text: May 2019

text: May 2019

text: May 2019

text: Using a basis of 500M (EU citizens) times 365 (days) times 24 (hours). User hours is a metric we use throughout this report to quantify the impact of an incident, multiplying the number of subscribers/connections affected, with the duration in hours. For example 1M User Hours means 1M users were affected for one hour, or 2M users for half an hour, etc.

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: May 2019

text: 3 In 2015 ENISA commissioned an independent evaluation of

text: Article 13

text: a and found that incident reporting has greatly supported policy making and supervision in the EU Member States. See: https://www.enisa.europa.eu/publications/impactevaluation-article13a

text: May 2019

identifier: Annual Report Telecom Security Incidents 2018

title: Annual Report Telecom Security Incidents 2018

text: ABOUT ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquires about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Aggelos Koukounas, Eleni Vytogianni, Marnix Dekker

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the experts in the ENISA Article 13a Expert Group which comprises national telecom regulatory authorities (NRAs) from all EU and EFTA countries.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Network and Information Security (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: Catalogue number: TP-AD-19-001-EN-N ISBN: 978-92-9204-296-7 DOI: 10.2824/350004

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6 2. INCIDENT REPORTING FRAMEWORK AND EXAMPLES OF INCIDENTS 7

text: 2.1 INCIDENT REPORTING FRAMEWORK 7

text: 2.2 EXAMPLES OF INCIDENTS REPORTED 7

text: 3. ANALYSIS OF THE INCIDENTS 9

text: 3.1 ROOT CAUSE CATEGORIES 9

text: 3.2 USER HOURS LOST FOR EACH ROOT CAUSE CATEGORY 10

text: 3.3 DETAILED CAUSES 10

text: 3.4 SERVICES AFFECTED 11

text: 4. DETAILED ANALYSIS: POWER CUTS 12 5. MULTI-ANNUAL TRENDS ON PERIOD 2012-2018 14

text: 5.1 MULTIANNUAL TREND ROOT CAUSE CATEGORIES 14

text: 5.2 MULTIANNUAL TREND IMPACT PER SERVICE 14

text: 5.3 MULTIANNUAL TREND USER HOURS PER ROOT CAUSE CATEGORY 15

text: 5.4 MULTI-YEAR TREND NUMBER OF INCIDENTS AND USER HOURS 15

text: 6. CONCLUSIONS 17 ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018

text: EXECUTIVE SUMMARY

text: In the EU, electronic communication providers notify significant security incidents to the National Regulatory authority (NRA) in their country. At the start of every calendar year the NRAs send a In 2018, half of summary about these incidents to ENISA. This document, the Annual Report Telecom Security the total user Incidents 2018, covers the incidents reported by NRAs for 2018 and gives an anonymised, hours lost (482 aggregated EU-wide overview of telecom security incidents. million user hours) were Security breach reporting has been part of the EU’s telecom regulatory framework since the due to natural 2009 reform of the telecom package:

text: Article 13

text: a of the Framework directive (

text: ) phenomena. It came into force in 2011. The breach reporting in

text: Article 13

text: a focuses on security incidents with is the first year significant impact on the operation of services, i.e. outages of the electronic communication that natural networks and/or services. phenomena are the main root Statistics annual summary reporting 2008 cause category in this respect, The 2018 annual summary reporting contains reports about 157 incidents submitted by NRAs accounting for from the 28 EU Member States and 2 EFTA countries. The total user hours lost, multiplying for more user each incident the number of users and the number of hours, was 969 Million User Hours, i.e. hours lost than roughly 0,02% of the total user hours in a year . the category of system failures.

text: Here are the key takeaways from about the 2018 incidents:

text:  Natural phenomena dominate in terms of impact: In 2018, half of the total user hours lost (482 million user hours) were due to natural phenomena. It is the first year that natural phenomena are the main root cause category in this respect, accounting for more user hours lost than the category of system failures.  System failures are the most frequent root cause of incidents: Most incidents (67%) are caused by system failures, a percentage which is consistent with previous years. Often these system failures are hardware failures and software bugs.

text:  Power cuts are a major factor: Although only a small number of incidents was caused by power cuts (15%) they had a huge impact in terms of user hours with 50% of the total, i.e. 496 million user hours lost.  Faulty software changes/updates are the second most common cause: In 2018 faulty software changes/updates were the second most common cause of incident, accounting for a fifth of the incidents.

text: ENISA offers an online visual tool for analysing the incidents. It can be used to dive into other aspects and detailed causes. See: https://www.enisa.europa.eu/topics/incident-reporting/fortelcos/visual-tool For example, by selecting (top left) years 2018, 2017, 2016, then natural phenomena (top left), then mobile telephony and internet (top right), the charts at the bottom show detailed causes, assets affected.

text: Multiannual trends over 7 years of reporting

text: Looking back at the last 7 years of annual incident reporting we can observe a number of multiannual trends.

text: Number of incidents and million user hours lost per year

text: 1942 2000 1711 1514 1500 1240 893 960

text: 445 500 77 95 146 138 158 169 157

text: 0 2012 2013 2014 2015 2016 2017 2018 number of incidents user hours (M)

text:  Total number of incidents reported is stabilizing at around 160: Over the period 2014-2018, there is a consistent number of incidents reported which is stabilizing at around 160 incidents per year.  Sharp drop of the average impact of incidents: Until 2017 there was a gradual increase of total user hours lost per year. But in 2018 we see a sharp drop in the total user hours lost compared to previous years, to just 960 Million user hours. It remains to be seen if this is part of a larger trend or if this year was an exception.  Impact of natural phenomena trending up: Natural phenomena have been trending up rapidly since 2016, and now account for more than half of the user hours lost. For the first time, this year natural phenomena account for more user hours lost than system failures, which used to be the leading root cause in this specific field.  System failures continue to be the most frequent but their average size is trending down: Every year system failures have been the most common root cause category between 60% and 80% of the total number of incidents. Since 2016 the average size of these incidents is decreasing.  Frequency and impact of human errors and malicious actions stable: Over the reporting period the frequency of human errors and malicious actions is stable (approximately accounting for 17% and 5% of incidents per year). Their impact in terms of user hours is stable also.

text: We refer the reader to the body of this paper for more charts and more details.

text: Outlook

text: Security breach reporting has now become a hallmark of EU cybersecurity legislation and this process is an important enabler for cybersecurity supervision and policy making, at national level as well as at EU level. Since 2016 security breach reporting is also mandatory for trust service providers in the EU, under Article 19 of the EIDAS regulation. In 2018, under the NIS Directive (NISD), security breach reporting became mandatory for Operators of Essential Services in the EU and for Digital Service Providers, under

text: Article 14

text: and Article 16 of the NIS directive.

text: Soon, by the end of 2020, the European Electronic Communications Code (EECC) will come into effect across the EU. Under Article 40 of the EECC the breach reporting requirements have a broader scope, including not only outages, but also breaches of confidentiality, for instance. Also there are more services in scope of the EECC, including not only traditional telecom operators, but also for example over-the-top providers of communications services.

text: ENISA is now working with NRAs and experts from the private sector to prepare the ground for these changes and at the same time trying to find and exploit synergies between the different pieces of EU legislation, particularly when it comes to breach reporting and cross-border supervision.

text: We look forward to continuing our close collaboration with the EU member states, the national telecom authorities and experts from the telecom sector from across Europe.

