identifier: NIS Directive and national CSIRTs

amnesord: EU incident response and cyber crisis management

nummer: nis-directive-and-national-csirts

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: NIS Directive and national CSIRTs

serie: rapporter

text: NIS Directive and national CSIRTs TLP WHITE | Info Note | Final | February 2016

type: rubrik

text: NIS Directive and national CSIRTs

text: 1 Introduction

text: In December 2015, the Commission, the Parliament of the EU, and the Council of Ministers reached an agreement on the Network and Information Security (NIS) Directive (hereafter “the Directive”). This draft Directive still needs to be polished, but a preliminary version is already available. Articles and paragraphs referred to in this document refer to the draft version of the Directive mentioned here. The final text is expected in spring. This document will be adjusted should the NIS Directive change. This note explains the structure of the Directive, and highlights the parts that are relevant to National CSIRTs. For easier reading we refer to national CSIRTs in the context of this document simply as “CSIRT” or “dedicated CSIRT”.

text: 2 Structure of the Directive

text: The Directive is structured around the following sections. More specific provisions directly targeted to CSIRTs (mainly from Chapter 3 and Annex 1) will follow in Section 3: Recitals give the context in which the Directive works. They state the importance and specificities of Network and Information Security, and describe the actors that will need to play a role. Chapter 1. General provisions. This Chapter describes the goals of the Directive, and its legislative environment. It also gives formal definitions to terms that appear in the text. Chapter 2. National frameworks on NIS. This Chapter lists the different entities and legislative frameworks that each Member State will have to set up in order to comply with the Directive. Each MS needs to adopt a national NIS strategy; designate one or more national competent authorities, as well as a single point of contact for cross-border cooperation; and set up at least one Computer Security Incident Response Team (CSIRT). These teams need to cover certain sectors and services. Chapter 3. Cooperation between competent authorities. This Chapter defines two groups meant to improve NIS-related cooperation between MS. The first is the Cooperation Network, composed of representatives of MS, the Commission, and ENISA. This group is meant to focus on strategic issues. The second group is the CSIRT Network, composed of representatives of MS’ CSIRT and CERT-EU, with the Commission as observer and ENISA as Secretary and active support. Chapter 4. Security of the NIS of operators of essential services. This Chapter defines security requirements for and duties of operators of essential services. These services are described in Annex 2 of the Directive. Chapter 4a. Security of the NIS of digital service providers. This Chapter defines security requirements for and duties of digital service providers. These providers are described in Annex 3 of the Directive. Chapter 4b. Standardisation. This Chapter encourages the use of EU standards. Chapter 5. Final provisions. This Chapter covers all other aspects, like the details the timeline for transposition of the Directive, or penalties. Annex 1. Requirements and tasks of the CSIRT. This Annex gives a list of tasks that a MS’ CSIRT has to perform.

text: © European Union Agency for Network and Information Security (ENISA), 2016 01 NIS Directive and national CSIRTs

type: stycke

text: Annex 2. Sectors and entities. This Annex lists the sectors and subsectors that need to be covered by each country’s Information Security Strategy and CSIRTs. Annex 3. Types of digital services. This Annex lists the digital services targeted by the Directive.

text: 3 CSIRTs

text: Article 7 of the Directive gives the framework for CSIRTs. The following table presents each paragraph, and if necessary comments on what it means for the relevant CSIRTs.

text: PARAGRAPH STATEMENT MEANING

text: Each Member State shall designate one or more Each MS will designate one or more CSIRT. Together, Computer Security Incident Response Teams (hereinafter: these CSIRTs need to cover the sectors and services listed "CSIRTs ") covering at least the sectors referred to in in Annex II and III. Annex II and types of digital services referred to in Annex 1 III, responsible for handling incidents and risks according The designated CSIRT(s) need to fulfil the requirements to a well-defined process, which shall comply with the and tasks listed in Annex I. This is one of the places where requirements set out in point (1) of Annex I. A CSIRT may the Directive points to “adequate resources and be established within a competent authority. equipment” for the CSIRT.

text: The Directive does not impose a structure or hierarchy for Where they are separate, the competent authority, the single point of contact and the CSIRTs of the same the competent authority, the single point of contact and the CSIRTs. They may be together in one organisation, or Member State shall cooperate with regard to the obligations laid down in this Directive. Where a Member be separate. What matters is that, together, they have to State decides that CSIRTs shall not receive notifications, fulfil the obligations defined by the Directive. Each 1a Member State will have to come up with the structure the CSIRTs shall, to the extent necessary to fulfil their tasks, be granted access to data on incidents notified by that suits them. operators of essential services pursuant to Article 14(2) The designated CSIRTs are entitled to data on incidents and (2ac) or by digital service providers pursuant to Article notified by operators of essential services and providers of 15a(2). digital services.

text: The designated CSIRTs are entitled to sufficient resources, Member States shall ensure that the designated CSIRTs which need to be provided by the respective government 2 have adequate resources to effectively carry out their of the Member State. This is the second time the Directive tasks set out in point (2) of Annex I. points to “adequate resources and equipment” for the CSIRT

text: Member States shall ensure that the designated CSIRTs have access to an appropriate, secure, and resilient The third time the Directive points to “adequate resources 3 communication and information infrastructure at national and equipment” for the CSIRT level.

text: CSIRTs need to document their constituencies and services. They also will need to provide a high level overview of their incident handling process to the Member States shall inform the Commission about the Commission. 4 remit as well as the main elements of the incident handling process of the CSIRTs. The practical details as to how this will happen are not defined yet, however a good start is that the team publishes an RFC2350-compliant document (https://tools.ietf.org/html/rfc2350).

text: Member States may request the assistance of ENISA in 5c CSIRTs can get ENISA’s help either to set up their developing national CSIRTs. operations, integrate in the community, or ask for

text: © European Union Agency for Network and Information Security (ENISA), 2016 02 NIS Directive and national CSIRTs

text: PARAGRAPH STATEMENT MEANING

text: training. Please contact cert-relations@enisa.europa.eu for more details.

text: 4 The CSIRT Network

text: Article 8b of the Directive covers the CSIRT Network.

text: PARAGRAPH STATEMENT MEANING

text: In order to contribute to developing confidence and trust There will be a dedicated network for all national CSIRTs between the Member States and to promote swift and

text: 1 established, run by the MS (with the help of ENISA) and effective operational cooperation, a network of the secretariat provided by ENISA. national CSIRTs is hereby established.

text: The CSIRTs network shall be composed of representatives of the Member States’ CSIRTs and CERT-EU. The Commission shall participate in the CSIRTs network as an ENISA is there to support the group and its members. The 2 observer. The European Network and Information Security Agency will provide resources and input to discussions. Agency (ENISA) shall provide the secretariat and actively support the cooperation among the CSIRTs.

text: Exactly how the group will perform these tasks is up to the group itself, as stated by paragraph 5. It means that the 3 The CSIRTs network shall have the following tasks: group will determine its own priorities, with input from the Collaboration Group. ENISA will support the group by making appropriate proposals.

