text: P. 1 of the German Strategy

text: For example: COM/2005/0229 final “i2010 – A European Information Society for growth and employment”; COM(2006) 251 “A strategy for a Secure Information Society”; COM(2010) 245 final/2 “A Digital Agenda for Europe”; COM(2009) 149 on Critical Information Infrastructure Protection.

text: DIRECTIVE

text: COM(2011) 163 final “Achievements and next steps: towards global cyber-security” 5 The ability of a network to provide and maintain an acceptable level of service in the face of various challenges to normal operation, ‘Stock Taking of Member States’ Policies and Regulations related to Resilience of public eCommunications Networks’, ENISA, 2008.

text: Please see the annex for references to EU National Cyber Security Strategies

text: H. Luiijf, K. Besseling, M. Spoelstra, P. de Graaf, Ten National Cyber Security Strategies: a comparison, CRITIS 2011 – 6 International Conference on Critical information infrastructures Security, September 2011.

text: The definition of cyberspace, cyber-attacks and cyber security policies also varies from country to country.

text: P. 10 of the Slovakian strategy

text: P. 12 of the strategy from the Netherlands

text: P. 8 of the French strategy

text: P. 4 of the Lithuanian strategy

text: P. 29 of the strategy from the UK

text: COM(2011) 777 final VOL. 1/2 http://ec.europa.eu/atwork/programmes/docs/cwp2012_en.pdf

text: As of 1 of July 2012, DG INFSO changes name to DG CONNECT.

text: COM(2011) 777 final VOL. 2/2 http://ec.europa.eu/atwork/programmes/docs/cwp2012_annex_en.pdf

text: ROADMAP: Proposal on a European Strategy for Internet Security http://ec.europa.eu/governance/impact/planned_ia/docs/2012_infso_003_european_internet_security_strategy_en.pdf

text: SPEECH/12/204 http://europa.eu/rapid/pressReleasesAction.do?reference=SPEECH/12/204

identifier: National Cyber Security Strategies

nummer: cyber-security-strategies-paper

title: National Cyber Security Strategies

text: National Cyber Security Strategies May 2012 Setting the course for national efforts to strengthen security in cyberspace

text: National Cyber Security Strategies

text: Setting the course for national efforts to strengthen security in cyberspace About ENISA

text: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.

text: Contact details

text: Resilience and CIIP Program at ENISA Email: resilience@enisa.europa.eu

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Reproduction is authorised provided the source is acknowledged.

text: © European Network and Information Security Agency (ENISA), 2012

text: National Cyber Security Strategies

text: 1. Introduction

text: Reliable communications networks and services have long been a critical element in ensuring public welfare and economic stability. Malicious attacks on the Internet, disruptions due to physical phenomena, software and hardware failures, and human errors all affect the proper functioning of essential public services that run over public telecommunication networks. Such disruptions reveal the increased dependency of our society on these networks and their services. This is echoed in the German cyber security strategy which states that, “The availability of cyberspace and the integrity, st authenticity and confidentiality of data in cyberspace have become vital questions of the 21 century. Ensuring cyber security has thus turned into a central challenge for the state, business and society both at national and international level.” Several of the European Commission’s communications have highlighted the importance of network and information security and resilience for the creation of a single European Information Space. The existing and recently proposed updates of Regulatory Framework Directives and the recent Commission’s Communication on Critical Information Infrastructure Protection (CIIP) propose concrete policy and regulatory provisions for the improvement of the security and resilience of public telecommunications. Cyber security is increasingly regarded as a horizontal and strategic national issue affecting all levels of society. A national cyber security strategy (NCSS) is a tool to improve the security and resilience of national infrastructures and services. It is a high-level, top-down approach to cyber security that establishes a range of national objectives and priorities that should be achieved in a specific timeframe. As such it provides a strategic framework for a nation’s approach to cyber security. To assist the EU Member States in the important task of developing and maintaining a successful national cyber security strategy, ENISA is developing a Good Practice Guide . The guide will present good practices and recommendations on how to develop, implement and maintain a cyber security strategy. This paper presents some of the preliminary findings from the project that is developing the guide. It includes a short analysis of the current status of cyber security strategies within the European Union (EU) and elsewhere; it identifies common themes and differences, and concludes with a series of observations and recommendations.

text: National Cyber Security Strategies

text: 2. Evolution of Cyber Security Strategies of EU Member States

text: The first national cyber security strategies began to appear during the first years of the previous decade. One of the first countries to recognise cyber security as a national strategic matter was the United States. In 2003 they published the National Strategy to Secure Cyberspace . It was a part of the overall National Strategy for Homeland Security, which was developed in response to the terrorist th attacks on September 11 2001.

text: Developed for similar reasons, action plans and strategies with limited focus began to spring up across Europe in the following years. In 2005, Germany adopted the “National Plan for Information Infrastructure Protection (NPSI)” . The following year, Sweden developed a ‘Strategy to improve Internet security in Sweden’. Following the severe cyber-attack on Estonia in 2007, the country was the first EU Member State to publish a broad national cyber security strategy in 2008 . Since then considerable work has been done in this area on a national level and in the last four years, ten EU Member States have published a national cyber security strategy. These are briefly summarised below.

text: Across the EU there are also several Member States which are currently developing strategies – and some are very far in the process, close to publication. In addition, a few more EU Member States have unofficial or informal NCSS.  Estonia (2008): Estonia emphasizes the necessity of a secure cyberspace in general and focuses on information systems. The recommended measures are all of a civil character and concentrate on regulation, education and cooperation.  Finland (2008): The basis of the strategy is a view of cyber security as a data security issue and as a matter of economic importance that is closely related to the development of the Finnish information society.  Slovakia (2008): Ensuring information security is viewed as being essential to the functioning and development of society. Therefore the purpose of the strategy is to develop a comprehensive framework. The strategic objectives of the strategy are mainly focused on prevention as well as readiness and sustainability.  Czech Republic (2011): Essential objectives of the cyber security strategy include protection against threats which information and communication systems and technologies are exposed to, and mitigation of potential consequences in the event of an attack against ICTs. The strategy focuses mainly on unimpeded access to services, data integrity and confidentiality of the Czech Republic’s cyberspace and is coordinated with other related strategies and concepts.  France (2011): France focuses on the enablement of information systems to resist events in cyberspace which could compromise the availability, integrity or confidentiality of data. France

text: National Cyber Security Strategies

text: stresses both technical means related to the security of information systems and the fight against cybercrime and the establishment of a cyber-defence.  Germany (2011): Germany focuses on preventing and prosecuting cyber-attacks and also on the prevention of coincident IT failures, especially where critical infrastructures are concerned. The strategy sets the ground for the protection of critical information structures. It explores existing regulations to clarify whether, and if so, where additional powers are required to secure IT systems in Germany by means of providing basic security functions certified by the state and also supporting SMEs by setting up a new task force.  Lithuania (2011): Lithuania aims to determine the objectives and tasks for the development of electronic information in order to ensure the confidentiality, integrity and accessibility of electronic information and services provided in cyberspace; safeguarding of electronic communication networks, information systems and critical information infrastructure against incidents and cyber-attacks; protection of personal data and privacy. The strategy also defines the tasks, which when implemented would allow total security of cyberspace and entities operating in it.  Luxembourg (2011): Recognising the pervasiveness of ICTs, the strategy states that it is a priority to prevent any adverse effects on health and public safety or on the economy. It also mentions the importance of ICTs for citizens, society and for economic growth. The strategy is based on five action lines. These can briefly be summarised as CIIP and incident response; modernizing the legal framework; national and international cooperation; education and awareness; and promoting standards.  Netherlands (2011): The Netherlands aims towards safe and reliable ICTs and fears abuse and (large-scale) disruption – and at the same time acknowledges the need to protect the openness and freedom of the Internet. The Netherlands include a definition of cyber security in the strategy: "Cyber security is to be free from danger or damage caused by disruption or fall-out of ICT or abuse of ICT. The danger or the damage due to abuse, disruption or fall-out can be comprised of a limitation of the availability and reliability of the ICT, breach of the confidentiality of information stored in ICT or damage to the integrity of that information.”  UK (2011): The UK approach is concentrating on the national objectives linked to evolving cyber security: making the UK the major economy of innovation, investment and quality in the field of ICT and by this to be able to fully exploit the potential and benefits of cyberspace. The objective is to tackle the risks from cyberspace like cyber-attacks from criminals, terrorists and states in order to make it a safe space for citizens and businesses.