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 1. INTRODUCTION

text: Electronic communication providers in the EU have to notify security incidents with a significant impact on the continuity of electronic communication services, to the national telecom regulatory authorities (NRAs) in each EU member state. Every year the NRAs report a summary to ENISA, covering a selection of these incidents, i.e. the most significant incidents, based on a set of agreed EU-wide thresholds. This document, the Annual Security Incidents Report 2018, This is the 8th aggregates the incident reports reported in 2018 and gives a single EU-wide overview of time ENISA telecom security incidents in the EU. publishes an annual incident This is the 8th time ENISA publishes an annual incident report for the telecom sector. ENISA report for the started publishing such annual reports in 2012. Mandatory breach reporting has been part of the telecom sector. EU’s telecom regulatory framework since the 2009 reform of the telecom package:

text: Article 13

text: a of ENISA started the Framework directive (

text: ) came into force in 2011. publishing such annual reports in Note that although

text: Article 13

text: a itself is fairly broad, the mandatory breach reporting in

text: Article 13

text: a 2012. Mandatory has specific focus on security incidents with a significant impact on the functioning of the breach reporting service. There is some divergence and discussion about what is in scope here, but generally has been part of speaking, in most countries, this was understood to mean that there has to be a service outage. the EU’s telecom Now consider for example an attack in which attackers wiretap major undersea cables; if the regulatory attack causes no outages, then the incident does not fall under the breach reporting framework since requirements of

text: Article 13

text: a. Recently the Council and Parliament agreed with an update of the the 2009 reform of EU telecom rules called the European Electronic Communications Code (EECC). The breach the telecom reporting requirements in (

text: Article 40

text: of) the EECC have a broader scope, including not only package: Article incidents causing outages, but also, for example, breaches of confidentiality. An incident like the 13a of the one just mentioned would be reportable under (

text: Article 40

text: of) the EECC. Framework directive This document is structured as follows: In section 2 we briefly summarize the reporting (

text: ) procedure and to give an idea about the kind of incidents that are reported we give some came into force in specific but anonymized examples of incidents that occurred in 2018. In Section 3 we provide 2011. some key facts and statistics about the 2018 incidents. In Section 4 we take a closer look at power cuts. In section 5 we look at multiannual trends over the years 2012-2018. Conclusions about trends and comparisons with previous years have to be made with care, because national reporting has improved over the years, reporting thresholds have been lowered in most countries, etc.

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 2. INCIDENT REPORTING FRAMEWORK AND EXAMPLES OF INCIDENTS

text: We briefly explain the main features of the incident reporting procedure, as described in the

text: Article 13

text: a Technical Guideline on Incident Reporting , which was developed in collaboration with the NRAs.

text: 2.1 INCIDENT REPORTING FRAMEWORK

text: Article 13

text: a introduces three types of incident reporting: 1) National incident reporting from providers to NRAs, 2) Ad-hoc incident reporting between NRAs and ENISA, and 3) Annual summary reporting from NRAs to the EC and ENISA. The different types of reporting are shown in the diagram below.

text: Note that in this setup ENISA acts as a collection point, anonymizing aggregating and analysing the incident reports. In the current setup NRAs can search incidents in the reporting tool (CIRAS) but the incident reports themselves do not refer to countries or providers, making the overall summary reporting process less sensitive.

text: 2.2 EXAMPLES OF INCIDENTS REPORTED

text: We give some specific examples of incidents to give an idea of the kind of incidents that are notified to NRAs and then included in the annual summary reporting to ENISA:

text:  A system failure caused a mobile internet, telephony and SMS outage for

text: thousands of users (duration: hours, connections: thousands, cause: software

text: bug): A software bug occurred in the SPR (Subscriber Profile Repository) server. Following the repeated instability of the equipment, the signalling traffic increased and

text: the STP (Signalling Transfer Point) platforms became overloaded. As a result, end users had difficulties to access mobile internet services as well as voice and SMS services. The vendor responded by fully restoring the functionality of the SPR equipment. In order to stop the avalanche of signalling messages, the 3G and 4G networks were partially shut off and all subscribers were located on the 2G network.  A power cut caused by a heavy storm affected mobile, fixed services and Cable

text: TV for hundreds of users (duration: hours, connections: thousands, cause:

text: heavy wind/storm): A heavy storm combining with heavy winds strongly affected assets in a defined area causing outages to mobile and fixed services. The operator emergency team was activated. A number of emergency generators was used and a number of VSAT antennas was installed on affected sites.  A malicious action caused a mobile internet outage for a million of users (duration: hours, connections: a million, cause: Denial of Service attack): The network was subject to a cyber-attack (Denial of Service attack) which caused congestion and degraded service. Mobile switches and routers were affected by this attack. The network had self-recovered after the attack had ceased.  A human error caused a mobile internet outage for millions of users (duration: hours, connections: millions, cause: faulty software change/update): Due to a human error (wrong software configuration) during the migration of the packet gateway, clients of one operator were not able to use mobile data. Mobile switches were affected by this incident. A rollback was successfully executed to resolve the issue.  Fixed telephony, broadband internet, cable TV service lost due to cable cuts (duration: hours - days, connections: thousands, cause: human errors): A number of network outages were suffered due to cable cuts during construction and road excavation work. Networks were restored following manual repair intervention on damaged cables.

text: Note that the experts from NRAs have access to the CIRAS incident reporting tool where they can search for and study specific incidents. This tool anonymizes which country was involved. For externals ENISA runs an online visual tool which can be used for custom analysis of the data: https://www.enisa.europa.eu/topics/incident-reporting/for-telcos/visual-tool

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 3. ANALYSIS OF THE INCIDENTS

text: In total, all 28 EU Member States and 2 EFTA countries participated in this process. Of these, 19 Member States and 2 EFTA countries reported in total 157 significant incidents and 5 countries reported there were no significant incidents. In this section, the 157 reported incidents are aggregated and analysed. First, the impact per root cause category is analysed (in section 3.1), in section 3.2 we focus on the user hours that have been lost per root cause category, then detailed causes are examined (Section 3.3), and in Section 3.4 the impact per service is analysed.