text: Exchange information on CSIRTs services, operations and 3a (see comment for paragraph 3) cooperation capabilities

text: At the request of the representative of a Member State potentially affected by an incident, exchange and discuss non-commercially sensitive information related to that 3b (see comment for paragraph 3) incident and associated risks. Any Member State may refuse to contribute to that discussion if there is a risk of prejudice to the investigation of the incident.

text: Exchange and make available on a voluntary basis non- 3c (see comment for paragraph 3) confidential information on individual incidents.

text: At the request of the representative of a Member State's CSIRT, discuss and, where possible, identify a coordinated 3d (see comment for paragraph 3) response to an incident that has been identified within the jurisdiction of that same Member State.

text: Support Member States in addressing cross-border 3e incidents on the basis of their voluntary mutual (see comment for paragraph 3) assistance.

text: Discuss, explore and identify further forms of operational cooperation, including in relation to: 3f (see comment for paragraph 3) (i) categories of risks and incidents

text: (ii) early warnings

text: © European Union Agency for Network and Information Security (ENISA), 2016 03 NIS Directive and national CSIRTs

text: PARAGRAPH STATEMENT MEANING

text: (iii) mutual assistance (iv) principles and modalities for coordination, when Member States respond to cross border NIS risks and incidents.

text: Inform the Cooperation Group on its activities and on the further forms of operational cooperation discussed 3g (see comment for paragraph 3) pursuant to paragraph 3(f), and request guidance related thereto.

text: Discuss lessons learnt from NIS exercises, including from 3h (see comment for paragraph 3) those organised by ENISA.

text: At the request of an individual CSIRT, discuss the 3i (see comment for paragraph 3) capabilities and preparedness of that same CSIRT.

text: Issue guidelines in order to facilitate the convergence of (operational) practices with regard to the application of 3j (see comment for paragraph 3) the provisions of this Article concerning operational cooperation.

text: As input to the Commission's periodic review of the functioning of this Directive, the CSIRTs network shall The form and content of the report are not defined yet. This will need to be negotiated between the CSIRT every one and a half years produce a report assessing the 4 experience gained with the operational cooperation, network and the cooperation group. including conclusions and recommendations, pursued ENISA will help producing the report, and the group will under this article. That report shall also be submitted to have to approve it. the cooperation group.

text: The group will need to determine its governance structure The CSIRTs network shall define its own rules of and terms of reference. ENISA, as secretary and support, 5 procedure. can provide input to the group and come up with proposals

text: 5 Tasks for CSIRTs (Annex 1)

text: Annex 1 of the Directive gives basic requirements for designated CSIRTs, as well as a list tasks.

text: PARAGRAPH STATEMENT MEANING

text: This is a tool for designated CSIRTs to demand that their The requirements and tasks of the CSIRT shall be mandate be officially published. adequately and clearly defined and supported by national Preamble policy and/or regulation. They shall include the following ENISA and others have long argued that an officially elements recognised mandate is one of the very first steps for a successful national CSIRT.

text: Article 1 is about operational requirements, and gives 1 Requirements for the CSIRT arguments to request necessary budget, manpower, or infrastructure.

text: The CSIRTs shall ensure high availability of its There are two parts to this requirement: 1a communications services by avoiding single points of failure and have several means for being contacted and 1. High availability of communication services. for contacting others at all times. Furthermore, the Without further details, it’s hard to provide

text: © European Union Agency for Network and Information Security (ENISA), 2016 04 NIS Directive and national CSIRTs

text: PARAGRAPH STATEMENT MEANING

text: communication channels shall be clearly specified and much guidance. In fine, it will be up to the CSIRT well known to the constituency and cooperative partners Network to define what constitutes high availability. ENISA will support the group by making appropriate proposals.

text: 2. Clear specification of communication channels. RFC 2350 is the industry standard for publishing contact information. ENISA recommends that all participating CSIRTs publish such a document.

text: The group will have to define what “secure site” means: depending on the context, the range of measures that can The offices of the CSIRT and the supporting information be taken is huge. 1c systems shall be located in secure sites. ENISA will support the group by making appropriate proposals.

text: 1. This requirement can be translated as the need for adequate tools to track incidents. There is a Business continuity: variety of tools that CSIRTs can use. Popular

text: tools are RTIR, FIR, etc. More concrete 1. The CSIRT shall be equipped with an appropriate definitions are up to discussion within the CSIRT system for managing and routing requests, in network. ENISA will support these discussions by order to facilitate handovers, making appropriate proposals. 1e 2. The CSIRT shall be adequately staffed to ensure 2. See ENISA CSIRT maturity study as a first availability at all times, pointer, but more concrete definitions are up to

text: 3. The CSIRT shall rely on an infrastructure whose discussion within the CSIRT network. ENISA will continuity is ensured. To this end, redundant support these discussions by making systems and backup working space shall be appropriate proposals. available. 3. See 1a

text: We interpret this as a tool for designated CSIRTs to make sure they have the necessary travel budget to take part in existing communities like TF-CSIRT, FIRST, or EGC. CSIRTS shall have the possibility to participate, where 1f appropriate, in international cooperation networks In order to contribute to that and make it easier for designated CSIRTs, ENISA will try as much as possible to co-locate physical meetings of the group with TF-CSIRT meetings.

text: Article 2 is about what designated CSIRTs will have to do. 2 Tasks of the CSIRT This should be considered as the minimum set of tasks for designated CSIRTs.

text: 1. Monitoring is a generic term, and designated CSIRTs will need to translate it to their own Tasks of the CSIRT shall include at least the following: context. ENISA plans to make monitoring the topic of its Workshop for national and 1. Monitoring incidents at a national level, governmental CSIRTs in May 2016. 2. Providing early warning, alerts, announcements 2. This task amounts to providing the “Alerts and and dissemination of information to relevant 2a Warnings” and “Announcements” services. stakeholders about risks and incidents, More information as to how a CSIRT can deliver 3. Responding to incidents, these services can be found in ENISA’s guides on

text: 4. Providing dynamic risk and incident analysis and (Set up; Alerts-Warnings-Announcements?) situational awareness, 3. This is a basic requirement for CSIRTs. If

text: 5. Participating in the CSIRT network necessary, ENISA’s Incident Management Guide can be of help.

text: © European Union Agency for Network and Information Security (ENISA), 2016 05 NIS Directive and national CSIRTs

text: PARAGRAPH STATEMENT MEANING 4. Concrete definitions are up to discussion within the CSIRT network. ENISA will support these discussions by making appropriate proposals. 5. Participation, both online and in physical meetings, is essential to build trust between the members of the group.

text: Collaboration with the private sector is required to handle incidents efficiently. Designated CSIRTs will need to cover at least the sectors specified in Annex II of the Directive, The CSIRT shall establish cooperative relationships with 2b however the group members will have to decide what private sector. information they want to share with the private sector. ENISA will support the group by making appropriate proposals.