text: National Cyber Security Strategies

text: 3. Cyber Security Strategies of non-EU Nations

text: Below is a short introduction to three strategies from non-EU countries. Many other countries have also published NCSS, for example, India, Australia, New Zealand and Colombia. The list is by no means exhaustive. However, it does illustrate that the importance of cyber security is recognised globally.

text: United States of America

text: The United States released the International Strategy for Cyber-space in May 2011 , which describes a set of activities across seven interdependent areas, based on a collaborative model involving government, international partners and the private sector:  Economy: Promoting International Standards and Innovative, Open Markets.  Protecting Our Networks: Enhancing Security, Reliability, and Resiliency.  Law Enforcement: Extending Collaboration and the Rule of Law.  Military: Preparing for 21st Century Security Challenges.  Internet Governance: Promoting Effective and Inclusive Structures.  International Development: Building Capacity, Security, and Prosperity.  Internet Freedom: Supporting Fundamental Freedoms and Privacy.

text: Canada

text: Canada’s cyber security strategy was published in 2010 and is built on three pillars:  Securing government systems.  Partnering to secure vital cyber systems outside the federal Government.  Helping Canadians to be secure online.

text: The first pillar aims to establish clear roles and responsibilities, to strengthen the security of federal cyber systems and to enhance cyber security awareness throughout the government. The second pillar covers a number of partnering initiatives with the provinces and territories and involving the private sector and critical infrastructure sectors. Finally, the third pillar covers combatting cybercrime and protecting Canadian citizens in online environments. Privacy concerns are notably addressed in this third pillar.

text: Japan

text: Japan’s cyber security strategy of May 2010 can also be decomposed into a number of key areas of action:  Reinforcement of policies taking account of possible outbreaks of cyber-attacks and establishment of a response organization.  Establishment of policies adapted to changes in the information security environment.  Establishing active rather than passive information security measures.

text: National Cyber Security Strategies

text: The main action points covered by the strategy include:  Overcome IT risks to realize safety and security in the nation’s life.  Implementation of a policy that strengthens national security and crisis management expertise in cyberspace, and integrity with ICT policy as the foundation of socioeconomic activities.  Establishment of a triadic policy that comprehensively covers the viewpoints of national security, crisis management, and nation/user protection. An information security policy with a focus on the nation’s/users’ viewpoint is particularly important.  Establishment of an information security policy that contributes to the economic growth strategy.  Building up international alliances.

text: National Cyber Security Strategies

text: 4. Common themes

text: At both the European level and international level a harmonised definition of Cyber Security is clearly 13 14 lacking . The understanding of cyber security and other key terms varies considerably from country to country. This influences the different approaches to cyber security strategy among countries. The lack of common understandings and approaches between countries may hamper international cooperation, the need of which is acknowledged by all countries.

text: The main points covered by a typical NCSS are usually:  To define a governance framework for cyber security.  To define an appropriate mechanism (often a public private partnership) that allows all relevant public and private stakeholders to discuss and agree on different policy and regulatory cyber security issues.  To outline and define necessary policy and regulatory measures and clearly defined roles, responsibilities and rights of the private and public sector (e.g. new legal framework for fighting cybercrime, mandatory reporting of incidents, minimum security measures and guidelines, new procurement rules). For example, the strategy from Slovakia identifies a need to define a legal framework for the protection of cyberspace .  To set the goals and means to develop national capabilities and the necessary legal framework to engage in the international efforts of diminishing the effects of cybercrime. In several strategies there is a particular focus on cybercrime. For example in The Netherlands which aims to intensify investigation and prosecution of cybercrime . France also stresses this point and wish to promote the strengthening of current legislation and international judicial cooperation .  To identify critical information infrastructures (CIIs) including key assets, services and interdependencies.  To develop or improve preparedness, response and recovery plans and measures for protecting such CIIs (e.g. national contingency plans, cyber exercises, and situation awareness). The Lithuanian strategy states that “To ensure cyberspace security it is necessary to establish a continuous and properly managed system covering all phases of incident management, such as early warning, prevention, detection, elimination and investigation.” This also includes defining integrated organisational structures that develop, implement and test these preparedness, response and recovery plans and measures. This may also mean an integration of existing structures (e.g. national/governmental CERTs).  To define a systematic and integrated approach to national risk management (e.g. trusted information sharing and national registries of risks).

text: National Cyber Security Strategies

text:  To define and set the goals for awareness raising campaigns that instil changes in the behaviour and working patterns of users.  To define the needs for new curricula with emphasis on cyber security for IT and security professionals and specialists; and also training programs that allow the improvement of skills of users. For example, the UK strategy aims to improve training and education for information security specialists to create a strong cyber security profession .  International co-operation with EU and non EU Member States (e.g. adoption of international conventions).  Comprehensive research and development programs that focus on emerging security and resilience issues of current as well future systems and services (e.g. smart devices).

text: National Cyber Security Strategies

text: 5. The EU Internet Security Strategy

text: There is currently no overall EU cyber security strategy. However, as part of the Commission Work Programme for 2012 , the Commission will develop an Internet Security Strategy for Europe. This work will be carried out by DG CONNECT (DG INFSO ). The objectives of the initiative are to:  Describe the main risks and challenges as well as the economic and geopolitical opportunities.  Compare states of preparedness or political attention given to the topic in other third countries.  Describe the major issues at stake or problems to be addressed.  Assess the on-going or planned actions and also highlight the areas where more EU action is needed. It is not a cyber security strategy but it is likely to have common elements and objectives, for example, in defining and proposing suitable governance frameworks and setting goals for incident response capabilities. Overall it will aim to place existing and planned actions in a global political framework. Also, it will prepare the agenda for further work by looking ahead to propose how to achieve a more comprehensive, consistent and structured EU approach to Internet security . This will have a wide effect, which goes beyond issues for just DG CONNECT, which is why Vice President Commissioner Kroes has stated that this work is done in close collaboration with Commissioner Malmström (home affairs) and Vice President Ashton (the High Representative for foreign affairs and security policy) . The need to focus on and achieve a more holistic and coordinated approach has been highlighted several times - ENISA recognised this in the 2011 paper Cyber security: future challenges and 25 26 opportunities and the House of Lords report on the EU Internal Security Strategy also makes this point.

text: National Cyber Security Strategies

text: 6. Conclusions and recommendations

text: In an environment with constantly emerging and evolving cyber threats, EU Member States would greatly benefit from flexible and dynamic cyber security strategies to meet new, global threats. The cross-border nature of threats makes it essential to focus on strong international cooperation. Cooperation at pan-European level is necessary to effectively prepare, but also respond to cyberattacks. Comprehensive national cyber security strategies are the first step in this direction. We make the following recommendations to the Member States: In the short-term:  Develop, re-evaluate and maintain a National Cyber Security Strategy as well as action plans within the framework of the strategy.  Clearly state the scope and objectives of the strategy as well as the definition of cyber security used in the strategy.  Ensure that input and concerns from across governmental departments, national regulatory authorities and other public bodies are heard and addressed.  Ensure the input and engagement of industry, academia and citizen representatives.  Collaborate with other Member States and with the European Commission to ensure that the cross-border and global nature of cyber security are addressed in a coherent fashion.  Recognise that the constant development and evolution of cyberspace and cyber security issues means that the strategy will have to be a living document.  Be aware that the above point does not just mean emerging threats and new risks, but also opportunities to improve and enhance the use of information and communication technologies for government, industry and citizens.  Ensure that strategies recognise and take account of the work that has been done to date in improving the level of security of national and pan European CIIP, by avoiding duplication of effort and concentrating on new challenges.  Support the EU Commission in the definition of the Internet Security Strategy.

