text: In addition, it provides a detailed background of EISAS. ‘EISAS - Roadmap for further development and deployment’, ENISA, 2010: http://www.enisa.europa.eu/act/cert/other-work/eisas_folder/eisas_roadmap

text: All information about the FISHA project is available at the project’s website: http://www.fisha-project.eu

text: For more details check http://www.cpni.gov.uk/

text: All information about the NEISAS project is available at the project’s website: http://www.neisas.eu/

text: Please see Page 3: List of contributors.

text: Please see Annex 4-2 for details about the questionnaire.

text: In those cases where the Experts actually represented such an organisation, the question was rephrased to apply to their own organisation.

text: For more details about L-SEC please see the organisation’s website: http://www.lsec.be/

text: For more details about CLUSIT please see the organisation’s website: http://www.clusit.it/

text: For more details about CASES please see the organisation’s website: http://www.cases.public.lu/fr/index.html

text: For more details about NorSIS please see the organisation’s website: http://www.norsis.no/

text: For more details about GetSafeOnline please see the organisation’s website: http://www.getsafeonline.org/

text: See ‘Minutes of the FISHA project closing workshop’: http://fisha-project.eu/sites/default/files/FISHA_closing_workshop_minutes.pdf

text: See also EISAS Basic Toolset report, (ENISA, 2011) for further details on ENISA’s view on EISAS implementation.

text: According to the EU definition on sizes of SMEs, micro enterprises are defined as fewer than 10 employees, small enterprises as fewer than 50 and medium-sized enterprises as fewer than 250. http://ec.europa.eu/enterprise/policies/sme/facts-figures-analysis/sme-definition/index_en.htm

text: The website of WARP is located at: http://www.warp.gov.uk/

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu

identifier: EISAS (enhanced) report on implementation

nummer: eisas-report-on-implementation-enhanced

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: EISAS (enhanced) report on implementation

serie: rapporter

text: EISAS – European Information Sharing and Alert System Implementation through cooperation October 2011

type: stycke

text: EISAS – European Information Sharing and Alert System for citizens and SMEs Implementation through cooperation

type: rubrik

text: About ENISA

text: The European Network and Information Security Agency (ENISA) acts as a centre of expertise on cyber security for the European Union (EU), its Member States (MS), the private sector and Europe’s citizens. As an EU agency, ENISA’s role is to work with all of these stakeholder groups, as well as the academic world, to develop advice and recommendations on good practice in computer security. The agency assists MS in implementing relevant EU legislation, and works to protect Europe’s critical information technology networks through activities such as pan-European cyber security exercises. In addition, ENISA acts as a ‘switchboard’ for exchanging knowledge among all of its stakeholders.

text: Contact details

text: The editor of this report was Mr Kjell Kalmelid, Expert, ENISA. For questions related to this report, EISAS or for general enquiries on CERT Cooperation, please use the following contact details:

text: E-mail: CERT-Relations@enisa.europa.eu

text: Internet: http://www.enisa.europa.eu/act/cert/

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Reproduction is authorised provided the source is acknowledged.

text: © European Network and Information Security Agency (ENISA), 2011

text: EISAS – European Information Sharing and Alert System Implementation through cooperation

text: List of contributors

text: This paper was produced by the ENISA editor using input and comments from a group selected for their expertise and experience in the subject area. The views expressed in this publication are those of the editor, unless stated otherwise, and do not necessarily reflect the opinions of the participating Experts. Pascal Steichen Ministry of Economy (LU) Otmar Lendl CERT-AT Kauto Huopio CERT-FI Raoul Chiesa CLUSIT (IT) Ioannis Askoxylakis FORTHcert (GR) Tony Neate GetSafeOnline (UK) Tore Larsen Orderløkken NORSIS (NO) Andrew Cormack JANET (UK) John Harrison LanditD and NEISAS Ulrich Seldeslachts LSEC (BE) Peter Burnett Quarter House Ltd.

text: Executive summary

text: This report contains considerations and suggestions on how to further support the Member States in deploying the European Information Sharing and Alert System (EISAS). This report implements the foreseen activities in the ENISA Work Programme of 2011 and paves the way for the implementation

text: of the 2012 activities that were pointed out in the EISAS Roadmap. The goal of this report is to provide input to future activities aiming at further developing the recommendations of the FISHA project including, but not limited to, those of ENISA.