text: To facilitate cooperation, the CSIRT shall promote the adoption and use of common or standardised practises for: More concrete definitions are up to discussion within the 2c CSIRT network. ENISA will support these discussions by 1. incident and risk handling procedures, making appropriate proposals. 2. incident, risk and information classification schemes.

text: 6 Conclusion

text: The advent of the NIS Directive is a significant event in the EU, because it is the first time NIS is tackled at such a high level. For designated CSIRTs, the Directive gives many arguments that will help them formalise their mandate as well as secure budget, resources, and infrastructure. The tasks given to the CSIRT network are varied, and it will be up to group members to define their own rules and good practices. The group can help build further trust within CSIRTs in the EU, provided its members take an active part. ENISA will provide active support to the group, as Secretary, but also in helping teams come to meetings, and by providing input for discussions and moderating debates if necessary.

text: About “Info Notes” from ENISA

text: With the “Info Notes” series ENISA aims at giving the interested reader some background and recommendations about NIS related topics. The background and recommendations are derived from past experiences and common sense, and should be taken as starting points for discussions on possible course of action by relevant stakeholders. Feel free to get in touch with ENISA to discuss or inquire more information on the “Info Notes” series (cert-relations@enisa.europa.eu).

text: © European Union Agency for Network and Information Security (ENISA), 2016 06

type: vagledning

utgivare: enisa


text: http://blogs.ec.europa.eu/neelie-kroes/youth-engagement-will-make-the-digital-agenda-a-reality/ (accessed 25 October

text: http://www.enisa.europa.eu/act/it/library/pp/cookies/?searchterm=cookies http://www.enisa.europa.eu/act/it/past-work-areas/massively-multiplayer-online-games-and-social-and-corporate-virtual-

text: (accessed 25 October 2011)

text: http://www2.lse.ac.uk/media@lse/research/EUKidsOnline/EU%20Kids%20II%20(2009- 11)/EUKidsOnlineIIReports/Final%20report.pdf (accessed 25 September 2011 )

text: http://ec.europa.eu/avpolicy/reg/minors/rec/2011_report/index_en.htm (accessed September 2011)

text: http://www.itu.int/net/pressoffice/press_releases/2011/31.aspx (accessed 16.09.2011)

text: http://www.economist.com/node/21529014?fsrc=nlw|edh|09-15-11|editors_highlights (accessed on 17

text: September 2011)

text: What should parents / guardians / educators do?

text: What should Teenagers do?

text: https://www.enisa.europa.eu/act/rm/emerging-and-future-risk/deliverables/Cyber- Bullying%20and%20Online%20Grooming/

text: http://www.enisa.europa.eu/act/ar/deliverables/2009/cop_initiative?searchterm=guidelines+for+parents+%2C+guar dians

text: Cyber bullying.pptx

text: Children on virtual worlds - What parents should know.pptx

text: Awareness Raising Quiz Templates.pptx

text: Guidelines for Parents, Guardians and Educators report of ITU in cooperation with ENISA.pptx

text: Security Issues and Recommendations for Online Social Networks.pptx

text: Virtual worlds-real money.pptx

text: Secure printing.pptx

identifier: NIS in Education

nummer: nis-in-education

title: NIS in Education

text: Network Information Security in Education

text: Consolidated ENISA contribution

text: Network Information Security in Education I Consolidated ENISA contribution

text: Publication date January 2012

text: II Network Information Security in Education Consolidated ENISA contribution

text: Acknowledgements

text: This Report is the outcome of collective effort from between the Ministry of the Economy and Foreign Trade of Luxemburg and ENISA. ENISA would like to thank Mr Francois Thill, Assistant Director for Communications and his team for the open and constructive cooperation that led to this deliverable.

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact details

text: For contacting ENISA or for general enquiries on Network Information Security in Education, please use the following details: Daria Catalui, NIS in Education and Stakeholder Management, Seconded National Expert, ENISA E-mail: daria.catalui@enisa.europa.eu Louis Marinos, Senior Expert Risk Analysis & Management, ENISA E-mail: louis.marinos@enisa.europa.eu Internet: http://www.enisa.europa.eu

text: Network Information Security in Education III Consolidated ENISA contribution

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2011

text: 2 Network Information Security in Education

text: Consolidated ENISA contribution

text: 1 Executive Summary

text: The Report on Network Information Security (NIS) in Education comes at a time when education and ITC are interrelated and interconnected more than ever. The challenge of the digitally active citizen is to remain informed on the news coming from the dynamic field of ITC and of Information Security in particular. Long life learning, formal, non-formal and informal education are on the agenda of policymakers. Children, youth and their peers, parents and educators are all part of the discussion and the recommendation is that they should cooperate and get involved as much as possible. Through Network Information Security in Education we understand the transmission of basic safety information to the young citizens using the internet. Our intention is to start the knowledge transfer process between all involved actors in order to achieve sustainable results with a real impact on the European digital citizen. One way to achieve this is by disseminating the work done in the last few years by ENISA by using a language that can be understood by the target group. We have summarized the findings of ENISA reports by means of concise information in form of fiches. Interested parties can read and use this material and, if necessary, look for further details in the full documents. The selection of the reports was done in order to deliver content that is relevant to be directly used for educational purposes. In addition to the fiche produced, within this report we would like to point the excellent work in the field done by a series of organisations (national and international). In order to be updated and use the relevant information needed we included some recommended readings both under “Related Work” in the Annex (see Annex III: Related work). In the policy flagship of the European Commission, The Digital Agenda for Europe , it is mentioned that ‘’Youth engagement will make the Digital Agenda a reality’’. The information included in this consolidated report supports the process of being better informed, better educated and better involved in the area of NIS, thus contributing towards the objectives of the Digital Agenda.

text: Network Information Security in Education 3 Consolidated ENISA contribution

text: 2 Introduction

text: The purpose of this document is to present a consolidated version of available ENISA results in a form that is adequate for use within education. This material targets primary education and especially educators, parents and to some extents teenagers. The idea was to simplify relevant ENISA deliverables and bring them to a form that will allow easy adaptation to educational objectives, identification of competencies needed and/or direct use through relevant stakeholders. Our aim is not to substitute excellent existing material in this area, but rather to provide concise information from ENISA work that can be easily integrated into existing educational material. The text used in the topics presented below has been extracted from relevant ENISA publications. The present work was the result of a fruitful cooperation between Ministry of the Economy and Foreign Trade of Luxemburg and ENISA: based on the structure of available educational material of the Member State, existing ENISA material has been digested in order to be used by Member States. After interaction with various players, we have short-listed ENISA deliverables in the following areas:

text:  Cyber Bullying / online Grooming  Children on virtual worlds  Awareness raising quiz  Guidelines of Parents, Guardians, Educators  Security issues in online social networking  Cookies  Security issues in Virtual Worlds and  Secure printing

text: The format selected for the presented information consists of:

text: 4 Network Information Security in Education

text: Consolidated ENISA contribution

text:  a short description of the topic/area,  a reference to main findings/recommendations,  a reference to the full text and  a set of slides that can be used for presentation purposes

text: Our aim is to put interested stakeholders in the position to extract learning objectives from the consolidated information and embed them in their approaches. Due to the assumption that the information of this report will be reused and adapted to particular educational needs and existing methods, we have not spent any effort in layout. It has to be noted, that the present material is a compilation of relevant ENISA work that has been delivered during the last 3-4 years.

