text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: https://www.enisa.europa.eu/topics/national-cyber-security-strategies/ncss-map For more on this see https://www.securityforum.org/tool/protecting-the-crown-jewels/

text: Review of Cyber Hygiene practices

text: December 2016

text: https://www.enisa.europa.eu/publications/etl2015 https://www.gov.uk/government/news/cyber-security-boost-for-uk-firms https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/

text: Review of Cyber Hygiene practices

text: December 2016

text: https://www.enisa.europa.eu/topics/national-cyber-security-strategies/ncss-map Available from https://www.b-ccentre.be/wp-content/uploads/2014/04/B-CCENTRE-BCSG-EN.pdf The guide has been produced by ICC Belgium, FEB, EY, Microsoft, L-SEC, B-CCENTRE and ISACA Belgium Available from https://www.ssi.gouv.fr/uploads/IMG/pdf/guide_hygiene_v1-2-1_en.pdf Agence nationale de la sécurité des systèmes d'information

text: Review of Cyber Hygiene practices

text: December 2016

text: Available from https://www.ssi.gouv.fr/uploads/2015/03/guide_cgpme_bonnes_pratiques.pdf Available from https://www.gov.uk/government/publications/cyber-essentials-scheme-overview

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: e Cy Ongoing research EU ap Hy be sc gie r land ne Scope Gu es Literature review of Cyber ide tic s ac Hygiene guidelines and Pr

text: Skeleton for questionnaireSkeleton for questionnaire Draft Draft QuestionnaireQuestionnaire

text: Survey – Interviews Current situation

text: Identify ContactsIdentify Contacts List of stakeholdersList of stakeholders

text: First Draft

text: Analysis of the findings (final draft)

text: Review of Cyber Hygiene practices

text: December 2016

text: Available from http://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.7621r1.pdf https://www.congress.gov/bill/114th-congress/house-bill/3664 http://eshoo.house.gov/issues/economy/eshoo-bill-vaccinates-against-majority-of-hacks-with-cyber-hygienenetwork-security-management/

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

text: Review of Cyber Hygiene practices

text: December 2016

identifier: Cyber Hygiene

nummer: cyber-hygiene

title: Cyber Hygiene

text: Review of Cyber Hygiene practices DECEMBER 2016 www.enisa.europa.eu European Union Agency For Network and Information Security

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact

text: For media enquires about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2016 Reproduction is authorised provided the source is acknowledged.

text: ISBN 978-92-9204-219-6, DOI 10.2824/352617

text: Table of Contents

text: Executive Summary 5

text: 1. Introduction 6

text: 2. Overview of Leading European Cyber Hygiene Programs 7

text: Belgium 7

text: 2.1.1 Belgian Cyber Security Guide, produced by a public-private sector partnership. 7

text: France 7

text: 2.2.1 40 Essential Measures for a Healthy Network, produced by ANSSI. 7 2.2.2 Guide Des Bonnes Pratiques De L’informatique, produced by CGPME / ANSSI. 8

text: United Kingdom 8

text: 2.3.1 Cyber Essentials, produced by the UK Government. 8

text: 3. Methodology 10

text: 4. United States National Institute of Science and Technology 11

text: 5. Research Findings 12

text: 6. Conclusions 14

text: Cyber hygiene 14

text: 6.1.1 Recommendations 14

text: Good cyber hygiene practices – a standard approach 14

text: 6.2.1 Recommendation 15

text: Cyber Security Awareness 16

text: 6.3.1 Recommendations 17

text: Conflicting Requirements 17

text: 6.4.1 Recommendation 17

text: Combined Public and Private Sector Engagement 17

text: 6.5.1 Recommendation 18

text: Cyber security is perceived to be expensive 18

text: 6.6.1 Recommendations 18

text: Lack of cloud security controls 18

text: 6.7.1 Recommendation 19

text: Risk management 19

text: 6.8.1 Recommendation 19

text: Limited research cover 19

text: 6.9.1 Recommendation 19

text: Annex A: Cyber hygiene Practices Across Europe 20

text: Belgian Cyber Security Guide – 10 Key Security Principles 20

text: Belgian Cyber Security Guide – 10 “Must-Do” Security Actions 20

text: Annex B: Cyber hygiene Practices Across Europe 21

text: ANSSI 40 Essential Measures for a Healthy Network – Control Areas 21

text: CGPME Guide des Bonnes Pratiques De L’informatique (Good Practice Guide) 21

text: Annex C: Cyber hygiene Practices Across Europe 23

text: UK Cyber Essentials Scheme – Control Areas 23

text: Certification Levels 23

text: Certification Process Overview 23

text: Annex D: Cyber hygiene Practices Across Europe 24

text: High Level Recommendations for a Standard Approach to Cyber Hygiene 24

text: D.1.1 Five Key Control Objectives 24 D.1.2 10 Foundational Cyber Hygiene Tasks 24

text: Executive Summary

text: Cyber hygiene plays a critical role across the EU in protecting businesses, but it also provides the foundations for protecting the infrastructure and customer data which businesses rely on. This importance is recognised within the European Union to the extent that almost all the Member States have developed a national cyber security strategy which aims to improve, and enhance, the way organisations protect themselves from cyber threats.

text: Unfortunately, despite the national strategies, this has rarely translated into direct cyber hygiene programs targeted at businesses in a manner which provides guidance around what constitutes good practice and why only three such hygiene programs were found in the EU.

text: The general trend from respondents in this survey was that cyber hygiene may be a good idea, but it is generally quite low priority for most businesses unless there is a pressing, external, need to comply. The most common forms of this are business to business contract terms and governmental regulations. Without this form of pressure, it is unlikely that there will be significant take-up of any cyber hygiene scheme.

text: Businesses, especially small to medium enterprises, perceive they get the most benefit from cyber hygiene programs which allow them to achieve a demonstrable certification and request a demonstrable certification from their supply chain. This generates a measurable return on investment, justifying any resource cost required by the increased security.

text: One key part of security missing from all three European guides, but captured in the USA program, is the use of a risk-based approach. In the European programs there is little if any guidance for business owners with regards to assessing their individual risks, identifying high-risk assets and scaling their security to implement a “crown jewels ” type approach. While this may be challenging for small businesses, excluding it entirely forces organisations into a one-size fits all approach. In turn, this may lead to excessive implementation or operational costs for the cyber security program.

text: The key recommendation from this report is that there needs to be a standard approach to cyber hygiene across all the European Union. The European Commission should set the standard of minimum baseline requirements for cyber security. Additionally, this approach should be flexible enough that Member States can enhance areas which are important to them but should still support cross-border and cross-industry recognition.

text: To be effective this approach needs to be attainable, accreditable and affordable. The affordability is likely to be the most important aspect for any business but all three will work in conjunction to drive engagement.

text: 1. Introduction

text: Cyber attacks are growing in both frequency and impact . The repercussions of security mistakes often end up being headline news and can cause significant harm to the victim organisation. However, there is a perception that only big, global, corporations are at risk and, as a result, thousands of attacks against the Small – Medium business sector go largely unreported.