text: Several Experts were interviewed to give their opinion on EISAS. They are representing European National/Governmental CERTs (‘Nat/Gov. CERTs’), organisations active in raising information security awareness among citizens and SMEs (‘non-CERTs’) in their countries or are independent with long experience in the area of trusted information sharing and exchange.

text: The result of the interviews revealed that the idea of EISAS is supported by Experts representing both Nat/Gov. CERTs and non-CERTs. However, in the discussions on EISAS from different perspectives, those from non-CERTs were generally more enthusiastic about EISAS than those from Nat/Gov. CERTs. This is mainly due to the fact that Nat/Gov. CERTs will need funding if a meaningful engagement in EISAS is to be realised.

text: The non-CERTs consider EISAS as a way of exchanging ideas and experiences on a European level since a community for these organisations and initiatives does not really exist. They are very positive to contribute to the development of EISAS by participating in a possible large-scale pilot of the EISAS Basic Toolset in 2012. So are the Nat/Gov. CERTs, but they are much more cautious and reiterate the importance of obtaining funding as a condition for their participation.

text: All the Experts agree that targeting citizens is different from targeting SMEs. For citizens a concept such as the EISAS Basic Toolset is definitely worthwhile to further develop. For SMEs, and particularly medium-sized enterprises, it appears to be a better approach to apply the concept of WARPs (Warning, Advice and Reporting Points), which are information-sharing communities based on a model developed by the UK government CPNI (formerly NISCC).

text: On the issue of management of EISAS, the model proposed by FISHA was generally seen as feasible, but there were no strong opinions on this matter. Most of the Experts believe priority must be given to the development of activities for cross-border cooperation on issues concerning information sharing

text: and exchange. Finally, the Experts see at least partial funding from the governments as a precondition for realising EISAS.

text: Introduction

text: The EISAS Roadmap anticipates that ‘National/Governmental CERTs and relevant stakeholders would need to develop, with the support of ENISA, the basic EISAS functionalities required to reach citizens and SMEs’. Furthermore it states that:

text: ‘The relevant services already existing should be brought together to foster discussions on what is needed to further build economy of scale (e.g. in terms of threat analysis, vulnerabilities assessment etc.). The findings from the EISAS Feasibility Study, the FISHA and NEISAS projects, and from other existing public and private initiatives need to be considered’.

text: This report builds on the aforementioned findings and, additionally, on discussions held with members of an Expert Group . The group comprised 11 persons representing National/Governmental CERTs in Europe and organisations active in raising information security awareness among citizens and SMEs in their countries. Each individual was invited for a phone interview by the author of this report.

text: The interviews were conducted from 5 to 15 September 2011. As a basis for the discussion, and to ensure consistency, a questionnaire with 14 questions was used. Since the intention was to allow for a broader discussion on the various issues, all questions were open. Each interview lasted for about 45-60 minutes, but all individuals were given the option to convey their opinions in writing if they so wished.

text: The objective of the discussions was primarily to obtain a deeper understanding of what is required to enable the implementation of EISAS. In other words, the objective was to identify concrete opportunities and obstacles for such implementation. The objective was also to explore the possibilities of gaining support for the EISAS Basic Toolset approach in its first version.

text: Results 1.1 The FISHA management model

text: The FISHA consortium has proposed a management model with four players (‘the FISHA Model’):

text: • Network Security Organisations; • Information Producers; • Local Information Brokers; • Information Consumers (i.e. Citizens and SMEs).

text: The ‘Network Security Organisations’ are central in this model as they would be the main stakeholders for running a national Information Sharing and Alert System (‘National ISAS’). The producers and brokers are certainly critical, but complementary to the network security organisations. According to this model, Nat/Gov. CERTs as well as other organisations with a mission to target citizens and/or SMEs in the Member States would fall within the category of network security organisations even though, to some extent, they are also producers and brokers of security information.

text: Furthermore, the FISHA project proposed two kinds of node to be established for administering the cooperation between these players: a Central node and several Basic nodes. From a technicaladministrative point of view, the network security organisation representing the Central node would, among other things, be responsible for managing the network of Basic nodes. To that end, the FISHA project had developed a web application prototype (‘the FISHA System’), which also builds on P2P technology for sharing information in the network. The Central node would also be the interface to other Central nodes in other countries.

text: The combined activities carried out by the Central node and the Basic nodes can be described as the national ISAS. Regardless of whether or not the Central node is a CERT, the role entails taking responsibility for the running and coordination of the national ISAS.