text: 2.1 Target audience

text: As stated in the WK 2011 the Agency supports an open multi-stakeholder dialogue and, for that reason, maintains close relations with industry, the academic sector and users. According to this, this report targets all stakeholder groups who either have stakes or are interested in the issue of NIS and education. As already mentioned, this report aims at all individuals who are concerned with primary education. This includes parents, guardians and educators, responsible authorities of Member States (e.g. Ministries, national organisations related to education, volunteer organisations, interest groups, etc.). Furthermore, this material can be used by teenagers themselves to become an insight into various NIS issues in the mentioned areas.

text: Network Information Security in Education 5 Consolidated ENISA contribution

text: 3 Related work

text: In the last years, a series of reports and articles have referenced the issue of NIS in Education. We have chosen to quote some of the sources in order to provide a general overview on existing material in this domain.

text: EU kids online final report : talking about the policy implications needed in the field

text: This is a report issued by EU Kids online. “EU Kids online aims to enhance knowledge of the experiences and practices of European children and parents regarding risky and safer use of the internet and new online technologies, in order to inform the promotion of a safer online environment for children.” . Main issues addressed are:  Encouraging children to do more online will improve their digital skill set.  Teaching safety skills is likely to improve other skills, while teaching instrumental and informational skills will also improve safety skills.  Inequalities in digital skills persist. So efforts to overcome these are needed.  Low skills among younger children are a priority for teachers and parents, as ever younger children go online.  As frequent internet use has become commonplace for many children in Europe, the policy priorities are changed. For children who still lack access, efforts are vital to ensure.  Digital exclusion does not compound social exclusion. For children with access, efforts are required to ensure their quality and breadth of use is sufficient and fair.  Efforts to promote children’s digital citizenship – in terms of online safety and good practice – are bearing some fruit, and should be extended.  Parents are not the only people responsible for children. Teachers also have a vital role to play, and for many children their peers also constitute a valuable resource: 63% of European 9-16 year olds have received internet safety advice from parents, 58 % from teachers and 44% from peers.

text: 6 Network Information Security in Education

text: Consolidated ENISA contribution

text: EC Protecting children in a digital world

text: This document is a report from the Commission to the European Parliament, the Council the European Economic and Social Committee and the Committee of the Regions on the application of the Council Recommendation of 24 September 1998 concerning the protection of minors and human dignity and of the Recommendation of the European Parliament and of the Council of 20 December 2006 on the protection of minors and human dignity and on the right of reply in relation to the competitiveness of the European audio-visual and online information services industry. It contains the following reference to education:  Media literacy and awareness-raising initiatives are partly integrated into formal education and some efforts are also being made to sensitise parents and teachers. However, an assessment carried out by the Commission in 2009 showed that even though the topic is included in national curricula in 23 European countries, actual delivery of such education is fragmented and inconsistent.

text: ITU research , Targeting youth could be transformational

text: In a report on ICT pricing and penetration ITU stipulated that information and communication technology (ICT) uptake continues to accelerate worldwide, spurred by a steady fall in the price of telephone and broadband Internet services. Among the comments, the following references to young people have been made:  The report “Measuring the Information Society 2011” suggests that the main barriers to Internet use are not always related to infrastructure and price. Usage patterns show major differences related to education, gender, income, age and geographical location of users (urban/rural). For example, there is remarkably little difference in patterns of Internet use among highly educated, high-income individuals across the developing and developed worlds. People with higher educational degrees use the Internet more than those with a lower level of education, and in most countries more men than women are online.  Young people (below the age of 25) are online more than older ones; and there is a higher level of Internet use among those currently in school compared with those no longer studying. Assuming that people will continue using the Internet once they have become accustomed to being online, those currently enrolled at school or university are more likely to be future Internet users. For young people all over the world social networking and user-created content like blogs have become key drivers of Internet uptake.

text: Network Information Security in Education 7 Consolidated ENISA contribution

text:  Given that 46% of the population in developing countries is below the age of 25 (representing more than 2.5 billion people), the report suggests that one of the most effective ways to increase Internet use in these countries is by targeting the younger generation – for example through connecting schools and other educational institutions, and improving enrolment rates.

text: The great schools revolution, The Economist

text: In a report on reforming education, The Economist refers to issues in future education that are indicative for the role of new technologies and kids’ skills:  Technology has also made a difference. After a number of false starts, many people now believe that the internet can make a real difference to educating children. The growing need for workers to keep upgrading and adapting their skills is one of the themes of a new book, “The Shift: The Future of Work is Already Here”, by Lynda Gratton of the London Business School. She argues that the pace of change will be so rapid that people may have to acquire a new expertise every few years if they want to be part of the lucrative market for scarce talent. She calls this process “serial mastery” and notes that the current educational system in most countries, from kindergarten through university, does a poor job of equipping people for continuous learning. There is likely to be a wave of innovation in further education, particularly online, that will cater to this need in a more flexible, personalized way than the traditional degree or postgraduate course.  While there is convergence in the Member States that promoting self-regulatory measures (codes of conduct) is useful, there is persistent concern that the protection levels achieved in this field still differ significantly. Going forward, existing measures against illegal or harmful contents should be constantly monitored in order to ensure their effectiveness. For instance, reporting points for this type of content, provided by the content provider and to be used by children and parents are being developed and supported by functioning back office infrastructures, but all these initiatives lack common features and economies of scale that would increase their efficiency.

text: 8 Network Information Security in Education

text: Consolidated ENISA contribution

text: 4 Concise ENISA Material

text: In the following, we present fiches covering the identified NIS areas that are relevant for educational purposes. Please note that the discussions below are in most cases directly taken from the corresponding ENISA reports. We recommend visiting the ENISA reports in order to obtain detailed material.

text: 4.1 Cyber-bullying and online grooming: helping to protect against the risks

text: Children are the most valuable part of every society, regardless of culture, religion and national origin. They depend on the care they receive from their parents, the school and their social environment. Duty of care makes parents worry about any of their children’s activities that might carry risks, such as extreme sports, or the use of technology. This last topic particularly concerns parents, as they often they do not feel as confident with technology as their children, who:  Have fun in using technology/gadgets

text:  Use technology intuitively

text:  Develop an understanding for usage of technical features very easily

text:  Become very familiar with innovations

text:  Use ICT as a learning tool

text:  Use technology in communicating with their friends

text: What is Bullying and Grooming?