text: Most successful attacks leverage well known security problems. Reporting from the UK Government’s CESG (the part of GCHQ tasked with protecting the nation) indicates that around 80% of cyber attacks are the result of poor cyber habits within the victim organisations.

text: To address this, a cyber hygiene strategy should be implemented which emphasises the importance of carrying out regular, low impact security measures. This will minimise the risks of becoming a victim of a cyber attack or spreading the impact of a cyber attack to other organisations.

text: In this context, cyber hygiene should be viewed in the same manner as personal hygiene and, once properly integrated into an organisation will be simple daily routines, good behaviours and occasional check ups to make sure the organisations online health is in optimum condition.

text: As businesses across Europe become more connected, with multi-level supply chains for even the smallest organisation, this last point becomes quite significant. The attack on the US Target corporation in 2013, for example, was the result of a compromised vendor within their supply chain . While this has highlighted the need to secure the supply chain, most SMEs struggle to have the resources, access or knowledge to do this properly. In turn, this places a greater emphasis on cyber hygiene to help businesses protect the entire community as well as themselves.

text: This report looks at the leading cyber hygiene programs across the European Union and drills down into a selection of Small – Medium Enterprises to establish their understanding and engagement with the national strategies. Based on the information provided by the organisations, this report also looks to draw conclusions leading to recommendations on how cyber hygiene can be improved across Europe.

text: 2. Overview of Leading European Cyber Hygiene Programs

text: Currently there is no single standard or commonly agreed approach to cyber hygiene across Europe with each of the Member States having their own programs and guidance. Predominately, these programs are aligned to, or driven by, the National Cyber Security Strategies published by each Member State and are at varying levels of maturity.

text: Within the publicly available documents, three programs can be identified as developed enough to give specific advice to businesses. These are the programs from Belgium, France and the United Kingdom.

text: In addition to this, the United States National Institute of Science & Technology (NIST) produces a guide for small business security and this is reviewed at a high level below.

text: Belgium 2.1.1 Belgian Cyber Security Guide , produced by a public-private sector partnership .

text: This is a high level, informational guide designed to provide advice on good practices around cyber security controls. The guide is designed to be industry and technology agnostic. The publicly available version of this document does not carry any indication of when it was last published or when a change is due.

text: The guide is split into two main parts. The first part identifies 10 Key Security Principles which should be adopted by every business (See Annexe A). This is followed by 10 “must do” security actions which look to turn the principles into more accessible guidance. Following this, there is a self-assessment (SA) questionnaire which aims to allow users to drill into each principle/action area to get a better view of what they need to consider for their organisation. There are 16 high level question areas with 5 questions in each, and users can provide 3 answers broadly equating to “we do this properly, we could

text: improve, and we are bad at this.”

text: To further facilitate ease of use, each SA question is clearly linked to the relevant principles and must-do actions.

text: Although there is no formal, externally verified, certification scheme linked to this Guide, it is possible that the SA questions could be used as an attestation document during a security assessment exercise.

text: France 2.2.1 40 Essential Measures for a Healthy Network , produced by ANSSI .

text: This is a foundational guide covering 13 control areas and seeking to drive a defence in depth approach. Each of the essential measures are effectively rules building what ANSSI believes is the minimum baseline for security. There is some latitude available to end users as the guide does not mandate

text: specific implementations or technology choices. Initially produced in 2013, the 40 measures are due for their next update in 2017.

text: The control areas chosen by ANSSI (see Annexe B) are geared around standard office systems (separate guidance is available for SCADA / ICS systems) and are driven by ANSSI research which indicates that following these rules would have prevented a significant number of attacks they have dealt with.

text: ANSSI currently have no mechanism by which organisations can verify compliance with the 40 essential measures or use these rules to demonstrate good cyber hygiene practices to other businesses.

text: 2.2.2 Guide Des Bonnes Pratiques De L’informatique , produced by CGPME / ANSSI.

text: Because of the size and perceived complexity of the 40 rules, a cut down version of 12 rules has been produced to assist small to medium size enterprises in France. Unlike the 40 Essential Measures document, this is only publicly available in French which limits is applicability across Europe.

text: The good practice guide is accessible to both IT professionals and non-experts alike. This is a good reflection of the variety among the small to medium enterprise sector and each section (rule) starts with a scenario designed to be immediately relatable for the small business owner.

text: In the same manner as the 40 essential measures, there is no accreditation, verification or compliance assessment scheme for the 12 rules within the good practice guide.

text: United Kingdom 2.3.1 Cyber Essentials , produced by the UK Government.

text: The UK Government, supported by the Information Assurance for Small and Medium Enterprises (IASME) consortium and the Information Security Forum (ISF), developed the Cyber Essentials guidance to identify the basic technical controls required to defeat the vast majority (estimated to be around 80%) of cyber attacks detected by the national security agencies.

text: Highlighting the “essentials” element of the scheme, there are only 5 control areas (see Annexe C) and the emphasis is very much on physical infrastructure controls – cloud services and application layer security controls are largely excluded from the scheme.

text: Cyber Essentials has been designed to provide a “certification” scheme by which companies adhering to the guidance can be verified and demonstrate compliance to customers and business partners. There are currently two levels of certification – a self-attestation version, similar to the Payment Card Industry SAQ, and an independently technically verified version (called Cyber Essentials Plus). Successful certification allows businesses to put the Cyber Essentials logos on their business documents & websites.

text: Certification is handled by the private sector. Currently four accreditation bodies are appointed by the Government to manage the activity of certification bodies, who in turn are responsible for delivery of certification services to the end customer.

text: Launched in June 2014, certification against the Cyber Essentials scheme became a mandatory requirement for Government contracts handling sensitive information in October 2014. Partly as a result of this, as of October 2016 there are approximately 4000 certified companies.

text: 3. Methodology

text: This report uses a two-stage research approach. In the first part, a desktop search was conducted to establish what information was publicly available regarding cyber hygiene programs. This was followed up by engagement with representatives from ANSSI and the UK government to get specific details on the national schemes.

text: The second stage was a series of interviews with small-medium businesses in the UK to establish the level of engagement with the national cyber hygiene program and the level of understanding within the business around general cyber security issues. These interviews used a pre-determined questionnaire to standardise responses. To maximise the value from the second stage, businesses were selected from a range of industries and geographical regions within the UK. To encourage open and honest responses, it was agreed with the interviewees that their names, and their business identities, would be withheld from the final report.

text: On completion of the interviews a qualitative assessment was carried out to establish patterns within the responses and determine overlaps between industry sectors and organisational size.

text: 4. United States National Institute of Science and Technology

text: In November 2016, the US National Institute of Science and Technology (NIST) published NISTIR 7621 Revision 1 “Small Business Information Security: the fundamentals .”

text: This publication is a guide to help small businesses apply basic security controls to their information, systems and networks. The guide itself is organised into sections which assist the user on a logical flow through a risk managed approach to cyber security.

text: In general, this program contains enough advice for reasonably skilled IT workers in a small business to apply some good practice controls (e.g. passwords should be set to at least 12 characters) without forcing the business to implement a specific technology.

text: Unusually for a small business cyber security program, this guidance also includes advice on risk management and worksheets. These assist the business in determining the value of their information assets and prioritising security controls in a reasonably straight forward manner.