text: 1.2 Considerations on the idea of EISAS

text: The high-level objective of EISAS is to empower all EU citizens and SMEs with the knowledge and skills necessary to protect their IT systems and information assets. EISAS is supposed to build upon and link together existing or planned national public and private initiatives. Nat/Gov. CERTs should also play a role in the realisation of EISAS.

text: With this description of EISAS, the Experts were initially asked for their general opinion on the idea. When it comes to the overall objective of EISAS, everyone agreed this is a highly important task for every Member State to perform. However, when the discussion went into the issue of how EISAS

text: should be implemented as a means of sharing targeted security information to citizens and SMEs, it is clear that the following factors need to be addressed:

text: • the roles and operational conditions of Nat/Gov. CERTs vis-à-vis other organisations within the frame of the FISHA model; • the FISHA prototype web application (‘the FISHA System’); • the differences between the EISAS target groups, i.e. citizens and SMEs respectively.

text: 1.3 Roles and operational conditions

text: 1.3.1 Nat/Gov. CERTs

text: The Expert Group were asked which of the two roles – Central or Local node – they see as most fit for the Nat/Gov. CERT to play within a national ISAS in their country. They were, additionally, asked to respond in view of the division of roles and responsibilities for awareness-raising in their country.

text: Experts from Luxembourg, the UK and Norway answered that they did not regard the Nat/Gov. CERTs as a suitable player for this role in their country whatsoever. The reasons they gave as the basis for this view were scope and focus. CERT representatives generally shared the view that, to some extent, scope and focus pose a challenge when it comes to engaging in EISAS. However, the main issue in terms of taking the responsibility for an ISAS as a Central node is that of resources. The operational conditions scope, focus and resources are briefly presented below.

text: • Scope Although many Nat/Gov. CERTs do target citizens and SMEs, far from all CERTs target those groups alone. Some countries have several publicly funded CERTs, none of which have citizens and SMEs as their target group. In such countries, other initiatives have been established to address the needs of citizens and SMEs to obtain security information. • Focus The primary task of the CERT is to respond to and coordinate the handling of incidents. Their main focus is not to proactively stop incidents from happening, but to react when an incident has occurred; the so-called ‘Digital Fire Brigade’ task. • Resources It is a fact that Nat/Gov. CERTs are generally very small organisations with fewer than ten and in some cases fewer than five employees. This circumstance makes it difficult for most of them to engage in anything other than the core business.

text: If the FISHA System is to be integrated into EISAS, the representatives of CERT.at, FORTH CERT and CERT-FI all consider their organisation as the most realistic option for running the Central node in their countries respectively. They are open to further developing their proactive activities, but unless funding can be secured they simply have no or very limited possibilities to develop or engage in any such activity, EISAS included.

text: 1.3.2 Other organisations

text: The Expert Group were also asked: a) which other organisations/initiatives should be considered part of a national ISAS in their country, b) if these organisations could be defined as network security organisations and c) to what extent they would be suitable to represent the Central node in the country.

text: It was clear that in the countries where the Nat/Gov. CERT is not seen as the most relevant organisation, there was at least one alternative organisation established in that country. If the FISHA System is to be integrated into EISAS, the Experts representing non-CERT organisations all consider themselves as suitable candidates for being the Central node in their country. The organisations that participated in this survey are briefly presented below:

text: • The main mission for L-SEC – a not-for-profit association in Belgium – has been to create IT security awareness for industry at large, and their members are primarily SMEs. Nonetheless, L-SEC could definitely consider being the Central node in Belgium as the security information it distributes to SMEs often covers the needs of citizens as well. • CLUSIT in Italy is also a not-for-profit association and is open to both individuals and organisations. Their mission is to raise the computer security culture among companies, public administrations and citizens. CLUSIT is a well-renowned and respected organisation in Italy. It has excellent relations with both industry and the Italian government. 11 12 13 • CASES in Luxembourg, NorSIS in Norway and GetSafeOnline in the UK are all partly funded by their governments and have very similar tasks and target groups. NorSIS and GetSafeOnline rely on additional funding from the private sector.

text: 1.4 CERTs and the FISHA System

text: The main deliverable of the FISHA project was a web application prototype for information sharing and alerts (‘the FISHA System’). But at the closing workshop , the use of the FISHA System raised a number of questions and, to some extent, also concerns . Mainly, it was unclear what information was supposed to be processed and shared in the system.