text: One definition views bullying in terms of its negative impact on the victim, and sees it as the negative and damaging treatment of another in such a manner that is causes the target to suffer and feel humiliated or vulnerable, and which has a detrimental and stressful effect on him/her. As with harassment, bullying is defined largely by the impact of the behaviour on the recipient, not its intention. Bullying may therefore be seen primarily in terms of aggression, or long-standing violence, physical or psychological, conducted by an individual or a group, and directed against an individual who is not able to defend him/herself in the actual situation. The purpose of grooming is to make a victim. Grooming is done to choose a victim, to see if the person may cooperate with sexual abuse because of the imbalance of power and coercion. Grooming is done to make a potential victim feel comfortable enough to be close to an offender, to be alone with an offender, and after the ABUSE, to keep the behaviour a secret.

text: Network Information Security in Education 9 Consolidated ENISA contribution

text: Recommendations

text: ENISA has issued recommendations to mitigate the risks young people are exposed to in cyber space. The recommendations are divided into groups according to the particular group concerned:

text:  ENHANCE LEVEL OF BEHAVIOUR KNOWLEDGE: Enhance skills of parents and educators with regard to knowledge of the online behavioural patterns of minors. Keep continuous communication with parents/educators. Discuss irregularities and consult experts in that area (behavioural psychologists) and participate in knowledge sharing activities relating to that area.  ENHANCE KNOWLEDGE ON TECHNOLOGY: Undertake knowledge transfer to parents/educators with regard to technical issues. Depending on the role in duty of care/education, different levels of knowledge would be necessary.  ENHANCE PRIVACY POSTURE: Teenagers, parents and educators should be kept informed about privacy issues with regard to the cyber world.  TRIGGER KNOWLEDGE EXCHANGES: Technological knowledge should be regularly exchanged between parents and minors. By keeping an open channel with teenagers on technological issues, it easier to assess their knowledge, level of interest, level of use and usage patterns.  USE OF SPECIALISED SECURITY CONTROLS FOR PARENTS/EDUCATORS: Consider using security controls that are especially customised for use by parents/educators.  OFFER SUPPORT FOR TEENAGERS AT SCHOOLS: It is important to identify potential cyber bullying and online grooming attacks as early as possible. For this reason, teenagers should have immediate access to specialised advice points that are located at schools, to which they can turn in cases where support is required.

text:  USE OF SPECIALISED SECURITY CONTROLS FOR TEENAGERS: Consider the deployment of security controls for devices used by teenagers in order to prevent easy access to information.  ADAPT EXISTING SECURITY CONTROLS TO TEENAGERS: Currently, in many areas of everyday life, there are security/safety controls that are adapted to children (e.g. cars, planes, ships, toys, etc.). A similar approach should be introduced in cyber space. We

text: 10 Network Information Security in Education

text: Consolidated ENISA contribution

text: therefore recommend considering the deployment of security controls that are specially customised for use by teenagers/minors  DEVELOP ONLINE RATING SCHEMES: In the TV and film industries, parental guidelines exist in order rate television programmes in terms of explicit sexual content, graphic violence and strong profanity. In the area of computer and video games, similar guidelines exist to score/classify them accordingly. Similarly, the establishment of parental guidelines for online content (services, web sites, social networking applications, etc.) could be considered.  PERFORM PRIVACY IMPACT ASSESSMENTS: Numerous web applications/services process significant amounts of personal data (e.g. social networking sites). It is recommended that criteria should be developed in order to identify application areas where a Privacy Impact Assessment needs to be performed prior to the deployment of the service.  DEACTIVATION OF ALL ACTIVE COMPONENTS: Various handheld devices, portable computers, etc. may have applications installed that have active components, that is, they communicate/process data (e.g. location data, movement data, etc.) in the background. We recommend that users are equipped with functions allowing them to stop any background functions communicating personal data to some service/application providers.  ENHANCE AGE ORIENTED ACCESS CONTROL: We recommend that the age of users becomes an integral part of their credentials throughout the entire infrastructure and in particular the authentication/authorisation mechanisms used.

text: In order to assess the risks, we used the scenario “Kristie online” details of which can be found in the ENISA report For more details please visit:

text: Network Information Security in Education 11 Consolidated ENISA contribution

text: 4.2 Children on virtual worlds: What parents should know

text: With every passing day, a new social-networking website seems to spring up. Online users are spoilt for choice. From Facebook to Bebo, MySpace and Second Life to the business-oriented LinkedIn. But there's a new online phenomenon that's growing and it's for the younger generation. The biggest concerns about virtual worlds are the online safety of children (7 years old and under) and tweens (8-12 years old) and how they can be protected from online predators. Adults must assist children to ensure positive experiences in these threedimensional environments. Parents are naturally concerned about how their children are using and acting in the virtual worlds. Information is needed to ensure that parents are able to decide, with their child, what is appropriate and safe for their use, as well as how to behave responsibly in the virtual worlds.

text: What are virtual worlds?

text: A virtual world is a computer-based simulated environment intended for users to inhabit and interact via avatars. These avatars are usually depicted as textual, two-dimensional, or threedimensional graphical representations, although other forms are possible (auditory and touch sensations for example). Some, but not all, virtual worlds allow for multiple users.

text: The computer accesses a computer-simulated world and presents perceptual stimuli to the user who, in turn, can manipulate elements of the modelled world and thus experiences telepresence to a certain degree. Such modelled worlds may appear similar to the real world or instead depict fantasy worlds. The model world may simulate rules based on the real world or some hybrid fantasy world. Examples of such rules are gravity, topography, locomotion, realtime actions and communication.

text: Why do children access virtual words?

text: Young people access virtual world sites for a variety of different reasons including the following:

text:  Interaction with friends in a new environment and in real time, and sharing interests

text:  Creating and joining communities or interest groups, e.g. music, football etc.

text:  Communicating thoughts and information on areas of interest through blogs, instant messaging and other tools

text:  Meeting new people and eventually making new friends

text:  Creating and sharing original and personal content, such as images, pictures and videos, to expand opportunities for self-expression.

text:  Creating, publishing and sharing music

text: 12 Network Information Security in Education Consolidated ENISA contribution  Playing games  Having their own space, even when parents and carers are present  Experimenting with their identity, new social spaces and boundaries Stories and analysis conducted by ENISA have highlighted four main areas of concern:  Bullying  Harassment  Illegal content  Child abuse In addition, risks are increased by:  Unsecure environments  Lack of educational content  Product placement in virtual worlds  Marketing to children  Cost of engagement: o Monthly fees o Product purchase o Advertising

text: How can parents and guardians support children?

text:  Read the terms and conditions of use with their children before they enter the virtual world, discus safety precautions together, set some basic rules and monitoring use to ensure that the rules are respected.  Educate young users about the responsible use of technology in general, encouraging them to listen to their instincts and use their common sense.  Ensure use of technical solutions such as: o Filters and parental controls.