text: Like the Belgian and French guides, the NIST document is an advisory publication. There is no associated scheme which allows businesses to certify their compliance or use certifications to reduce the supplier security assessment burden.

text: In October 2016 legislation was introduced to combat cyber attacks against U.S. computer networks. 14 15 The Promoting Good Cyber Hygiene Act builds on President Obama’s 2013 Executive Order by instructing the National Institute of Standards and Technology, in consultation with the Federal Trade Commission and the Department of Homeland Security, to establish voluntary best practices for network security, such as not using a default password and regularly applying software updates. Figure 1: How risk is determined for businesses

text: 5. Research Findings

text: Analysis of the questionnaires has led to the following key findings:  There is no unified, pan European approach to cyber hygiene programs.  While there isn’t a consistent set of requirements for a cyber hygiene program, there are sufficient overlaps to identify some key control areas which should be included in any program.  None of the UK SME’s interviewed initially recognised the term cyber hygiene and this had to be explained to put the questionnaire in context.  Each nation within Europe has its own Cyber Security strategy which drives the direction of cyber hygiene and as would be expected from the topic, there are overlaps in the choice of controls. However the approval of the NIS Directive will pave the way towards homogeneous cyber security strategy’s across the European Union.  There is no simple mechanism by which a business in one Member State can demonstrate cyber hygiene compliance to a business/customer in a different Member State without adhering to multiple programs simultaneously.  The Member State guidance around cyber hygiene is almost entirely advisory with no obligations to implement the controls or sanctions for any security failures – with the exception of failures leading to personal data breaches.  The UK Government has implemented a policy of requiring compliance with its cyber hygiene program (cyber essentials) for businesses delivering services which has driven adoption of the program.  Every organisation questioned identified the need to factor in the cost of a cyber hygiene program against the perceived benefits. In some instances, this led to decisions against adopting a security program.  Every SME interviewed who has implemented a cyber hygiene program, has done so because of a legal or contractual requirement to do so. None of the organisations interviewed have implemented good security practices to simply protect themselves properly.  There is a direct correlation between the size of the organisation and the awareness of IT Security risks. Once an organisation becomes large enough to dedicate someone to manage IT, there appears to be at least a baseline awareness of good security practices.  Small businesses are unwittingly carrying a significant risk regarding their cyber hygiene practices and appear to think it doesn’t affect them because they are so small.  SMEs who operate outside traditional IT-based industries have very limited awareness of the importance of IT to their business, this is especially acute when considering the impact of a security incident.

text:  The UK has a government backed cyber hygiene program, which is mandatory for most public-sector contracts and which shows strong public sector support. Unfortunately however there is still very limited awareness of the scheme at the time of writing.  The UK Cyber Security Forum scheme is a promising development and should increase cyber hygiene awareness within the SME sector, but this still has limited penetration.  The main pain point for all businesses is finding a simple, cost effective way to improve their security which can be understood by non-technical people.  The main additional pain point for businesses as they grow in both size and structure, is securing the supply chain.

text: 6. Conclusions

text: Cyber hygiene

text: Cyber hygiene is a fundamental principle relating to information security and, as the analogy with personal hygiene shows, is the equivalent of establishing simple routine measures to minimise the risks from cyber threats. The underlying assumption is that good cyber hygiene practices can drive increased immunity across businesses reducing the risk that one vulnerable organisation will be used to either mount attacks or compromise a supply chain.

text: While this appears well understood at the national level, and almost all European Union Member States have now developed a National Cyber Security Strategy, this does not translate well to the small – medium enterprise sector.

text: The variation between national standards leads to uncertainty and, given the overlap between both Member State programs and global security standards, confusion over what needs to be implemented.

text: This is a critical issue as a uniform approach to cyber hygiene which allowed businesses to establish security trust across national borders would drive improvements across the board and effectively develop a cyber version of increased immunity to common attacks.

text: 6.1.1 Recommendations

text: The European Commission should promote cyber hygiene schemes, particularly those targeting Small and Medium sized Enterprises, throughout the EU. In addition, the Commission should foster a common approach to the core messages across all member States.

text: ENISA should consider establishing a pan-European set of guidelines to act as the minimum baseline requirements for cyber hygiene and would allow Member States to build their own programs on top of this.

text: To provide value, these guidelines must enable companies (or government bodies) in one Member State to trust the implementation of the controls by a company (or government) in another.

text: Good cyber hygiene practices – a standard approach

text: Overall, the existing schemes present three different views of cyber hygiene with enough areas of overlap to indicate what should be considered general good practice.

text: Unfortunately, these good practices are rarely fully implemented across business sectors and this creates a gulf between the “theoretical” guidance from the standards and the “practical” experience of small-medium business owners and managers.

text: This has led to some confusion between standards. In the UK this is most noticeable when respondents compare Cyber Essentials, which is essentially a good practice guide, with ISO 27001 which is a way of assessing an Information Security Management System. Although some appear to think there is a decision to be made between these standards, the reality is compliance with one, assists compliance with the other.

text: 6.2.1 Recommendation

text: If implemented, the standard approach to cyber hygiene should cover the following main topic areas, which would also give scope for individualisation by Member States or industry sectors, while retaining the ability to establish compliance regimes:

text: 1. Protect the perimeter 2. Protect the network 3. Protect individual devices 4. Use the cloud in a secure manner 5. Protect the supply chain

text: Based on these five areas, one approach, similar to the existing regimes, would be to break down into 10 action points:

text: 7. Regularly back up data and test it can be restored

text: 8. Establish an incident response plan

text: 9. Enforce similar levels of security across the supply chain

text: 10. Ensure suitable security controls in any service agreements (including cloud services)

text: In order that small businesses would consider adopting this standard, there are three key aspects which must be considered during the creation of the controls:

text: 6.2.1.1 Attainable

text: The good practice requirements should be measures which can be implemented by businesses with limited, or no, dedicated IT Security personnel. It is not realistic to expect a small business to be able to hire a coding expert to deploy bespoke monitoring and alerting scripts, and this level of detail is excessive for a foundational standard.

text: Good practice controls should be aimed at measures which can be achieved by standard operating systems or applications, or through minimal business processes. This can be enhanced with technology for organisations facing a more powerful threat, but the enhancements should be optional to the standard.

text: 6.2.1.2 Accreditable

text: The real value for most businesses from a cyber hygiene program is the benefits it can bring. This can be as simple as a way of advertising to customers and clients that they take security seriously, therefore acting as a market differentiator, or as complicated as allowing them to streamline the security aspects of due diligence checks.

text: In the UK, the primary driver of Cyber Essentials is its role in allowing businesses to retain and deliver contracts with various government agencies. This drives two benefits: the cost of certification is offset

text: by the value of the contract; and the government agency can reduce the resource burden of accreditation.

text: By being accreditable, a cyber hygiene program provides immediate benefits and encourages businesses to pass on the improved security in their own contracts. In the European Union context, this would require the accreditation system to allow cross border checks to ensure equivalence independent of Member State requirements.