text: In the long-term:  Agree on a commonly accepted working definition of cyber security that is precise enough to support the definition of common goals across the EU.  Ensure that the cyber security strategies of the EU and of its Member States do not conflict with the goals of the international community, but rather support the efforts to tackle cyber security challenges globally.

text: The public and the private sector should work closely together to implement these cyber security strategies. This should be done through sharing of information, deployment of good practices (e.g. on incident reporting and handling) and through national exercises and pan-European exercises.

text: To assist the Commission and the Member States in this important task ENISA is developing a Good Practice Guide. This will present good practices and recommendations on how to develop, implement

text: National Cyber Security Strategies

text: and maintain a national cyber security strategy. The Good Practice Guide is intended to be a useful tool and practical advice for those, such as regulators and policy makers, responsible for and involved in cyber security strategies. The guide is being developed in collaboration with public and private stakeholders from across Europe with participation of a few international stakeholders to expand on the intermediate analysis and recommendations from ENISA as presented in this paper.

text: National Cyber Security Strategies

text: Annex – References to EU NCSS

text: Czech Republic: http://www.enisa.europa.eu/media/newsitems/CZ_Cyber_Security_Strategy_20112015.PDF Estonia: http://www.kmin.ee/files/kmin/img/files/Kuberjulgeoleku_strateegia_2008-2013_ENG.pdf Finland: http://www.lvm.fi/c/document_library/get_file?folderId=57092&name=DLFE- 5405.pdf&title=Valtioneuvoston%20periaatep%C3%A4%C3%A4t%C3%B6s%20kansalliseksi%20tietotur vastrategiaksi%20%28su/ru/eng%20LVM62/2008%29 France: http://www.enisa.europa.eu/media/news-items/french-cyber-security-strategy-2011 Germany: http://www.enisa.europa.eu/media/news-items/german-cyber-security-strategy-2011-1 Lithuania: http://www.ird.lt/doc/teises_aktai_en/EIS(KS)PP_796_2011-06-29_EN_PATAIS.pdf Luxembourg: http://www.gouvernement.lu/salle_presse/actualite/2011/11-novembre/23biltgen/dossier.pdf (in French) Netherlands: http://www.enisa.europa.eu/media/news-items/dutch-cyber-security-strategy-2011 Slovakia: Not available online United Kingdom: http://www.official-documents.gov.uk/document/cm76/7642/7642.pdf

text: National Cyber Security Strategies Setting the course for national efforts to strengthen security in cyberspace

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu

type: vagledning

utgivare: enisa


identifier: Cyber Threats Outreach In Telecom - Leaflet

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: EUROPEAN UNION AGENCY FOR CYBERSECURITY

type: rubrik

text: WARNING TELECOM USERS ABOUT CYBER THREATS

text: Guidelines for National Authorities and telecom providers on how to inform users about cyber threats. CYBER THREATS: TYPES OF CONSUMER OUTREACH

text: General awareness raising activities Communications about specific about potential security threats security threats

type: stycke

text: General, ex ante communication Communication about a specific threat, about possible threats and preventive including advice for mitigative measures measures e.g. importance of strong e.g. protecting against SIM Swapping passwords.

text: FRAMEWORK FOR CONSUMER OUTREACH

text: General cybersecurity awareness raising

text: Not particular

text: 1. TRIGGER 2. COMMUNICATE 3. EVALUATE

text: NEW (is the threat particular (determine target audience, (measure the effect of THREAT and significant?) choose channel, explain the outreach) measures and, if appropriate, explain the threat)

text: CHECKLIST – WHEN AND HOW TO CARRY OUT OUTREACH ACTIVITIES

text: Short name Descriptive name of the threat

text: THREAT INFORMATION

text: Date Date Description Short description of the threat References Reference to background information, media reports, etc Nature of the threat Choose from: System failures, Natural phenomena, Malicious actions, human errors, third-party failures. Potential impact Describe the potential impact on the network or service 1. TRIGGER Particular Determine if the threat is particular or common/general. Significant risk Determine if there is a significant risk: Assess the likelihood and the potential impact to find the level of risk. Outreach or not Yes or no Channel Choose from: SMS, emails, social media (general or direct), company’s

text: 2. COMMUNICATE

text: app, company’s website, other (please specify) Measures or remedy List specific measures the customer can take or, if there are none, explain what the outreach aims to achieve. Include threat information Assess whether information about the threat itself can be included in the outreach. Communication received Describe how to measure if the communication reached the

text: 3. EVALUATE

text: customers. Did customers take action? Describe how to measure if the customers reacted Other KPIs Describe other KPIs that can be used to assess effectiveness.


text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: Directive (EU) 2018/1972

text: of the European Parliament and of the Council of 11 December 2018 establishing the EuropeanElectronic Communications Code, OJ L 321, 17.12.2018, p. 36 2 Art 40(3) of the EECC refers to ‘users’. However, for the purposes of this report, and given that not all practices described here may fall under Art 40(3), we will use the terms ‘customers’, ‘consumers’, ‘users’ and ‘end-users’ interchangeably 3 https://www.forbes.com/sites/daveywinder/2020/03/27/hacker-threat-google-confirms-40000-nation-state-cyber-attack-warnings-issued/ . 4 https://www.theguardian.com/technology/2019/nov/01/whatsapp-hack-is-serious-rights-violation-say-alleged-victims . 5 https://www.t-mobile.com/news/press/how-to-fight-account-takeover-fraud 6 https://support.vodafone.co.uk/Flubot/1656667612/What-is-the-Flubot-scam.htm

text: March 2022

text: March 2022

text: Proposal for a directive of the European Parliament and of the Council of 16 December 2020 on measures for a high common level of cybersecurity across the Union, repealing

text: Directive (EU) 2016/1148

text: , COM(2020) 823 final, 16.12.2020.

text: March 2022

text: March 2022

text: March 2022

text: https://www.telenor.com/get-free-access-to-online-security-awareness-program/ 9 https://m.facebook.com/watch/?v=292264332511439&_rdr 10 www.telekom.de/hilfe/festnetz-internet-tv/sicherheit/sicherheitsmeldungen?samChecked=true 11 https://support.vodafone.co.uk/Flubot/1656667612/What-is-the-Flubot-scam.htm

text: March 2022

text: https://support.vodafone.co.uk/Flubot/1656667612/What-is-the-Flubot-scam.htm 13 https://explore.zoom.us/en/trust/security/security-bulletin/ 14 https://nvd.nist.gov/vuln-metrics/cvss 15 https://baps.ccb.belgium.be/en/belgian-anti-phishing-shield Belgian Anti Phishing Shield 16 https://www.virginmedia.com/help/security-hub; 17 https://www.virginmedia.ie/customer-support/support-by-products/broadband/online-security-safety/ 18 https://www.sunrise.ch/en/residential/mobile/freedom/options/surf-protect.html; 19 https://www2.telenet.be/fr/serviceclient/signaler-un-abus-dinternet/

text: March 2022

text: 20https://beinternetawesome.withgoogle.com/en_us/ 21 https://www.ibm.com/blogs/client-voices/outsmart-bank-fraud-real-time-cybersecurity/ 22https://www.byteacademy.co/blog/banking-cyber-security 23https://chile.bnpparibas.com/en/__trashed/

text: March 2022

text: March 2022

text: https://www.bankmillennium.pl/en/log-in 25 https://www.bankmillennium.pl/en/electronic-banking/internet-banking-security 26 https://www.aliorbank.pl/dodatkowe-informacje/bezpieczenstwo/cert-alior.html 27 https://www.aliorbank.pl/dodatkowe-informacje/bezpieczenstwo/bezpieczenstwo-edukacja.html 28 https://www.aliorbank.pl/dodatkowe-informacje/bezpieczenstwo/bezpieczenstwo-filmy-edukacyjne.html 29 https://www.alpha.gr/en/retail/support-center/security/apati-sim-swapping

text: March 2022

text: https://www.natwest.com/fraud-and-security.html. 31 https://www.natwest.com/business/security.html. 32 https://www.natwest.com/fraud-and-security.html. 33 https://www.natwest.com/business/security.html. 34 https://stopscamsuk.org.uk/159 .

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: March 2022

text: THREAT Short name Flubot phishing SMS messages in Q1 of 2021

text: Date 03 March 2021

text: Description Flubot is a malware that infects smartphones

text: malware-spreading-rapidly-through-europe-may-hit-us-soon Nature of the threat Malicious (malware)

text: Compromised smartphone of the user (Android) and more malicious

text: Potential impact

text: SMS messages targeting contacts. 1. TRIGGER Yes. While SMS-ishing is not a new threat, Flubot is a new threat that

text: is spreading fast. Threat is not common. Significant risk? Yes. Likelihood is medium, impact is high, so the risk is high.

text: Outreach or not? Yes 2. COMMUNICATE SMS and webpage: the risk is high, so using direct channel is

text: appropriate: SMS. In addition, use the website and social media The outreach aims to create awareness about phishing via SMS.

text: Measures or remedy?

text: Also, specific actions to remove the malware are proposed Include threat Threat information is not sensitive, there are many media reports about information? Flubot. Therefore, threat information can be included. 3. EVALUATE Communication Measure the SMS delivery rate received? Measure the numbers of visitors on the Flubot webpage

text: Did users take action? N/A – no specific action is required Other KPIs? Number of helpdesk tickets and complaints about Flubot

text: For example, see the news articles at https://www.proofpoint.com/us/blog/threat-insight/flubot-android-malwarespreading-rapidly-through-europe-may-hit-us-soon

text: March 2022

text: THREAT Short name Sim Swapping attack

text: Date 10 December 2021

text: Fraudulent SIM swapping is a type of fraud in which the attacker takes over a mobile subscriber’s account by changing affiliation of that

text: account with the original SIM card to a SIM card under the attacker’s control.

text: References https://www.enisa.europa.eu/publications/countering-sim-swapping

text: Malicious action (Social engineering on the providers’ employees or the

text: Nature of the threat

text: user, cyberattacks on providers infrastructure)

text: Takeover of the subscriber’s account that enable exploiting SMS-based security measures (2FA authentication, e.g. one-time passwords sent

text: Potential impact

text: via text or telephone calls) to perform financial transactions, or access social media and email accounts). 1. TRIGGER Yes. SIM swapping is threat that is spreading fast. It targets a specific

text: individual’s activity. Threat is not common.

text: Yes. Likelihood is medium, Impact is high, so the Risk is high

text: Significant risk?

text: Outreach or not? Yes 2. COMMUNICATE Direct channels used: Calls and email messages to targeted subscribe Channel? Indirect channels: Posting of warnings on the company’s website and social media accounts

text: Providers are requested to be cautious with their personal data and the

text: Measures or remedy?

text: warning signs of the attack are highlighted

text: Threat information is not sensitive; there are many media reports about Include threat SIM Swapping Fraud. Threat information can be included.

text: EVALUATE Communication Measure the numbers of visitors on the SIM Swapping webpage received? SMS delivery rate

text: Did customers take Measure the click-through rate in the webpage and the social media action? sites

text: Other KPIs? Evaluate how soon users realized that they have been attacked, evaluate the impact of the attack based on user’s helpdesk tickets

text: March 2022

text: THREAT Short name WhatsApp hack

text: Date June 2019 More than 1,400 WhatsApp users were targeted by NSO technology in a two-week period in May 2019. The cyber-attack exploited WhatsApp’s video calling system in order to send malware to the

text: mobile devices of a number of WhatsApp users. WhatsApp worked with an academic research group to identify the victims of the attacks and the technology used against them.

text: https://en.wikipedia.org/wiki/Pegasus_(spyware), References https://www.theguardian.com/news/2021/jul/18/what-is-pegasusspyware-and-how-does-it-hack-phones Nature of the threat Malicious action (Pegasus Malware)

text: Once Pegasus malware penetrates a smartphone, it can steal its contents — texts, photos, videos, emails — and can turn on its camera

text: Potential impact

text: and microphone for real-time monitoring without the user ever detecting a problem. 1. TRIGGER Yes. Pegasus software was used to gain access to user’s smartphones. An average person is not the target of this specific piece of software,

text: which is built to sell to governments to target individuals and does not work on a large scale. Threat is not common.

text: Significant risk? Yes. Likelihood is medium, impact is high and so the risk is high. Outreach or not? Yes 2. COMMUNICATE Channel? Privately warn the affected customers

text: Measures or remedy? No specific measures

text: Include threat Threat information is not sensitive; there are many media reports about information? Pegasus software. Threat information can be included. 3. EVALUATE Communication Measure the SMS delivery rate

text: Did customers take N/A

text: Other KPIs? Number of helpdesk tickets and complaints about WhatsApp hack

identifier: Cyber Threats Outreach In Telecom

nummer: cyber-threats-outreach-in-telecom

title: Cyber Threats Outreach In Telecom

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: CONTACT

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

text: AUTHORS

text: Georgia Bafoutsou, Slawomir Bryska, Marnix Dekker

text: ACKNOWLEDGEMENTS

text: For the completion of this report, ENISA has worked closely with a working group of experts from national authorities, the ECASEC Expert Group (formerly known as the Article 13a Expert Group). We are grateful for their valuable input, comments and support in the process of developing of this document.

text: Also, in preparing this paper we conducted a survey to assess the state of play. We received survey responses from 32 providers across Europe and from 17 national competent Authorities.

text: Several experts from electronic communications providers were consulted through targeted interviews, provided written answers and/or peer reviewed the document:

text: Pedro Silva, Carla Carrinho (NOS Protugal), Vasilis Kouktzoglou, Nikos Niskopoulos (Vodafone Greece), Ivan Lescak (SWAN), Florian Pennings, Lorelien Hoet (Microsoft), Peter Gervai (Tarr Ltd HU), Frank Van Berkel, Martijn Ronteltap (T-Mobile, Netherlands), Giulia Pastorella, Magnus Falk, Heather Ceylan (Zoom), Andreas Neocleous, Loukia Pavlidou (CYTA), Stephen Hermanson (Vodafone Spain, Vodafone Germany)

text: Their input was vital in the development of this paper and we would like to thank them for their contribution.

text: CYBER THREATS OUTREACH IN TELECOM LEGAL NOTICE

text: This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the

text: Regulation (EU) No 2019/881

text: ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

text: Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

text: Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: ENISA maintains its intellectual property rights in relation to this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2022

text: This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

text: Cover image © shutterstock.com and other pictures are referenced.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN: 978-92-9204-538-8, DOI: 10.2824/4233

text: CYBER THREATS OUTREACH IN TELECOM

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 8

text: 1.1 TARGET AUDIENCE 8

text: 1.2 POLICY CONTEXT 8

text: 1.3 METHODOLOGY 8

text: 2. CASE STUDIES 10

text: 2.1 CASE STUDIES FROM THE TELECOM SECTOR 10

text: 2.2 CASE STUDIES FROM THE BANKING SECTOR 12

text: 3. STOCK TAKING OF CURRENT PRACTICES 16

text: 3.1 GENERAL APPROACH 16

text: 3.2 TRIGGERS FOR OUTREACH 17

text: 3.3 CONTENT OF THE COMMUNICATION 18

text: 3.4 TARGET AUDIENCE 18

text: 3.5 COMMUNICATION CHANNELS USED 19

text: 3.6 MEASURING EFFECTIVENESS 20

text: 4. OUTREACH FRAMEWORK 21

text: 4.1 FRAMEWORK 21

text: 4.2 TRIGGER 22

text: 4.3 COMMUNICATION 22

text: 4.4 EVALUATION 22

text: 4.5 CHECKLIST 23

text: 4.6 ISSUES/CHALLENGES 24

text: 5. CONCLUSIONS 25 ANNEX: EXAMPLES 26

text: A.1 WARNING USERS ABOUT FLUBOT SCAM MESSAGES 26

text: CYBER THREATS OUTREACH IN TELECOM

text: A.2 WARNING CUSTOMERS ABOUT SIM SWAPPING ATTACKS 26

text: A.3 WARNING CUSTOMERS ABOUT WHATSAPP EXPLOIT 28

text: CYBER THREATS OUTREACH IN TELECOM

text: EXECUTIVE SUMMARY

text: The new EU telecom legislation, the European Electronic Communications Code (the ‘EECC’), requires providers of public electronic communications networks or services to notify their users when there has been a particular and significant threat to these networks or services. Warning customers regarding cyber threats is also industry good practice. Here are some recent examples:

text: • In 2020, Google warned 40,000 customers that it had detected activity from nationstate sponsored cyber-attackers against customer accounts .