text: 3.1 ROOT CAUSE CATEGORIES

text: In 2018 roughly two thirds of the telecom security incidents were system failures. This is consistent with previous years. Often they are hardware failures and software bugs. Also human errors are stable at around 18%. Most often these are accidental cable cuts and faulty software changes/updates. 10% of the incidents are caused by natural phenomena, two times less than the previous year. Only 5% of incidents were due to malicious actions. Typically these cases are denial of service attacks and cable theft.

text: Root cause categories Telecom security incidents - 2018 5% 10%

text: System failures

text: Human errors

text: Natural phenomena

text: Malicious actions

text: There is a fifth category called Third-party failures, which can be selected (only) in conjunction with another root cause category. Typically third party failures are incidents which happen at a utility company or supplier and then affect the telecom providers, for example a power cut. In total over 2018, 9% of incidents were flagged as third-party failures. The division is shown in the chart below.

text: Third party failures - 2018 0%

text: System failures

text: 4% 6% 5%

text: System failures - Third party failures

text: Human errors

text: Human errors - Third party failures

text: Natural phenomena

text: Natural phenomena - Third party failures

text: Malicious actions

text: Malicious actions - Third party failures

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 3.2 USER HOURS LOST FOR EACH ROOT CAUSE CATEGORY

text: Adding up the total user hours lost for each root cause category we find that than half of the total user hours lost were due to natural phenomena (50%, 482 million user hours). All system failures combined account for two fifths of user hours lost (39%, 380 million user hours).

text: So although system failures are the most common (see section 3.1), they are having less impact than natural phenomena. In 2018 the natural phenomena are the dominant root cause category in terms of user hours lost. The multi annual trends graph for user hours lost per root cause category (see section 5.3) shows this is the first year that natural phenomena account for more user hours lost than system failures.

text: 3.3 DETAILED CAUSES

text: An incident is often not only triggered by one cause but often by multiple causes and a chain of causes. For instance, detailed causes could be:

text: 1. Heavy snow 2. Power cut

text: In this case, the root cause of the incident could be natural phenomena, and the description of a possible event could be as follows: an incident may initially be triggered by heavy snow, which tears down power supply infrastructure causing a power cut, which in turn leads to a telecom outage. For this example, both heavy snow and power cut are detailed causes. These detailed causes are equally represented in the statistics, because both causes may be addressed by the provider in terms of security measures.

text: Detailed cause

text: 30% 28% 25%

text: 20% 16%

text: 15% 12%

text: 10% 7% 7%

text: 6% 3%

text: 5% 0%

text: In 2018, the most common cause of incidents was hardware failures, which confirms the multiannual trend in which hardware failure is always either the first or the second most common cause. Also, faulty software changes/updates became the second most common “detailed cause” as just under a fifth of the incidents reported were caused by them. Both with software bugs and power cuts remained at the top four causes of the last three years. Many detailed causes of incidents reports do not fall under a specific category and form the category of “Other” which has a minor position in this year’s overall chart.

text: ENISA runs an online visual tool which can be used by externals to do custom analysis over the full dataset. See: https://www.enisa.europa.eu/topics/incident-reporting/for-telcos/visual-tool For example, by selecting system failures (top left), then fixed internet and telephony (top right), the charts at the bottom show the detailed causes for this subset.

text: 3.4 SERVICES AFFECTED

text: For fourth year in a row, most of the reported incidents affected mobile services. This year, almost the half of the incidents reported had an impact on mobile telephony and internet in the EU. This confirms the shift of the last years. Fixed telephony was the most affected service only in the early years of reporting.

text: Services affected

text: 50% 45% 40% 35%

text: 29% 28%

text: 20% 10% 0% Fixed internet Fixed telephony Mobile internet Mobile telephony Other services

text: Note that for most reported incidents there is impact on more than one service, which explains why the percentages in the chart here add up to more than 100%.

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 4. DETAILED ANALYSIS: POWER CUTS

text: In 2018 15% of the incidents involved a power cut, as a detailed cause, but these incidents accounted for half of the total user hours lost (50%, 496 million user hours). In this section, we take a closer look at the power cuts. In many countries NRAs are currently analysing and mitigating the dependencies of the telecom sector on the electricity subsector. In some countries NRAs have issued specific rules on battery-life of base stations for example. In other countries the NRA is taking stock of possible contingency measures in case of long lasting outages, such as increasing the output power of large sites.

text: We look at the user hours lost for the main detailed causes. The graph below shows millions of user hours lost for each detailed cause. Clearly power cuts have a major impact.

text: User hours lost per detailed cause

text: 600 496 500 407 400 346 300 200 126 97 96 80 100 62 38 5 0

text: For all incidents involving power cuts we show the root cause categories of these incidents in the graph below. Most incidents involving a power cut were categorized as either natural phenomena (52%) or system failures (42%).

text: Root causes for power cuts 4%

text: Natural phenomena

text: 42% System failures

text: Human errors

text: Power cuts had a large impact on mobile services as 79% of the reported incidents affected mobile telephony while 70% of them had an impact on mobile internet. This is not surprising because the mobile network infrastructure, the mobile base stations, relies on power and it is not easy to mitigate power cuts: Batteries last only a short time, and they are vulnerable to theft.

text: Services affected by power cuts

text: 70% 60%

text: 50% 45%

text: 40% 30% 20% 10% 0% Fixed internet Fixed telephony Mobile internet Mobile telephony Other services

text: Note that by using the ENISA visual tool at https://www.enisa.europa.eu/topics/incidentreporting/for-telcos/visual-tool one can study also other detailed causes. For example by selecting all years (top) and denial of service attacks (bottom right) we see that over the years denial of service affect mostly addressing servers.

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 5. MULTI-ANNUAL TRENDS ON PERIOD 2012-2018

text: ENISA has been collecting and aggregating incident reports since 2012. In this section we look at the multiannual trends over the last 7 years, covering from 2012 to 2018. This dataset contains 940 reported incidents in total.

text: 5.1 MULTIANNUAL TREND ROOT CAUSE CATEGORIES

text: Every year from 2012 to 2018, system failures are the most common root cause, roughly two thirds every year. In total system failures account for 636 of incident reports (68% of the total). For this root cause category, over the last 7 years, the most common causes were hardware failures (36%) and software bugs (29%). The second most common root cause over the 7 years of reporting is human errors with nearly a fifth of total incidents (17%, 162 incidents in total). Natural phenomena come third at just under a tenth of total incidents (9%, 89 incidents in total). Only 4% of the incidents are categorized as malicious actions. In the period 2012-2018 two thirds of the malicious actions consist of Denial of Service attacks, and the rest are mainly damage to physical infrastructure.

text: Root cause categories Telecom security incidents in the EU - reported over 2012-2018

text: 80% System failures 60% Human errors 40% Natural phenomena 20% Malicious actions 0% 2012 2013 2014 2015 2016 2017 2018

text: 5.2 MULTIANNUAL TREND IMPACT PER SERVICE

text: In 2018 mobile networks and services were the most impacted by incidents. This is part of a multiannual trend. Only in 2014 the fixed networks and services was where the most affected. Looking back at the 7 years of annual incident reporting, a total of 940 incidents, almost half had an impact on mobile internet or mobile telephony. The chart below shows the multiannual trends over the 2012-2018 period.