text: 6.2.1.3 Affordable

text: Cost is likely to be the ultimate deciding factor for any organisation considering adopting a cyber hygiene program. While the lifetime cost of any program might be significantly less than the cost of a breach, this is unlikely to sway small businesses concerned about immediate cashflow.

text: Engagement from the smaller businesses will need more than guidance about return on investment, it will need the costs of compliance to be low enough that any impact is negligible.

text: In practical terms, there are three aspects to the cost of a scheme:

text: Cost of Implementation – this cost impacts any organisation looking to adhere to the requirements and

text: is manifest in any new technology, service agreements or support contracts required. It is difficult to anticipate what this will be, but by reducing the need for specific applications or tools, this can be minimised. A standard which makes extensive use of built in controls and permits free choice in any new tooling, will also minimise the implementation costs.

text: Cost of Accreditation – this is a cost which is only carried by organisations who need to achieve

text: certification for a business purpose. Thus, the cost is likely to be compared against the possible benefits the certification brings. In the UK, accreditation to the Cyber Essentials scheme costs £300 (approximately €350) per year which may seem trivial to a company bidding on a five-figure government contract. Ultimately in a publicly managed scheme the cost of accreditation will be dictated by the value the certification offers and the cost of administering a system.

text: Cost of ongoing maintenance – this is the cost necessary to maintain the scheme and to ensure that it is

text: kept up to date and reflects changes in the threat environment. This is a long-term commitment that needs to be factored into the business plans.

text: Cyber Security Awareness

text: Organisations without a dedicated, and separate, IT function demonstrated very limited understanding around cyber security in general. Where organisations operate on a business to business line, there is a tendency to implement controls as required by contracts and for business to customer organisations, there doesn’t appear to be a clear driver around why security adds value.

text: Even though the UK Government is trying to drive Cyber Essentials, there is almost no awareness of the program within small businesses unless they have already attempted to gain government contracts. This indicates that while the scheme may be effective, it isn’t driving good practice across all industries.

text: The current trend within the national awareness programs is to have the information available on request and it was apparent from the small businesses that most do not have the awareness to seek out advice, even if they had the technical knowledge to consume it.

text: This issue is highlighted by a small retail respondent who thought cyber security didn’t matter because they didn’t sell goods online. They were not aware of the risks from an attacker using their administrative computers to steal funds, change orders or attack other businesses.

text: 6.3.1 Recommendations

text: Member States should be encouraged to have a stated policy of driving awareness to the small-medium business sector rather than rely on providing information for those who search for it. If given more support, a model like the UK Cyber Security Forum / Cyber Security Clusters may achieve this at a grassroots level.

text: This should include educating the SME sector to understand how important all technology assets are to a modern business and on the importance of good practices on all IT assets.

text: Conflicting Requirements

text: Although there is foundational overlap between the various national standards, there are sufficient differences that some organisations, especially those without dedicated IT resources, find it challenging to map between standards. This creates challenges for organisations seeking to deliver goods or services across geographical borders as there is a perception that compliance in one country isn’t the same as compliance in another.

text: This leads to an additional difficulty faced by companies with cross border supply chains. Supplier security assessments become resource intensive, time consuming and costly with limited confidence as to the level of risk management they provide.

text: For a small business, the difficulty in properly verifying supplier security frequently leads to this being neglected without a real understanding of the associated risks.

text: One positive point raised about the UK Cyber Essentials scheme is that the process makes it easier for businesses to rely on the certification body to carry out the checks. This appears to have been the main driver for the UK government mandating certification for companies winning defence contracts.

text: 6.4.1 Recommendation

text: Any EU wide cyber hygiene scheme should have a mechanism for companies to certify their compliance with the scheme in a manner which is trusted by other companies and government bodies. This immediately generates value for both the company getting certification and the company requiring it across the supply chain.

text: Combined Public and Private Sector Engagement

text: Most organisations interviewed were unaware of the Government established cyber hygiene schemes and the existence of Cyber Essentials was not enough for them to become interested. Additionally, there appears to be little appetite to enhance security for the sole purpose of protecting the organisation.

text: The primary drivers for businesses to adopt good cyber hygiene practices were almost entirely in direct response to a set of contractual requirements. Given the lack of interest in self-protection, it is therefore concluded that the most effective way to encourage good cyber hygiene is to ensure it is enshrined in unavoidable obligations.

text: It was also noted that the more mature an organisation appeared to be with regards to cyber security, the more likely they would force security controls across their supply chain through the use of enforceable contractual clauses.

text: 6.5.1 Recommendation

text: A two pronged approach should be used to maximise engagement and minimise perception that this is government overreach.

text: Member State governments should be encouraged to establish requirements around the minimum viable security an organisation should take, aligned to the cyber hygiene standards recommended above.

text: However, private sector organisations should also be engaged to embed good cyber hygiene into standard contract terms. Ideally this would be through engagement with business groups, chambers of commerce and similar structures. This may be assisted if the accreditation of the standard is managed by a private sector body with Member State government’s approval.

text: Cyber security is perceived to be expensive

text: Profitability and profit margins are an overwhelming concern for every business interviewed. Most noticeable within the small business sector is the perception that following any sort of good security practices will erode profits.

text: This is possibly driven by the effort organisations have to absorb to achieve ISO9001 certification and the headline costs of ISO27001 certification which can be unacceptable to a business operating on small margins.

text: Based on the technological awareness of the organisations surveyed, it is also concluded that this perception of cost is driven by the belief that good security practices need expensive tools or skilled professionals on the payroll.

text: 6.6.1 Recommendations

text: Any Member State or pan-European cyber hygiene standard should strive to minimise the requirement for expensive security controls.

text: Effort should be made to avoid specifying a particular technology, and controls should be achievable using built in Operating System tools wherever possible.

text: Lack of cloud security controls

text: All the existing national cyber hygiene programs focus very heavily on managing and protecting physical infrastructure. This is most apparent in the French and UK programs where most controls assume the business is directly managing the assets.

text: This creates a problem for organisations who want to adhere to the guidance but have adopted a cloudbased service model where they aren’t directly able to carry out administrative tasks such as ensuring patches are applied.

text: While security professionals may quickly realise how to adapt the programs to service environments, this is less likely for small businesses without specialised resources.

text: 6.7.1 Recommendation

text: ENISA should advise Member States to adopt the Cloud Security Guide for SME s as part of their national cyber hygiene programs. This can enable businesses looking to migrate into cloud services to ensure good practices are verified in advance and confirmed by contractual commitments.

text: Risk management

text: The three European programs provide a generic set of controls with, in the case of the Belgian & UK, a set of requirements to meet each control. While this can be effective it does set an arbitrary baseline and a business owner may not feel they have latitude when it comes to implementing a security control.

text: This effectively eliminates the function of risk management within the cyber hygiene programs and may lead to organisations taking an all-or-nothing approach.

text: While this may only be applicable to a limited number of SMEs, it has the potential to undermine adoption and lead to users believing the program is more a compliance exercise then adding genuine security value.

text: 6.8.1 Recommendation

text: Any standard approach to cyber hygiene needs to advise users on risk management and allow a scaled response to security threats. Ideally this would be based on the US NIST model of advising the users on how to grade their assets then giving them latitude to create defence in depth with their security controls.

text: Limited research cover

text: The current state with fragmented cyber hygiene programs made it challenging for this research to cover more than a small sample of Member States.

text: 6.9.1 Recommendation

text: Further research to identify the understanding of cyber hygiene and resulting approach to security should be conducted to specifically target businesses in Member States without a documented cyber hygiene program.

text: Annex A: Cyber hygiene Practices Across Europe

text: Belgian Cyber Security Guide – 10 Key Security Principles

text: Principle 1: Look beyond the technology Principle 2: Compliance is not enough Principle 3: Translate your security ambition into an information security policy Principle 4: Ensure top management commitment Principle 5: Create a visible security role in your company and embed personal responsibility Principle 6: Remain secure when you outsource Principle 7: Ensure security is an enabler for innovation Principle 8: Keep challenging yourself Principle 9: Maintain focus Principle 10: Be prepared to handle security incidents

text: Belgian Cyber Security Guide – 10 “Must-Do” Security Actions

text: Action 1: Implement user education & awareness Action 2: Keep systems up to date Action 3: Protect information Action 4: Apply mobile device security Action 5: Only give access to information on a “need to know” basis Action 6: Enforce safe surfing rules Action 7: Use strong passwords and keep them safe Action 8: Make and check backup copies of business data and information Action 9: Apply a layered approach against viruses and other malware Action 10: Prevent, detect and act

text: Annex B: Cyber hygiene Practices Across Europe

text: ANSSI 40 Essential Measures for a Healthy Network – Control Areas

text: The ANSSI 40 measures are broken down into 13 control areas as follows:

text: 1. Know the System and its Users 2. Control the Network 3. Upgrade Software 4. Authenticate the User 5. Secure Computer Terminals 6. Secure the Inside of the Network 7. Protect the Internal Network from the Internet 8. Monitor Systems 9. Secure Network Administration 10. Control Access to the Premises and Physical Security

text: 11. Organise Response in the Event of an Incident

text: 12. Raise Awareness

text: 13. Carry Out a Security Audit

text: CGPME Guide des Bonnes Pratiques De L’informatique (Good Practice Guide)

text: The 12 essential rules are in the following areas (with approximate translations from French)

text: 1. Choisir avec soin ses mots de passe Choose your passwords carefully 2. Mettre à jour régulièrement vos Regularly updates your software logiciels 3. Bien connaître ses utilisateurs et ses Know your users and providers prestataires 4. Eﬀectuer des sauvegardes régulières Make regular backups 5. Sécuriser l’accès Wi-Fi de votre Secure your company's Wi-Fi access entreprise 6. Être aussi prudent avec son ordiphone Secure your mobile devices (smartphone) ou sa tablette qu’avec (Smartphones / Tablets) son ordinateur 7. Protéger ses données lors de ses Protect your data while on the move déplacements 8. Être prudent lors de l’utilisation de sa Be careful when using your mail messagerie

text: 9. Télécharger ses programmes sur les Download software from official sites officiels des éditeurs sites 10. Être vigilant lors d’un paiement sur Be vigilant when paying over the Internet Internet 11. Séparer les usages personnels des Separate personal and business use usages professionnels 12. Prendre soin de ses informations Take care of personal, professional personnelles, professionnelles et de son information and digital identities. identité numérique

text: Annex C: Cyber hygiene Practices Across Europe

text: UK Cyber Essentials Scheme – Control Areas

text: 1. Boundary Firewalls and Internet Gateways 2. Secure Configuration 3. User Access Control 4. Malware Protection 5. Patch Management

text: Certification Levels

text: Cyber Essentials – Self Assessment Form submitted with evidence to Certification Body

text: Cyber Essentials Plus – As above plus independent technical verification

text: Certification Process Overview Certification Submit to Complete Self Body notify Certification Certification Assessment Accreditation Granted Body Body

text: Annex D: Cyber hygiene Practices Across Europe

text: High Level Recommendations for a Standard Approach to Cyber Hygiene D.1.1 Five Key Control Objectives

text: D.1.2 10 Foundational Cyber Hygiene Tasks

text: 1. Have a record of all hardware so you know what your estate looks like 2. Have a record of all software to ensure it is properly patched 3. Utilise secure configuration / hardening guides for all devices 4. Manage data in and out of your network 5. Scan all incoming emails 6. Minimise administrative accounts 7. Regularly back up data and test it can be restored 8. Establish an incident response plan 9. Enforce similar levels of security across the supply chain 10. Ensure suitable security controls in any service agreements (including cloud services)

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece TP-02-17-008-EN-N

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-219-6 Tel: +30 28 14 40 9710 DOI: 10.2824/352617 info@enisa.europa.eu www.enisa.europa.eu


text: These are currently the security breaches and personal data breaches which occur related to the provision of public electronic communications networks and services. Public electronic communication networks and services are networks and services which offer or facilitate electronic communications to the public. Examples are fixed telephony, mobile telephony and internet access to the general public. Internal company networks, for example, are not in the scope of this legislation.

text: In a number of countries, the competent body for notification about personal data breaches related to electronic communications networks and services is not the telecom regulator, but a data protection authority or other agency.

text: This provision extends personal data breach notifications beyond the electronic communications sector.

text: In the recommendation for the technical implementation of

text: Article 4

text: , unintelligible data is described as data that has either been encrypted (asymmetric or symmetric), or hashed. Trust service means any electronic service consisting in the creation, verification, validation, handling and preservation of electronic signatures, electronic seals, electronic time stamps, electronic documents, electronic delivery services, website authentication, and electronic certificates, including certificates for electronic signature and for electronic seals.

text: Network or Security measures 2 Victims service Notification provider 1 Informing 3 Summary reporting

text: Competent 4 national 1 authority 4 6 5

text: National Public authorities EC and ENISA abroad and ENISA

text: Technical and organisational security measures are an important aspect in all the legislation discussed in Section 2 Although out of scope of this paper, CERTs are crucial capabilities to be able to limit the impact of cyber security incidents and a key activity of ENISA is to support EU countries in setting up well-functioning CERTs and to foster collaboration and information sharing between the different CERTs.

text: - Art 13a of the Framework directive.

text: Network or

text: Art 4

text: Victims service - Art 4 of the e-Privacy directive.

text: Art 32

text: - Art 30, 31, 32 of the proposed Data

text: Art 13a, Art 4,

text: Art 15, Art 30 protection regulation.

text: Art 13a, Art 4,

text: Art 15, Art 31 - Art 15 of the proposed regulation on esignatures and e-identities

text: Art 13a, Art 4 national Art 13a, Art 4, Art 15 authority Art 15, Art 30

text: Art 13a, Art 15 Art 13a, Art 15 Art 13a, Art 15

text: The Dagmar storm caused power cuts which led to large outages which fall under

text: Article 13

text: a: To be precise in the article this would be called a breach of integrity of the networks affecting the continuity of supply of electronic communication services over these networks. The EC and ENISA received summary incident reports from three countries as part of

text: Article 13

text: a’s annual incident reporting to ENISA and the EC. The Diginotar incident was a security breach at a Certificate Authority which would fall under the proposed

text: Article 15

text: To give a simple example, access control to databases is an important measure under both

text: Article 13

text: a and 4.

text: ENISA will address synchronization of

text: Article 13

text: a and

text: Article 4

text: security measures, in collaboration with the national authorities, as part of ENISA’s 2013 work program.

text: For example by adopting a two-staged approach, where brief reports with impact estimates are sent within hours, while longer reports with exact figures are sent days after the incidents have been resolved.

text: In the context of

text: Article 13

text: a a number of countries are developing online reporting tools with interfaces to incident response systems of providers, and also ENISA is developing an automated tool for EU-level reporting which provides important functionality for national regulators.

identifier: Cyber Incident Reporting in the EU

nummer: cyber-incident-reporting-in-the-eu

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Cyber Incident Reporting in the EU

serie: rapporter

text: An overview of security articles in EU legislation August 2012

type: rubrik

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

type: stycke

text: Authors

text: Dr. Marnix Dekker, Christoffer Karsberg, Barbara Daskala

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu. For media enquires about this paper, please use press@enisa.europa.eu.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of theart and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

text: Cyber Incident Reporting in the EU 1 An overview of security articles in EU legislation

text: 1 Introduction

text: Reliable and secure internet and electronic communications are now central to the whole economy and society in general. Cyber security incidents can have a large impact on individual users, on the economy and society in general. We give five examples:

text: 1. In June 2012 6.5 million (SHA-1) hashed passwords of a large business-focussed social network appeared on public hacker forums. The impact of the breach is not fully known, but millions of users were urged to change their passwords and their personal data could be at risk.

text: 2. In December 2011, the storm Dagmar affected power supplies to electronic communication networks in Norway, Sweden and Finland. As a result millions of users were without telephony or internet for up to two weeks.

text: 3. In October 2011 there was a failure in the UK datacentre of a large smartphone vendor. As a result millions of users across the EU and globally could not send or receive emails, which severely affected the financial sector.

text: 4. Over the summer 2011, a Dutch certificate authority experienced a security breach, allowing attackers to generate fake PKI certificates. The fake certificates, the result of the breach, were used to wiretap the online communications of around half a million Iranian citizens. Following the breach many Dutch e-government websites were offline or declared unsafe to visit.

text: 5. In April 2010 a Chinese telecom provider hijacked 15% of the world’s internet traffic through Chinese servers for 20 minutes, routing traffic to some large e-commerce sites, such as www.amazon.de and www.dell.com as well as the .mil and .gov domains, et cetera. As a result, the internet communications of millions of users were exposed (to eavesdropping). The large outages and large data breaches receive extensive media coverage, showing the importance of cyber security in society. Many breaches, however, remain undetected and if detected, are not reported to authorities and not known to the public. There is no overall view across the digital society of the incidents, the root causes or the impact for users. Lack of transparency and lack of information about incidents makes it difficult for policy makers to understand the overall impact, the root causes and possible interdependencies. It also complicates the efforts in the industry to understand and address cyber security incidents. And finally, it leaves customers in the dark about the frequency and impact of cyber incidents. Legislation can play an important role here. For some types of incidents , there is now an EU directive, which has been transposed in national laws obliging providers to report incidents to a national authority. In this paper we give an overview of different articles of EU legislation on cyber security incident reporting and prevention and we show how they are related. We conclude with some general remarks about incident reporting across the European digital society.

text: 2 Cyber Incident Reporting in the EU An overview of security articles in EU legislation

text: 2 Security articles in EU legislation

text: In recent years a number of EU Member States recognized the need for preventing cyber security incidents and they had started up, for example, voluntary or mandatory incident reporting schemes to create more transparency about cyber security incidents. In these countries often the focus was on the vital infrastructure for the digital society; the electronic communication networks and services. Not all EU countries adopted legislation on security measures and incident reporting and there were big differences between the different national approaches. This had two main disadvantages: ● Cyber security incidents in one country may well have an impact across national borders. The Diginotar incident shows how national incidents can have a cross-border impact. This means that to improve security across the EU, all countries should agree on common principles. ● Furthermore, service providers often operate across EU countries, especially telecom companies and internet service providers. It is cumbersome for these providers to have to adapt their systems to different national requirements. A harmonized legislation across the EU avoids digital borders and allows for a level-playing field for providers across the EU market. To address these issues, the EU countries, through the European commission (EC), have been working together on common EU wide legislation with the objective to have consistency and harmonization across the EU. In the following paragraphs we go over existing and proposed EU legislation on security measures, breach notification and incident reporting.

text: Article 13

text: a of the Framework directive: “Security and Integrity”

text: The Telecoms reform passed into law in 2009, adds

text: Article 13

text: a to the Framework directive, regarding security and integrity of public electronic communication networks and services.

text: Article 13

text: a states: ● Providers of public communication networks and services should take measures to guarantee security and integrity (i.e. availability) of their networks. ● Providers must report to competent national authorities about significant security breaches. ● National authorities should inform ENISA and authorities abroad when necessary, for example in case of incidents with impact across borders. ● National authorities should report to ENISA and the EC about the incident reports annually.

text: Article 13

text: a also says that the EC may issue more detailed implementation requirements if needed, taking into account ENISA’s opinion. The EC, ENISA, and the national regulators have been collaborating for the past 2 years to implement

text: Article 13

text: a and to agree on a single set of security measures for the European electronic communications sector and a modality for reporting about security breaches in the electronic communications sector to authorities abroad, to ENISA and the EC. In May 2012 ENISA received the first set of annual reports from Member States, concerning incident that occurred in 2011. ENISA received 51 incident reports about large incidents, which exceeded an agreed impact threshold. The reports describe services affected, number of users affected, duration, root causes, actions taken and lessons learnt. While nationally incident reporting is implemented differently, with different procedures, thresholds, et cetera, nearly all national regulators use a common procedure, a common template and common thresholds for reporting to the EC and ENISA.

text: Cyber Incident Reporting in the EU 3 An overview of security articles in EU legislation

text: Despite the fact that this first set of incident reports is incomplete, as some countries had not yet fully implemented national incident reporting schemes, these reports already provide valuable insights into the types of threats facing the European electronic communications sector. The information from the incident reports is used, for example, as input to the European Cyber Security Strategy and the pan- European Cyber Security exercises. ENISA will publish a summary of the received annual incident reports in September 2012, and from spring 2013 annually.

text: 2.2 Article 4 of the e-Privacy directive: “Security of processing”

text: The Telecoms reform also changed the e-Privacy Directive, which addresses data protection and privacy related to the provision of public electronic communication networks or services. Article 4 of the e-Privacy directive requires providers to notify personal data breaches to the competent authority and subscribers concerned, without undue delay. The obligations for providers are: ● to take appropriate technical and organisational measures to ensure security of services, ● to notify personal data breaches to the competent national authority, ● to notify data breaches to the subscribers or individuals concerned, when the personal data breach is likely to adversely affect their privacy, and ● to keep an inventory of personal data breaches, including the facts surrounding the breaches, the impact and the remedial actions taken.

text: Article 4

text: also says that the EC may issue technical implementing measures regarding the notification formats and procedures, in consultation with the

text: Article 29

text: Working Party, the European Data Protection Supervisor (EDPS) and ENISA. In 2011, ENISA started an expert group, including experts from national data protection authorities, industry, and EDPS, to draft recommendations for the technical implementation of

text: Article 4

text: 2.3 Articles 30, 31 and 32 of the Data Protection regulation

text: The EC has proposed to reform the current European data protection framework (Directive

text: ), and has proposed an EU regulation on data protection. The regulation regards organisations that are processing personal data, regardless of the business sector the organisation is in. Security measures and personal data breach notifications are addressed in Articles

text: and

text: : ● Organisations processing personal data must take appropriate technical and organisational security measures to ensure security appropriate to the risks presented by the processing. ● For all business sectors the obligation to notify personal data breaches becomes mandatory . ● Personal data breaches must be notified to a competent national authority without undue delay and, where feasible, within 24 hours, or else a justification should be provided.

text: 4 Cyber Incident Reporting in the EU An overview of security articles in EU legislation

text: ● Personal data breaches must be notified to individuals if it is likely there will be an impact on 5 their privacy. If the breached data was unintelligible , notification is not required.

text: 2.4 Article 15 of the e-Sig and e-ID regulation: “Security requirements”

text: The EC recently released a proposal for a regulation on electronic identification and trust services for electronic transactions in the internal market..

text: Article 15

text: in this proposal introduces

text: obligations concerning security measures and incident reporting: ● Trust service providers must implement appropriate technical and organisational measures for the security of their activities. ● Trust service providers must notify competent supervisory bodies and other relevant authorities of any security breaches and where appropriate, national supervisory bodies must inform supervisory bodies in other EU countries and ENISA about security breaches. ● The supervisory body may, directly or via the service provider concerned, inform the public. ● The supervisory body sends a summary of breaches to ENISA and the EC.

text: Article 15

text: is similar to

text: Article 13

text: a of the Framework directive (see References).

text: 2.5 EU Cyber Security Strategy

text: The European Commission is developing a European Cyber Security Strategy. The roadmap for the strategy refers to

text: Article 13

text: a and mentions extending

text: Article 13

text: a to other business sectors. The Commission has indicated that there will be five main strands: ● Capabilities and response networks, for sharing information with public and private sector ● Governance structure including the national competent authorities, to address incidents and develop an EU contingency plan. ● Incident reporting for critical sectors like energy, water, finance and transport. ● Pre-commercial procurement of security technology and public-private partnerships to improve security across the single market ● Global cooperation, to address global interdependencies and the global supply chain.

text: A European Cyber Security Strategy is an important step to increase transparency about incidents, and ultimately to prevent them or limit their impact. Cyber Incident Reporting in the EU 5 An overview of security articles in EU legislation

text: 3 A model of security articles

text: In this section we show the overall picture of the different security articles discussed in Section 2.

text: 3.1 General model

text: The diagram in Figure 1 shows the actions of the actors as described in the different security articles. In particular it shows the issuing of security measures to prevent breaches, as well as the reports about breaches.

text: We stress that this overall picture is not an exact description of the individual security articles, but intended as an overall view. We refer the reader to Section 3.2 for details about what is different across the different articles. Figure 1: Overall view of actions and information flows

text: A simplification in this diagram is that we describe only one single national authority collecting breach notifications and incident reports. In practice multiple national authorities may be involved when dealing with security and privacy breaches. It is at the discretion of national governments to assign tasks to competent government bodies, depending on national circumstances. For example, in some countries security and privacy breaches regarding electronic communication services are all dealt with by the national telecom regulator acting as a single point of contact for the electronic communications sector. In other countries, the privacy breaches are reported separately to the data protection authorities, or to a national cyber security centre.

text: We go over the numbered arrows in the diagram, step by step:

text: 6 Cyber Incident Reporting in the EU An overview of security articles in EU legislation

text: 1. (blue dotted arrows) National authorities require providers to take appropriate technical and organisational security measures, taking into account the state of the art in security technology. To ensure that these security measures are taken, national authorities may audit providers, or ask them to do a self-assessment or undergo an audit. This step can be seen as one of the main objectives of this legislation, to ensure that appropriate measures are being taken, across the EU .

text: At some point in time an incident is detected at a network or service provider. The incident may be a security breach, a personal data breach or both (e.g. a security breach resulting in a personal data breach). The provider starts to respond to the incident and if needed, the provider should contact technical experts or national computer emergency response teams (CERTs) to address the incident . 2. (red arrow) The provider notifies users affected by the breach (victims) 3. (red arrow) The provider notifies competent national authorities about the breach. An initial quick notification is followed by more detailed incident reports at a later stage, containing impact analysis, root causes, actions taken, lessons learnt, et cetera. 4. (black dash-dotted arrow) When necessary the national authority informs the public. Alternatively, depending on the situation, the national authority may require the provider to inform the public. 5. (black dash-dotted arrow) Additionally, when relevant, the national authority informs authorities abroad and ENISA. For example, in case a breach has a cross-border impact.

text: 6. (black dashed arrow) Later, on an annual basis, the national authority sends a summary report of the significant incidents to ENISA and the EC. The annual reporting gives feedback at an EU level about the effectiveness of EU legislation, to understand EU wide trends, and to provide a platform for discussing lessons learnt and agreement about a harmonized and consistent approach to improving cyber security across the EU. Finally, returning to the blue dotted arrows (1), past incidents, root causes, lessons learnt expost, are being discussed nationally and at an EU level, and the security measures are being adapted to improve the security of the networks and services.

text: Cyber Incident Reporting in the EU 7 An overview of security articles in EU legislation

text: 3.2 Commonalities and differences

text: The overall picture provided in Section 3.1 ignores some differences between the security articles. In the diagram below (Figure 2) we illustrate the commonalities and differences between the different security articles, by annotating the information flows with references to individual articles.

text: Figure 2: Commonalities and differences between the security

text: articles 8

text: Cyber Incident Reporting in the EU An overview of security articles in EU legislation

text: 4 Conclusions

text: Security measures and incident reporting, implemented across the EU’s digital society, are important to improve overall security. EU legislation plays an important role here as it allows harmonization across the EU member states. This in turn prevents weak links and unnecessary costs for providers operating cross-border. The European Commission, in collaboration with the EU Member States, has undertaken a number of legislative initiatives aiming to further improve transparency about incidents. Another important step is the proposed Cyber Security Strategy, which emphasizes incident reporting and the importance of exchange across the EU about incidents and how to address them. We conclude with some general remarks. ● Regulatory gaps: In the introduction we gave five examples of cyber incidents with a severe nd impact on the security or privacy of electronic communications. The 2 incident, caused by the Dagmar storm, is in scope of existing incident reporting legislation and as such reported to 9 th authorities . The proposed regulation on electronic trust providers would also cover the 4 10 st rd th incident . But the remaining incidents (the 1 , 3 , and 5 ) are not clearly in scope or subject of debate between providers and the national regulator. It is important that national authorities and the EC discuss, agree, and clarify the scope of legislation on electronic communications and address these and other gaps. This can be done without necessarily changing the text of existing legislation, such as the telecom regulatory framework, but rather the interpretation of what the services are, because the landscape of electronic communications is continuously changing (from landline telephones and minitel in the past, to mobile phones, internet and VoIP). ● Model security articles: There is a lot of similarity between

text: Article 13

text: a of the Framework directive and Article 15 of the e-Signatures and e-Identities regulation. The former has been taken as a model for drafting the latter. Both articles combine security measures and incident reporting, at a national level and at an EU level. Consistency and standardization in the legislative texts allows for more easy governance by the member states, and more easy implementation by the providers. Furthermore, the combination of national reporting and EU reporting (present in both

text: Article 13

text: a and

text: Article 15

text: ) allows national authorities room to adjust to national circumstances, while at the same time providing overview and feedback at an EU level, which allows Member States to optimize implementation and to ensure a harmonized approach across EU member states. ● Governing security measures: Mandatory breach reporting receives a lot of media attention and it is arguably the most visible part of the security articles discussed in Section 2. But the

text: Cyber Incident Reporting in the EU 9 An overview of security articles in EU legislation

text: ultimate goal is to limit the impact of security and personal data breaches or prevent them altogether by making sure appropriate security measures are taken. This type of governance is crucial and not easy. In security much depends on the technical details of the implementation and these details are hard to capture in (high-level) legislation and subject to change. National authorities should exchange knowledge about an effective and efficient combination of highlevel legal obligations and technical implementation requirements. For the latter it is important to adopt a bottom up approach (i.e. commonly agreed recommendations), taking into account the (changing) state of the art and the practical experiences of regulators and experts from the private sector. As a second, but related point, the need to take “appropriate technical and organisational security measures” is mentioned in all the security articles discussed in Section 2. Although these articles are aimed at different providers and different types of breaches, there is still a large overlap between the security measures that have to be taken. The competent national authorities should collaborate (nationally and at an EU level) to ensure that these security measures are implemented consistently and where there is an overlap, similarly, to allow providers to comply more easily, and to allow equipment vendors to adapt their products 12 accordingly .

text: ● Optimizing incident reporting procedures:

text: ○ Incident response versus incident reporting: To prevent incidents from escalating Member states should encourage providers to quickly contact technical experts, incident response teams (like national CERTs), crisis coordination groups, and other organizations relevant in the response phase, should this be necessary. Member states should underline that incident response receives priority. The purpose of mandatory incident reporting to national authorities is supervision over whether or not providers comply with legal requirements, while the purpose of information exchange in the response phase, for example with a national CERT, is to tackle the incident. Member states should encourage transparency and trusted information sharing in the response phase and ensure that response processes are independent and not slowed down by legal reporting requirements. Member states should for instance ensure that incident reporting procedures are easy and quick to apply. . ○ Exchange and sharing: Over the past years CERTs have developed effective platforms for collaboration and information exchange. Beyond the response phase, however,

text: 10 Cyber Incident Reporting in the EU An overview of security articles in EU legislation

text: there is still little exchange of information about breaches between different national authorities. The EC should continue to support the working groups and platforms for exchanging information between national authorities, about breaches, about lessons learnt and best practices. ○ Granularity and tools: An important aspect of the evaluation of existing legislation on incident reporting should be an analysis of costs and benefits. Both for national and EU level reporting it is important to review over time the thresholds for reporting, the type of information that is reported, the level of detail, and so on. If too few incidents are reported, then it will be difficult to draw meaningful conclusions about common root causes or trends. This would defeat the purpose of the legislation altogether and make the legislation cost ineffective. National authorities should analyse what is a good balance, taking into account the costs and benefits for providers as well as the national authorities. Providers and national authorities should investigate automated tools and computer interfaces to allow for cost-effective incident reporting at a sufficient level of detail, while avoiding the burden of manual and ad-hoc reporting procedures . For example, one could distinguish between small and large incidents and use less reporting detail for the (many) smaller incidents. For the sake of brevity we refrain from discussing a number of other related issues (including for example, common data models for incident reports, common impact assessment methods, severity classification of breaches, common risk assessment methods, et cetera), which are already being addressed in the different working groups for

text: Article 13

text: a and

text: Article 4

text: . Concluding we would like to remark that in recent years a lot of progress has been made, in terms of addressing incidents and increasing transparency about incidents. The national authorities, for example, recently submitted to ENISA and the EC, the first

text: Article 13

text: a incident reports regarding severe incidents that occurred in 2011. The vast majority of national authorities use a single set of security measures and a common reporting template allowing for efficient collection and analysis. ENISA will publish an analysis of the 51 severe incidents in September 2012. From next year, every spring ENISA will collect annual incident reports and publish an analysis of the incidents of the previous year. For example, next spring 2013 ENISA will publish an analysis of the 2012 incidents. We look forward to continuing our work with national authorities and the European Commission to support an efficient and effective implementation of

text: Article 13

text: a,

text: Article 4

text: , and the other security articles across the single digital market, and to support collaboration and information exchange between national authorities across the EU, to improve security across the EU’s digital society.

text: Cyber Incident Reporting in the EU 11 An overview of security articles in EU legislation

text: 5 References 5.1 EU legislation and proposals

text: Article 13

text: a of the Framework directive of the EU legislative framework on electronic

text: communications:

text: http://ec.europa.eu/information_society/policy/ecomm/doc/140framework.pdf ● Article 4 of the e-Privacy directive, part of the EU legislative framework on electronic

text: communications:

text: http://ec.europa.eu/information_society/policy/ecomm/doc/24eprivacy.pdf ● The electronic communications regulatory framework (incorporating the telecom reform): http://ec.europa.eu/information_society/policy/ecomm/doc/library/regframeforec_dec2009. pdf ● Article 15 of the Regulation on electronic identification and trust services for electronic transactions in the internal market: http://ec.europa.eu/information_society/policy/esignature/eu_legislation/regulation/index_e n.htm ● Article 30, 31 and 32 of the proposed Data Protection regulation: http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_en.pdf The regulation is part of a wider reform of the data protection framework: http://ec.europa.eu/justice/newsroom/data-protection/news/120125_en.htm ● Roadmap for a proposal on a European strategy for internet security: http://ec.europa.eu/governance/impact/planned_ia/docs/2012_infso_003_european_interne t_security_strategy_en.pdf ● The speech of EU Commissioner Neelie Kroes on the EU strategy for internet security: http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/12/204&format=HTML&a ged=0&language=EN&guiLanguage=en ● The speech of EU Commissioner Cecilia Malmström on the EU Cyber security strategy: http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/12/315

text: 5.2 Related ENISA publications

text: ● ENISA’s

text: Article 13

text: a Guidelines on Incident reporting and Minimum security measures ● ENISA’s Recommendations for the technical implementation of

text: Article 4

text: ● ENISA’s 2009 paper on incident reporting shows an overview of the situation 3 years ago ● ENISA’s 2011 paper on data breach reporting across the EU shows an overview of the different national approaches to personal data breach notifications. ● ENISA’s paper on National Cyber Security Strategies shows commonalities and differences between national cyber security strategies across the EU.

text: 12 Cyber Incident Reporting in the EU An overview of security articles in EU legislation P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu

type: vagledning

utgivare: enisa