • At the top of the SoD Matrix all the four possible roles that each actor (CSIRT, LE, Prosecutors, and Judges) may play are listed and briefly explained: Responsible (R), Supporting (S) (if applicable), Consulted (C) (if applicable), and informed (I) (if applicable). • In the rows, the duties are listed and numbered for convenience (e.g. 10. Collecting data that may be evidence/Evidence collection). It must be noted that “duties” is used here as a synonymous of “tasks” • Column 2, Column, 3, Column 4, Column 5, refer to the actors, respectively CSIRT, LE, Prosecutors, and Judges. • The interviewees are asked to indicate which role(s) each actor (CSIRTs, LE, prosecutors, judges) has in the performance of duties during a cybercrime (supporting) fighting activity. In other words, the interviewees are asked to identify whether the CSIRTs, the LE, the prosecutors or the judge are for a particular duty responsible (R) for that duty, and, if applicable, which other actor is Supporting (S) the performance of that duty, is Consulted (C) or is Informed (I) during the performance of that duty. • Column 6 (optional) is used to capture information on training topics, which is closely connected to the competencies that are required for the performance of the specific duties. • Column 7 is used for any additional information that the interviewee might provide and to record possible synergies and potential interferences, especially for those cases where a task is performed by more than one community.

text: An example of completed information related to one duty in the SoD Matrix in the table below.

text: Table 1: Example of completed information related to one duty in the SoD Matrix

text: -N -EN -378 -21 -08 TP

text: ABOUT ENISA

text: ISBN: 978-92-9204-550-0 DOI: 10.2824/14089