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 Trend on impact per service

text: 2017, 52%

text: 50% 2014, 45% 40% 30%

text: 2015, 34% 2014, 32%

text: 2013, 21%

text: 10% 0% 2012 2013 2014 2015 2016 2017 2018 Mobile telephony Mobile internet Fixed telephony Fixed internet

text: 5.3 MULTIANNUAL TREND USER HOURS PER ROOT CAUSE CATEGORY

text: Adding up the total user hours lost per root cause category, we observe that natural phenomena have been increasing since 2016. In 2018, for the first time, natural phenomena are the dominant root cause category. Last year natural phenomena accounted for more than half of the total user hours lost. We observe a downward trend in the user hours lost due to system failures which started in 2016. The other root cause categories are relatively stable over the years.

text: User hours lost per root cause category - multiannual 2012- 2018 (percentage of total user hours lost)

text: 100 80 60 40 20 0 2012 2013 2014 2015 2016 2017 2018 system failures human errors natural phenomena malicious actions

text: 5.4 MULTI-YEAR TREND NUMBER OF INCIDENTS AND USER HOURS

text: In the chart below we show the total number of incidents reported over the year. Over the years, the number of incidents included in annual summary reporting to ENISA has increased slowly and it seems to stabilize at around 160 per year. This is probably due to more reporting by providers, better awareness about the reporting obligations, and partly due to lower national thresholds for annual summary reporting.

text: In the chart below we also show total numbers of incidents reported and total user hours lost per year over the period 2014-2018. There was an upward trend in user hours lost reaching a peak in 2017 with 1942 million user hours lost. Interestingly there was a sharp drop in the average user hours lost per incident reported over 2018. It remains to be seen if this decrease

text: is structural and sustained in the future, i.e. whether 2018 is the exception or the start of a longer trend. Several NRAs have remarked that overall incident size seems to be smaller, possibly due to improvements on the operator side, i.e. changed network topology, better architecture, better core components, etc.

text: 1942 2000 1711 1514 1500 1240 893 960

text: 445 500 157 77 95 146 138 158 169

text: 0 2012 2013 2014 2015 2016 2017 2018

text: number of incidents user hours (M)

text: ANNUAL REPORT TELECOM SECURITY INCIDENTS 2018 6. CONCLUSIONS

text: With the adoption This annual report telecom security incidents 2018 marks the 8th time ENISA publishes an of the European annual report for the telecom sector. ENISA started publishing annual reports about telecom Electronic security incidents in 2012. Mandatory breach reporting has been part of the EU’s telecom Communications regulatory framework since the 2009 reform of the telecom package:

text: Article 13

text: a of the Code (EECC), Framework directive (

text: ) came into force in 2011. due to be transposed in We refer to the executive summary for some of the key findings and statistics facts about the national law by incidents that occurred in 2018 and the multiannual trends over 2012-2018. We would like to the Member conclude with some more general observations about this process and the broader policy States by the end context. of 2020, the telecom security  Security breach reporting under

text: Article 13

text: a has been implemented pragmatically and breach reporting efficiently by the NRAs. Although the incidents in scope of this reporting are only a very will be further small part of the cybersecurity universe, as near misses, risks, threats, etc. are for aligned with the example not included, NRAs have said that this cross-EU process was extremely breach reporting helpful . The process of mandatory notification by operators yielded interesting data under the NIS and facts for policy makers both at EU and national level, for NRAs, and other Directive. competent authorities.  Security breach reporting has become a hallmark of EU cybersecurity legislation and the security breach reporting under

text: Article 13

text: a was the basis for the breach reporting requirements in eIDAS (

text: Article 19

text: ) and the NIS Directive (

text: Article 14

text: Article 16

text: ). All three laws take an all-hazard approach to cybersecurity incidents and they have comparable notification thresholds. This means that competent authorities can build on each other’s experience when implementing such legislation.  With the adoption of the European Electronic Communications Code (EECC), due to be transposed in national law by the Member States by the end of 2020, the telecom security breach reporting will be further aligned with the breach reporting under the NIS Directive. In particular, the definition of what is a security incident and the definition of notification thresholds are now fully aligned. This means there is a clear opportunity to synergize and harmonize taxonomy, processes and tools. ENISA is supporting the process of finding and exploiting these synergies for example by using the same taxonomy of root causes.  Two years ago the NIS Directive (NISD) established a cooperation group (the NIS Cooperation group, or NIS CG) for strategic collaboration between EU Member States on cybersecurity issues. Specific sectoral work is now happening in subgroups, for example there is a NIS CG work stream for the Energy sector (very important for the telecom sector, see Section 4), there is a working group for NISD Competent authorities who supervise the Digital Service providers and recently a work stream on 5G security issues was started.. This means there is a clear benefit for the NRAs in the

text: Article 13

text: a expert group to have a good liaison with the NIS Cooperation group and we look forward to exchanging experience and doing joint work.  When the EECC comes into effect by the end of 2020, the telecom regulators will be dealing with a new type of provider, the so-called over-the-top communication services

text: like Whatsapp. This means coordination and collaboration between NRAs across the EU will become even more important.

text: We look forward to continue our close collaboration with the telecom regulators in the future and we look forward to develop a new reporting process for breach reporting and security supervision under the EECC, building on our joint experience and lessons learned with

text: Article 13

text: a.

text: -N -EN -001 -19 -AD TP

text: ABOUT ENIS A

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: ISBN 978-92-9204-296-7 doi: 10.2824/350004


text: July 2020

text: July 2020

text: July 2020

text: Using a basis of 500M (EU citizens) times 365 (days) times 24 (hours). User hours is a metric we use throughout this report to quantify the impact of an incident, multiplying the number of subscribers/connections affected, with the duration in hours. For example, 1M User Hours means 1M users were affected for one hour, or 2M users for half an hour, etc.