text: • In 2019, WhatsApp detected attacks targeting around 1,400 users and sent each of them a warning about this threat .

text: • In 2020, T-Mobile warned its users to be on alert, following an increase in SIM swapping attacks .

text: • In 2021, Vodafone published a warning about the Flubot malware on its website, warning customers about it and explaining what they could do if their device was infected.

text: However, warning about cyber threats is not a straightforward activity and has to be done carefully. Warning toο often about cyber threats could be counter-productive because users might start downplaying or even ignoring the warnings in the long run. Likewise, there may be limited utility in warning about a general threat when there is very little customers can or are likely to do about it. On the other hand, warning a customer about a particular and imminent yet addressable threat is more likely to generate tangible results. Specifically, it may help the customer avoid the threat turning into a security incident.

text: Choosing the right channel and method for contacting users is important. Very frequent and badly designed warnings could result in users finding it difficult to distinguish them from fraudulent messages. As a result, in some cases, such warnings could actually lead to increasing the likelihood of fraud. Often, cyber-attacks start with an SMS message or email containing an alarming text and a call for urgent action. For example, the so-called ‘helpdesk scams’ warn the user about an infected PC asking them to contact customer support and install ‘cleaning’ software, including links and contact information that lead them to the fraudster instead.

text: In this paper, we aim to give guidance to national Authorities and providers of electronic communications networks and services regarding how to strike the right balance and carry out efficient and effective outreach to users about cyber threats.

text: In the first part of this report, we present an overview of the state of play by analysing several examples, case studies and responses from the experts working in the sector. We note that this overview reflects the situation before the EECC came into effect.

text: CYBER THREATS OUTREACH IN TELECOM

text: In the second part of this report, we provide a framework, a checklist, for determining whether to carry out outreach activities and how. The checklist has three steps: 1. Trigger: Determine if outreach about a potential threat is needed. 2. Communication: Determine the right channel, and the right message. 3. Evaluation: Define the parameters for measuring the effectiveness of the outreach. Figure 1: Checklist to determine whether to carry out outreach activities and how

text: CYBER THREATS OUTREACH IN TELECOM

text: In the Annex we fill in this checklist for a few well-known cases.

text: We conclude this paper with general observations:

text: • Monitoring and notifying about potential threats is a new paradigm: The EECC requires providers of electronic communications networks and services to monitor potential threats before they turn into cybersecurity incidents. In the proposal for the revised Network and Information Systems Directive (the ‘NIS2 proposal’), the Commission extends this approach to other sectors. While there are benefits in communicating warnings about threats before they become cybersecurity incidents, authorities and providers should collaborate to strike the right balance about which threats should be in the scope of these warnings. The proposed simple framework is sector-agnostic, and could be adjusted and reused in other policy areas, so that users are informed about cyber threats and possible preventative or mitigative measures effectively and in a timely manner.

text: • Engage and collaborate with national authorities about outreach: The national authorities we interviewed suggested that collaboration and knowledge sharing are good between electronic communications providers and authorities. Providers could engage them before reaching out to the customers. The national authorities could then also coordinate with other providers, other governmental entities, such as the national CSIRTs, and even coordinate with authorities in other sectors to address the problem.

text: • Outreach does not replace other actions: Finally, outreach to customers should be seen as a complementary measure and should not replace other actions by the authorities or the providers - specifically, applying the necessary preventive or mitigative technical measures. This is because the users receiving the communication often do not have the time and/or the know-how to deal with technical issues.

text: CYBER THREATS OUTREACH IN TELECOM

text: 1. INTRODUCTION

text: EECC, the EU’s new telecom security legislation, requires providers of public electronic communications networks or services to notify their users of a particular and significant threat. Warning customers regarding cyber threats is also industry good practice.

text: In this paper we provide guidance on:

text: • Which cyber threats should trigger outreach to the customers using the networks and services? • How to communicate about threats, which channels to use, which messages to convey? • How to evaluate the effectiveness of the outreach?

text: 1.1 TARGET AUDIENCE

text: This paper provides technical guidance to national Authorities supervising the implementation of

text: Article 40

text: , par. 3 of the EECC, and it may also be useful for experts working in the EU telecom sector.

text: 1.2 POLICY CONTEXT

text: EECC

text: Article 40

text: par. 3 requires providers of communications networks and services in the EU to notify users of particular and significant threats about the measures or remedies they can take to mitigate these threats, to protect the security of their communications. Where relevant, providers should also notify the users about the threat itself. We quote the legislative text in full:

text: "Member States shall ensure that in the case of a particular and significant threat of a security incident in public electronic communications networks or publicly available electronic communications services, providers of such networks or services shall inform their users potentially affected by such a threat of any possible protective measures or remedies which can be taken by the users. Where appropriate, providers shall also inform their users of the threat itself."

text: In the following paragraphs, we give guidance about how this step can be implemented effectively and efficiently in practice.

text: Note that the EU Member States are in the process of transposing the EECC into national legislation.

text: Note also that the European Commission recently made a proposal for a reviewed NIS Directive, the NIS2 proposal, which substitutes Article 40 of the EECC. However, current NIS2 proposal also contains the same provision about warning/notifying users of the service, which means that there would be no substantial change in this regard.

text: 1.3 METHODOLOGY

text: We developed this guidance by looking into the following research questions:

text: ● How do providers currently inform users about threats and mitigative measures and how is the effectiveness of this outreach measured?

text: ● How do operators in other critical sectors such as banking and utilities reach out to their customers?

text: CYBER THREATS OUTREACH IN TELECOM

text: We collected information in three ways:

text: • Desk research: We have analysed publicly available sources and specialised literature on the status, practices and mechanisms in place related to consumer outreach about cybersecurity threats. The processed materials served as the basis for the online survey and the interviews.

text: • Online questionnaire, targeting national authorities and telecom providers in the EU: In total, 49 stakeholders answered the online questionnaire, from both private and public sectors at EU and national levels.

text: • Interviews with stakeholders: We held 15 expert interviews to get a better understanding of the current industry practices when it comes to reaching out to users about cybersecurity threats.

text: Figure 2: Overview of the research participation

text: CYBER THREATS OUTREACH IN TELECOM

text: 2. CASE STUDIES

text: In this section, we provide examples of situations in which providers reach out to customers about cybersecurity threats.

text: Note that these case studies are indicative of the existing good practices in the industry, before transposition of the EECC into national legislation.

text: 2.1 CASE STUDIES FROM THE TELECOM SECTOR

text: General awareness raising – Telenor

text: Telenor has an awareness programme, including 10 ‘digital lessons’ introducing security awareness for typical cybersecurity threats, such as ransomware, phishing and malicious links, or fake news and false facts. The digital lessons are available for citizens and enterprises.

text: Videos with lifelike examples of threats – Telefónica

text: Telefónica provides detailed descriptions of currently trending potential threats in posts on social media, which includes video explanations of threats through lifelike examples. For instance, in a video-post in May 2021, Telefónica provided information on the characteristics, consequences and preventive measures of ‘smishing’, a variant of phishing, through SMS.

text: Fake email examples - Deutsche Telekom

text: On its website, Deutsche Telecom publishes information about ongoing and past incidents sorted by date, including the characteristics of the incident, the measures that have been taken to address it, and suggestions for users on how to take preventive or mitigating measures.

text: For example, on 19 May 2021, Deutsche Telekom published a description of fake emails allegedly sent by Deutsche Bank, Sparkasse and Amazon, which included a description of the characteristics of such messages (e.g. misspellings, strange email address), the tricks for stealing log-in data (e.g. mandatory updates, user advantages available on a link), the consequences of falling victim to those emails, as well as the mitigation steps customers could take (e.g. call customer service).

text: FluBot warning - Vodafone Greece

text: Vodafone Greece maintains a webpage about the FluBot mobile phone malware, where users can find detailed information about the threat, e.g. a description of the fraud, protecting measures and a comprehensive list of steps a user can take to find out if he has been affected.

text: CYBER THREATS OUTREACH IN TELECOM

text: FluBot warning - Vodafone UK

text: Vodafone UK provides a detailed description of current threats on Twitter, e.g. a description of the FluBot fraud. The tweet consists of three steps, which should be taken by the users to avoid the fraud.

text: Detailed incident communication, including severity scores and steps taken – Zoom

text: Zoom provides descriptions of vulnerabilities and incidents in its ‘Security Bulletin’. This bulletin entails not only descriptions of the incidents dating back several years, but also assigns a score to identify their severity based on the Common Vulnerability Scoring System (CVSS) . Furthermore, it includes descriptions of measures that have been taken to mitigate the vulnerabilities. For example, on 26 March 2021, Zoom posted the details of a screen-sharing vulnerability with a CVSS score of 5.7 (medium severity), a detailed description of the consequences of using screen sharing (screen sharing users may be seen by other meeting participants for a brief moment), all the products affected and the steps Zoom had taken to address it.

text: Belgian Anti-Phishing Shield - Proximus

text: The campaign aims at reducing active botnet participation from user devices. The customers are warned when they are about to access a malicious website following a phishing attack. The initiative does not only notify users of potential threats, but also navigates them to an awareness-raising site where they are walked through the steps for cleaning their device. The step-by-step instructions and immediate alerts make the process more user-friendly and easyto-understand.

text: Countrywide awareness raising campaigns with provider participation - T-Mobile Netherlands

text: T-Mobile participates in countrywide awareness-raising campaigns about potential cybersecurity threats and mitigation measures, where the participating providers share their industry knowledge. These awareness-raising campaigns are funded by the Dutch Government and organised by the Dutch Ministry of Justice and Security.

text: Simple targeted awareness raising campaign – SSF Cybersecurity

text: The Swedish Internet Foundation conducted research in connection with leaked passwords and the Swedish internet security organisation (Stoldskyddsforeningen - SSF) turned the results of this survey into a nationwide awareness raising campaign with easy-to-understand messages. The most common leaked passwords were presented on eye-catching billboards and bus stop advertisements.

text: A variety of dedicated educational material for children, parents and teachers - Liberty

text: Global

text: CYBER THREATS OUTREACH IN TELECOM

text: Via its subsidiaries, Liberty Global provides educational material on online safety dedicated to different age groups, parents and teachers. The material is provided in easy-to-understand formats, games, workbooks and readings for the ages of 4 to 16 in more than 10 languages. For example, the workbook for children from 13-16 years incorporates decision-making steps in real-life examples, such as what information we can share on the internet and with whom. This segmentation of the young generations allows parents and teachers to provide access to suitable learning materials for the children.

text: Interactive learning environment with hands-on tasks designed for children - Google

text: Google has developed an initiative called ‘Interland’ in which children can access interactive videos, games and materials to become ‘internet awesome’ and learn to use the internet safely. ‘Interland’ includes hands-on practice with four challenging games (namely ‘Share with care’, ‘Don’t fall for fake’ and ‘Secure your secrets’), and helps children learn how to act responsibly in unsafe situations. The interactivity of the platform provides a unique learning environment specifically designed for children, who may find it easier to learn new things through interactive formats.

text: 2.2 CASE STUDIES FROM THE BANKING SECTOR

text: Automatic tracking, alerting and blocking of suspicious activities – Santander Bank

text: In the finance sector, banks must send alerts to users if their system detects anything suspicious. For example, the Santander Bank in Spain uses a behavioural biometrics solution called “Trusteer”, which develops a customer profile based on normal user activity. It can detect abnormal activity and continuously authenticates the user. When the solution does detect abnormal behaviour, they alert the customer and block unauthorized transactions before they cause damage.

text: Obligatory guidelines on source authenticity and potential precautious actions

text: Banks are required to include cybersecurity awareness material on their websites, as their customers must be careful with checking the authenticity of sources that are asking for account details and take precautions while using the bank’s websites .

text: BNP Paribas has a dedicated subpage for awareness raising, on which the internet banking risks, the bank’s security practices and client recommendations are listed .

text: CYBER THREATS OUTREACH IN TELECOM

text: Figure 3: Bank Millennium’s warnings and advice usually for social engineering

text: CYBER THREATS OUTREACH IN TELECOM

text: On its internet banking log-on page , Bank Millennium also provides information on the most common vulnerabilities, threats and mitigation measures. Apart from providing advice on good login practices, Bank Millennium’s warnings and advice usually relate to social engineering tactics – for example: fake authorisation SMS, fake ads on social networks and fake emails claiming to originate from Bank Millennium. In addition, Bank Millennium advises on the security measures it has in place to minimise cybersecurity risks.

text: Alior Bank, with its own Computer Emergency Response Team (‘CERT’) , also provides advice on its website regarding the most common threats and vulnerabilities, and how to minimise them. It also provides descriptions of, and guidelines on security measures the bank provides, such as multi-factor authorisation. Alior’s advice goes beyond its banking services. The bank provides general cyber-hygiene awareness-raising on conducting oneself online – for example, on offers that seem ‘too good to be true’ . We note that Alior Bank has a series of short educational videos in which it provides simple language information on selected threats and vulnerabilities, for example fake banking websites, SpyWindow, applications coming from unknown third parties or security of connected devices.

text: Figure 4: Alior Bank’s SpyWindow

text: Information on the “SIM Swapping” fraud – Alpha Bank Greece

text: Alpha bank Greece has developed a web page including information on the SIM Swapping fraud. On this page, the bank explains how the fraud works, and includes advice for the clients to self-protect. On its website, the bank also lists measures it takes to mitigate the risk of SIM swapping frauds.

text: CYBER THREATS OUTREACH IN TELECOM

text: Cybersecurity-related advice to both B2C and B2B segments - National Westminster Bank (NatWest)

text: National Westminster Bank (NatWest) provides cybersecurity-related advice to both B2C and B2B segments. In the latter case, information related to preventive and mitigative measures is further divided based on the size of the business.

text: For example, in the B2C part of its website, NatWest advises on some of the latest types of fraud (such as delivery and cryptocurrency scams), the steps customers can take when they feel they may have become a victim of one, and the channels they can use to contact NatWest.

text: Specifically, NatWest, several other banks, and telecommunications companies in the United Kingdom are operating a pilot scheme offering customers one specific number they can call regardless of which bank they do business with – similar to calling the police – if they have reasons to believe they are at risk of fraud .

text: CYBER THREATS OUTREACH IN TELECOM

text: 3. STOCK TAKING OF CURRENT PRACTICES

text: In this section, we look at current good practices in the industry, using data from the online survey and the in-depth interviews.

text: We asked industry experts detailed questions about the kind of outreach they perform now. We used the following structure for this survey:

text: 1. General approach: What is the general approach to user outreach? 2. Triggers for outreach: Which factors and circumstances trigger an outreach to customers? 3. Content of the communication: What information is shared with the customers? 4. Target audience: What is the target audience of the outreach? 5. Communication channels and frequency: What are the channels used for the outreach?

text: 6. Measuring effectiveness: How is the effectiveness of the outreach measured?

text: 3.1 GENERAL APPROACH

text: The overall strategy for user outreach needs to take into account the general cybersecurity strategy of the provider, as well as its communication strategy:

text: ● Provider’s cybersecurity strategy - What are the provider’s high-level plans to build resilience to threats and ensure its users (natural persons and businesses) benefit from trustworthy services? ● Provider’s communication strategy - How should the company communicate about a threat? How – in what language and style – should the message be formulated? What channels should be used in specific cases? How can the effects of this communication be measured?

text: Figure 5: Connection between communication and security strategy

text: CYBER THREATS OUTREACH IN TELECOM

text: When reaching out to their customers, providers of electronic communications and services mix two approaches: • Targeted communications about specific security threats • General awareness raising activities about potential security threats Figure 6: Two general types of user outreach about security threats

text: Most providers carry out user outreach only when customers can actually take preventive or mitigative measures. Based on the surveys and the interview responses, providers appear to be mindful of the risk of information overload. Figure 7: Survey responses on when electronic communications providers reach out to users

text: CYBER THREATS OUTREACH IN TELECOM

text: Providers reach out about malicious actions (potential security threats) and system failures, but rarely about natural phenomena. See the diagram below.

text: Figure 8: Survey responses: Threats users are informed about

text: The main reported goal for the providers in their user outreach is to increase user awareness about cybersecurity threats. Other aspects, such as brand protection, reportedly do not play an important role.

text: 3.3 CONTENT OF THE COMMUNICATION

text: The content of the outreach is often adjusted to the knowledge and competency level of the users, with focus on sending a clear message. Cybersecurity is a challenging topic and, if messages are not specific and sufficiently understandable, they are less effective.

text: Communication about specific threats often includes facts about the nature of the threat, potential impact, steps that have been taken by the provider so far, etc. The most frequent topics are:

text: • phishing e-mails, • data breaches, • system failures or • denial-of-service attacks (DoS).

text: The majority of experts agree that besides the preventive and/or mitigative measures users may take, they should also be informed about the threats themselves. Incorporating information on examples of specific threats in the communication, supports its effectiveness. Some providers provide detailed, lifelike examples of threats.

text: 3.4 TARGET AUDIENCE

text: When reaching out to users about security threats, electronic communications providers generally target those who are directly affected by the threat.

text: Providers do not segment their customers in groups (for example based on age, etc.). The more the communication is targeted and specific, the more likely it is to trigger action by the customer.

text: Communication with the business segment is different. In this segment, outreach goes to the corporate account and the procedures are integrated in standard IT processes, as part of technical support. The communication is typically more technical and more strictly monitored, for example, by ticketing systems.

text: CYBER THREATS OUTREACH IN TELECOM 3.5 COMMUNICATION CHANNELS USED

text: Providers use different communication channels, depending on the type of outreach. See the chart below – showing survey responses from experts working in the sector.

text: Figure 9: Survey responses: channels used for communication about threats

text: Social media posts may reach a wider audience. However, if we were to take the number of In case an action is ‘likes’, comments and shares as the indication of their effectiveness, it would often appear to be

text: required from the

text: limited.

text: users: direct channels are the

text: In general, it would appear that number-independent interpersonal communication service providers (NI-ICS or OTT providers), such as WhatsApp and Facebook generate more impact most commonly with outreach using their social media than traditional telecom providers. used.

text: Providers often also use their own website for informing customers about threats. Typically, the messages can be found on the home page to ensure that customers can easily find these warnings.

text: Direct communication, such as emails or SMS, appears to be more effective. Mass communication, such as press releases and social media posts, reach large groups, but are not as effective as direct communication.

text: Electronic communications providers detect a significant number of threats on a daily basis. Communicating every single threat would be ineffective, so in most cases providers only approach their users in high-risk cases, in order to increase the chances of grabbing their users’ attention.

text: CYBER THREATS OUTREACH IN TELECOM 3.6 MEASURING EFFECTIVENESS

text: Most providers do not measure the effectiveness of their outreach about threats.

text: However, several providers plan to implement such measurements. The providers who do measure the effectiveness of their communication to users regarding security threats, mostly focus on monitoring whether the target audience has been reached properly and the requested actions have been implemented by the users.

text: Figure 10: Survey responses: Measurement of the effectiveness of communication to users regarding security threats

text: The following KPIs are monitored most frequently:

text: ● Delivery rate of emails: The percentage of emails that were actually delivered to recipients' inboxes, calculated by subtracting hard and soft bounces from the gross number of emails sent, then dividing that number by gross emails sent, ● First call resolution rate: no repeat calls or contacts are required to follow-up on the initial call, and ● Click through rate: the ratio of users who click on a specific link to the number of total users who view a page, email, or advertisement hosting that link.

text: CYBER THREATS OUTREACH IN TELECOM

text: 4. OUTREACH FRAMEWORK

text: Following a review of the current industry practices and considering the requirements of

text: Article 40

text: , par. 3 of the EECC, in this section, we provide three high-level steps that can be followed by electronic communications providers for notifying threats to their users. Our framework consists of a decision point (Trigger- whether to proceed with user outreach) and two factors for consideration that will shape the outreach (Communication and Evaluation).

text: In the end of this section, the steps are included in a checklist that can be used by the provider to structure the information of a specific outreach campaign and explain the reasoning behind it on the basis of

text: Article 40

text: , par. 3 of the EECC.

text: 4.1 FRAMEWORK

text: Article 40

text: , par. 3 of the EECC includes several factors/circumstances having to do with communication to users about cybersecurity threats and the kind of outreach action required. It provides that if a threat is particular (i.e. it is not a general or common threat) or significant (i.e. it poses a risk to the customer), providers should communicate possible protective measures or remedies to all users that are potentially affected and if appropriate (i.e. if such communication does not result in increasing the overall level of risk), inform customers of the threat itself.

text: We outline these factors/circumstances and actions in the flow-chart below.

text: Figure 11: Framework for user outreach about cybersecurity threats

text: CYBER THREATS OUTREACH IN TELECOM

text: We go over the three steps in more detail and provide guiding questions.

text: 4.2 TRIGGER

text: When a new threat is found, an assessment should be made on a case-by-case basis to decide if outreach is needed, and to ensure that there is added value in the outreach. It is important to strike a balance between the communication objectives and the risk of ‘customer fatigue’. If providers send messages too often, customers may start to ignore them.

text: Questions to ask:

text: ● Is it a particular threat? Or is it a more general and common threat? ● Is it a significant threat? ● What is the potential impact of the threat for the customers? ● What is the likelihood that the threat materializes? ● Does the security threat affect a particular component of the network, a particular service, or transmitted, stored or processed data? ● Would communication lead to unnecessary loss of trust or fatigue? ● Can users take measures to mitigate/prevent the threat? ● Is it appropriate to communicate about the threat itself? Would such communication not result in additional (potentially significant) risks?

text: 4.3 COMMUNICATION

text: Communication about a specific threat should include description of the threat and well-defined instructions for threat mitigation or prevention. Simple messages with practical information are most effective in reaching the target audience. The following questions are important to answer:

text: • Who is targeted and affected by this threat? • What is the best channel for reaching out to this group of customers? • Is a specific action required from the customer? If so, direct channels could work best. • Is it appropriate to use multiple channels and messages? • Could a simplified explanation/message be provided for non-expert users? • Will there be a separate message and channel for the B2B segment? • Is it appropriate to inform the customers about the threat itself? Would such communication not result in additional (potentially significant) risks?

text: 4.4 EVALUATION

text: Evaluating the outreach about threats is important, but it is not always easy to define the right parameters. The parameters should be defined on a case-by-case basis.

text: • What parameters and KPIs can be used to evaluate if the outreach/communication reached all the targeted users? • What parameters and KPIs can be used to evaluate if the users took the required actions (such as a password change)? • What parameters and KPIs can be used to evaluate the overall effectiveness of the outreach (such as a decrease in the number of infected smartphones)?

text: CYBER THREATS OUTREACH IN TELECOM 4.5 CHECKLIST

text: In this section, we provide a basic checklist that can help in structuring the information and explaining the reasoning behind carrying out user outreach. Figure 12: Checklist for notifying customers about threats

text: CHECKLIST FOR NOTIFYING CUSTOMERS ABOUT THREATS

text: THREAT

text: INFORMATION Short name Descriptive name of the threat Date Date Description Short description of the threat References Reference to background information, media reports, etc Choose from: System failures, Natural phenomena, Malicious

text: Nature of the threat

text: actions, human errors, third-party failures. Potential impact Describe the potential impact on the network or service

text: 1. TRIGGER

text: Particular? Determine if the threat is particular or common/general. Determine if there is a significant risk: Assess the likelihood

text: Significant risk?

text: and the potential impact to find the level of risk. Outreach or not? Yes or no

text: 2. COMMUNICATE

text: Choose from: SMS, emails, social media (general or direct),

text: Channel?

text: company’s app, company’s website, other (please specify) Measures or List specific measures the customer can take or, if there are remedy? none, explain what the outreach aims to achieve. Include threat Assess whether information about the threat itself can be information? included in the outreach.

text: 3. EVALUATE

text: Communication Describe how to measure if the communication reached the received? customers. Did customers take Describe how to measure if the customers reacted

text: action?

text: Other KPIs? Describe other KPIs that can be used to assess effectiveness.

text: CYBER THREATS OUTREACH IN TELECOM 4.6 ISSUES/CHALLENGES

text: Warning about cyber threats, even following the framework described in the previous paragraphs is not an easy task. It has to be done carefully, taking into account several issues and challenges that could interfere with the effectiveness of the communication.

text: • There is a risk of causing fatigue: Warning toο often about cyber threats could be counter-productive, because users could start downplaying or even ignoring the warnings in the long run. Likewise, there may be limited utility in warning about a general threat when there is very little the users can do or are likely to do about it. On the other hand, warning a customer about a particular and imminent yet addressable threat is more likely to generate tangible results. and prevent the threat from turning into a security incident.

text: • There is a risk of increasing the likelihood of fraud: Choosing the right channel and method for contacting the users is important. Very frequent and badly designed warnings could result in the users finding it difficult to distinguish them from fraudulent messages. As a result, in some cases, such warnings could actually increase the likelihood of fraud. Often, cyber-attacks start with an SMS message or email containing an alarming text and a call for urgent action. For example, so-called ‘helpdesk scams’ warn the user about an infected PC asking them to contact customer support and install ‘cleaning’ software, including links and contact information that lead him to the fraudster instead.

text: • Outreach does not replace other actions: Outreach to customers should be seen as a complementary measure and should not replace other actions by the authorities or the providers – specifically, applying the necessary preventative or mitigative technical measures. Obviously, the users receiving the communication often do not have the time and/or the know-how to deal with technical issues. In general, it is not a proposed to rely on communication alone as a mitigative measure. For example, in the case of the Flubot malware, in some country’s providers started to block certain SMS messages to avoid infection, which could be much more efficient than just warning the customers about the malware.

text: CYBER THREATS OUTREACH IN TELECOM

text: 5. CONCLUSIONS

text: The new EU telecom security legislation, the EECC, requires providers of public electronic communications networks or services, to notify their users in the case of a particular and significant threat to these networks or services. Warning customers in case of cyber threats is also industry good practice.

text: However, warning about cyber threats is not a straightforward activity and has to be done carefully. In this paper we proposed a checklist that could help providers and authorities determine whether to carry out outreach activities and how, and we outlined several issues/challenges.

text: In the NIS2 proposal, the Commission extends the approach of user outreach about cybersecurity threats to other critical sectors. The proposed simple framework is sectoragnostic, could be adjusted and reused in other policy areas, so that users are informed effectively and in a timely manner about cyber threats and possible preventative or mitigative measures.

text: Collaboration and knowledge sharing between national authorities and electronic communications providers in the case of specific and important threats is very important. It could promote coordination also with other providers and other governmental entities, such as the national CSIRTs and lead to successful threat mitigation.

text: For instance, AGCOM , the national regulatory Authority of Italy led a trial involving the Bank of Italy, the Italian Data Protection Authority, the Ministry of Economic Development, Police and Financial Police, Banks, operators that offer messaging services to the banks and MNOs. The trial involves MNOs informing banks of the latest SIM swap, either through the subscriber’s IMSI, hashed IMSI, or sending time information of the latest SIM swap.

text: In the case of the Flubot malware, the Belgian Institute for Postal Services and Telecommunications had a discussion with the electronic communication providers on how to respond in a coordinated way. The Authority supported the electronic communication providers by creating a forum for discussing and sharing good practices, filter rules and suspicious links. They agreed on how the electronic communication providers should reach out to their users and what measures they could take (blocking URLs and outgoing traffic/calls, and asking customers to factory reset their devices).

text: Finally, it is important to note that outreach to customers should be seen as a complementary measure and should not replace other actions by the authorities or the providers - specifically, applying the necessary mitigation and/or preventive technical measures.

text: CYBER THREATS OUTREACH IN TELECOM

text: ANNEX: EXAMPLES

text: A.1 WARNING USERS ABOUT FLUBOT SCAM MESSAGES

text: FluBot is an Android malware that is used by cyber attackers to steal passwords, online account login information, personal details and banking information. This information is then used to make payments, take over accounts and perform identity theft. FluBot spreads via SMS messages, and infected smartphones send SMS messages to the contacts listed in the infected smartphone to try and infect other customers .

text: INFORMATION

text: A.2 WARNING CUSTOMERS ABOUT SIM SWAPPING ATTACKS

text: Fraudulent SIM swapping is a type of fraud in which the attacker takes over a mobile subscriber’s account by changing affiliation of that account with the original SIM card to a SIM card under the attacker’s control.

text: This type of attack takes advantage of the mobile network operator’s ability to quickly and seamlessly affiliate a mobile telephone number with a different SIM. This ability, usually referred to as ‘number porting’, is normally used when a subscriber has lost his device, the device has

text: CYBER THREATS OUTREACH IN TELECOM

text: been stolen, the SIM card has been damaged or when the subscriber wishes to switch service to a new device.

text: An attacker typically begins a SIM swapping attack by gathering personal details about the targeted subscriber, for example through social engineering, phishing, malware, exploiting information from data breaches, or by doing research on social media. Once an attacker has obtained enough details to convincingly impersonate the targeted subscriber, he may be able to convince the MNO to port the subscriber's mobile number to a new SIM card under the attacker’s control.

text: Should this initial part of the attack be successful, the genuine subscriber’s SIM card loses connection to the network. This will enable the attacker to receive all the SMS and voice traffic intended for the targeted subscriber. This, in turn, will enable him to undermine or indeed exploit SMS-based security measures, as SMS-based authentication is often used in online banking portals, as well as for social media and email accounts (e.g., one-time passwords sent via text or telephone calls).

text: INFORMATION

text: CYBER THREATS OUTREACH IN TELECOM A.3 WARNING CUSTOMERS ABOUT WHATSAPP EXPLOIT

text: The WhatsApp exploit enables the installation of malicious software from the NSO Group, a firm from Israel that is behind a software tool called Pegasus.

text: The cyber-attack exploited WhatsApp’s video calling system in order to send malware to the mobile devices of a number of WhatsApp users.

text: NSO spyware was used to exploit a vulnerability in the app to target more than 1,400 people between approximately April 2019 and May 2019. One hundred of those targeted were human rights defenders according to WhatsApp, in countries around the world. The vulnerability, first published about in May, allowed attackers to install spyware by calling the target using WhatsApp.

text: INFORMATION

text: -N -EN -454 -21 -09 TP ABOUT ENISA

text: ISBN: 978-92-9204-538-8 DOI: 10.2824/4233