text: Network Information Security in Education 13 Consolidated ENISA contribution

text: o User history. o Confirm the use of automated moderation, such as text filtering which recognises specific words patterns and URLs or more sophisticated filters which include the Anti-Grooming Engines (AGE). o Ratings: parents and guardians should be aware of rating symbols and their use as an important tool to protect young users from inappropriate services and content. o Age verification.  Check that the virtual world is monitored through active in-game and/or silent moderation.  Stay involved in young users‘ activities in the virtual world.  Stay calm and don‘t jump to conclusions if you hear or see of anything that concerns you about your child‘s behaviour or the behaviour of one of their online friends. If your children fear that you will simply cut off their social lifeline, they are likely to be increasingly reluctant to share problems or concerns they may have.  Be open minded to reports from the virtual world community teams that your child may behave quite differently online than offline, face to face with you.  Learn the online culture so you believe the typical excuses young people give when faced with accountability for their behaviour online, such as ―someone stole my account.  Teach your children not to share their virtual world access passwords with friends or siblings.  Contact the Community Head via the virtual world‘s website contact page and share your concerns and questions.  Don‘t assume everyone on the net is targeting your child. Statistics show that offline problems with paedophiles far outweigh online incidents. In general, children‘s sites can be safe and can provide a wonderful, creative social and educational experience for your child but only if you stay involved and aware. As a consolidation of the above mentioned information, ENISA has issued a poster with 10 internet tips for parents and guardians (see and feel free to use this poster).

text: For more details please visit:

text: 14 Network Information Security in Education

text: Consolidated ENISA contribution

text: 4.3 Awareness Raising Quiz Templates

text: What is the content of the Quiz?

text: The objective of the developed quizzes is to give the respondent an appreciation of their level of awareness and hopefully serve as a tool to encourage further interest in the values and risks of using computers and utilizing online services on the Internet. Hence they should not be perceived as comprehensive self-tests of individual’s current level of awareness and knowledge. Rather, they aim at drawing the attention to the right direction and pinpoint to the topics that are worth elaborating to increase security awareness. Target groups of this ENISA work are parents, end-users and Small Medium Enterprises (SMEs).

text: This material exists in different languages (EN, ES, DE, FR, IT, DA, PL), making it attractive to a large number of potential users.

text: Due to the length of the quizzes, we just give below an overview of the parent’s quiz, while we propose interested individuals to look at the ENISA report and identify interesting parts (i.e. pages 13-21 of the ENISA report). We expect that identified parts can be directly re-used as they are generic and comprehensive.

text: Overview of Parents Quiz

text: In the context of NIS in Education, of particular interest is the part of the quiz related to parents. The aim of this quiz is to provide a means for parent to test their awareness and knowledge on a number of topics concerning child’s use of the computer and online services on the Internet. It can serve as a tool to encourage further interest in the values and risks of having your child using the Internet.

text: The parents quiz covers the areas: PC Usage of Kids, Privacy & Social Networks, Illegal Content, File Sharing and Cyber-Bullying.

text: For more details please and for end user’s quiz, please visit:

text: Network Information Security in Education 15 Consolidated ENISA contribution

text: 4.4 ‘’Guidelines for Parents, Guardians and Educators’’ report of ITU in cooperation with ENISA

text: Understand the type of online experience your kid is looking for

text: The Internet has great potential as a means of empowering children and young people to help and find things out for themselves. Base learning on emotional experiences, teaching positive and responsible forms of online behaviour is a key objective. In doing so, it is important to understand the type of online experience your kid is likely to look for (see pages 12-13 of the report). This information is an important determinant for the types of risks kids are exposed and consequently the type of protection that will be required.

text: What many parents, guardians and educators don’t know?

text: Recent analysis conducted by ENISA has highlighted that in most cases parents and guardians are not aware of details concerning the online experiences their children are likely to encounter and the risks and vulnerabilities related to various online activities. Children can be online using different platforms and devices which can include:  Personal computers

text:  Mobile phones

text:  Personal digital assistants (PDAs).

text: What is the role educators can play?

text: It is very important that educators do not make any assumptions about what children and young people may or may not know about e-safety issues. There are many misconceptions about the Internet and what either is, or is not appropriate. For example many teenagers share passwords with each other and this is often seen as a sign of true friendship. An important role for educators is to teach children and young people about the importance of passwords, how to keep them safe and how to create a strong password. Similarly, with regard to issues of copyright, many adults are horrified at the apparent lack of concern that younger users have about downloading illegal music and video. Children and young people are hugely lacking in knowledge regarding issues of legality concerning copyrighted content online. Again, there is a clear role for educators to play here in explaining this to pupils. Schools have the opportunity to transform education and help pupils to fulfil both their potential and to raise standards with ICT’s. However it is also important that children learn how to be safe when they are using these new technologies, particularly Web 2.0 collaborative technologies such as social networking sites, which are becoming an essential aspect of productive and creative social learning. Educators can help children use technology wisely and safely by:

text:  Making sure that the school has a set of robust policies and practices and that their effectiveness is reviewed and evaluated on a regular basis.

text: 16 Network Information Security in Education Consolidated ENISA contribution

text:  Ensuring that everyone is aware of the acceptable use policy and its use. It is important to have an AUP which should be age-appropriate.  Checking that the school’s anti-bullying policy includes references to bullying over the Internet and via mobile phones or other devices and that there are effective sanctions in place for breaching the policy.  Appointing an e-safety coordinator.  Making sure that the school network is safe and secure.  Ensuring that an accredited Internet service provider issued.  Using a filtering/monitoring product.  Delivering e-safety education to all children and specifying where, how and when it will be delivered.  Making sure that all staff (including support staff) has been adequately trained and that their training is updated on a regular basis.  Having a single point of contact in the school. And being able to collect and record e-safety incidents which will give the school a better picture of any issues or trends which need to be addressed.  Ensuring that the management team and school governors have an adequate awareness of the issue of e-safety.  Having a regular audit of all e-safety measures.

text: What are the elements in a safe ICT Environment?

text: Creating a safe ICT learning environment has several important elements which include the following:  responsibilities, policies and procedures  an effective range of technological tools  a comprehensive e-safety education  programme for everyone in the establishment  a review process which continually monitors the effectiveness of the above

text: Network Information Security in Education 17 Consolidated ENISA contribution

text: It is, therefore, crucial that parents and educators are able to decide, with their child what is appropriate and safe for their use, as well as how to behave responsibly using ICTs. In working together, parents, educators and children can reap the benefits of ICTs, while at the same time minimizing the possible dangers for children.

text: For more details please visit:

text: 18 Network Information Security in Education Consolidated ENISA contribution

text: 4.5 Security Issues and Recommendations for Online Social Networks

text: What are the vulnerabilities of Social Networks?