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: Hardware failures 30

text: Software bugs 21

text: Faulty software change/update 15

text: Other 11

text: Power cut 9

text: Policy/procedure flaw 6

text: Overload 6

text: Cable cut 3

text: Cable cut 12

text: Faulty software change/update 9

text: Other 6

text: Power cut 6

text: Faulty hardware change/update 4

text: Policy/procedure flaw 3

text: Security shutdown 2

text: External env causes 1

text: Power cut 15

text: Heavy wind 12

text: External env causes 5

text: Heavy snow/ice 3

text: Cable cut 2

text: Flood 1

text: Other 1

text: Fire 1

text: Hardware failure 1

text: July 2020

text: DDoS 3

text: Arson 2

text: Cable cut 2

text: Power cut 1

text: Vulnerability exploit 1

text: Hardware failure 1

text: Fixed internet Fixed telephony Mobile internet Mobile telephony

text: July 2020

text: July 2020

text: July 2020

text: July 2020

text: Mobile telephony 35%

text: Mobile internet 40%

text: Fixed internet 45%

text: Fixed telephony 50%

text: July 2020

text: July 2020

text: Mobile telephony Mobile internet Fixed telephony Fixed internet

text: July 2020

text: July 2020

identifier: Telecom Services Security Incidents 2019 Annual Analysis Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Telecom Services Security Incidents 2019 Annual Analysis Report

serie: rapporter

text: TELECOM SERVICES SECURITY INCIDENTS 2019 Annual Analysis Report JULY 2020 0

type: rubrik

text: TELECOM SERVICES SECURITY INCIDENTS 2019 ABOUT ENISA

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For technical queries about this paper, please email resilience@enisa.europa.eu For media enquires about this paper, please email press@enisa.europa.eu

text: AUTHORS

text: Georgia Bafoutsou, Aggelos Koukounas, Marnix Dekker - ENISA

text: ACKNOWLEDGEMENTS

text: We are grateful for the review and input received from the experts in the ENISA Article 13a Expert Group which comprises national telecom regulatory authorities (NRAs) from in the EU and EEA, EFTA and EU candidate countries.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: Catalogue number: TP-AD-20-001-EN-N ISBN: 978-92-9204-350-6 DOI: 10.2824/491113

text: TELECOM SERVICES SECURITY INCIDENTS 2019

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 7 2. INCIDENT REPORTING FRAMEWORK 8

text: 2.1 INCIDENT REPORTING FRAMEWORK 8

text: 2.2 EXAMPLES OF INCIDENTS REPORTED 8

text: 2.3 INCIDENT REPORTING TOOL 9

text: 3. ANALYSIS OF THE INCIDENTS 10

text: 3.1 ROOT CAUSE CATEGORIES 10

text: 3.2 USER HOURS LOST FOR EACH ROOT CAUSE CATEGORY 11

text: 3.3 DETAILED CAUSES 11

text: 3.4 SERVICES AFFECTED 13

text: 4. DETAILED ANALYSIS – HUMAN ERRORS 16 5. MULTI-ANNUAL TRENDS 18

text: 5.1 MULTIANNUAL TRENDS - ROOT CAUSE CATEGORIES 18

text: 5.2 MULTIANNUAL TRENDS - IMPACT PER SERVICE 18

text: 5.3 MULTIANNUAL TRENDS - USER HOURS PER ROOT CAUSE 19

text: 5.4 MULTIANNUAL TRENDS - NUMBER OF INCIDENTS AND USER HOURS 20

text: 6. CONCLUSIONS 21

text: 6.1 KEY TAKEAWAYS 21

text: 6.2 OBSERVATIONS 21

text: EXECUTIVE SUMMARY

text: In the EU, telecom operators notify significant security incidents to the National Regulatory authority (NRA) in their country. At the start of every calendar year, the national authorities for In 2019, half of the telecom security send a summary about these incidents to ENISA. This document, the Annual total user hours Report Telecom Security Incidents 2019, covers the incidents reported by the authorities for the lost were due to calendar year 2019 and it gives an anonymised, aggregated EU-wide overview of telecom system failures. security incidents.

text: In 2019, human

text: Security incident reporting has been part of the EU’s telecom regulatory framework since the

text: errors were more

text: 2009 reform of the telecom package:

text: Article 13

text: a of the Framework directive (

text: frequent, an

text: came into force in 2011. The incident reporting in

text: Article 13

text: a focuses on security incidents with

text: increase of 50%

text: significant impact on the operation of services, i.e. outages of the electronic communication

text: compared to 2018

text: networks and/or services.

text: Statistics annual summary reporting 2019

text: The 2019 annual summary reporting contains reports about 153 incidents submitted by national authorities from the 26 EU Member States and 2 EFTA countries. The total user hours lost, multiplying for each incident the number of users and the number of hours was 988.12 Million User Hours, i.e. roughly 0.026% of the total user hours in a year .

text: It should be noted that the current incident reporting is not the full telecom security picture, because it only covers the largest incidents that cause the big outages.

text: Figure 1: Number of incidents and million user hours lost per year

text: TELECOM SERVICES SECURITY INCIDENTS 2019 Key takeaways from the 2019 incidents

text:  System failures dominate in terms of impact: they represent almost half of the total user hours lost (479 million user hours). They are also the most frequent root cause of incidents: 56% of the total. Over the last 4 years, both the frequency and overall impact of system failures have been trending down significantly.

text:  Incidents caused by human errors have risen: More than a quarter (26%) of total incidents have human errors as a root cause. Human errors have increased with 50% compared to the previous year.  Third-party failures show a great increase: Almost a third of the incidents were also flagged as third-party failures (31%), i.e. incidents which originated in third party, say a utility company, a contractor, a supplier, etc. This number tripled compared to 2018, when it was just 9%.

text: Figure 2: Root Causes and Third party failures – 2019

text:  Power cuts are the second most common detailed cause: Overall, independent from the underlying root cause, power cuts are either a primary or a secondary cause in over a fifth of the major incidents.  Natural phenomena have a major impact: Natural phenomena account for a third of the total user hours lost, which brings them in the second place in terms of impact.

text: Figure 3: Share of user hours lost for each root cause category in 2019

text: ENISA offers an online visual tool for analysing the incidents. It can be used to dive into other aspects and detailed causes. See:

text: Multiannual trends over 8 years of reporting

text: Every year, the incident data points to important issues and trends. Apart from the national initiatives, the EU telecom security authorities also collaborate with ENISA on an EU level to analyse and work on specific issues.

text: Figure 4: Root cause categories Telecom security incidents in the EU - reported over 2012-2019

text:  Total number of incidents reported is stabilizing at around 160: Over the period 2014-2019, there is a consistent number of incidents reported which is stabilizing at around 160 incidents per year.  Sharp drop of the average impact of incidents: Until 2017, there was a gradual increase of total user hours lost per year. But in 2018 we see a sharp drop in the total user hours lost compared to previous years. This trend continues in 2019.  Share of incidents caused by human errors is trending up: The percentage of incidents caused by Human errors in regards with the total number of incidents has been trending up since 2016 and now in 2019 they account for 21% of the total number of incidents.  System failures continue to be the most frequent cause of incidents, but their average size is trending down: Every year system failures have been the most common root cause category. Although, since 2016 the average size of these incidents is decreasing, between 2018 and 2019 we observe a slight increase in lost user hours due to system failures, and a corresponding decrease to hours lost due to natural phenomena.  Frequency and impact of malicious actions stable: Over the reporting period the frequency of malicious actions is stable (approximately accounting for 5% of incidents per year). Their impact in terms of user hours is stable also.

