text: January 2020

text: January 2020

text: January 2020

text: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32018L1972&from=EN Directive

text: as amended by Directive

text: , https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2009:337:0037:0069:EN:PDF

text: January 2020

text: January 2020

text: as amended by Directive

text: January 2020

text: January 2020

text: January 2020

text: January 2020

text: January 2020

text: January 2020

text: January 2020

text: 6The ECJ jurisprudence has clarified what constitutes an electronic communications service. See case C- 142/18 Skype Communications Sarl v IBPT.

text: January 2020

text: The supervision regime in the NIS Directive for Digital Service Providers (DSPs) on the other hand is ‘lighttouch’ (ex-post supervision only).

text: January 2020

text: January 2020

text:  Physical and environmental security Security of networks  Security of supply and facilities  Access control to networks  Integrity of networks

text:  Handling procedures

text: Handling of security

text:  Security incident detection capability

text:  Security incident reporting and communication

text: Business continuity  Service continuity strategy and contingency plans management  Disaster recovery capabilities

text: January 2020

text:  Monitoring and logging policies  Exercise contingency plans

text: Monitoring, auditing

text:  Network and service testing

text: and testing

text:  Security assessments and compliance monitoring  Compliance with international standards.

text: Article 13

text: a Technical Guideline on Security Measures https://resilience.enisa.europa.eu/article-13/guideline-for-minimum-securitymeasures/Article_13a_ENISA_Technical_Guideline_On_Security_Measures_v2_0.pdf

text: January 2020

text: January 2020

text: January 2020

text: January 2020

text: There is a publicly available visual frontend which can be used for a custom analysis of all the past telecom security incidents https://www.enisa.europa.eu/topics/incident-reporting/for-telcos/visual-tool

text: January 2020

identifier: Security Supervision under the EECC

title: Security Supervision under the EECC

text: ABOUT ENISA

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

text: CONTACT

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Eleni Vytogianni and Marnix Dekker, ENISA

text: ACKNOWLEDGEMENTS

text: We are grateful for the valuable input received during interviews, discussions and meetings with different telecom experts, telecom security experts, both in the public and in the private sector. For this project we have worked with Ernst & Young Business Advisory Solutions S.A. and the Athens Cybersecurity Team, under tender ENISA S-COD-19-T07.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover and other pages: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: CATALOGUE NUMBER TP-02-19-765-EN-N ISBN 978-92-9204-304-9 DOI 10.2824/ 647924

text: SECURITY SUPERVISION UNDER THE EECC

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 TARGET AUDIENCE 5

text: 2. POLICY CONTEXT 6

text: 2.1 OLD RULES 6

text: 2.2 MAIN PROVISIONS OF THE EECC 6

text: 2.3 SECURITY REQUIREMENTS IN THE EECC 7

text: 2.4 ROLE OF ENISA 9

text: 3. SECURITY SUPERVISION 10

text: 3.1 MORE SERVICES IN SCOPE 11

text: 3.1.1 Interpersonal communications services 12 3.1.2 Number independent interpersonal communications services 12 3.1.3 Supervision regime for over-the-top services 13 3.1.4 Emergency access via over-the-top services 13

text: 3.2 DEFINITION OF SECURITY AND SECURITY INCIDENTS 14

text: 3.2.1 Security incident definition 14 3.2.2 Security baseline 15

text: 3.3 STATE-OF-THE-ART MEASURES AND ENCRYPTION 16

text: 3.4 PROMOTE ENCRYPTION AND INFORM ABOUT THREATS 16

text: 3.5 CLARIFICATION OF INCIDENT NOTIFICATION PARAMETERS 17

text: 3.6 COLLABORATION WITH NATIONAL CSIRT AND AUTHORITIES 18

text: 3.7 MITIGATING SIGNIFICANT THREATS 19

text: 4. CONCLUSIONS AND OUTLOOK 20

text: SECURITY SUPERVISION UNDER THE EECC

text: EXECUTIVE SUMMARY

text: The EU’s electronic communications landscape has changed dramatically over the last decade. Consumers have largely switched from traditional electronic communication services, like

text: EUROPEAN

text: telephony and SMS, to number independent interpersonal communications services the so-

text: ELECTRONIC

text: called “over-the-top” (OTT) communications services like Skype and WhatsApp offering voice calls, video calls, sharing of photos, etc. Consumers nowadays require high-quality internet COMMUNICATIONS connections for consuming online content, social media, streaming content and therefore they CODE (EECC) need fast and reliable internet connections. 

text: Article 40

text: contains In December 2018, the new set of telecom rules called the European Electronic detailed security Communications Code (abbreviated as EECC) was published and it entered into force. The requirements for EECC updates the existing EU telecom package of 2009 and paves the way for the roll out of electronic fibre, very high capacity networks and next generation mobile networks (5G), which will create communication jobs and growth, enable new application scenarios like internet of things (IoT) and new business providers and models. EU countries have to transpose this EU directive into national law by the end of 2020. 

text: Article 41

text: empowers An important part of the EECC is consumer protection and security of electronic the competent communications. Article 40 of the EECC contain detailed security requirements for electronic authority with respect communication providers and

text: article 41

text: empowers the competent authority with respect to the to the implementation implementation and enforcement of these requirements. As with

text: Article 13

text: a, the security and enforcement of requirements in the 2009 telecom package, ENISA will support EU Member States with the these requirements implementation of

text: Article 40

text: , to ensure there is an effective, efficient, and harmonized approach to security supervision across the EU.

text: With this paper, ENISA aims to support EU countries with their transposition, by analysing the main changes to the security requirements and the security supervision under the new rules.

text: The principles of security supervision under the new rules (Article 40 and 41 of the EECC) are a continuation of the old rules (

text: Article 13

text: a and

text: Article 13

text: b of the Framework directive ). However, we see seven important changes in the new rules, which adapt, extend or in some cases clarify the old rules:

text: 1. Under the EECC, more communication services are in scope, particularly the so-called Over-The-Top (OTT) communications services like Gmail, WhatsApp e.g. 2. There is a definition of security, security incidents and security measures. 3. Providers should implement state-of-the-art measures, as well as encryption and end-toend encryption, when needed. 4. Providers should promote encryption and encryption software, where needed, and inform subscribers about threats.

text: 5. Incident notification parameters are clarified, specifying factors of significance, such as economic and societal impact,

text: 6. The authorities for electronic communications should be able to get support from the national CSIRT and collaborate with other authorities, such as the national authorities for the NIS Directive and data protection authorities.

text: SECURITY SUPERVISION UNDER THE EECC

text: 7. The national telecom authorities have the power to require providers to take measures to mitigate significant threats and to impose a time-limit on the implementation of those measures (even before actual incidents occur).

text: Based on these seven changes, we propose three key areas where work needs to be done by the national authorities as well as ENISA.

text: 1. The existing security measures framework needs to be reviewed and updated to reflect the state-of-the-art, good practices in the EU Member States, and the new provisions in the EECC. 2. A common threshold and reporting model should ideally be developed to allow for harmonized national reporting thresholds and a consistent EU-wide implementation of mandatory incident notification and annual summary reporting. This model should take into account the OTT communications services. 3. A common approach to cross-border security supervision is needed, not only because the European telecom market is increasingly interconnected and interdependent, but also because the EECC brings a number of global communication service providers in scope.

text: For the latter it is important to communicate and share good practices with other groups of national authorities, such as the working group of authorities for the Digital Service Providers under the NIS Directive and the group of authorities for the Digital infrastructure sector under the NIS Directive.

text: In the coming period, ENISA will be preparing for these changes. We have started the adaptation of the Cybersecurity Incident Reporting and Analysis System (CIRAS). We are also reviewing the

text: Article 13

text: a guideline on security measures, which is used by many countries as the basis for supervision of the security requirements for the electronic communication service providers. ENISA looks forward to working closely with BEREC and the competent authorities for supervision of Article 40 of the EECC.

text: SECURITY SUPERVISION UNDER THE EECC

text: 1. INTRODUCTION

text: In December 2018, the EU adopted a new set of telecom rules, the European Electronic

text: ENISA will

text: Communications Code (EECC). An important part of the EECC is consumer protection and

text: support the

text: security of electronic communications. Article 40 of the EECC contains specific security requirements for electronic communication providers. As with

text: Article 13

text: a of the Framework national Directive in the past, ENISA will support the national authorities for Article 40 of the EECC, authorities for particularly on the technicalities and details of security supervision, to ensure there is an

text: implementation

text: effective, efficient, and where possible harmonized approach across the EU. Article 40 of the

text: of

text: Article 40

text: of

text: EECC brings important changes with respect to

text: Article 13

text: a. In this paper, we analyse these

text: the European

text: changes and their meaning for security supervision by the national competent authorities.

text: Electronic

text: This work follows up on almost 10 years of close and fruitful collaboration between ENISA and Communications the national competent authorities on the implementation of

text: Article 13

text: a. This collaboration has

text: Code (EECC)

text: resulted in several technical guidelines on

text: Article 13

text: a, which carry the consensus of the entire

text: Article 13

text: a Expert Group.

text: We should underline however that this paper is an ENISA paper and that it is not a guideline produced by the ENISA

text: Article 13

text: a Expert Group. For the EECC it is too early to discuss or reach consensus about more detailed aspects of security supervision, because most EU Member states are in the process of transposing and competences still need to be assigned.

text: We based our analysis on interviews with experts from public and private sector, including experts from providers, national authorities, industry associations, telecom consultancy firms, etc.

text: Throughout this document, we discuss examples of electronic communication services. These examples are merely for the sake of illustration and we underline that this paper does not aim to define which services are in scope of the EECC. Member States will transpose and interpret the EECC provisions. It is the role of BEREC to enhance the consistent application of the provisions of the EECC across Member States. The EECC is a directive, meaning that EU countries will have to transpose this into national law by the end of 2020. In this document, we refer to the EECC provisions as “new rules” and those of the Framework Directive as “old rules” even if they are still applicable.

text: 1.1 TARGET AUDIENCE

text:  Experts in national ministries, telecom and other national authorities  Experts in the electronic communications sector (providers, industry associations, etc).

text: SECURITY SUPERVISION UNDER THE EECC

text: 2. POLICY CONTEXT

text: The European Electronic Communications Code, the EECC, is an EU directive, meaning that EU countries will have to transpose the new rules into national legislation. The deadline for this transposition is December 2020. It is important to see the changes it brings and the main provisions.

text: December 2020 is the deadline for the transposition of the EECC Directive into national legislations of EU Member State. 2.1 OLD RULES

text: The new EECC replaces four EU directives. In this paper, we refer to these directives as the “old rules”, although they are of course currently still in place.

text:  The Framework Directive, which is based on the Framework Directive

text: as amended by Directive

text: .  The Access Directive, which is based on the Access Directive

text: and amended by Directive

text: .  The Authorisation Directive is based on the Authorisation Directive

text: and amended by Directive

text: .  The Universal Service Directive is based on the Universal Service Directive

text: and the Citizens' Rights Directive

text: These rules were last modified in 2009 as part of a wider EU telecom reform, which included also the e-privacy directive, addressing privacy in electronic communications and the BEREC regulation, establishing the Body of European telecom regulators.

text: 2.2 MAIN PROVISIONS OF THE EECC

text: SECURITY SUPERVISION UNDER THE EECC

text: The main provisions of the EECC are:

text:  Clear and inclusive rules: the same rules will apply all over Europe with a vision of an inclusive single market;  Higher quality of services: the Code will foster competition for investments, in particular in next generation networks - 5G, meaning higher connection speeds and higher coverage;  Competitive prices: by multiplying the offers available and bringing more capacity, the prices are expected to go down;  Consumer protection: the Code proposes a regulatory approach, which allows all actors, from traditional telecom operators to online players, to provide interpersonal communication services with the same level of protection for the end-user. That means that, 'electronic communications services' will also cover services provided over the internet such as messaging apps and email (also known as 'over-the-top' or 'OTT' communications services).

text: 2.3 SECURITY REQUIREMENTS IN THE EECC

text: Security is one of the general objectives of the EECC, as outlined in Article 3 of the EECC:

text: Article 3

text: General objectives

text: […] (d) promote the interests of the citizens of the Union, […] by maintaining the security of networks and services, by ensuring a high and common level of protection for end-users

text: through the necessary sector-specific rules

text: Most of the security requirements are contained in

text: Article 40

text: and Article 41 of the EECC. Although the EECC uses many of the same principles of security supervision that existed in the old rules, the EECC also brings several changes in security supervision. We will look at the changes in more detail in the next section.

text: For the sake of reference we quote

text: Article 40

text: and

text: Article 41

text: in full below.

text: Article 40

text: Security of networks and services

text: 1. Member States shall ensure that providers of public electronic communications networks or of publicly available electronic communications services take appropriate and proportionate technical and organisational measures to appropriately manage the risks posed to the security of networks and services. Having regard to the state of the art, those measures shall ensure a level of security appropriate to the risk presented. In particular, measures, including encryption where appropriate, shall be taken to prevent and minimise the impact of security incidents on users and on other networks and services.

text: The European Union Agency for Network and Information Security (‘ENISA’) shall facilitate, in accordance with

text: Regulation (EU) No 526/2013

text: of the European Parliament and of the Council (45), the coordination of Member States to avoid diverging national requirements that may create security risks and barriers to the internal market.

text: In order to determine the significance of the impact of a security incident, where available the following parameters shall, in particular, be taken into account:

text: (a) the number of users affected by the security incident;

text: SECURITY SUPERVISION UNDER THE EECC

text: (b) the duration of the security incident;

text: (c) the geographical spread of the area affected by the security incident;

text: (d) the extent to which the functioning of the network or service is affected;

text: (e) the extent of impact on economic and societal activities.

text: Where appropriate, the competent authority concerned shall inform the competent authorities in other Member States and ENISA. The competent authority concerned may inform the public or require the providers to do so, where it determines that disclosure of the security incident is in the public interest.

text: Once a year, the competent authority concerned shall submit a summary report to the Commission and to ENISA on the notifications received and the action taken in accordance with this paragraph.

text: 3. Member States shall ensure that in the case of a particular and significant threat of a security incident in public electronic communications networks or publicly available electronic communications services, providers of such networks or services shall inform their users potentially affected by such a threat of any possible protective measures or remedies which can be taken by the users. Where appropriate, providers shall also inform their users of the threat itself.

text: 4. This Article is without prejudice to

text: Regulation (EU) 2016/679

text: and Directive

text: 5. The Commission, taking utmost account of ENISA’s opinion, may adopt implementing acts detailing the technical and organisational measures referred to in paragraph 1, as well as the circumstances, format and procedures applicable to notification requirements pursuant to paragraph 2. They shall be based on European and international standards to the greatest extent possible, and shall not prevent Member States from adopting additional requirements in order to pursue the objectives set out in paragraph 1.

text: Article 41

text: Implementation and enforcement

text: 1. Member States shall ensure that, in order to implement

text: Article 40

text: , the competent authorities have the power to issue binding instructions, including those regarding the measures required to remedy a security incident or prevent one from occurring when a significant threat has been identified and time-limits for implementation, to providers of public electronic communications networks or publicly available electronic communications services.

text: 2. Member States shall ensure that competent authorities have the power to require providers of public electronic communications networks or publicly available electronic communications services to:

text: (a) provide information needed to assess the security of their networks and services,

text: including documented security policies; and

text: (b) submit to a security audit carried out by a qualified independent body or a competent authority and make the results thereof available to the competent authority; the cost of the audit shall be paid by the provider.

text: 3. Member States shall ensure that the competent authorities have all the powers necessary to investigate cases of non-compliance and the effects thereof on the security of the networks and services.

text: SECURITY SUPERVISION UNDER THE EECC

text: 4. Member States shall ensure that, in order to implement

text: Article 40

text: , the competent authorities have the power to obtain the assistance of a Computer Security Incident Response Team (‘CSIRT’) designated pursuant to

text: Article 9 of Directive (EU) 2016/1148

text: in relation to issues falling within the tasks of the CSIRTs pursuant to point 2 of Annex I to that Directive.

text: 5. The competent authorities shall, where appropriate and in accordance with national law, consult and cooperate with the relevant national law enforcement authorities, the competent authorities within the meaning of

text: Article 8(1) of Directive (EU) 2016/1148

text: and the national data protection authorities.

text: 2.4 ROLE OF ENISA

text: Article 40 of the EECC asks ENISA to facilitate harmonization on the security aspects.

text: Regulation (EU) No 526/2013

text: This paper is a first step towards harmonized implementation of the EECC across Europe. It follows up on a decade of ENISA support of and collaboration with the EU’s telecom regulators in the

text: Article 13

text: a Expert Group.

text: SECURITY SUPERVISION UNDER THE EECC

text: 3. SECURITY SUPERVISION

text: Article 13

text: a and

text: Article 13

text: b of the Framework directive). Under the new rules, as with under the old rules:

text:  Communication providers have to assess risks, take appropriate security measures and report significant incidents to national authorities (

text: Article 13

text: a of the Framework directive, Article 40 of the EECC).  The national telecom authorities should have powers to supervise this, to enquire about measures in place, and to investigate cases of non-compliance by providers (

text: Article 13

text: b of the Framework directive, Article 41 of the EECC).

text: This means that for the new rules national authorities can build on the experience and practice developed under the old rules.

text: There are also some changes for security supervision, which adapt, extend or in some cases clarify the old rules. In this section, we analyse the seven most important changes:

text: 1. More services in scope: Under the EECC more communication services are in scope, particularly the so-called Over-The-Top (OTT) communications services like for example Gmail, WhatsApp, and Skype.

text: 2. New definitions of security and security incidents: The EECC provides definition of security, including also aspects like the confidentiality of communications. The EECC also provides a security baseline and a set of minimum-security measures.

text: 3. State-of-the-art measures and (end-to-end) encryption: The EECC requires that providers implement state-of-art measures, as well as encryption and end-to-end encryption, where appropriate.

text: 4. Promote encryption and inform subscribers about threats: The EECC requires that providers promote the use of encryption and encryption software with subscribers and that they inform subscribers about potential threats.

text: 5. Clarification of incident notification parameters: The EECC clarifies the impact criteria for mandatory breach reporting, specifying the factors, such as economic and societal impact, and clarifies that reporting must be done without undue delay.

text: 6. Collaboration with national CSIRT and authorities: The EECC requires that national telecom authorities have the power to get support from the national CSIRT, and that they collaborate with law enforcement authorities, national authorities for the NIS Directive and the data protection authorities.

text: 7. Mitigating significant threats: National telecom authorities have the power to require providers to take measures to mitigate significant threats and to impose a time limit on the implementation of those measures (even before actual incidents occur).

text: SECURITY SUPERVISION UNDER THE EECC 3.1 MORE SERVICES IN SCOPE

text: Under the EECC, more communication services are in scope, particularly the so-called Over- The-Top (OTT) communications services, such as Gmail, WhatsApp, and Skype. The EECC aims to protect consumers, irrespective of the chosen communication tool, focusing on the functionality (electronic communication), rather than on the underlying technology or implementation choices.

text: Article 2

text: gives the definition of electronic communications services in scope:

text: Article 2

text: Definitions

text: […] (4) ‘electronic communications service’ means a service normally provided for remuneration via electronic communications networks, which encompasses, with the exception of services providing, or exercising editorial control over, content transmitted using electronic communications networks and services, the following types of services: (a) ‘internet access service’ as defined in point (2) of the second paragraph of

text: Article 2 of Regulation (EU) 2015/2120

text: (b) interpersonal communications service; and

text: (c) services consisting wholly or mainly in the conveyance of signals such as transmission services used for the provision of machine-to-machine services and for broadcasting; This means that under the EECC there are three main service categories. The picture below shows examples of services for the sake of explanation. Especially for the new services in scope, we show some examples of the most popular OTT communications services.

text: Figure 1: Examples of services in scope

text: SECURITY SUPERVISION UNDER THE EECC

text: Note that some applications or software can offer functionality in terms of services, which may fall under different categories. This is the case when the application/software offers number independent interpersonal communication and a functionality, which enables communication with numbers in national or international numbering plans.

text: Under the old rules: The EU telecom rules currently in place normally cover traditional

text: telecommunications like the Public Switched Telephone Network (fixed or mobile), SMS, fixed and mobile internet connections, broadcasting platforms (like television, or satellite), and the email services offered by telecom providers .

text: 3.1.1 Interpersonal communications services

text: An important new term introduced by the EECC is “interpersonal communications service”. This category includes all services that allow direct and interactive communications between a finite number of persons, determined by the sender of the communication. See preamble 17.

text: (17) Interpersonal communications services are services that enable interpersonal and interactive exchange of information, covering services like traditional voice calls between two individuals but also all types of emails, messaging services, or group chats. Interpersonal communications services only cover communications between a finite, that is to say not potentially unlimited, number of natural persons, which is determined by the sender of the communication.

text: This definition excludes services like linear broadcasting, video on demand, websites, social networks, blogs, exchange of information between machines, etc.

text: Note that some of the interpersonal communications services were already in scope under the old rules like for example mobile telephony or SMS.

text: 3.1.2 Number independent interpersonal communications services

text: Interpersonal communications are sub-divided into “number-based” interpersonal communication services, i.e. services, which connect to the public switched telephone network, and “number-independent” interpersonal communication services, which do not connect to the public switched telephone network and do not use conventional telephone numbering. The number dependent interpersonal communications services are well known: mobile telephony, fixed telephony, SMS, VOIP, etc.

text: The number independent interpersonal communications services, which are often referred to as “Over-The-Top” (OTT) communications services, are services like Viber, WhatsApp, Slack, Gmail, Outlook, Skype-to-Skype etc., which are provided over internet connections, on top of more traditional networks. The OTT communications services are new in scope and this means that competent authorities will be supervising a new group of providers. Often, they are multinational companies, providing communication services in multiple countries or even across the globe.

text: The most popular OTT communications services operate globally and have hundreds of millions of subscribers, sometimes billions of subscribers across the globe. Note that the use of a mobile phone number for authentication or as identifier does not make an interpersonal communications service ‘number-based’. A good example is WhatsApp, which uses mobile phone numbers as identifiers but does not connect with publicly assigned numbering resources for the communication itself. This is clarified in recital 18.

text: (18) […] The mere use of a number as an identifier should not be considered to be equivalent to the use of a number to connect with publicly assigned numbers and should therefore, in

text: SECURITY SUPERVISION UNDER THE EECC

text: itself, not be considered to be sufficient to qualify a service as a number-based interpersonal communications service.

text: Note that many websites offer end-users some kind of an interpersonal and interactive communication functionality. The EECC makes an exception if the functionality is ‘minor’ and ‘purely ancillary’, and that it cannot be used without the principal service, and that it is in reality, barely used by the end-user.

text: 3.1.3 Supervision regime for over-the-top services

text: In general, the security provisions in the EECC for number-based and number-independent interpersonal communications services are the same. Both are subject to (normal) ex-ante, supervision, and are required to provide information, submit to security audits and be subjected to investigation of non-compliance by the competent authorities. This is similar to the security supervision regime in the NIS Directive for the Operators of Essential Services (OES) .

text: However, there are some exceptions for the OTT communications services. The EECC outlines that, because these providers of OTT communications service do not exercise actual control over the transmission networks, there may be fewer risks for these providers, and certain security measures may not be needed, if justified on the basis of a risk assessment. See recital 95.

text: (95) […] independent inter personal communications services, […] are also subject to appropriate security requirements in accordance with their specific nature and economic importance. Providers of such services should thus also ensure a level of security appropriate to the risk posed. Given that providers of number -independent interpersonal communications services normally do not exercise actual control over the transmission of signals over networks, the degree of risk for such services can be considered in some respects to be lower than for traditional electronic communications services. Therefore, where justified on the basis of the actual assessment of the security risks involved, the measures taken by providers of number-independent interpersonal communications

text: services should be lighter. […]

text: The EECC also exempts providers of number independent interpersonal communication services from the ‘general authorisation’ requirement, and possible related notification requirements at Member States level.

text: 3.1.4 Emergency access via over-the-top services

text: Under the EECC the number based interpersonal communications services should provide the end-user access to emergency services, beyond just the traditional voice communication services. See recital 20

text: (20): Technical developments make it possible for end-users to access emergency services not only by voice calls but also by other interpersonal communications services. The concept of emergency communication should therefore cover all interpersonal communications services that allow such emergency services access.

text: For citizens, access to emergency services is an important function of communication networks and services. Access to emergency services is an important factor when assessing the significance of security incidents, and such outages can have a significant impact on economy, society, increase risks for public safety, potentially putting lives at stake.

text: SECURITY SUPERVISION UNDER THE EECC 3.2 DEFINITION OF SECURITY AND SECURITY INCIDENTS

text: The EECC provides a definition of security, clarifying for example that it includes also aspects like the confidentiality, authenticity, integrity and availability of communications.

text: Article 2

text: Definitions

text: (21) ‘security of networks and services’ means the ability of electronic communications networks and services to resist, at a given level of confidence, any action that compromises the availability, authenticity, integrity or confidentiality of those networks and services, of stored or transmitted or processed data, or of the related services offered by, or accessible via, those electronic communications networks or services;

text: The definitions in the EECC clarify that security measures to be taken by providers should protect not only the continuity of services, but also the confidentiality of the communications, the metadata, etc.

text: Under the old rules: In the 2009 telecom rules, a definition of security was lacking in the

text: Framework directive, which led to some discussions and divergence.

text: 3.2.1 Security incident definition

text: The EECC also includes a definition of a security incident, which was lacking in the 2009 telecom rules.

text: Article 2

text: Definitions

text: […] (42) ‘security incident’ means an event having an actual adverse effect on the security of electronic communications networks or services.

text: This definition of security incident in the new rules is aligned with the definition in the NIS Directive and consistent with industry standards and good practices.

text: Figure 2: Security incident, properties and assets affected

text: This means that, considering the definition of security, security incidents can include not only network outages but also other types of incidents, like for example breaches of the confidentiality of communications.

text: SECURITY SUPERVISION UNDER THE EECC

text: Events, which reduce the redundancy of a network or service, such as for instance when one of two redundant submarine cables breaks, could fall under the definition of an incident because they reduce the ability of the system to protect itself.

text: Newly discovered security vulnerabilities (like, for example, Heartbleed) may become security incidents, if there is an actual effect on the security of the networks and services. It does not mean that all such vulnerabilities fall under mandatory breach reporting, which requires there to be a significant impact on the networks or services.

text: Under the old rules: In the 2009 telecom rules, a precise definition of security incident was

text: lacking, which led to discussions and some divergence in interpretation.

text: 3.2.2 Security baseline

text: The EECC also defines a security baseline, a set of technical and organizational security measures, which need to be taken by providers, as a minimum.

text: Article 40

text: requires providers to take appropriate security measures:

text: Article 40

text: Security of networks and services

text: Recital 94 details which aspects security measures should take into account, as a minimum.

text: (94) […] Security measures should take into account, as a minimum, all the relevant aspects of the following elements: as regards security of networks and facilities: physical and environmental security, security of supply, access control to networks and integrity of networks; as regards handling of security incidents: handling procedures, security incident detection capability, security incident reporting and communication; as regards business continuity management: service continuity strategy and contingency plans, disaster recovery capabilities; as regards monitoring, auditing and testing: monitoring and logging policies, exercise contingency plans, network and service testing, security assessments and compliance monitoring; and compliance with international standards.

text: In this way, the EECC provides a starting point for a security supervision framework

text: Table 1: EECC Security baseline

text: Measures Description

text: SECURITY SUPERVISION UNDER THE EECC

text: Under the old rules: The national authorities in the

text: Article 13

text: a expert group agreed, in a

text: consensus process, about a minimum set of security measures, which goes beyond the measures listed in the EECC. This

text: Article 13

text: a guideline covers the above-mentioned security measures enumerated in the EECC and lists 25 high-level security objectives, divided in 7 security domains . For each security objective, there are examples of technical measures and possible evidence, which should be considered by national authorities when assessing compliance.

text: 3.3 STATE-OF-THE-ART MEASURES AND ENCRYPTION

text: The EECC requires that the security measures taken by providers are state-of-the-art and to include encryption, where appropriate, to mitigate the impact of security incidents on subscribers, other services, etc.

text: Article 40

text: Security of networks and services

text: […] Having regard to the state of the art, those measures shall ensure a level of security appropriate to the risk presented. In particular, measures, including encryption where appropriate, shall be taken to prevent and minimise the impact of security incidents on users and on other networks and services.

text: Recital 97 clarifies that where necessary, encryption and end-to-end encryption should be mandatory and turned on by default:

text: (97)In order to safeguard security of networks and services, and without prejudice to the Member States’ powers to ensure the protection of their essential security interests and public security, and to permit the investigation, detection and prosecution of criminal offences, the use of encryption for example, end-to-end where appropriate, should be promoted and, where necessary, encryption should be mandatory in accordance with the principles of security and privacy by default and by design.

text: The latter provisions are in line with industry good practices. For example, a popular messaging particular and significant threat of a security incident a closer look at the security and technology behind some of these services.

text: 3.4 PROMOTE ENCRYPTION AND INFORM ABOUT THREATS

text: Article 40(3)

text: and Recitals 96 explain that it is the responsibility of the provider to inform subscribers about significant security threats and how they can protect themselves, for example by using specific software or encryption. Recital 97 mentions that end-to-end encryption should be promoted.:

text: (96) Providers […] should inform users of particular and significant security threats and of measures they can take to protect the security of their communications, for instance by using

text: specific types of software or encryption technologies. […]

text: SECURITY SUPERVISION UNDER THE EECC

text: (97) […] the use of encryption for example, end-to-end where appropriate, should be promoted and, where necessary, encryption should be mandatory in accordance with the principles of security and privacy by default and by design.

text: This is a new provision that builds on Art 4(2) ePrivacy Directive but considerably amended and modernised. It expands the duty of care providers have regarding the security and privacy of their subscribers.

text: Under the old rules: The 2009 telecom rules only make it mandatory for a provider to reach out

text: subscribers when there was an actual significant incident and if the authority mandated the provider to do so.

text: 3.5 CLARIFICATION OF INCIDENT NOTIFICATION PARAMETERS

text: The EECC specifies parameters that, where available, should be taken into account when determining the significance of a security incident and in this way puts the basis for harmonized incident reporting thresholds across the EU. In addition, the EECC clarifies that reporting must be done without undue delay.

text: Article 40

text: Security of networks and services […] 2. Member States shall ensure that providers of public electronic communications networks or of publicly available electronic communications services notify without undue delay the competent authority of a security incident that has had a significant impact on the operation of networks or services. In order to determine the significance of the impact of a security incident, where available the following parameters shall, in particular, be taken into account: (a) the number of users affected by the security incident; (b) the duration of the security incident; (c) the geographical spread of the area affected by the security incident; (d) the extent to which the functioning of the network or service is affected; (e) the extent of impact on economic and societal activities.

text: The provisions about cross-border information and annual summary reporting to ENISA remain unchanged.

text: In the past, the national telecom authorities in the

text: Article 13

text: a group and ENISA have discussed EU-wide thresholds, in particular for an efficient and consistent implementation of annual summary reporting across the EU. The experience is that a threshold using absolute numbers of subscribers is difficult to use across the EU because of the differences in size of the EU

text: SECURITY SUPERVISION UNDER THE EECC

text: countries. A common EU-wide threshold model should be flexible enough to work for countries of all sizes.

text: The EECC uses a two-step definition to determine which security incidents fall under mandatory notification. The EECC first gives a broad definition of a security incident, including a wide range of security events. The threshold for reporting is defined more strictly in terms of the impact on the operation of the networks and/or services.

text: Figure 2: EECC two-step definition for incident mandatory notification

text: Under the old rules: Previously the legislation did not list detailed criteria to consider when an

text: incident should be considered significant. Each country also derived their own national thresholds. The

text: Article 13

text: a expert group did reach agreement about thresholds for EU-wide annual summary reporting. For the sake of reference, we report these EU-wide annual summary thresholds (see also the

text: Article 13

text: a guideline on incident reporting ):

text: - duration more than an hour, and the percentage of users affected is more than 15%, - duration more than 2 hours, and the percentage of users affected is more than 10%, - duration more than 4 hours, and the percentage of users affected is more than 5%, - duration more 6 hours, and the percentage of users affected is more than 2%, or if it - duration more than 8 hours, and the percentage of users affected is more than 1%. - or the product of duration and number of users exceeds 1 million user hours

text: 3.6 COLLABORATION WITH NATIONAL CSIRT AND AUTHORITIES

text: The EECC in

text: Article 41

text: asks member states to give the national competent authorities the power to get assistance from national CSIRTs and requires them to consult and cooperate with other national authorities, like law enforcement, authorities for the NIS Directive, and data protection authorities.

text: Article 41

text: Implementation and enforcement

text: […] 4. Member States shall ensure that, in order to implement

text: Article 40

text: Article 9 of Directive (EU) 2016/1148

text: 5. The competent authorities shall, where appropriate and in accordance with national law, consult and cooperate with the relevant national law enforcement authorities, the competent

text: SECURITY SUPERVISION UNDER THE EECC

text: Under the old rules: Under the old rules there was no such provision. Nevertheless, in most

text: countries there is close collaboration between the competent authorities for telecommunications, national cybersecurity agencies, and national CSIRTs.

text: 3.7 MITIGATING SIGNIFICANT THREATS

text: Under Article 41 of the EECC national telecom authorities shall have the power to require providers to mitigate significant threats and to impose that measures should be taken within a time limit (even before actual incidents occur).

text: Article 41

text: defines the supervision powers of national competent authorities:

text: Article 41

text: Implementation and enforcement

text: Article 40

text: , the competent authorities have the power to issue binding instructions, including those regarding the measures required to remedy a security incident or prevent one from occurring when a significant threat has been identified and timelimits for implementation, to providers of public electronic communications networks or publicly available electronic communications services.

text: (a) provide information needed to assess the security of their networks and services, including

text: documented security policies; and

text: Most of this is similar to the old rules. It describes ‘normal’ preventive, ex-ante supervision. Part 1) however contains an additional provision regarding significant threats and measures to mitigate those threats, to prevent incidents from occurring. This part (

text: Article 41(1)

text: ) enhances clarity regarding the binding instructions competent authorities can give.

text: Under the old rules: Under the old rules,

text: Article 13

text: b of the Framework directive stipulated the

text: supervision powers of competent authorities. In the EECC it is clearly specified that already a significant threat is enough basis for the competent authority to instruct providers to take mitigating measures. In the past, in some countries the authorities only had the power to request information after a suspicion or a reason for such information requests or audits, for example when presented with evidence of an incident or evidence of non-compliance.

text: SECURITY SUPERVISION UNDER THE EECC

text: 4. CONCLUSIONS AND OUTLOOK

text: Security supervision under the new rules, the EECC, is in its principles similar to the security supervision under the old rules. However, there are several changes, which adapt, extend or clarify the old rules. Therefore, once the EECC is transposed into national legislation, the national competent authorities, i.e. those national authorities who will be assigned the relevant competences (for

text: Article 40

text: and Article 41 of the EECC), as well as ENISA, will have to adapt the current guidelines, procedures and tools.

text: We see three key areas where work is needed. In each area, we outline potential next steps for the coming 2-3 years: ENISA and

text: national

text: 1. Review and update the existing security measures framework: The EECC clarifies the competent security requirements and requires state of the art measures and encryption where needed.

text: authorities will

text: National authorities will need to develop a new security framework for assessing the

text: work together to

text: conformity of providers with the new rules. ENISA, with the support of the

text: Article 13

text: a Expert Group, aims to review the current Technical Guidelines for Security Measures and start the adapt the current process of extending the guidelines to align with the EECC. guidelines,

text: procedures and

text: 2. Develop harmonized reporting thresholds and a new incident reporting guideline:

text: tools.

text: ENISA will work with the national authorities to develop a harmonized reporting approach by defining the parameters for measuring the impact of an incident and the thresholds for the reporting. This work will be based on the current technical guidelines but it will go further to cover not only outages, but also all kind of security incidents and the various aspects of their impact (economical, societal etc). The aim is to agree on thresholds that will take into consideration the size, the population and the specific characteristics of every country.

text: 3. Develop a cross-border approach to security supervision: The supervision of the OTT providers brings new challenges to the national authorities. Incidents affecting the OTT communications services will be mostly cross-border and collaboration between the Competent Authorities will be required to allow for effective and efficient supervision. ENISA will focus on helping the Competent Authorities to agree on cross-border collaboration procedures for supervision. Communication with other similar groups such as the NISD DSPs group will help to learn more about supervising (multinationals with global services) across borders.

text: In parallel, ENISA has started the work of rebuilding the CIRAS reporting tool, which is used for annual summary reporting as well as cross-border information about incidents between national authorities, to make it fit for the EECC. The work should be ready in the next months, in time for the next round of annual summary reporting. Currently CIRAS contains around 1000 incident reports, which are publicly accessible, going back to 2012 when annual summary reporting started in earnest .

text: In this period of transposition of the new rules, it is important to share good practices and collaborate with other national authorities in other EU countries, to avoid unnecessary divergence. As stipulated in the EECC, ENISA will support the EU countries to ensure there is a

text: SECURITY SUPERVISION UNDER THE EECC

text: harmonized approach, where possible. This work will start as in earnest when the EECC competences for

text: Article 40

text: have been assigned.

text: We look back at a decade of successful collaboration with the national authorities on the implementation of

text: Article 13

text: a, in the

text: Article 13

text: a group, and we look forward to continue working with the member states, national authorities and the private sector, towards an efficient and effective implementation of the new EECC.

text: -N -EN -765 -19 -02 TP

text: ABOUT ENIS A

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

text: ISBN: 978-92-9204-304-9 DOI: 10.2824/ 647924


text: Joint Publication Structured Cooperation between CERT-EU and ENISA TLP:CLEAR | 15/02/2023 | JP-23-01 | v1.0

text: [1] https://www.consilium.europa.eu/en/press/press-releases/2021/07/19/declaration-by-the-high-representative-onbehalf-of-the-eu-urging-china-to-take-action-against-malicious-cyber-activities-undertaken-from-its-territory/ [2] https://diplomatie.belgium.be/en/news/declaration-minister-foreign-affairs-malicious-cyber-activities [3] https://blog.talosintelligence.com/mustang-panda-targets-europe/ [4] https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempoagainst-european [5] https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx [6] https://www.microsoft.com/en-us/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latinamerica-and-europe/ [7] https://cyware.com/research-and-analysis/apt27-an-in-depth-analysis-of-a-decade-old-active-chinese-threat-groupe4cc [8] https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf [9] https://www.verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2022/2022-01-26-cyberbrief.html [10] https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/cyberabwehr/2022-01-bfv-cyberbrief.pdf?__blob=publicationFile&v=10 [11] https://www.intrinsec.com/apt27-analysis/?cn-reloaded=1&cn-reloaded=1 [12] https://www.cert.ssi.gouv.fr/pdf/CERTFR-2021-IOC-003.pdf [13] https://pst.no/alle-artikler/pressemeldinger/etterforskningen-av-datanettverksoperasjonen-motfylkesmannsembetene-er-avsluttet/ [14] https://supo.fi/en/-/supo-identified-the-cyber-espionage-operation-against-the-parliament-as-apt31 [15] https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-013b.pdf [16] https://unit42.paloaltonetworks.com/pingpull-gallium/ [17] https://cyware.com/news/apt27-group-backdoors-mimi-chat-app-for-supply-chain-attack-eecc8010/ [18] https://www.reuters.com/article/idUSKBN28Q1DB [19]https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ [20] https://research.checkpoint.com/2021/the-story-of-jian/ [21] https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/ [22] https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/apt31-cloud-attacks/ [23] https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempoagainst-european [24] https://www.enisa.europa.eu/publications/boosting-your-organisations-cyber-resilience [25] https://github.com/enisaeu/CNW#security-best-practices [26] https://attack.mitre.org/groups/ [27] https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014- 007_Kerberos_Golden_Ticket_Protection_v1_4.pdf [28] https://cert.europa.eu/static/WhitePapers/CERT-EU-SWP2019-001.pdf [29] https://cert.europa.eu/static/WhitePapers/CERT-EU_SWP_17-002_Lateral_Movements.pdf [30] https://cert.europa.eu/static/WhitePapers/CERT-EU-SWP2012-004.pdf [31] https://csirtsnetwork.eu/ [32] https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html [33] https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asiapacific-targets [34] https://www.enisa.europa.eu/securesme/cyber-tips/strengthen-technical-measures/secure-backups [35] https://www.cert.europa.eu/static/WhitePapers/TLP-WHITE-CERT-EU_Security_Guidance-22-001_v1_0.pdf [36] https://www.enisa.europa.eu/publications/proactive-detection-measures-and-information-sources

identifier: Sustained Activity by Threat Actors- Joint Publication

amnesord: EU incident response and cyber crisis management

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: JP-23-01 - Sustained activity by specific threat actors

type: rubrik

text: Summary

text: The EU Cybersecurity Agency (ENISA) and the CERT for the EU institutions, bodies and agencies (CERT-EU) would like to draw the attention of their respective audiences on particular Advanced Persistent Threats (APTs), known as APT27, APT30, APT31, Ke3chang, GALLIUM and Mustang Panda. These threat actors have been recently conducting malicious cyber activities against business and governments in the Union.

type: stycke

text: On 19 July 2021, the EU has urged Chinese authorities to take actions against malicious cyber activities undertaken from their territory, and linked to APT31 [1]. These malicious cyber activities, which had significant effects, targeted government institutions and political organisations in the EU and Member States, as well as key European industries.

text: On 18 July 2022, Belgium has also urged Chinese authorities to take action against malicious cyber activities undertaken by Chinese actors. These activities can be linked to the hacker groups known as APT 27, APT 30, APT 31, and GALLIUM [2]. Moreover, commercial firms indicated that Ke3chang and Mustang Panda are likely operating from the territory of China [3][4][5].

text: These threat actors present important and ongoing threats to the European Union. Recent operations pursued by these actors focused mainly on information theft, primarily via establishing persistent footholds within the network infrastructure of organisations of strategic relevance.

text: ENISA and CERT-EU call for all public and private sector organisations in the EU to apply the recommendations included in this document in a consistent and systematic manner. These recommendations aim to reduce the risk of being compromised by the mentioned APTs, as well as substantially improve the cybersecurity posture and enhance the overall resilience of these organisations against cyberattacks.

text: Recommendations

text: All public and private sector organisations in the EU are strongly advised to follow common cyber hygiene recommendations. Our previously published best practices [24] and the corresponding security guidance [35] provide a solid basis for mitigating cyberattacks.

text: Following the analysis of the available information on the aforementioned threat actors (see below) and of some of their major tactics, techniques, and procedures, ENISA and CERT-EU draw a number of complementary

text: recommendations to foster the defensive capabilities of the intended audience. Each organisation which wants to apply these recommendations is fully responsible for the implementation, according to its business needs and priorities.

text: For best practices issued by the relevant CSIRTs of the EU Member States, please refer to their websites [31].

text: Additionally, CERT-EU and ENISA emphasise the importance of participating in information sharing communities and reviewing your national/governmental CSIRT’s security guidance [25] and public resources detailing tactics, techniques and procedures associated with the threat actors [26].

text: Prevention

text: To reduce your cyber risks through good cyber hygiene: • Follow the security best practices proposed by vendors to harden their products and manage highprivileged accounts and key assets. • Strive to maintain current asset inventories. The inventories shall include both, physical (i.e. on-prem servers, endpoints, etc.) and virtual assets (i.e. instances in the Cloud, virtual machines, etc.) and installed software. This allows the timely identification of systems impacted by vulnerabilities. A patch prioritisation strategy defined in a policy should particularly cover critical assets like hardware and software directly exposed to the Internet. • Block or severely limit egress Internet access for servers or other devices that are seldom rebooted. As they are coveted by threat actors for establishing backdoors, these systems are often used to create persistent beacons to Command and Control (C2) infrastructure. • Follow best practices for identity and access management. A robust password policy shall be enforced for all accounts and multi-factor authentication must be used where applicable. Tightly manage and monitor the lifecycle of all accounts. Promote the use of password managers throughout the organisation. • Adopt a backup strategy and use the 3-2-1 rule approach which states that organisations should keep three complete copies of their data, two of which are locally stored on different types of media, and at least one copy is stored off-site [34]. • Ensure tight and proper access controls for end users and, most crucially, external third-party contractors with access to internal networks and systems (i.e. managed service and cloud service provider access). Consider requesting proofs for the security claims made by providers of these services. • Segment the network to isolate critical systems, functions, or resources – specifically implement isolation in regards of interconnections with Internet and third parties. • Secure your cloud environments before moving critical assets there. Use the strong security controls that are available on cloud platforms and properly segment cloud system management from onpremise system management to ensure that threat actors cannot easily jump from one environment to the other.

text: • Implement a resilient email policy that includes adequate mechanisms for filtering and scrutinising malicious content. A secure email gateway can further enhance the protection of the recipients. • Consider preventing attacks based on the so-called Pass-the-Ticket technique on Active Directory environments [27]. • Invest in cybersecurity education. This includes encouraging your cybersecurity professionals to enrol in specialised professional training courses in their domain and performing concise awareness campaigns for end users.

text: Detection

text: Detection refers to actions that will help expose malicious cyber activities in your network: • Implement robust log collection and regularly review alerts triggered by security components. You may refer to ENISA’s guidance on proactive detection (pp. 12 - 18) which comprehensively covers sources of telemetry [36]. It is specifically advisable to collect event logs linked to unauthenticated creation, modification, use, and permission changes associated with privileged accounts, and to review network connections from IP ranges associated with non-corporate VPN Tor, and similar services. • Monitor the activities of devices in your network with appropriate tools like Endpoint Detection and Response (EDR) and User and Entity Behaviour Analytics (UEBA), since a substantial part of network traffic is encrypted nowadays. This applies to both servers and endpoints. It is crucial to ensure that your EDR is set to alert mode if monitoring or reporting is disabled, or if communication is lost with a host agent for more than a reasonable amount of time. • Use carefully curated cyber threat intelligence to proactively search your logs for possible signs of compromise. • Detect traces of compromise in your network through well-conceived, regular threat hunting based, for example, on the MITRE ATT&CK® framework [26]. • Use intrusion detection signatures and NetFlow to spot suspicious traffic at network boundaries and detect conditions that may indicate software exploitation or data exfiltration. • Prevent and detection PowerShell based attacks [28], in order to stop attackers from gaining full control of a Windows-based infrastructure or business-related operator accounts. • Invest in detecting lateral movements which exploit NTLM and Kerberos protocols in a Windows environment [29]. • Train your users to immediately report any suspicious activity to your local cybersecurity team.

text: Response

text: Incident response is composed of several phases: Preparation, Identification, Containment, Clean-up, Recovery, and Lessons learned. To successfully respond to an incident, ENISA and CERT-EU strongly advise to:

text: • Create and maintain an incident response plan. Ensure you have documented the procedures to reach out and swiftly communicate with your national or governmental CSIRT [31], and to provide access to

text: forensics evidence when asked by relevant parties. The security white paper "Data Acquisition Guidelines for Investigation Purposes" contains related technical guidelines [30]. At the minimum, you should have an up-to-date list of key contacts for your strategic suppliers and service providers. Prepare and verify these procedures are tested and known to all the local incident handlers. • Be able to assess the incident severity, for example based on its scale and impact. Handling of more advanced attacks may require engaging external security service providers who may offer professional advice and personnel. A suitable service provider should have solid experience in APT handling, and expertise in memory, storage and network forensics, as well as log data collection and analysis. Operating system experts – and Active Directory log analysis experts in particular – can be of great help too. • Avoid common mistakes in incident handling such as: o ignoring a security event without assessing what triggered it and the potential impact; o pre-emptively blocking or probing infrastructure used by threat actors (pinging, making DNS queries, browsing, etc.); o mitigating the affected systems before responders can collect and/or recover evidence; o ignoring telemetry sources, such as network, system and access logs; o fixing the symptoms, ignoring the root causes and doing partial containment and recovery; o forgoing keeping a detailed record of actions taken and the event timeline. • Incident response requires communication among several internal stakeholders and it is strongly recommended to have clear, concise communication guidelines prepared and tested in advance.

text: If personal data is in the scope of the incident, seek the advice of your Data Protection Officer and/or your legal team.

text: Threat actor overview

text: Name Likely motive Examples of associated tools

text: APT27 (aka Lucky Mouse, Information theft; Ghost, ASPXSpy, ZxShell RAT, HyperBro, PlugX RAT, Emissary Panda, Iron Tiger, ransomware Windows Credential Editor, FoundCore, China ZipToken, Group 35, operation Chopper, gsecdump, HTTPBrowser, Impacket, TEMP.Hippo, TG 3390, Bronze ipconfig, Mimikatz, NBTscan, Net, OwaAuth, Union) pwdump, ZxShell.

text: Threat actor description

text: APT27 has been observed targeting a broad range of organisations across a wide geographic area, including Europe, North and South America, Africa, the Middle East, and the Asia Pacific (APAC) region. The group has been primarily observed conducting watering hole and spear-phishing attacks as its key means of gaining initial footholds within target networks [7]. Since 2020, APT27 operators have also been observed engaging in ransomware-based cybercriminal activities, suggesting members of the group may be conducting financially motivated activity, in addition to standard exfiltration-driven activities [8]. APT27 is also known for its high degree of operational sophistication and frequently alters its attack strategies. In order to obfuscate its their activities, evade detection and maintain long-term network persistence, APT27 deploys fileless malware and pivots within the target networks. Incidents linked to APT27 have also been recorded alongside clusters of activity from other threat groups, assessed to be operating from the same nation state such as APT30, APT31, and GALLIUM.

text: Recent operations

text: In January 2022, Germany’s domestic intelligence services – the Bundesamt für Verfassungsschutz (BfV) – published information regarding an ongoing data gathering campaign affecting German companies which the agency attributed to APT27 [9].

text: While the BfV declined to indicate the names or sectors of the commercial entities targeted, their report notes the attacks are representative of an increase in the use of HyperBro malware by Chinese threat groups against German targets [10].

text: In July 2022, Belgium’s Minister of Foreign Affairs released a statement regarding the Belgian government’s detection of an espionage campaign against the country’s Interior and Defence Ministries. The Foreign Ministry linked the campaign to APT27 alongside three other groups with assessed ties to China: APT30, APT31, and GALLIUM [2].

text: In October 2022, the France-based private incident response provider Intrinsec published a report detailing a security incident faced by an unnamed customer in spring 2022, which the company attributed to APT27. Intrinsec indicated APT27’s operation was conducted over the course of at least a year and involved the exploitation of the target’s MS Exchange server via the ProxyLogon vulnerabilities chain. After gaining initial access, the group proceeded to compromise five domains over nine months, before ultimately deploying HyperBro malware to exfiltrate many gigabytes of data over a 17-day period [11].

text: Name Likely motive Examples of Examples of associated tools

text: APT31 (aka Judgment Panda, Zirconium, Information theft Cobalt Strike, DopboxAES Rat, Bronze Vinewood) SalsaTrade, PakDoor

text: Threat actor description

text: APT31 operations date back to at least 2010. The group became more difficult to track in recent years. APT31 has been working on new methods to avoid detection, including the creation of its own anonymising proxy, which is hosted on a global network of hacked routers. Since the French national cybersecurity agency (ANSSI) report of July 2021 [12] detailing the use of this anonymisation proxy network, a general decline in these operations has been noted.

text: Recent operations

text: In 2020, the Norwegian police security service (PST) concluded a two years and a half investigation of a 2018 cyberattack against the Norwegian state administration and the cloud service provider Visma AG. According to public news, the threat actor behind the attacks was APT31 [13].

text: The Parliament of Finland had fallen victim to a breach in December 2020. In March 2021, the Finnish national authorities disclosed that their investigations pointed to APT31 [14].

text: In July 2021, the French national cybersecurity agency (ANSSI) warned of an ongoing campaign by the APT31 threat actor against a large number of French organisations [15].

text: GALLIUM

text: GALLIUM Information theft PlugX, ChinaChopper, Poison Ivy, HTRAN, Mimikatz, NBTscan, Netcat, (Softcell) PsExec, BlackMould, WinRAR, Windows Credential Editor (WCE), PingPull

text: Threat actor description

text: GALLIUM has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in several regions of the world. GALLIUM has developed the capability to target not only Windows, but also Linux (32/64-bit) systems through Remote Access Tools (RATs).

text: Recent operations

text: In July 2022, Belgium’s Minister of Foreign Affairs released a statement regarding the Belgian government’s detection of an espionage campaign against the country’s Interior and Defence Ministries. The Foreign Ministry linked APT27 alongside three other groups with assessed ties to China: APT30, APT31, and GALLIUM [2].

text: GALLIUM has been identified on 13 June 2022 by the security company Palo Alto Networks’ Unit42. The group has been expanding its operations, beyond its original telecommunications sector, to government and finance. Its targeting, according to the analysis, includes, at least, entities from one European country [16].

text: Ke3chang (APT15)

text: Ke3chang (aka Vixen Panda, Okrum, Ketrikan, Neoichor, RoyalDNS, RoyalCli, Information theft Nickel, APT15) Mimikatz, RemoteExec (similar to PsExec)

text: Threat actor description

text: Ke3chang conducts cyber operations with the purpose of stealing data. The group has been active since at least 2010. Ke3chang has targeted several sectors, including energy, government, and the military. Until 2021, Ke3chang’s favoured method for initial access was spear-phishing, using compromised or spoofed email addresses. More recently, Ke3chang has been observed exploiting vulnerabilities in public-facing software.

text: Recent operations

text: In December 2021, Microsoft reported on Ke3chang conducting a series of attacks against several organisations in Europe, Latin America, and other regions [6]. According to the Microsoft’s report, at least 11 European entities were targeted.

text: In 2021 and 2022, CERT-EU detected exploitation attempts of vulnerabilities in some EU institutions, bodies or agencies (EUIBAs), likely linked to Ke3chang.

text: Mustang Panda

text: Mustang Panda (aka RedDelta, TA416, Bronze Information theft Cobalt Strike, PlugX, RedDelta, President, Temp.Hex, HoneyMyte) WildPressure, VBScript, PoisonIvy

text: Threat actor description

text: Mustang Panda was first observed in 2017, but has possibly been conducting operations since at least 2014. Mustang Panda has targeted government entities, nonprofit, religious, and other non-governmental organisations in the EU, the US, Germany, Mongolia, Myanmar, Pakistan, and Vietnam, among others. Since end 2021 - early 2022, CERT-EU has observed an uptick in campaigns targeting entities in the EU. Mustang Panda uses both proprietary and publicly available hacking tools. Mustang Panda uses several different initial access methods, including (primarily) spear-phishing with malicious attachments or links, watering hole attacks, and infected USB drives.

text: Recent operations

text: In 2022, Mustang Panda was observed using public documents belonging to EU Institutions, bodies or agencies (EUIBAs) as lures in spear-phishing campaigns. The targets were mainly ministries of foreign affairs and the diplomatic sector. Detected spear-phishing campaigns impersonated officials in order to be more credible.

text: In a March 2022 report, Proofpoint identified malicious activity by Mustang Panda, in which the group targeted European diplomatic entities, including one involved in refugee and migrant services [4].

text: In April 2022, threat researchers from Secureworks, a cybersecurity vendor, published a report that revealed Mustang Panda’s targeting of Russian officials [5].

text: Between October and December 2022, several security firms, including Trend Micro and BlackBerry, reported on spear-phishing activity by Mustang Panda using EU lures [32][33].

text: Tactics, Techniques and Procedures (TTPs)

text: The analysis of these threat actors’ TTPs focuses on some of the major patterns noticed in the last few months and is not intended to be exhaustive.

text: Reconnaissance and scanning

text: • According to an ANSSI report, APT31 has been using offensive IT infrastructure which is likely built as a botnet of compromised SOHO (Small Offices/Home Offices) devices. The infrastructure builds anonymous proxy chains that support TCP, UDP, and raw communications with the victim [15]. • According to reports from both Sekoia and Trend Micro, in August 2022, APT27 had compromised the servers of MiMi, an instant messaging application primarily used in China in a supply-chain attack that intended to spread malware [17]. • A Reuters news report linked Mustang Panda to the breach of the IT systems of the African Union and the monitoring of security camera video feeds (2020) [18].

text: Initial access

text: Exploitation of Internet-facing applications

text: The tactic uses previously unidentified or recently discovered vulnerabilities that have not been fixed or patched. In particular: • Microsoft observed Ke3chang in the first quarter of 2021 compromising networks using attacks on Internet-facing web applications running unpatched Microsoft Exchange and SharePoint instances. They also observed Ke3chang attack remote access infrastructure, such as unpatched VPN appliances including the Pulse Secure VPN platform [6]; • Palo Alto Networks’ Unit 42 observed APT27 in April 2019 installing web shells on SharePoint servers to compromise government organisations of two different countries in the Middle East [19]; • According to Check Point Software researchers, a piece of malware used by APT31 was, almost certainly, a clone of a US-origin cyber intrusion tool. Of particular note, the clone was created before the existence of the original malware became widely known [20];

text: • Palo Alto Networks’ Unit 42 reported that they had observed some correlation of APT27 activities with the exploitation of vulnerabilities in ManageEngine ADSelfService Plus – a self-service password management and single sign-on solution (August - September 2021) [21]; • Several entities have observed related threat actors’ exploitation of the Log4shell vulnerability.

text: Spear-phishing

text: Activities by the groups examined involve: • substantial preparation through reconnaissance; • social engineering (e.g. distribution of credible decoy documents, impersonation of partner organisations); • highly targeted spear-phishing activity rather than general-approach phishing campaigns.

text: Some characteristic phishing campaigns have been: • Phishing via legitimate cloud storage platforms. According to Positive Technologies, the APT31 group used in 2021 and 2022 the Yandex.Disk service and Dropbox [22]; • Research from Proofpoint pointed to Ke3chang conducting spear-phishing operations, targeting European entities using lures related to Russia’s war on Ukraine or to activity targeting EU Institutions, bodies and agencies [23].

text: References History

text: 15/02/2023 1.0 Initial Release

type: vagledning

utgivare: enisa