text: Online Social Networks or Social Networking Sites (SNSs) are one of the most remarkable technological phenomena of the 21st century, with several SNSs now among the most visited websites globally. The impact of cyber-stalking and cyber bullying on the victim is well known and can range from mild intimidation and loss of privacy to serious physical harm and psychological damage. Various factors make SNSs particularly vulnerable to this kind of exploitation:  Many schools ban the use of SNSs at school, which acts as a strong disincentive to the reporting of bullying.  The ease of remaining anonymous (using a fake profile).  The ease of communicating with restricted groups of people (a feature which can be very beneficial if used for the right purposes).  The one-stop-shop effect. SNS provides all the usual tools and attacks used by a cyberbully, and more, in a single interface (IM, mobile messaging, fake profiles and slander, etc.) gap. Teachers and adults are frequently unable to intervene because they are not familiar with the technology used.

text: Forms of cyber-bullying behaviour that can be carried out on SNSs

text: Various types of activities can be seen as form of cyber-bullying. Early identification of each of these types might lead to an effective surfacing of negative impact to the victims:  Flaming: Online fights using electronic messages with angry and vulgar language.  Harassment: For example, repeatedly sending hurtful or cruel and insulting messages; gaining access to another’s username and password in order to send inappropriate messages to friends’ lists.  Denigration: Setting up accounts pretending to be people in order to humiliate them; sending or posting gossip or rumours about a person to damage his or her reputation or friendships, e.g., the creation of ‘Hate’ websites, the posting of jokes, cartoons, gossip and rumours, all directed at a specific victim; posting harmful, untrue and/or cruel statements or pictures, and inviting others to do the same, or to comment on them.  Impersonation: Pretending to be someone else and sending or posting material to get that person in trouble, put them in danger or to damage their reputation or friendships.

text: Network Information Security in Education 19 Consolidated ENISA contribution

text:  Outing: Sharing someone’s secrets or publishing embarrassing information or images online.  Trickery: Talking someone into revealing secrets or embarrassing information, then sharing it online.  Exclusion: Intentionally and cruelly excluding someone from an online group, for example, a group of offline friends deciding to ignore a specific individual as a form of punishment.  Stalking: Typically linked to a problematic intimate relationship, repeated, intense harassment and denigration that includes threats or creates significant fear.  Threatening behaviour: Either direct or indirect.

text: Discourage the Banning of SNSs in Schools

text: A growing number of schools are banning or restricting the use of SNSs in schools. It is recommended that schools and education policymakers should carefully consider the consequences of banning SNSs since they act as a disincentive to the reporting of bullying. It also means that teachers and adults are less likely to learn the skills needed to mentor and monitor young people in this area. Finally it also means that a valuable educational resource is lost.

text: SNSs should be used in a controlled and open way (i.e. not banned or discouraged), with coordinated campaigns to educate children, teachers and parents.

text: It is not the technologies themselves which are responsible for bullying behaviour but the individuals who misuse them. For this reason, education, the modelling of the positive use of technology by peers, teachers and adults and community self-regulation are all key areas in combating cyber-bullying.

text: For more details please visit:

text: 20 Network Information Security in Education Consolidated ENISA contribution

text: 4.6 About cookies

text: What are cookies?

text: Cookies are small information items stored in user’s PCs and used widely by online service providers in order to: run their services, capture user preferences (language, layout, credentials, etc.), identification for shopping list purposes, etc. Any Web Site can issue cookies that are stored on user PCs. All the activities related to storing and sending cookies are invisible to the user and are managed by the visited Web Site.

text: What are the advantages of using cookies?

text: From a functional perspective, cookies can be used for:  User identification and authentication (i.e. avoiding re-identification).  Statistics on visits such as web locations, number of visits, etc.  Storing preferences and settings. From a marketing and online advertising perspective, they could be used to:  Quantify/evaluate the efficiency of ads (i.e. making it possible to determine how many unique users visited a site as a direct response to an ad).  Profile users and use the profiles to provide targeted advertising (i.e. behavioural targeting).  Improve management of advertisements (adaptation to user profile, rotation and duplication avoidance).

text: What are the security concerns?

text: Main security concerns related to cookies are related to privacy issues of users and to common attacks that are being made on the basis of information found in cookies:  Collection of private information on user preferences, visited sites, statistics.  Modify information (e.g. search results).  Impersonating users leading to malicious logon into accounts (e.g. banking, e-mail, etc.).

text: For more details please visit:

text: Network Information Security in Education 21 Consolidated ENISA contribution

text: 4.7 Virtual Worlds - Real Money

text: What is virtual world security about?

text: Online gaming (and virtual world) fraud is about misuse of user information related to online games. Such fraudulent activities target real money and are based on the increasing use of malicious programs that specifically target online games and virtual worlds; and the emergence of thousands of new programs aimed at stealing online game passwords.

text: The attackers aim at stealing virtual objects and virtual property and sell them within an existing, emerging grey-market.

text: What are the top 5 risks in virtual worlds?

text: The top five risks in the area of virtual worlds are:

text: Privacy risks: Users may even disclose more personal data because the virtual environment gives a false sense of security. There is also a trend towards behavioural marketing by “eavesdropping” on avatars.

text: Avatar identity theft and identity fraud: theft of account credentials (username and password). The main motivation is real-money financial gain, but identity fraud can also be used to damage reputation.

text: Trading and financial attacks – credit card chargebacks: Whenever an in-game purchase is made with an online payment service (e.g. credit card or PayPal), a full refund can be claimed from the payment company (usually within a month). If a chargeback is issued, reversing these transactions is technically and administratively very problematic.

text: Risks to intellectual property: Original works can be created in-world using official tools provided by the service provider. The actual rights held by the user are often only vaguely defined and may be invalidated by underlying rights. Also, users of virtual worlds often import copyrighted material without the permission of the copyright owner.

text: Information security related risks for minors: Minors can be exposed to inappropriate content in MMO/VWs either through the circumvention of age verification techniques or the failure of content rating systems. This exposes them to risks such as disclosure of real-world contact data.

text: Please note that additional risks can be found in the ENISA report.

text: What are the most important recommendations?

text: Recommendations made concern all stakeholder groups related to virtual worlds. Important elements from the recommendations made are hints for users to detect compromise of their data. The following is a check-list which could be used:  Your character is not in the same place as when you logged out.

text: 22 Network Information Security in Education Consolidated ENISA contribution

text:  Some of your items are missing.  Your password is incorrect.  There are new people on your friends list.  Some of your characters are missing, or there are new characters.  The last login on the Account Management does not match when you last logged on You have received an e-mail from the Game Masters with a warning for something that happened when you were not online.  Your guild members say that they have seen your character online when you were not playing. The full set of recommendations can be found in the report.

text: For more details please visit:

text: Network Information Security in Education 23 Consolidated ENISA contribution

text: 4.8 Secure printing

text: What is secure printing?

text: Secure printing is any step taken by an organisation to ensure that: printing devices will remain secure; printed or transmitted data will remain confidential, integral and available; the organization will be helped to comply with some of the security standards.