text: We refer the reader to the body of this paper for more details.

text: TELECOM SERVICES SECURITY INCIDENTS 2019 Outlook

text: Security incident reporting has is a hallmark of EU cybersecurity legislation and it is an important enabler for cybersecurity supervision and policy making, at national and EU level. Since 2016 security incident reporting is also mandatory for trust service providers in the EU, under Article 19 of the EIDAS regulation. In 2018, under the NIS Directive (NISD), security incident reporting became mandatory for Operators of Essential Services in the EU and for Digital Service Providers, under

text: Article 14

text: and Article 16 of the NIS directive.

text: By the end of 2020, the European Electronic Communications Code (EECC) will come into effect across the EU. Under Article 40 of the EECC the incident reporting requirements have a broader scope, including not only outages, but also breaches of confidentiality, for instance. Also, there are more services in scope of the EECC, including not only traditional telecom operators, but also for example over-the-top providers of communications services.

text: In 2020, the annual reporting guideline will be updated to include new thresholds for annual summary reporting to ENISA combining quantitative and qualitative parameters and also the notification of security incidents affecting not only the services of fixed and mobile internet and telephony, but also the number-based interpersonal communications services and/or number independent interpersonal communications services (OTT communications services).

text: ENISA has been working with national authorities and experts from the private sector to prepare the ground for the above mentioned changes.

text: ENISA is also working with the NIS Cooperation group to find and exploit synergies between the different pieces of EU legislation, particularly when it comes to incident reporting and crossborder supervision.

text: We look forward to continuing our close collaboration with the EU member states, the national telecom authorities and experts from the telecom sector from across Europe to implement security incident reporting efficiently and effectively.

text: TELECOM SERVICES SECURITY INCIDENTS 2019 1. INTRODUCTION

text: Electronic communication providers in the EU have to notify security incidents with a significant impact on the continuity of electronic communication services, to the national telecom regulatory

text: This is the 9th

text: authorities (NRAs) in each EU member state. Every year the NRAs report a summary to ENISA,

text: time ENISA

text: covering a selection of these incidents, i.e. the most significant incidents, based on a set of

text: publishes an

text: agreed EU-wide thresholds. This document, the Annual Security Incidents Report 2019,

text: annual incident

text: aggregates the incident reports reported in 2019 and gives a single EU-wide overview of

text: report for the

text: telecom security incidents in the EU.

text: telecom sector.

text: This is the 9th year ENISA publishes an annual incident report for the telecom sector. ENISA

text: Mandatory

text: started publishing such annual reports in 2012. Mandatory incident reporting has been part of

text: incident

text: the EU’s telecom regulatory framework since the 2009 reform of the telecom package: Article

text: reporting has

text: 13a of the Framework directive (

text: ) came into force in 2011.

text: been part of the

text: The mandatory incident reporting under

text: Article 13

text: a has a specific focus on security incidents EU’s telecom with a significant impact on the functioning of the service. There is some divergence and regulatory discussion about what is in scope here, but the authorities agreed to focus on network/service framework since outages. This would leave out of scope for example an attack involving a wiretap on an the 2009 reform undersea cable or a BGP hijack, if the attack causes no outages. Recently the Council and of the telecom Parliament agreed about an update of the EU telecom rules called the European Electronic package: Article Communications Code (EECC). The incident reporting requirements in (

text: Article 40

text: of) the EECC 13a of the have a broader scope, including explicitly also for example breaches of confidentiality. An Framework incident like the one just mentioned would be reportable under (

text: Article 40

text: of) the EECC. directive

text: This document is structured as follows: In section 2 we briefly summarize the reporting came into force procedure and to give an idea about the kind of incidents that are reported we give some in 2011. specific but anonymized examples of incidents that occurred in 2019. In Section 3 we provide some key facts and statistics about the 2019 incidents. In Section 4 we take a closer look at Human Errors as a root cause of incidents. In section 5 we look at multiannual trends over the years 2012-2019.

text: Note that conclusions about trends and comparisons with previous years have to be made with care, because national reporting thresholds have changed over the years, reporting thresholds have been lowered in most countries, and because the incident reporting only covers the most significant incidents (and not smaller incidents which may be more frequent).

text: TELECOM SERVICES SECURITY INCIDENTS 2019 2. INCIDENT REPORTING FRAMEWORK

text: We briefly explain the main features of the incident reporting process, as described in the

text: Article 13

text: a Technical Guideline on Incident Reporting , which was developed in collaboration with the national authorities.

text: 2.1 INCIDENT REPORTING FRAMEWORK

text: Article 13

text: a introduces three types of incident reporting: 1) National incident reporting from providers to NRAs, 2) Ad-hoc incident reporting between NRAs and ENISA, and 3) Annual summary reporting from national authorities to the EC and ENISA. The different types of reporting are shown in the diagram below.

text: Figure 5: Incident Reporting Framework for Telecom Servicies

text: Note that in this setup ENISA acts as a collection point, anonymizing aggregating and analysing the incident reports. In the current setup NRAs can search incidents in the reporting tool (CIRAS) but the incident reports themselves do not refer to countries or providers, making the overall summary reporting process less sensitive.

text: 2.2 EXAMPLES OF INCIDENTS REPORTED

text: We give some specific examples of incidents to give an idea of the kind of incidents that are notified to NRAs and then included in the annual summary reporting to ENISA:

text:  Three high-capacity optical fibres were simultaneously cut, which caused mobile

text: internet and telephony and also fixed internet and telephony outage in a national level for three hours (duration: hours, connections: thousands, cause: human

text: errors): In two of these cases, the cables were cut as a result of road modernization

text: works (carried out by third parties); in the third case, the optical fiber was affected following a landslide. The incident had a national impact.

text:  The fixed network of an operator got isolated from all other networks during 3

text: hours, affecting emergency calls from all the other networks for millions of users for 3 hours (duration: hours, connections: millions, cause: system failures):

text: Since all emergency call centres were connected to this fixed network, emergency calls were not possible from all those other networks. The cause of the incident was a software bug that caused an interconnection platform to fail due to a combination of circumstances. Following this incident, multiple meetings were organized between the NRA, the main operators and the emergency services to identify single points of failure and discuss possible technical solutions to avoid similar incidents in the future and reduce their impact.

text:  A DDos attack caused a 13 hour outage of the VoIP service for 400.000 users (duration: hours, connections: thousands, cause: malicious actions): Corrective measures taken included hardening of the systems and hardening of firewall rules.

text:  A power outage caused mobile telephony, internet and sms outage for 100000

text: users and duration of 10 hours (duration: hours, connections: thousands, cause:

text: natural phenomena): A power outage caused by a storm had as a result the failure of the technological terminal equipment in the whole country. All processes we set up successfully and spare power supplies were activated.

text:  A software bug of a third party internet access service provider affected a data

text: center, causing email (OTT service) outage for more than a hundred users during 8 hours (duration: hours, connections: thousands, cause: system

text: failures: The affected data center caused an outage of the email service. The connections with the third party internet access service provider were reduced.

text: 2.3 INCIDENT REPORTING TOOL

text: In 2020, ENISA has released a new version of CIRAS, the tool for statistical analysis of cybersecurity incidents. Telecom security incidents reported for the year 2019 are available on the new CIRAS

text: Experts from the national authorities have access to the ENISA CIRAS incident reporting tool, where they can search for and study specific incidents. This tool anonymizes the country or operator involved.

text: TELECOM SERVICES SECURITY INCIDENTS 2019 3. ANALYSIS OF THE INCIDENTS

text: In 2019, 26 EU Member States and 2 EFTA countries participated in the annual reporting, reporting a total of 153 significant incidents. In this section, the 153 reported incidents are aggregated and analysed. First, the impact per root cause category is analysed (in section 3.1), in section 3.2 we focus on the user hours that have been lost per root cause category, then detailed causes are examined (Section 3.3), and in Section 3.4 the impact per service is analysed.

text: 3.1 ROOT CAUSE CATEGORIES

text: In 2019 more than half of the telecom security incidents were system failures. This is consistent with previous years, although somewhat lower. Often they are hardware failures and software bugs. Human errors show an increase, rising up to one fourth of the security incidents. Most often these are accidental cable cuts and faulty software changes/updates. 13% of the incidents are caused by natural phenomena also increased up to 30% compared to the previous year. Only 5% of incidents were due to malicious actions. Typically these cases are denial of service attacks, cable theft and arson.

text: Figure 6: Root cause categories Telecom security incidents – 2019

text: There is a fifth category called Third-party failures, which can be selected (only) in conjunction with another root cause category. Typically third party failures are incidents which happen at a utility company or supplier and then affect the telecom providers, for example a cable cut.

text: Figure 7: Root Causes and Third party failures - 2019

text: In total over 2019, 32% of incidents were flagged as third-party failures, which is greatly increased in comparison with the previous years. The division is shown in the chart below.

text: 3.2 USER HOURS LOST FOR EACH ROOT CAUSE CATEGORY

text: Adding up the total user hours lost for each root cause category we find that almost half of the total user hours lost were due to system failures (48%, 479 million user hours). Natural phenomena account for almost one third of user hours lost (30%, 289 million user hours) and human errors for almost one fifth of user hours lost (21%, 208 million user hours).

text: Figure 8: Share of user hours lost for each root cause category in 2019

text: So system failures are the most common (see section 3.1) and they also have more impact than the other root causes. However, human errors have doubled their percentage in impact and they are also more common than in 2018. Also, natural phenomena have less impact than 2018, although the number of incidents caused by natural phenomena has raised.

text: The multi annual trends graph for user hours lost per root cause category (see section 5.3) shows this is the first year that natural phenomena account for more user hours lost than system failures.

text: 3.3 DETAILED CAUSES

text: An incident is often not only triggered by one cause but can involve multiple detailed causes, a chain of events.For instance, an incident may be triggered by a storm, which tears down power supply infrastructure, power cuts and cable cuts, which in turn leads to a telecom outage. For this example detailed causes could be: Heavy wind, Cable cut, Power cut, Battery depletion. The root cause of the incident would be natural phenomena.

text: In the following graph we show the frequency of the detailed causes.

text: Figure 9: Detailed causes - 2019

text: In 2019, the most common cause of incidents was hardware failures, which confirms the multiannual trend in which hardware failure is always either the first or the second most common cause. Power cuts became the second most common “detailed cause”. Around a fifth of the incidents reported involved a power cut. Hardware failures, power cuts, faulty software updates and software bugs remain the top four causes, as in the previous years. Some detailed causes mentioned in incidents reports do not fall under a specific category and they are grouped under “Other”.

text: In the following charts, we look at the frequency of detailed causes under each root cause category.

text: Figure 10: System failures - detailed causes

text: Figure 11: Human errors - detailed causes

text: Figure 12: Natural phenomena - detailed causes

text: Figure 13: Malicious actions - detailed causes

text: Custom analysis over the full dataset can be done using CIRAS (see par. 2.3). For example, by selecting system failures (top left), then fixed internet and telephony (top right), the charts at the bottom show the detailed causes for the selected subset of incidents.

text: 3.4 SERVICES AFFECTED

text: In this section we look at the services affected by the incidents. For the fourth year in a row, most of the reported incidents affected mobile services. In 2019, almost the half of the incidents reported had an impact on mobile telephony and internet in the EU. This confirms the shift over the last years. Fixed telephony was the most affected service only in the early years of reporting.

text: Figure 14: Services affected

text: 56% 51%

text: Note that for most reported incidents there is impact on more than one service, which explains why the percentages in the chart here add up to more than 100%.

text: In the following pie charts the affected services are presented in relation to the four root causes.

text: Figure 15: Mobile telephony vs root causes

text: Figure 16: Mobile internet vs root causes

text: Having a closer look at the charts, we can conclude that system failures are the dominant root cause for mobile telephony and internet, whereas in fixed internet, human errors are the most common root cause.

text: Figure 17: Fixed telephony vs root causes

text: In general, fixed telephony and internet seem to be severely affected by human errors even more than natural phenomena. Natural phenomena are responsible for 1 out of 10 incidents in fixed telephony and for the 14% of incidents in fixed internet. Finally, malicious actions are responsible for 10% and 14% of incidents in fixed telephony and internet respectively, however in mobile telephony and internet this percentage is much lower (3% for mobile telephony and the same for mobile internet). Figure 18: Fixed internet vs root causes

text: TELECOM SERVICES SECURITY INCIDENTS 2019 4. DETAILED ANALYSIS – HUMAN ERRORS

text: In 2019, the number of incidents caused by human errors has risen up to 50% compared to the previous year. More than one fourth of the security incidents were caused by human errors and these incidents account for one fifth of the total user hours lost (21%, 208 million user hours).

text: Considering the above remarks, in this section we perform a deep dive in human errors.

text: of the incidents

text: Looking carefully at the multiannual graph above, though it is not the first time since 2012 that were caused by human errors are responsible for almost 20% of the incidents, it seems that they are trending up human error,

text: since 2016. accounting for 208 million user

text: Figure 19: Root cause categories Telecom security incidents in the EU - reported over 2012-2019 hour lost, 21% of

text: the total.

text: For all incidents having as a root cause human errors, we can see the detailed causes in the graph below. Most incidents caused by human errors are about cable cuts and the second more frequent detailed cause is faulty software change or update.

text: Figure 20: Human errors - detailed cause 14 12 10 8 6 4 2 0

text: In 2019, the increased number of incidents caused by human errors (raising from 18% in 2018 to 26% in 2019) is due to third-party failures, taking into account that third-party failures accounted in 2019 for 12% of incidents that had human errors as the root cause, whereas in 2018 this percentage was 3%.

text: Also, as far as human errors are concerned, fixed telephony and internet are the most affected services, which doesn’t follow the general conclusion that mobile internet and telephony are mostly affected by security incidents during the last years.

text: Figure 21: Services affected by human errors

text: As for the affected assets, the graph below indicates that human errors have a major impact on switches and routers in fixed telephony and internet.

text: Figure 22: Assets affected by Human Errors

text: TELECOM SERVICES SECURITY INCIDENTS 2019 5. MULTI-ANNUAL TRENDS

text: ENISA has been collecting and aggregating incident reports since 2012. In this section, we look at the multiannual trends over the last 8 years, covering from 2012 to 2019. This dataset contains 1093 reported incidents in total.

text: Incidents were 5.1 MULTIANNUAL TRENDS - ROOT CAUSE CATEGORIES reported over

text: Every year from 2012 to 2019, system failures are the most common root cause. In 2019,

text: 8 years of

text: however, system failures show a considerable decrease. In fact, in 2019 the number of

text: reporting,

text: incidents due to system failures is the lowest since 2012. In total system failures account for 722

text: of incident reports (66% of the total). For this root cause category, over the last 8 years, the most common causes were hardware failures (36%) and software bugs (28%). The second most common root cause over the 8 years of reporting is human errors with nearly a fifth of total incidents (19%, 202 incidents in total). Natural phenomena come third at almost a tenth of total incidents (9%, 109 incidents in total). Only 5% of the incidents are categorized as malicious actions. In the period 2012-2019 nearly two thirds of the malicious actions consist of Denial of Service attacks, and the rest resulted mainly in lasting damage to physical infrastructure.

text: Figure 23: Root cause categories Telecom security incidents in the EU - reported over 2012-2019

text: 5.2 MULTIANNUAL TRENDS - IMPACT PER SERVICE

text: In 2019 mobile networks and services were the most impacted by incidents. This is part of a multiannual trend. Only in 2014 the fixed networks and services was where the most affected. Looking back at the 8 years of annual incident reporting, a total of 1093 incidents, almost half had an impact on mobile internet or mobile telephony. The chart below shows the multiannual trends over the 2012-2019 period. It indicates the share of the total incidents for each year that involved one of the four classic telecommunication services. For instance, in 2019 56% of the incidents had to do with mobile telephony.

text: Figure 24: Trend on classic services affected per year

text: 60% 2019, 56%

text: 2014, 45%

text: 40% 2015, 34%

text: 2014, 32%

text: 2013, 21%

text: 5.3 MULTIANNUAL TRENDS - USER HOURS PER ROOT CAUSE

text: Adding up the total user hours lost per root cause category, we observe that human errors have been increasing since 2016. In 2019, although system failure is the dominant root cause category, human errors show a raise of almost 50% compared to the previous year. Between 2018 and 2019 we observe a slight increase in lost user hours due to system failures, and a corresponding decrease to hours lost due to natural phenomena. Malicious actions are stable over the years.

text: Figure 25: User hours lost per root cause category - multiannual 2012-2019 (percentage of total user hours lost)

text: TELECOM SERVICES SECURITY INCIDENTS 2019 5.4 MULTIANNUAL TRENDS - NUMBER OF INCIDENTS AND USER HOURS

text: Over the years, the number of incidents included in annual summary reporting to ENISA has increased slowly and it seems to stabilize at around 160 per year. This is probably due to more reporting by providers, better awareness about the reporting obligations, and partly due to lower national thresholds for annual summary reporting.

text: In the chart below we also show total numbers of incidents reported and total user hours lost per year over the period 2012-2019. There was an upward trend in user hours lost reaching a peak in 2017 with 1942 million user hours lost. Interestingly there was a sharp drop in the average user hours lost per incident reported over 2018 and they remain at the same level in 2019. This could lead to the conclusion that 2018 was a start of a longer trend.

text: Figure 26: Number of incidents and million user hours lost per year

text: TELECOM SERVICES SECURITY INCIDENTS 2019 6. CONCLUSIONS

text: This document, the Annual Report Telecom Security Incidents 2019, covers the incidents reported by the authorities for the calendar year 2019 and it gives an anonymised, aggregated EU-wide overview of telecom security incidents. It marks the 9th time ENISA publishes an annual report for the telecom sector.

text: We would like to conclude highlighting the most important findings and including some more general observations about this process and the broader policy context.

text: 6.1 KEY TAKEAWAYS

text: The key takeaways from the 2019 incidents are:  Annual number of incidents seems to be stabilizing at around 160: this shows that the process of incident reporting has matured among operators and national authorities so that worth-mentioning incidents get the attention they deserve. This is probably due to more reporting by providers, better awareness about the reporting obligations, and partly due to lower national thresholds for annual summary reporting.

text:  The sharp decline in total number of user hours lost: between 2017 and 2018, was not an exception. Also in 2019, the number of user hours lost remained low.

text:  Looking into the system failures, hardware failures are a major factor in 2019: almost a quarter of incidents (23%) were caused by hardware failures and they also had a major impact in terms of user hours with 38% of the total. Also, software bugs are still a concern, since they are responsible for 15% of the incidents.

text:  Frequency of human errors is trending up: In 2019, this raise is mostly due to thirdparty failures, often during construction works that led to cable/optic fiber cuts or because of faulty software updates, performed by subcontractors.

text:  Natural phenomena are trending up: due to severe weather conditions and climate change.

text:  One incident involving a fire had a major impact: It can be difficult to recover from a fire and it often takes hours or days before the operator can even start repairs. Fire protection as well as redundancy are important to consider.

text: 6.2 OBSERVATIONS

text: By the end of 2020, the European Electronic Communications Code (EECC) will come into effect across the EU. Under Article 40 of the EECC the incident reporting requirements have a broader scope, including not only outages, but also breaches of confidentiality. Also, there are more services in scope of the EECC, including not only traditional telecom operators, but also for example over-the-top providers of communications services.

text: In 2020, the annual reporting guideline will be updated to include new thresholds for annual summary reporting to ENISA combining quantitative and qualitative parameters. Furthermore, the notification of security incidents affecting not only the services of fixed and mobile internet and telephony, but also the number-based interpersonal communications services and/or number independent interpersonal communications services (OTT communications services).

text: -N -EN -001 -20 -AD TP

text: ABOUT ENIS A

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found www.enisa.europa.eu.

text: ISBN: 978-92-9204-350-6 DOI: 10.2824/491113