text: A comment from one Expert in this survey was that if the FISHA System is used for processing information as it arrives (input), the potential benefits for EISAS would be that it saves time. However, since the processed information is intended to be distributed to citizens and SMEs or published (output), it is by definition open.

text: Hence, the potential usefulness of the system ends as soon as the information is processed. As another Expert commented, the system is to a large degree ‘over-engineered’. If open information is the output, then there is no real need for a secure resilient distribution infrastructure based on P2P technology. On the other hand, if the information would be restricted then the FISHA System to some extent competes with other, already existing channels for sharing information. It was also remarked that the idea of translating security information to English prior to sharing it is challenging. Regardless of whether there are many small or a few large pieces of text, it will inevitably require time and resources to translate them.

text: In contrast to this quite sceptical view of the FISHA System, more than one Expert emphasised that the FISHA System could be potentially very useful if used for ‘co-analysing’ information. Basically, every CERT uses the same information sources and subscribes to the same mailing lists and RSS-feeds in order to monitor security events on the web at large. Those activities could be shared by several CERTs, thus synergies can be achieved.

text: A ‘co-analysing’ project like this, however, requires both mutual trust among CERTs and respect for the technical expertise of the provider of an analysis. If successful, it might be a way for Nat/Gov. CERTs to actually release resources for other activities, for example, more ‘proactive’ ones. Moreover, to share the burden of processing information would facilitate another objective of EISAS, namely to reinforce

text: cooperation between CERTs. One Expert said that although attempts to share the burden of processing of information among CERTs have been made in the past with little success, it should not stop the CERT community from trying again.

text: 1.5 Targeting citizens & SMEs

text: In the discussions on the EISAS Basic Toolset, it became clear that targeting citizens is quite different from targeting SMEs. In addition, it was remarked that there are also differences between micro, small and medium enterprises that must be taken into account.

text: 1.5.1 EISAS Basic Toolset

text: Two questions were about the EISAS Basic Toolset. This is an ENISA activity which is part of the ENISA 2011 Work Programme. It falls within the overall role of ENISA to facilitate the development of EISAS, it is an activity foreseen in the EISAS Roadmap as ‘Development of EISAS basic functionalities and services’ and aims at contributing to the ‘outreach challenge’ in the FISHA proposal for communication channels. That proposal recognised the need for ‘something’ in between information producers and the information consumers, but during discussions at the FISHA closing workshop it was unclear what this concretely could be apart from local information brokers.

text: The idea that ENISA has piloted – and named EISAS Basic Toolset – was to reach out to home users, i.e. citizens, at their workplace instead of addressing them at their home. At the interviews, the Experts were informed that preliminary results of the pilot were very promising in terms of impact, i.e. changes in knowledge, attitude and behaviour of the home users.

text: All the Experts said that if the preliminary results can be verified when the pilot has ended, it would definitely be worthwhile to develop the EISAS Basic Toolset concept further. All five Experts representing the non-CERT organisations, CASES (LU), GetSafeOnline (UK), CLUSIT (IT), L-SEC (BE) and NorSIS (NO), also expressed a strong interest in taking part in a large-scale pilot of this approach in 2012. CERTs were more ‘carefully positive’ to the idea of taking part in a large-scale pilot, provided costs are covered.

text: 1.5.2 Value of performance indicators

text: An essential requirement for the development of the EISAS Basic Toolset was that the results of the pilot would be validated. The preliminary results presented to the Experts were all validated through a set of performance indicators on knowledge, attitude and behaviour of the home users and thus demonstrated that the approach can lead to concrete effects.

text: The Experts were asked for their opinion on the value of obtaining such indicators as a result of targeting citizens with information on how to improve security. The Experts responded that they believe such indicators would be very useful. They point out that producing results is, of course, a condition in order for any organisation or initiative to obtain funding. If you can demonstrate success then raising funds is much easier. One Expert said that measuring concrete effect on set performance indicators should be integrated as a component in EISAS.

text: 1.5.3 Targeting micro and small enterprises

text: In the discussions, the Experts made remarks on the differences between the EISAS target groups, i.e. citizens and SMEs, and how important it was to take those differences into account when targeted. With regards to citizens, there are numerous factors that make it practically pointless to target them as one and label them ‘home users’. Differences in age and educational levels are just a few examples of the characteristics of home users. The EISAS Basic Toolset pilot recognised these differences by restricting its scope to those home users that are also non-manual workers, in other words, focusing on reaching out to adults of approximate age 24-65 with medium or high education.

text: With regard to SMEs, micro, small and medium are basic characteristics of size . However, from the perspective of successfully sharing security information with SMEs, the size does not seem to be what matters most. What seems to be a more important factor is their ability to grasp and comprehend security information. Many Experts say this ability is more linked with the ICT dependency than with the size of the company. Consequently, there are small companies with better ability to consume security information than medium-sized ones.

text: In general, however, this ability is linked to the growth of the company in terms of size. At a certain point in time of its evolution, a company needs to address development, maintenance and support of its ICT more strategically. Regardless of whether that need is addressed by hiring someone with the required skills or by outsourcing its ICT operations, the level of the company’s ICT maturity increases.

text: One Expert says micro-enterprises are considered one of the hardest communities to reach and provide actionable information to. Yet another one says the way to addressing micro-enterprises is to make it even easier for them to take security measures and added that these enterprises are not

text: interested in what the threats or vulnerabilities are and how they can damage their computers, they simply want to know which button to push in order to make things work smoothly.

text: 1.5.4 The WARP concept

text: In the discussions on how to better reach out to SMEs within EISAS, many Experts referred to the British WARP (Warning, Advice and Reporting Point) initiative. The WARP programme is part of the Information Sharing Strategy of the Centre for the Protection of National Infrastructure (CPNI) . According to CPNI, ‘a WARP is complementary to CERTs, helping to deliver advisories more effectively to small subsets of the CERT’s constituency and promote information security among organisations the CERT cannot reach on its own’. This suggests that WARPs fit pretty well in the FISHA model as information brokers. The FISHA model anticipates information brokers to be connected to network security organisations such as CERTs through the FISHA System.

text: With regards to those SMEs that have a higher level of ICT maturity and thereby a better understanding of the importance of information security, the WARP model could very well be the channel CERTs are looking for to better reach out to those target groups. It may not be an easy task to define ‘ICT maturity’ from a security perspective, nor which SMEs would be suitable to target. Nevertheless, it should be worth discussing if and how the WARP model could somehow be integrated into EISAS.

text: 1.6 Management and funding of EISAS

text: The FISHA project proposed the following governance model: • There would be a Steering Committee, which adopts a policy of the ‘FISHA Network’, i.e. EISAS. • The Steering Committee would decide: o who can become a member of the network; o what will be its role; o who will additionally work in the Core Network (offer the necessary services and responsibility).

text: At the FISHA closing workshop, it was not possible to agree on which organisations should form the Steering Committee and on what basis.

text: The Experts were asked for their views on FISHA’s proposal for a management model and also on the issue of funding. With a few exceptions, no strong feelings were expressed on that model. All Experts had long experiences of international cooperation on information sharing and exchange. They envision a future Steering Committee as a relatively small group of individuals dealing only with pure strategic issues. All operational matters should be left for the participating organisations in the Member States respectively to decide on.

text: Having all Member States represented was generally not seen as feasible. On the other hand, as one Expert said, it is probably necessary that the Central node organisations are represented in the committee. Another Expert said the sensitivity of the information to be exchanged inevitably will affect the management model of EISAS. If trust is to be a significant factor for any sharing to take place, the TF-CSIRT approach may be considered as a model for coordinating and managing the cooperation. It should be noted that the vast majority of the Experts agreed that before any cooperation has started, the issue of management is critical.

text: Most Experts said that in order for EISAS to be realised, the governments have to support the initial funding of EISAS. One Expert said the success and organisation of the Safer Internet programme with nodes in every Member State would have taken much longer to achieve without strong support and funding from the governments. The role of ENISA should remain that of a facilitator and driver.

text: Conclusions

text: From the discussions with the Expert Group the following can be concluded:

text: • There is a general support of the idea of EISAS as a cooperation model for targeting citizens and SMEs with security information. • The operational conditions of Nat/Gov. CERTs in terms of scope, focus and resources seriously challenge the idea of building on Nat/Gov. CERTs as the Central node and driving force for EISAS in the Member States. For Luxembourg and the UK, this is obviously not an option. In other Member States this may be an option or even the only option and it demonstrates the complexity of the issue. • The Nat/Gov. CERTs interviewed say the FISHA System may be used for co-processing/coanalysing information and that opportunity should definitely be further investigated, not least because of the high potential of the activity to reinforce cooperation among Nat/Gov. CERTs. • With regards to targeting home users and on the basis of preliminary results of piloting the EISAS Basic Toolset, non-CERTs from five countries, Belgium, Luxembourg, Italy, Norway and

text: the UK, expressed a strong interest in participating in a large-scale pilot of this concept in 2012. Two Nat/Gov. CERTs would also be willing to participate provided funding is secured. • Experts agreed that micro and small enterprises generally do not have the skills, time or resources to absorb very detailed security information and only want to know ‘which button to push’. The main problem concerning these target groups is not the quality of the security information, but how to reach them and convince them of the value of taking part in that information exchange. • Most medium enterprises have some sort of internal ICT coordination and are therefore more likely than not to gain from and have the ability to absorb more detailed information. The WARP model seems to be a good way of transmitting such information to medium enterprises. • Ideally, EISAS should develop into a network between organisations/initiatives targeting citizens and SMEs similar to that of Safer Internet. In other words, EISAS should get minimum funding from the Member States for setting up nodes throughout Europe.

text: Annexes

text: 4-1 Annex A: Acronyms

text: EISAS – European Information Sharing and Alert System ISAS – Information Sharing and Alert System NEISAS – National & European Information Sharing & Alerting System FISHA – Framework for Information Sharing and Alerting P2P technology – Peer-to-Peer technology WARP – Warning, Advice and Reporting Point CERT – Computer Emergency Response Team

text: 4-2 Annex B: Questionnaire

text: The questionnaire was composed of 14 questions divided into three main topics: • EISAS and national ISAS; • the role and responsibilities of the Nat/Gov. CERT; • discuss EISAS Basic Toolset and support of that concept including gathering of statistical data on the security of home users.

text: Questions

text: 1. What’s your opinion on the idea of EISAS?

text: 2. From the perspective of the division of roles and responsibilities for awareness-raising in your country, which of these roles do you see as most feasible for the CERT to play within a national ISAS in your country?

text: 3. What’s your opinion on this idea of having the CERTs taking the lead in realising EISAS? Is it realistic? If not, why? What is required to realise it?

text: 4. Given that EISAS targets citizens and SMEs, which other actors should be included in the operations of a national ISAS?

text: 5. Could you please provide us with some names of two such actors?

text: 6. On this background, what is your general impression about this approach and possibility to integrate in the EISAS concept?

text: 7. Would your organisation be willing to take part in a large-scale pilot of this approach in 2012?

text: 8. What about other actors in your MS. What are the chances they would be willing to participate in such a pilot?

text: 9. What is your opinion on the value of the stats produced? Could such data be useful for your organisation (regardless if it’s part of EISAS or not)?

text: 10. Do you have any opinions/suggestions on which organisations should form the Steering Committee?

text: 11. Is it important that the organisation running the Central node in an MS is a member of the SC?

text: 12. Do you have any suggestions to make/comments on the possible criteria/requirements to be fulfilled in order to be part of the SC?

text: 13. What role, if any, should ENISA play for EISAS?

text: 14. Do you have any opinions/suggestions on the long-term funding of a future EISAS? Who should be the main sponsor?


text: “The Commission supports the development and deployment of EISAS, reaching out to citizens and SMEs and being based on national and private sector information and alert sharing systems. The Commission financially supports two complementary prototyping projects. ENISA is called upon to take stock of the results of these projects and other national initiatives and produce a roadmap to further the development and deployment of EISAS”.

text: See COM(2006) 251 on a Strategy for a Secure Information Society – “Dialogue, partnership and empowerment”: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2006:0251:FIN:EN:PDF.

text: EISAS feasibility study – final report:http://www.enisa.europa.eu/act/cert/other-work/eisas.

text: See COM(2009) 149 on CIIP - "Protecting Europe from large scale cyber-attacks and disruptions: enhancing preparedness, security and resilience": http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2009:0149:FIN:EN:DOC See COM(2010)245 on a Digital Agenda for Europe: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0245:FIN:EN:PDF

text: See COM(2010) 673on the EU Internal Security Strategy in Action at: http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0673:FIN:EN:PDF

text: “Firstly, every Member State, and the EU institutions themselves should have, by 2012, a wellfunctioning CERT. (…). Secondly, Member States should network together their National/Governmental CERTs by 2012 to enhance Europe's preparedness. This activity will also be instrumental in developing, with the support of the Commission and ENISA, a European Information Sharing and Alert System (EISAS) to the wider public by 2013 (…)”.

text: EISAS feasibility study – final report: http://www.enisa.europa.eu/act/cert/other-work/eisas.

text: See http://www.fisha-project.eu/ and http://www.neisas.eu/

text: For more details on the activities in 2011, see the 2011 ENISA Work Programme: http://www.enisa.europa.eu/about-enisa/activities/programmes-reports/enisa-work-programmes-general-reports

text: See the Annual Work Programme for 2011 for the specific programme on "Prevention, Preparedness and Consequence Management of Terrorism and other Security Related Risks": http://ec.europa.eu/home-affairs/funding/docs/C20108325EN.pdf

text: Activities Timeline

text: Establishment of a well functioning national/governmental CERT in each MS End of 2011 Reinforce cooperation between national/governmental CERT towards a well-functioning 2011-2012

text: network of National/Governmental CERTs in Europe by 2012

text: Development of EISAS basic functionalities and services H1 2011 Integration of ISAS capabilities in National/Governmental CERT services 2011-2012 Development of customized services in order to meet particular MS' needs H2 2011 Development of interoperability services for national ISAS in order to enable the deployment of H2 2012

text: Trial among a subset of EU MS to stimulate the overall EU engagement H2 2012 Deployment of EISAS in the EU 2013

identifier: EISAS Roadmap

nummer: eisas-roadmap

title: EISAS Roadmap

text: EISAS – European Information Sharing and Alert System for citizens and SMEs

text: February 2011

text: A Roadmap for further development and deployment About ENISA

text: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.

text: Contact details

text: For contacting ENISA or for general enquiries on CERTs, please use the following details: E-mail: cert-relations@enisa.europa.eu Internet: http://www.enisa.europa.eu/act/cert/ For questions related to EISAS, please use the following details: E-mail: eisas@enisa.europa.eu

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent state-of the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. ©European Network and Information Security Agency (ENISA), 2011

text: Background

text: Citizens and Small and Medium Enterprises (SMEs) constitute the largest group of Internet users in the EU. IT systems owned and operated by these users are popular targets for hackers to, for instance, steal valuable personal information like credit card numbers or customer's details or to be incorporated into botnets, i.e. networks of remotely controlled computers. A botnet, in turn, is the means used to massively distributed spam and malware or to carry out Distributed Denial of Service attacks (“DDoS attacks”) against networks.

text: A successfully conducted DDoS attack will inevitably cause damage for the targeted organisation by causing longer or shorter disruptions of communication services and information systems. In worst case the networks and systems attacked would be part of Critical Information Infrastructures (CII), which makes DDoS attack a serious threat to society at large.

text: The reason why computers of citizens and SMEs are being targeted by hackers is because the computers of those end-users are generally less protected than those in large organisations and companies. In general, large organisations have more resources at their disposal for managing information security risks including having experts in charge of ensuring the appropriate protection of the organisation's computers and are able to invest in carrying out awareness raising activities and provide training for their employees, i.e. end-users.

text: Citizens and SMEs on the other hand often lack internal expertise on network and information security and awareness on threats and risks to their computers. Further to this, they often lack the appropriate knowledge about how to protect themselves against those risks and threats.

text: The EU policy context

text: In its 2006 Communication on a strategy for a Secure Information Society , the European Commission emphasized that public authorities in Member States and at EU-level have a key role to play in keeping citizens properly informed. In this way, they can contribute not only to their own safety and security, but also to a more resilient public communication infrastructure.

text: In view of its role in fostering a culture of Network and Information Security in Europe, ENISA was requested to “examine the feasibility of a European multilingual Information Sharing and Alert System (EISAS)”. EISAS would build upon and link together existing or planned national public and private initiatives. EISAS feasibility study was published in 2007.

text: The importance of functioning information and alert sharing systems targeting citizens and SMEs was further emphasized, in 2009, by the European Commission in its Communication on Critical Information Infrastructure Protection - COM (2009)149 :

text: Under its pillar on "Trust and Security", the Digital Agenda for Europe stresses the need for Member States to establish, by 2012, a well-functioning network of CERTs at national level covering all of Europe.

text: EISAS is further addressed in the EU Internal Security Strategy in Action . One of the five objectives aims to raise levels of security for citizens and businesses in cyberspace:

text: State of Play

text: The main findings of the ENISA's study on EISAS feasibility include the following elements:

text:  There are varying capabilities of Member States (MS) to sustainably reach out to their citizens and SMEs with NIS related information. In the majority (74%) of cases national/governmental CERTs are involved. This predominance of CERTs in that field results from the expertise that these teams have in collecting, processing and sharing of information to conduct their core services of incident response and alerting/warning. Both long-term good IT security practices, and short to mid-term security advices on recent and upcoming threats are provided to citizens and SMEs.  A centralised solution on European level that directly shares information with the European citizens and SMEs is less likely to be accepted than a solution based on national capabilities. Existing mechanisms and activities must be taken into account and should, even more, contribute to EISAS. The role of ENISA should be that of a facilitator, clearinghouse of good practice information and knowledge- and contact broker.  MS should entrust their national/governmental CERTs to play a key role in the deployment of EISAS. A successful and accepted deployment of EISAS can only be achieved by well working cooperation between MS in general and their national/governmental CERTs in particular. The possibilities to develop and deploy EISAS within a Public-Private Partnership (PPP) must be explored.

text: In 2010 ENISA updated its stock taking of existing information sharing and alerting activities in the Member States. In general there is an increasing awareness of the importance to address citizens and SMEs with NIS information and alerts. All known activities operate, as a minimum, a website as distribution channel providing information in the local language.

text: The two EU-funded prototyping projects FISHA and NEISAS7 will be finalised in the first quarter of 2011. The FISHA project has initiated a network of IT security teams, among them national/governmental CERTs, which have agreed to put into a standard format the relevant security

text: information that they usually process to inform and alert end-users. They have prototyped a model whereas they share these "information objects" and published them in the native languages of targeted citizens and SMEs.

text: The NEISAS project is complementary as it focuses on increasing cross border synergies between national Network Security Information Exchanges (NSIE). NSIEs are strategic partnerships between public authorities and key private stakeholders, like operators of National Critical Infrastructures, to provide them with additional expertise and information to support their information security process. A pilot between a subset of Member States is under finalisation. NEISAS has also contributed to the emerging ISO/IEC 27010 Information Security Management standard on trusted information sharing.

text: The Roadmap

text: Cooperation as the basis

text: Cooperation between Member States is a precondition for success and the cornerstone upon which this roadmap has been built. EISAS' high-level objective is to empower all EU citizens and SMEs with the knowledge and skills necessary to protect their IT systems and information assets. EISAS will build on national capabilities of EU Member States (including national Information Sharing and Alert Systems – national ISAS).

text: To that end, the development of well functioning National/Governmental CERTs and a reinforced cooperation between them will be essential. EISAS will be the result and the additional benefit gained from a reinforced cooperation between existing and to-be-built national capabilities. The overall benefit of EISAS is summarised in the figure below.

text: The role of ENISA

text: The role of ENISA is to contribute to the implementation of the roadmap by facilitating, supporting and reinforcing the cooperation with and between National/Governmental CERTs as well as other stakeholders from public and private sectors .

text: Next steps

text: As foreseen by the Digital Agenda for Europe, the establishment, by 2012, of a well-functioning network of National/Governmental CERTs in Europe is essential. Furthermore, National/Governmental CERTs and relevant stakeholders would need to develop, with the support of ENISA, the basic EISAS functionalities required to reach citizens and SMEs.

text: The relevant services already existing should be brought together to foster discussions on what is needed to further build economy of scale (e.g. in terms of threat analysis, vulnerabilities assessment etc). The findings from the EISAS Feasibility Study, the FISHA and NEISAS projects, and from other existing public and private initiatives need to be considered. Architectural aspects have to be analysed by leveraging on existing functions, protocols, procedures, templates and mechanisms and by identifying what needs to be further developed, in particular, to ensure interoperability between national ISAS services.

text: As an intermediary step, it can be envisaged to build upon regional/smaller group level cooperation to stimulate the overall EU engagement. A trial can be envisaged for 2012 to enlarge the existing prototyping to a broader community of Member States. It is to be noted that financial support is made available, on a needed basis, via the financing scheme of the European Programme for Critical Infrastructure Protection (EPCIP) whereas priority is given to advancing the development and deployment of EISAS.

text: The objective is to deploy EISAS by 2013. In the long term, synergies need to be envisaged between EISAS and the CERT for the EU Institutions to be established by 2012. In summary, the EISAS roadmap builds on the activities indicated in the table below.

type: vagledning

utgivare: enisa