text: 1. Define a document flow and management

text: 2. Ensure physical security of printing devices

text: 3. Ensure printing device logical security

text: 4. Ensure security of print data on hard disk or sent-to-printing devices

text: 5. Check how resilient your printing environment is

text: 6. Track printed copied and scanned documents to fax and email

text: 7. Establish a reporting flow on printing jobs

text: 8. Define procedures to govern the use of printing devices

text: 9. Organise awareness training

text: 10. Establish a secure printing strategy

text: 11. Define indicators to measure the success and benefits of the secure printing strategy

text: 12. Establish baseline for evaluation

text: 13. Document lessons learned

text: Which are the benefits it can bring?

text: An overview of the many benefits linked to a secure printing environment will help and lead the organization (e.g. school) to better decide about this matter. The following benefits were identified:  increased security;  increased flexibility associated with solutions;  decreased printing costs (e.g. money spent/device; ratio user/device and user/printing);  reduction of fraud cases;  increased mobility and flexibility of users, turning what used to be a cost centre to a business enabler;

text: 24 Network Information Security in Education Consolidated ENISA contribution

text:  achieve compliance (e.g. security audits against standards such as ISO 27002 or PCI DSS );  enforcement of network central controls;  full traceability of jobs;  flexibility in revoking or granting rights to users  decrease number of incidents reported to IT related to printing issues;  overall alignment of printing environment with confidentiality, integrity and availability best-practice security model.

text: Conclusions

text: Printing devices are handling often confidential information, such as invoices, forms, employee documents and customer data. These devices and the documents they produce remain largely unprotected, leaving as a result business and transaction documents printed susceptible to security breaches. IT asset managers and their organisations should manage print in a proactive way as ensuring a secure printing environment is key for any organization regardless of its size. Security of printing and document capture environments is an integral part of the organization overall security strategy.

text: For more details please visit:

text: Network Information Security in Education 25 Consolidated ENISA contribution

text: 5 Conclusions / Recommendations

text: Having in mind that education concerns all of us in our role of student or peer, parent or educator, ENISA invites the reader to stay connected to the safety information coming through all communication channels, use it as much as possible and disseminate it appropriately. We would like to propose following up ENISA publications, as security issues relevant to education may appear in the coming year. ENISA will try to update this document accordingly by inserting fiches relevant to new related material.

text: 26 Network Information Security in Education Consolidated ENISA contribution

text: 6 Annex I: References

text:  ENISA. Work Programme 2011 for ENISA, the European Network and Information Security Agency(ENISA website) http://www.enisa.europa.eu/about-enisa/activities/programmesreports/work-programme-2011/view (accessed 25 October 2011)  ENISA and ITU. Guidelines for Parents, Guardians and Educators on Child Online Protection, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/ar/deliverables/2009/cop_initiative?searchterm=guideli nes+for+parents+%2C+guardians (accessed September 2011)  EUKids Online. Final Report EUKids Online including all findings and recommendations http://www2.lse.ac.uk/media@lse/research/EUKidsOnline/EU%20Kids%20II%20(2009- 11)/EUKidsOnlineIIReports/Final%20report.pdf, (accessed 25 September 2011 )  European Commission. 2011 Implementation Report on the Protection of Minors and Human Dignity Recommendations, PROTECTING CHILDREN IN THE DIGITAL WORLD, http://ec.europa.eu/avpolicy/reg/minors/rec/2011_report/index_en.htm(accessed September 2011)  ITU. Measuring the Information Society 2011 http://www.itu.int/net/pressoffice/press_releases/2011/31.aspx (accessed 16.09.2011)  The Economist. The great schools revolution, Ed.,17th September 2011, http://www.economist.com/node/21529014?fsrc=nlw|edh|09-15-11|editors_highlights (accessed on 17 September 2011)  Hogben, Giles, Recommendations for Online Social Networks, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/it/past-work-areas/social-networks/security-issues-andrecommendations-for-online-social-networks (accessed August 2011)  Hogben, Giles, Recommendations for Online Social Networks, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/it/past-work-areas/social-networks/security-issues-andrecommendations-for-online-social-networks (accessed August 2011)  Hogben, Giles, Editor, Online Games and Virtual Worlds, European Network and Information Security Agency (ENISA website)

text: Network Information Security in Education 27 Consolidated ENISA contribution

text: http://www.enisa.europa.eu/act/it/past-work-areas/massively-multiplayer-online-gamesand-social-and-corporate-virtual-worlds/security-and-privacy-in-virtual-worlds-andgaming (accessed October 2011)  Kalmelid, Kjell, Awareness raising quizzes templates: Targeting parents, end-users and SMEs, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/ar/deliverables/2008/ar-quizzes-templates-en, (accessed September 2011)  Marinos, Louis, Cyber-bullying and online grooming: helping to protect against the risks, European Network and Information Security Agency (ENISA website) https://www.enisa.europa.eu/act/rm/emerging-and-future-risk/deliverables/Cyber- Bullying%20and%20Online%20Grooming/ (accessed October 2011)  Santa, Isabella, Children on virtual worlds - What parents should know, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/ar/deliverables/2008/children-on-virtual-worlds (accessed September 2011)  Santa, Isabella, Secure printing, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/ar/deliverables/2008/secure-printing (accessed October 2011)  Tirtea, Rodica – ENISA; Castelluccia, Claude – INRIA; Ikonomou, Demosthenes – ENISA, Bittersweet cookies. Some security and privacy considerations, European Network and Information Security Agency (ENISA website) http://www.enisa.europa.eu/act/it/library/pp/cookies/?searchterm=cookies, (accessed October 2011)

text: 28 Network Information Security in Education Consolidated ENISA contribution

text: 7 Annex II: Abbreviations

text: ENISA European Network and Information Security Agency EU European Union ITU International Telecommunication Union WP Work Programme MS Member State NIS Network Information Security SNS Social Networking Sites

text: Network Information Security in Education 29 Consolidated ENISA contribution

text: 8 Annex III: Related work

text: Affiliation Name Link

text: COE The http://book.coe.int/EN/ficheouvrage.php?PAGEID=36&lang= internet EN&produit_aliasid=2023 literacy handbook

text: Eurydice Key http://eacea.ec.europa.eu/education/eurydice/docu data on ments/key_data_series/129EN.pdf ITC and school

text: 30 Network Information Security in Education

text: Consolidated ENISA contribution

text: 9 Annex IV: Slides for presentation

text: Slides for Cyber Bullying / online Grooming:

text: Slides for Children on virtual worlds:

text: Slides for Awareness raising quiz:

text: Slides for Guidelines of Parents, Guardians, Educators:

text: Slides for Security issues in online social networking:

text: Slides for Cookies:

text: Slides for Security issues in Virtual Worlds:

text: Slides for Secure printing:

text: Network Information Security in Education 31 Consolidated ENISA contribution

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu