text: www.enisa.europa.eu European Union Agency For Network and Information Security

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: st  Initial Planning Conference (IPC ) was held in Brussels, 1 of March in DG Connect th th  Main Planning Conference (MPC), held in Athens (ENISA premises) during 19 -20 June

text: ECSC 2018 Analysis Report December 2018

text: Figure 1: ECSC Attendance evolution

text: ECSC 2018 Analysis Report December 2018

text: th  Sunday 14 Oct : Welcome dinner and presentation of the teams th  Monday 15 Oct: Dinner in London with some of the teams th  Tuesday 16 Oct: ECSC Competition Closing Party at London’s newest rooftop bar th  Wednesday 17 Oct: Awards Dinner and Presentations on the River Thames, aboard Riverboat

text: Figure 2 ECSC 2018 Winning team - Award ceremony

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: Figure 3 Jury Workflow

text: ECSC 2018 Analysis Report December 2018

text: GRADE NUMBER OF TEAMS Excellent 13 Very good 3 Good 1 Table 1 Presentation grades

text: ECSC 2018 Analysis Report December 2018

text: Figure 4 Scoreboard and contract management platform

text: ECSC 2018 Analysis Report

text: December 2018

text: ESTIMATED TIME TO ESTIMATED REF PROPOSED TITLE CHALLENGE TYPE COMPLETE DIFFICULTY

text: Unix privilege BT1 Following the Trail 4 hours Hard escalation

text: Image Intelligence - Forensic Image BT3 1 hour Easy Scenario #1 Analysis

text: BT4 Do Androids Dream? Android mobile 4 hours Medium

text: Password attack / BT7 Beneath the Waves 4 hours Hard Hash stealing

text: Unscrambling the BT9 Crypto 3 hours Medium Message #1 - Source

text: Unscrambling the BT10 Crypto 3 hours Medium Message #2 - Binary

text: Proving your Skills #1 BT11 Exploit development 3 hours Medium - Smashing the Stack

text: Vigenère Cipher BT13 Crypto 3 hours Medium Cracking

text: Hardware BT15 Hardware 3 hours Medium Manipulation #1

text: Combination network BT18 Curious Service 3 hours Hard / reversing

text: Image Intelligence - Forensic Image BT20 1 hour Easy Scenario #2 Analysis

text: KnowYourBrand - Enterprise1 Forensic 4 hours Medium Forensic Analysis

text: KnowYourBrand - Forensic Traffic Enterprise2 2 hours Easy Traffic Analysis Analysis

text: KnowYourBrand - Memory Dump Enterprise3 3 hours Medium Blockchain Analysis Analysis

text: KnowYourBrand - Packet capture Enterprise5 2 hours Easy TreasurePro analysis.

text: ECSC 2018 Analysis Report

text: December 2018

text: Packet capture KnowYourBrand - Enterprise6 analysis, 2 hours Easy Data Leakage steganography.

text: KnowYourBrand - RSA Packet capture Enterprise7 Medium Analysis analysis, cryptanalysis. 3 hours Password attack / ENISA1 Game of Dorms 1h (Easy) Easy bruteforcing ENISA2 Forest for the Trees Node analysis 2h (Easy) Easy Packet capture ENISA3 Lost in Transmission 3h (Medium) Medium analysis. ENISA4 Ma Baker Cryptanalysis. 3h (Medium) Medium ENISA5 Ma Baker Returns Cryptanalysis. 3h (Hard) Hard ENISA6 Byte Queen Cryptanalysis 2h (Easy) Easy Abyssinium Forensics Post-incident forensics ENISAForensics1a 6 hours Hard - Linux on Linux Abyssinium Forensics Post-incident forensics ENISAForensics1b 6 hours Hard - Windows on Windows

text: ENISACrypto1 Bob's Encrypted Email Cryptanalysis 1 hour Easy ENISACrypto2 Analysing BC4 Cryptanalysis 1 hour Easy Online Banking OTP ENISACrypto3 Cryptanalysis 2 hour Medium Token ENISACrypto7 Old Cryptogram Cryptanalysis 1 hour Easy ENISAHaris1 CTF - Congo CTF 3h (Medium) Medium ENISAHaris2 CTF - Domotica CTF 1h (Easy) Easy ENISAHaris3 CTF - Irony CTF 2h (Easy) Easy ENISAHaris4 CTF - Patient0 CTF 3h (Medium) Medium ENISAHaris5 CTF - Untrackable CTF 2h (Easy) Easy ENISAHaris6 CTF - VelvetTrail CTF 4h (Hard) Hard The Device Hardware Challenge Hardware 3h (Medium) Medium Table 2 Final list of challenges

text: ECSC 2018 Analysis Report December 2018

text: Figure 5 Bandstand

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report December 2018

text: Figure 6 Social Media Impact

text: ECSC 2018 Analysis Report December 2018

text: ECSC 2018 Analysis Report

text: December 2018

text: POSITION COUNTRY POINTS 179350 1 Germany 177050 2 France United Kingdom 169950 3 169250 4 Poland 166940 5 Greece 166450 6 Italy 156450 7 Estonia 153450 8 Belgium 149950 9 Romania 147690 10 Austria 147550 11 Spain 147250 12 Norway 13 Denmark 146250

text: ECSC 2018 Analysis Report December 2018

text: Czech Republic 134650 15

text: Table 3 ECSC 2018 Final results

text: ECSC 2018 Analysis Report

text: December 2018 Table 4 Meeting with MEP Eva Kaili

text: ECSC 2018 Analysis Report December 2018

text: ECSC2018 ECSC2018 Event Feedback surveys

text: ECSC Steering Committee and Jury

text: ECSC 2018 Analysis Report

text: December 2018

text: PARAMETER RECOMMENDATION

text:  The ECSC project team should consider creating a playbook with pictures of the national teams (“Who is who”) to be made available to the other ECSC stakeholders digitally and via hard copies during the event in order to enable the ECSC stakeholders (participants, facilitators, watch dogs…) to distinguish the team captains and coaches of the national Roles and teams and the ECSC Jury members. responsibilities  Clearly define and communicate the internal roles (team captains, coaches, ECSC Jury members, watch dogs…) to the ECSC stakeholders.  Consider creating visual indications for the different roles, for example, by providing stickers, polos and lanyards in different colours for each role.

text:  Consider foreseeing specific time slots for Jury meetings during the competition. Decision-  Capture and document all decisions made during the ECSC Steering Committee and Jury making of the meetings, including decisions, actions and owners, in a decision-making log. Steering  Track the implementation of decisions made by the ECSC Steering Committee and Jury in a Committee central register. and Jury  Ensure fair and equal representation of the different national teams with equal voting power in the ECSC Steering Committee and Jury meetings.

text:  Communicate all decisions made during the ECSC Steering Committee and Jury meetings in a transparent manner via official communication channels to the ECSC stakeholders (participants, organisers, facilitators, watch dogs…). Transparency  Avoid any last-minute changes to the ECSC game rules, in order to avoid confusion and ambiguity within the teams and unfair outcomes during the challenge.  Consider putting in place a screen within the ECSC gaming area via which any relevant communication towards the ECSC participants about the Jury meetings can be displayed.

text: Table 5 Governance and decision-making lessons learnt

text: PARAMETER RECOMMENDATION Public Affairs  Consider incentivising the transposition of the Public Affairs Strategy on a national level. Strategy Improve the communication between the national teams and coordination on social media adoption by in order to ensure an even intenser and more valuable collaboration between the Member national States on approaching social media for ECSC2019. teams Table 6 Public affairs lessons learnt

text: PARAMETER RECOMMENDATION

text:  Consider developing a few real challenges to be tested by the participants in order to assess Design whether the level of complexity is adequate to their skill. Request participant’s feedback on complexity for individual test challenges and take these into account for development of the final challenges.

text: ECSC 2018 Analysis Report

text: December 2018

text:  Consult with ECSC alumni and other active CTF players to ensure a level of complexity and challenge proportionate to the level of skill of participants.  Consider implementing a feature on the platform to report and provide feedback on challenges from a complexity point of view.

text: Service  Fixed position for service provider representative in jury. Providers  Additional HR capacity for service provider for trouble shooting.

text:  Consider a process for enforcement of rules and define standard consequences based on the type of violation. For example the use of red and yellow cards could be used by analogy with football games, where significant violations are penalised by a red card. Consider the following enforcement scheme: Rules o Red card. First red card: half hour time-out, second red card: disqualification o Yellow card. First yellow card: warning, second yellow card: 15 minutes time-out, third yellow card constitutes first red card.  Consider assigning the role of Referee to an individual that monitors compliance with the rules. Upon unclarity, the Referee can escalate to the Jury for final decision.

text:  Mandatory communication channels (between coaches and teams, and jury members).  Consider establishing an enforcement scheme that discourages malicious participants to spoil the fun for others. I.e. consider assessing ethical behaviour and incentivise fairplay. It is up the Steering Committee to develop and apply these rules. Enforcement  Consider detailing specific responsibilities for the watchdog function and communicate clearly their role to all stakeholders, including participants and organisers in order to avoid confusion about their mandate.  Consider installing a technical monitoring capability that enables identification of technical rule infringement by participating teams or specific individuals.

text:  Reconsider incentives for presentations in order to make them more strategically fitting with the challenges and encourage participants to do it. Presentations  Consider enlarging the driver for presentations. Incentivising presentations by providing points that will be taken into account for the challenge could be an option, but it has to be aligned with the overall philosophy of combining soft skills with technical skills.

text:  Consider implementing access controls to prevent users access the platform before it is Platform intended to be used.

text:  Perform adequate capacity testing beforehand (i.e. simulation testing/stress test). Infrastructure  Consider cloud / hybrid setup for hosting the challenge platform -> given high-bandwith and speed internet uplink.

text:  Consider involving ECSC alumni into designing the challenges in order to reflect the groups' level of expertise. Complexity  Consider involving CTF community – that is, actively involving seasoned CTF players into the process - in designing challenges.

text:  Consider implementing a scoring system that indicates scores for different phases in the Scoring challenge progress (indicate completion of milestones, overall progress for specific individual challenges, etc.).

text: Table 7 Challenge lessons learnt

text: ECSC 2018 Analysis Report

text: December 2018

text: PARAMETER RECOMMENDATION

text:  When determining the location of the challenge venue and hotel accommodations, take into account the distance and transportation options between both places. Ensure that Venue participants, organisers, facilitators and other relevant ECSC stakeholders can easily reach the challenge venue under any weather conditions.

text:  Ensure that sufficient water and food supplies are foreseen at the challenge venue.  Consider foreseeing a variety of meal options (including several vegan/vegetarian meal Catering options, gluten-free…) for the participants and other ECSC stakeholders during the challenge.

text:  Consider putting in place a big, central screen at the challenge venue, which displays all relevant communication regarding the outcome of the Jury meetings, lunch time, end time of the competition… towards the ECSC participants and other stakeholders.  Consider establishing a central WhatsApp group or other communication platform for the ECSC Jury members and organisers before the start of the challenge, in order to make it In-event possible for the members to communicate during the competition and inform each other communication of decisions taken during the Jury meetings.  Consider sharing an updated program schedule with the ECSC participants and other stakeholder throughout the competition to create the right expectations.  Consider using other means than microphones to communicate updates to the ECSC participants and other stakeholders during the competition.

text:  Consider the climate and weather context of the hosting country in order to foresee Accomodation alternate transport options from the accommodations to the actual event venue (e.g. in case of heavy rain).

text: Table 8 Logistics lessons learnt

text: PARAMETER RECOMMENDATION

text:  Consider facilitating the social events in spacious locations, which are adequate and sufficiently large to accommodate the amount of people present at the ECSC. Social event  Consider organising social events which trigger more interaction between the national teams (e.g. by placing name tags on the tables during dinner and ensuring that at least 4 countries are represented at each table).

text:  Ensure that the ECSC program schedule is aligned with the agendas of the side event Schedule/timing (e.g. job fair) in order to enable participants to attend the side event.

text: Table 9 Side events lessons learnt

text: ECSC 2018 Analysis Report

text: December 2018

text: PARAMETER RECOMMENDATION

text:  Ensure that the privacy preferences of all ECSC attendees are visible and respected. Privacy preferences could be expressed, for example, by providing coloured bracelets, polos or badges, which indicate whether or not the attendee wants to be captured in pictures, movies or other images which will be shared on social media (choice principle).  Ensure that all ECSC attendees are aware of the possible processing activities (e.g. being part Data of a group picture that will be shared on social media) by providing a general transparency protection notice at the event, for example via a banner at the entrance of the event, stating that pictures could be taken and shared with a wider audience) (transparency principle).  Ensure that all individuals have the option to opt-out of some of the processing activities (e.g. enable them to express they do not want to be in pictures published on the internet etc.) (choice principle).

text: Table 10 Compliance lessons learnt

text: ECSC 2018 Analysis Report

text: December 2018

text: Governance 4,00 3,50 3,00 Compliance 2,50 Finance 2,00 1,50 1,00 0,50 0,00 Total Side Events Public Affairs

text: Logistics Challenge

text: Figure 7 Maturity assessment results chart

text: ECSC 2018 Analysis Report December 2018

identifier: ECSC 2018 Analysis Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: ECSC 2018 Analysis Report

serie: rapporter

text: DECEMBER 2018 About ENISA

type: rubrik

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

type: stycke

text: Contact

text: For queries in relation to this paper, please use ecsc@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: We would like to thank our colleagues at Cyber Security challenge UK for taking care of all local logistics for the organisation of ECSC’2018 and in particular Ms. Debbie Tunstall and the colleagues at BT that provided the technical support throughout the event.

text: Our gratitude is also extended to our colleagues Razvan Gavrila and Adrien Ogee for their contributions to the success of the European Cyber Security Challenge. Finally, we would to thank all our colleagues’ responsible for the national competitions and the preparation of the teams that participate at the ECSC. Without their untiring efforts this competition will not be possible.

text: Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: Executive Summary 4

text: 1. Introduction 6 ECSC Background 6 ECSC Setup 7

text: 2. ECSC Attendance Evolution 8

text: 3. ECSC 2018 hosting country 9

text: 4. ENISA Contribution to ECSC2018 10 Steering Committee Management 10 Jury Management 10 Presentation management 12 Deployed Platforms 12 Scoring Platform (Score board) 13 Competition Challenges 13 Bandstand 16 Public affairs Strategy 17 Social media impact 18 VIP program support 19 International Engagement 19

text: 5. Final results 20 Post event activities 21

text: 6. Lessons learnt 23 Governance and decision-making 24 Public Affairs 24 Challenge 24 Logistics 26 Side Events 26 Compliance 27

text: 7. Maturity assessment results 28

text: 8. ECSC 2019 29

text: Executive Summary

text: The 5th Edition of the European Cyber Security Challenge, ECSC2018 was hosted in London during 14th to 17th October. The event was organised by the Cyber Security Challenge UK at the Tobacco Dock, an iconic grade one listed building which has a rich history. The event was hosted together with the job fair Cyber Re:coded.

text: Each country was represented at the ECSC final by a team of 10 contestants, comprised of the winners of the national competition. Half of the team members are within the range of ages of 14-20 years old and half in the 21-25 range. In total, 200 people (contestants, coaches and judges) representing 17 EU and EFTA countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, and United Kingdom) competed in the ECSC final in London. The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hacked hardware systems. However, technical skills are just one part of the whole story. Teamwork and presentation skills were also evaluated. The complete skillset which is important for working in an IT security team, is thus tested. The finalists of ECSC 2018 were the teams from Germany, France and UK.

text: ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: ECSC main website, ECSC planning platform, public affairs strategy, challenges creation, governance framework of the competition, secretariat support, etc…

text: In order to ensure appropriate and transparent reporting to the Steering Committee ENISA, the following key observations were made by independent third-party observers that have attended the ECSC planning meetings and the actual event. These observations have been produced based on the feedback collected from participants, members of the ECSC Jury, members of the ECSC Steering Committee, and attendees to the event. In addition, these observations reflect the feedback provided by organisers and participants collected by an online evaluation survey:

text:  The venue, accommodation and logistics provided by Cyberchallenge UK has been very well received by participants. The venue was very well aligned with the theme of the challenge and provided for adequate facilities to support the event.  The technical infrastructure supporting the challenge has significantly improved as compared to ECSC2017. The service providers contracted by Cyberchallenge UK delivered a relatively stable, state-of-the-art and reliable infrastructure. Some opportunities for improvement have been noted, but overall the user experience was positive. Some infrastructure challenges have affected the course of specific individual challenges (e.g. King of the hill, Capture The Flag), which is a key lesson learned to take into account in future editions.  The platform developed by ENISA to support the challenges in the format of contracts was received well by the participants and organisers as it facilitates a real-time scoreboard that is also accessible to the public over the ECSC website (www.ecsc.eu).  The Public Affairs activities conducted by the national teams, the organisers and ENISA have gained significantly in exposure, reach and engagement. To put things in perspective: #ECSC2017 had a total estimated social media reach of 199 913, compared to 5 062 457 for #ECSC2018.  Exposure towards traditional press and media, as well as potential sponsors, national representatives, and private entities has significantly increased. ECSC2018 welcomed several political representatives of EU Member States thereby supporting the objective of bringing

text: nationalities together and foster a pan-European spirit in the realm of the European Cyber Security Challenge. The 2019 edition of the European Cyber Security Challenge will take place in Bucharest Romania, in October 2019.

text: 1. Introduction

text: The growing need for IT security professionals is widely acknowledged at European level. To help mitigate this shortage of skills, many countries launched national cyber security competitions addressed towards students, university graduates or even non-ICT professionals with a clear aim:

text: ‘Identify new and young cyber talents and encourage young people to pursue a career in cyber security.’

text: The European Cyber Security Challenge (ECSC) https://www.europeancybersecuritychallenge.eu/ leverages on these competitions by adding a pan-European layer. Top cyber talents from each participating country meet to network and collaborate and finally compete against each other. Contestants are challenged in solving security related tasks from domains such as web security, mobile security, crypto puzzles, reverse engineering and forensics and in the process collect points for solving them.

text: In a nutshell, ECSC is the annual European event that brings together young talent from across Europe to have fun and compete in cyber security. Its main aim is to highlight the importance of the national competition.

text: ECSC Background

text: The project was initiated under the umbrella of the EU Cyber Security Strategy (Feb 2013):

text: ‘The European Commission will organise, with the support of ENISA, a cybersecurity Championship in 2014, where university students will compete in proposing NIS solutions.’

text: As of 2014, ENISA has been supporting the organisation of the ECSC. ENISA is actively organising the meetings of the governance structures, supporting the development of the competition rules and games and it is also part of the ECSC Jury. As of 2016, ENISA is the acting secretariat of the ESCS Steering Committee.

text: In 2017, 15 countries attended (Austria, Cyprus, Czech Republic, Denmark, Estonia, Germany, Greece, Ireland, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland and United Kingdom). The ECSC2017 st nd took place between the 31 and 2 November in Malaga, Spain. The winner of the final was Spain.

text: In the edition of 2018, held during 15-17 October 2018, 200 people (contestants, coaches and judges) representing 17 EU and EFTA countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, and United Kingdom) competed in the ECSC final at London. The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hack hardware systems. However, technical skills are just one part of the whole story. As time and resources were limited, teamwork and presentation skills were also evaluated. The complete skillset which is important for working in an IT security team, is thus tested. The finalist of ECSC 2018 were the teams from Germany, France and UK. By 2020, ENISA expects to have more than 25 countries involved in the ECSC.

text: The 2019 edition of the European Cyber Security Challenge will take place Bucharest Romania, in October 2019.

text: ECSC Setup

text: Each country is represented at the ECSC final by a team of 10 contestants, comprised by the winners of the national round. Half of them are within the range of ages of 14-20 years old and half in the 21-25 range.

text: Two preparatory pilot phases of ECSC have been held in 2014 (in Austria) and 2015 (in Switzerland) with attendance by 3 and 6 countries, respectively. Since 2015, ENISA is lending its experience and position to coordinate and organise the ECSC effort to reach its full maturity by 2020.

text: The activities of the ECSC are supervised by a Steering Committee, composed of representatives of the attending countries. ENISA facilitates the meetings of this group and provides strategic guidance. The decision making processes are described in the ECSC Charter, which is approved every year.

text: ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: the ECSC main website, the ECSC planning platform, the public affairs strategy, challenges creation, etc…

text: In addition, ENISA is working closely with the host of each edition, in order to ensure appropriate and transparent reporting to the Steering Committee.

text: During the year, two Steering Committee meetings are held prior the execution of the event:

text: ENISA organised these preparatory events and was overall responsible for the efficient running of the project, including meetings minutes and the follow-up of the proposed actions.

text: 2. ECSC Attendance Evolution

text: From the first edition of the ECSC in 2014 the evolution of the attendant’s countries has been the following:  2014 [3]: Austria, Germany, Switzerland  2015 [6]: Austria, Germany, Switzerland, Spain, Romania, United Kingdom  2016 [10]: Austria, Estonia, Germany, Greece, Ireland, Liechtenstein, Romania, Spain, Switzerland, United Kingdom  2017 [15]: Austria, Cyprus, Czech Republic, Denmark, Estonia, Germany, Greece, Ireland, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, United Kingdom  2018 [17]: Austria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Italy, Liechtenstein, Norway, Poland, Romania, Spain, Switzerland, United Kingdom

text: 25 20 15 10 5 0

text: 3. ECSC 2018 hosting country

text: The organization provided different useful information about how to get to the event from the selected hotel and the different facilities provided during the execution of the competition. Also, different activities were performed for the participants:

text: 4. ENISA Contribution to ECSC2018

text: Steering Committee Management

text: The activities of the ECSC are supervised by a Steering Committee, made out of representatives of the attending countries. ENISA facilitates the meetings of this groups and provides strategic guidance. The decision making processes are described in the ECSC Charter, which is approved every year.

text: During the preparation of ECSC 2018, ENISA was responsible for the following activities related with the management of the Steering Committee:

text:  Planning Platform maintenance and update  Mail list management  Organization of the IPC in Brussels  Organization of the MPC in Athens  Hot wash meeting after the execution of the competition in London  Feedback collection: Lessons learnt report and surveys to the participants

text: Jury Management

text: A jury body was established during the competition: A jury member is appointed from each of the members of the ECSC’s Steering Committee, once this is set, it will resolve any dispute during the competition.

text: The following improvements were implemented this year:

text: 1. A “Jury guidelines” document was created, summing up the most important points to take in to account. The Jury members and captains from all teams could use this document as a reference. 2. Jury meetings were scheduled at regular intervals in order to improve the efficiency of the competition: Jury members meet at predefined times during the competition to discuss and resolve complaints and queries received during the period in between two jury meetings. Also, a framework was created in the case an “extraordinary jury meeting” was necessary for issues that may affect severely the running of the competition. 3. Creation of a Jury coordinator role: In charge of acting as a PoC, receiving and collecting complains from participants, captains and jury members. 4. Definition of a clear workflow in case of complaints. The workflow is depicted in Fig. 3.

text: In general, during the competition the role of the jury was:

text:  Attend jury meetings  Resolve disputes with impartiality  Attend and evaluate presentations  Attend to any other issue that may need the expertise of the jury.

text: Presentation management

text: For ECSC 21018, ENISA proposed new guidelines and rules for the presentation of the contracts (“ECSC contract presentations guidelines”). During the event, the teams had the chance to present a contract of their choice, earning additional cash rewards. The final grade varied between:  Good ( extra 40% cash reward of the selected contract)  Very good (extra 50% cash reward of the selected contract)  Excellent (extra 60% cash reward of the selected contract) All the 17 teams presented during the competition with the following grades:

text: Deployed Platforms

text: For the planning, testing and execution of the ECSC, ENISA supported the development of the competition by deploying different platforms:  Planning portal: https://ecsc.enisa.europa.eu.  Test Scoreboard and contracts platform: https://board.ecsc.eu  File Sharing platform (owncloud): Used for information sharing and contingency mechanism: https://storage.ecsc.eu/  ECSC 2018 Website: Promotion of the event. Real time scoring information was provided during the challenge to externals interested parties: https://www.europeancybersecuritychallenge.eu/

text: Scoring Platform (Score board)

text: In order to manage the scores and the contract resolution, ENISA coordinated the development of a new game board platform:

text: Also, onsite support by the main developer was provided during the challenge. The code of the platform was released to the community under EUPL licensing and can be found on Github (https://github.com/enisaeu/ecsc-gameboard). For ECSC 2019 is expected that this platform will be further improved and many changes requested and identified during the challenge will be implemented.

text: Competition Challenges

text: For ECSC 2018, 36 challenges or “contracts” were provided to participants during the two days of the competition divided in 110 different tasks, these includes activities involving different skills like Crypto, forensics, malware and artefacts analysis, reverse engineering, network forensics, hardware, mobile, steganography, and Capture the flag (CTF) challenges.

text: Challenges were provided by BT and ENISA. The final selection of challenges was done by the organisers. The Final list of challenges executed in the event was the following:

text: The teams managed to resolve more than the 95% of the tasks

text: Bandstand

text: As a novelty, an exterior bandstand challenge with an escape-room approach was introduced this year with a very positive feedback. The bandstand was set-up by BT and consisted in a physical challenge with 5 different associated tasks which the teams can choose to do but is not compulsory.

text: 1. Bypass electronic access control 2. Disarm an intruder alarm using a number sequence challenge 3. Bypass some combination locks 4. Solve some hidden riddles which will be exposed by use of a UV torch 5. Using teamwork, disarm a device (wire cutting challenge)

text: This challenge was located just outside the main competition area and was manned by BT personnel.

text: Public affairs Strategy

text: The European Cyber Security Challenge (ECSC) Steering Committee decided per ECSC Charter to develop a Public Affairs Strategy for every edition. The main objective of this Public Affairs strategy is to create, distribute and manage a coherent information flow to inform relevant audiences and participating countries about the ECSC final. Moreover, the Strategy provides the input for the Dissemination plan that ensures coherent and synchronised communication.

text: These documents will contribute to the maturity enhancement of the European Cyber Security Challenge and increase brand exposure. This will draw interested parties from the private sector in context of sponsor opportunities and attract more countries and participants to enrol in future ECSC editions.

text: The hosting country and ENISA implemented the strategy for the first year and the participants were provided with an official media pack which included the lines to take, brand identity information and press releases. In addition, ENISA will provide a Dissemination Plan that facilitates timely and coordinated implementation of the strategy amongst all participants and ECSC stakeholders.

text: Social media impact

text: Together with the public affair strategy a social media report was created, collecting the reactions during the event, according to the report, some of the most remarkable facts regarding to social media impact were the following:

text:  Estimated social media reach over the 5 million  Over 17 thousands direct social media interactions  97,2% of positive mentions. The complete list of collected indicators is the following:

text: VIP program support

text: A program for VIP visits was supported by ECSC 2018 organization. In this context, the following VIP visits were received during the execution of the competition:

text:  Raffaele Trombetta, Italy's ambassador in the UK  His Excellency Lars Thuesen, Danish Ambassador to the UK  Brigadier Lars Christian Hedemark, Defence Attaché, Danish Embassy UK  Jakob Holm, Press Attaché at the Royal Danish Embassy in the UK  Guillaume POUPARD, Director general ANSSI

text: International Engagement

text: The head of the USA cyber challenge, Douglas Logan, attended as observer in order to find synergies for future collaborations and leverage the event to a more international scale.

text: 5. Final results

text: The final results were the following:

text: Post event activities

text: As post event activity and, in order to promote the competition and the work that is done at national level, representatives of the winning team of ECSC 2018 were invited by the European Commission as VIP guests to the ICT 2018 event held in Vienna on 4th- 6th of December. The ICT conference and fair is the largest event of DG CONNECT taking place every three years. This year is organised under the auspices of the Austrian Presidency to the EU Council.

text: The representation of the team had the chance to take part in the following activities:

text:  VIP tour on the exhibition area together with key EU officials  Attend to different ICT conferences and participate in the Innovation and Startups forum  Meet with key cybersecurity stakeholders but also MEPs and other EU officials  Participation in the social event of the conference  Participation at a Facebook LIVE chat interview

text: 6. Lessons learnt

text: A lessons learnt report has been developed by an external observer on behalf of ENISA. It takes into account the feedback provided by ECSC organisers, the ECSC Steering Committee, the Jury, and participants regarding to the following domains:

text: 1. Governance and decision-making aspects 2. Public Affairs: Improvements on the social media communication strategy 3. Challenge: Aspects of the competition to be improved related to the development and setup of the challenge and exercises 4. Logistics: Aspects of the competition related with venue, catering, hotel, transportation, etc. 5. Side Events: Aspects of the competition related with social events and networking meetings 6. Compliance: Aspects of the competition to be improved related with compliance with laws and standards

text: ECSC2018 Lessons Learnt Report Governance and decision-making Public Affairs Challenge Logistics Side Events Compliance

text: 7. Maturity assessment results

text: In order to measure the current status of the ECSC project, a maturity assessment on different areas was developed by an external contractor, the results on the report are the following:

text: Total

text: 8. ECSC 2019

text: The final of the 2019 edition of the European Cyber Security Challenge 2019 will take place at Bucharest in October 2019 where, at least, 20 countries are expected to participate. The latest updates will be published on ECSC 2019 website: https://www.europeancybersecuritychallenge.eu/

text: ENISA

text: European Union Agency for Network and Information Security 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

text: Heraklion Office

text: Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: 1 Vasilissis Sofias Str, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu


text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: th th  Initial Planning Conference (IPC), held in Bucharest, 6 -7 of March in DG Connect th  Main Planning Conference (MPC), held in Bucharest during 20 -21th of June

text: December 2019

text: December 2019

text: th  Tuesday 8 Oct : Welcome dinner and presentation of the teams th  Wednesday 9 Oct: Dinner in Bucharest with some of the teams th  Thursday 10 Oct: ECSC2019 Competition Closing Party th  Friday 11 Oct: Awards ceremony and gala dinner at the Palace of the National Military Circle

text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: December 2019

text: December 2019 Figure 3: Progression of the commits Not only ENISA provided feedback: Members of the teams and other collaborators notified bugs and notified issues/bugs and commented the changes. Figure 4: Issues and comments

text: December 2019

text: December 2019

text: binary reverse,crypto 2 security by design code review, crypto 3 log analysis forensics, network 4 incident response forensics, network 5 cover up forensics, network 6 unauthenticated encryption crypto 7 residue number system & crt crypto 8 ecc crypto 9 merkle trees crypto 10 ropper pwn, reverse 11 oo pwn, reverse 12 off pwn, reverse 13 slot pwn, reverse 14 get-access reverse, crypto 15 evilmg web, pentest 16 crack-me reverse, algorithms, keygen 17 simple-keygen reverse, keygen 18 debug-service web 19 baby_heap pwn, reverse 20 machine-learning machine-learning 21 younger sister crypto 22 cryptotime - hash roulette crypto 23 complicated forensics, network 24 hack the h4ck3rs forensics 25 business as usual pentest 26 evil admin web 27 protelnet web 28 random dice web 29 picasso forensics, protocol 30 mosaic stegano 31 plot twist misc, ransom

text: December 2019

text: radios radio, hardware, crypto

text: elgamal crypto 34 yellow duck forensics, misc

text: the bomb wifi 36 state web

text: find freddie escape room 38 blink box misc, hw

text: December 2019

text: December 2019

text: December 2019

text: Romania 8188 2 Italy 7324 3 Austria 7036 4 Germany 6764 5 United Kingdom 6088 6 Poland 6040 7 France 5934 8 Estonia 5502 9 Denmark 5166 10 Portugal 5142 11 Czech Republic 4980 12 Greece 4854 13 Spain 4816 14 Norway 4362 15 Ireland 4206 16 Netherlands 3960 17 Switzerland 3626 18 Cyprus 3384 19 Liechtenstein 2380 20 Luxembourg 2184

text: December 2019

text: December 2019

text:  Roles and responsibilities were clearly defined and respected during ECSC planning meetings. The different organisational stakeholders and ECSC Steering Committee members were documented in an ECSC WhosWho which aimed at ensuring transparency about the individual stakeholders and their role in the competition.  Jury members were selected in a clear and transparent manner. The Jury team was established prior to the competition and introduced to the ECSC Steering Committee on the night before the competition so it was clear during the competition who the Jury members were and what their role and responsibilities were. The Jury members applied impartial and objective judgement in their activities. Roles and  The Jury members were announced to the participants and were visually responsibilities identifiable by means of a blue scarf bound around their arms.  Clear "who is who" document, including pictures and role description of ECSC Steering Committee members, Jury members, watchdogs, team coaches, and team captains. The who is who document was disseminated to the participating national teams prior to the competition.  Participants have a decent idea on who to contact in case of questions or technical difficulties during the competition. There was a direct communication line from the participants to the technical staff by means of Signal.  Ad hoc Jury meetings during the second day of the competition prevented the Jury members from monitoring the competition area to spot possible infractions of the ECSC rules.  ECSC Steering Committee decision-making process efficient and effective during IPC (Brussels) and MPC (Bucharest). Meeting minutes were taken by the Secretariat in order to create an inventory of decisions taken during the Decision-making of planning meetings and an overview of actions to take prior to kick-off of the the Steering ECSC main event. Committee and Jury Decision-making in between the Mid Planning Conference and the actual event  was on an ad-hoc basis via email, e.g. in relation to the age threshold.  There was an effective and efficient decision-making process between jury members ensured a clear and consistent approach towards incident that

text: December 2019

text: occurred during the ECSC finals. All incidents and issues were approached correctly and treated in a timely manner.  Technical support staff and platform providers were invited on an ad-hoc basis to the Jury meetings, leading to adequate transparency from a technical perspective allowing the Jury and Steering Committee to make informed decisions with regard to technical aspects of the Challenge.  Team captains and coaches were invited on an ad-hoc basis to the Jury and Steering Committee meetings, leading to adequate transparency about issues and incidents, allowing the Jury and ECSC Steering Committee to take appropriate action and decisions towards award of points for solving a challenge, cheating etc.  Preparatory Steering Committee meetings were held in a constructive manner in preparation of the main competition.

text:  A dedicated communication channel was established for in-game communication between SC and Jury members, for example in relation to changes to the official ECSC2019 agenda, practicalities in relation the event etc.

text:  Questions from participants during the competition, for example, in relation to technical difficulties, were answered in a different way, depending on who gave the answer. When there was a question from one of the participating teams, the answer was not shared through the microphone with all the teams.

text:  The amount of participating countries increased from 17 during ECSC2018 to 20 during ECSC2019. In addition, there were some new countries that National attended the ECSC competition as an observer.

text:  Newcomers to the competition were Luxembourg, the Netherlands and Ireland.  Two observing countries were present at ECSC2019, Malta and Finland.

text:  Key Performance Indicators have been defined in the ECSC Public Affairs Strategy in accordance with the Public Affairs goals. Monitoring, measurement and  KPIs were monitored and measured by a social media analysis (KPIs) monitoring tool.  ECSC2019 KPIs were analysed and compared with KPIs reported for ECSC2018.  Social media statistics were reported via digital media impact reports to ENISA and the SC on a monthly basis.

text:  A public affairs dissemination plan was updated as part of the Public Affairs Strategy. Dissemination Plan The public affairs dissemination plan was communicated to the  individual SC stakeholders and participating teams.  The public affairs dissemination plan was implemented by the majority of the national teams leading to high exposure.

text:  Key messages were updated compared to ECSC2018 according to the engagement phases as detailed in the dissemination timeline.

text: Key Messages

text:  The participating teams have successfully adopted the key messages embedded in the ECSC Public Affairs Strategy. An increased level of activity by the national teams has been observed.

text: December 2019

text:  The total reach on social media for the #ECSC2019 campaign from February 1st, 2019 up until October 21st, 2019 is estimated at 1.2 million.  The total amount of mentions on social media for the #ECSC2019 campaign from February 1st, 2019 up until October 21st, 2019 is estimated at 2113.  The total amount of interactions on social media for the Engagement and reach #ECSC2019 campaign from February 1st, 2019 up until October 21st, 2019 is estimated at 22 240 (of which 4654 shares and 17 583 likes).  Although the total number of social media reach has decreased as compared to last year, the quality of mentions and amount of interactions has increased.  In order to facilitate a structured and coordinated approach towards public affairs activities, the ENISA Public Affairs Team organised an operational meeting with the Steering Committee, with the support of Deloitte.

text:  The ECSC Public Affairs Strategy details specific key messages that can be shared across social media networks in order to reach the different target audiences during the different engagement phases as defined in the Strategy. These key messages have been updated compared to the previous version

text: Social Media

text: of the ECSC Public Affairs Strategy in order to achieve maximum audience engagement.  Social media platforms were used by ENISA, the members of the ECSC Steering Committee, participating national teams and other relevant ECSC stakeholders prior to, during and after the competition in order to increase awareness about the ECSC.

text:  The ECSC website was only updated very shortly before the competition took place.  The official ECSC website (www.ecsc.eu) has been updated prior to the ECSC competition in order to make it more user- Website friendly, easy to navigate and to strengthen the ECSC branding.  The ECSC website included a real-time feed to the scoreboard, allowing externals to monitor the progress of national teams, leading to transparency in the competition and increased engagement by the target audience, for example, by sharing posts on Twitter on LinkedIn.

text:  Similar to the previous edition of ECSC, communications about the event were disseminated through relevant channels as detailed in the ECSC Public Affairs Strategy.

text:  There is very limited presence of communications on ECSC on social media platforms used by the participants such as Instagram and Facebook.

text:  In general, participants were satisfied with the level of difficulty/complexity of the challenges. The challenges included a reasonable learning curve compared to the average level of the Design participants.  For some challenges, it was not clear to the participants what to submit so it was not possible to solve the challenge.

text: December 2019

text:  Some challenges only required guessing skills and did not require any hard skills from the participants to solve the challenge.  The majority of the participants was satisfied by the physical security challenge "Free Eddie".  There was not enough diversity in the range of challenges included in the competition, which includes that only a limited set of skills is tested during the competition.  The focus of the challenges was too much on competition instead of collaboration.

text:  Service provider was present and supported the participants in technical troubleshooting.  Communication from the service provider to the participants was efficient and effective and supported by instant messaging. In case of emergencies, the technical support staff was available to Service Providers help participants with troubleshooting.  The service provider has offered a stable and high quality technical network infrastructure to support the challenge.  The service provider communicated transparently and effectively to the Jury and Steering Committee as requested.

text:  Although clearly defined, there was little awareness amongst the participants of the rules.  Rules are ambiguous and unclear to the participants, questions about the rules were not answered in a clear and consistent manner. Rules  Rules about the age limit of the participants was changed between the Main Planning Conference and the competition leading to unclarity up until days before the challenge. The SC has addressed this ad-hoc via email.  No in-game changes were made to the rules. The Jury members ensured a consistent application of all ECSC game rules during the competition.

text:  A breach of the rules was approached, treated and followed up by the members of the Jury in a consistent manner. Consequences were agreed upon by the members of the Jury Enforcement and were communicated in a transparent manner to the SC members and subsequently, to the participants.  Technical capabilities were installed to allow monitoring of infringement of the rules.

text:  The agenda for the presentations was confirmed and clearly communicated to the SC members and subsequently to the participants.  The five best presentations were presented again during the conference on the third day of ECSC.  The presentations are considered an important aspect of the competition. Presentations  The order of the presentations was decided based on the score of the participating teams at the end of the first.  The meeting room in which the presentations took place was right in front of the entrance of the competition venue. As a result, there was a lot of noise and people walking by the presentations. This was distracting to the presenters and the Jury members.  A template for the presentations was provided upfront and respect by the majority of participating teams.

text:  The were access controls preventing participants to start solving challenges before the competition has kicked off.

text:  The ECSC platform as first introduced during ECSC2018 has been successfully deployed in ECSC2019. The overall

text: December 2019

text: experience of participants with the platform was positive and in line with their expectations.  The network infrastructure for the platform was reliable and stable. No major issues or incidents took place with regards to the availability of network infrastructure. Infrastructure  Network capacity and speed was meeting expectations.  There was WiFi available for attendees, organisers and other non-participants in the competition venue. However, it was not able to activate VPN.  In general, participants were satisfied with the level of difficulty/complexity of the challenges. The challenges included a reasonable learning curve compared to the average level of the Complexity participants.  Some challenges only required guessing skills and did not require any hard skills from the participants to solve the challenge.  Exceptions on scoring were voted by the Jury. Scoring  Scoring of teams was transparent, both internally as externally.  Scoring was not altered during or after the challenge.

text:  Some of the accommodations (hotels) did not have an easy connection to the ECSC venue. Venue  The competition venue was large enough for all the teams.  The ventilation of the competition area was poor. There was no fresh air so it became very hot after a couple of hours.  The quality of the food was poor, especially on the first day. The second day, the organiser has made an effort to offer more qualitative food.  The catering did not indicate the ingredients of the food that was

text: prepared for the participants and the organisers so there was no information on potential allergies.  In the competition venue, there were two restaurants where participants could have lunch.  Clear in-game communication.  A screen was presented on the wall with an overview of the live In-event communication scores.  In-event communication between participants and organisers was facilitated by a secure instant-messaging platform.  The selected accommodations were qualitative and was up to the expectations of the participants. Accomodation  Some of the accommodations were too far away from the ECSC venue and from the locations where social events were organised.

text: December 2019

text:  The social events did not strengthen the connection between the teams as they were not organised in such a way as to increase Social event the connection between the teams.  As participants were allowed to continue working on write-ups and presentations during the evening, some chose not to join the social event, but instead, to focus on the challenge.

text: Relevance  No conferences or job fairs were organised alongside the competition. However, some of the key sponsors had representatives at the competition venue.

text: Format  No conferences or job fairs were organised alongside the competition. However, some of the key sponsors had representatives at the competition venue.

text:  Access for disabled people was taken into account at the competition venue but was not taken into account during the social events.

text:  Social events were organised in locations that were too far away from some of the accommodations (hotels).

text:  Stickers were available for participants to indicate they did not want their picture to be taken by photographers, but they were not used in practice.  There was no clear communication about how personal data of the participants would be processed by the ECSC organisation.

text: Data protection

text:  Pictures were taken of people who were wearing no-photo stickers.  The WiFi available at the competition venue for participants, organisers and visitors did not allow to set up a VPN connection, therefore, not giving its users a safe environment to do secure/private work during the competition.

text: December 2019

text: Public Affairs Monitoring, measurement and analysis (KPIs) Dissemination Plan Key Messages Social Media Website Visibility Engagement and reach Challenge Complexity Design Platform Presentations Rules Scoring Service Providers Enforcement Infrastructure Logistics In-event communication Venue Accommodation Catering Side Events Relevance Format Logistics Social event Compliance Data protection Governance and decision-making Transparency Roles and responsibilities Decision-making National Participation Decision-making of the Steering Committee and Jury

text: December 2019

text: December 2019

identifier: ECSC 2019 Analysis Report

title: ECSC 2019 Analysis Report

text: ABOUT ENISA

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For contacting the authors please use ecsc@enisa.europa.eu. For media enquiries about this paper please use press@enisa.europa.eu.

text: AUTHORS

text: Adrián Belmonte Martin, ENISA

text: ACKNOWLEDGEMENTS

text: We would like to thank our colleagues at ANSSI and CERT.RO for taking care of all local logistics for the organisation of ECSC’2019.

text: Finally, we would to thank all our colleagues’ responsible for the national competitions and the preparation of the teams that participate at the ECSC. Without their untiring efforts this competition will not be possible.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

text: ECSC 2019 ANALYSIS REPORT

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 6

text: 1.1 ECSC BACKGROUND 6

text: 1.2 ECSC SETUP 7

text: 2. ECSC ATTENDANCE EVOLUTION 8 3. ECSC 2019 HOSTING COUNTRY 9 4. ENISA CONTRIBUTION TO ECSC2019 10

text: 4.1 STEERING COMMITTEE MANAGEMENT 10

text: 4.2 JURY MANAGEMENT 10

text: 4.3 PRESENTATIONS MANAGEMENT 12

text: 4.4 PLATFORMS 13

text: 4.5 SCORING PLATFORM (SCORE BOARD) 13

text: 4.5.1 The use of GitHub 14

text: 4.6 ECSC NEW WEBSITE 16

text: 4.7 COMPETITION CHALLENGES 16

text: 4.8 PUBLIC AFFAIRS STRATEGY 18

text: 4.8.1 Women in Cybersecurity in the context of the European Cybersecurity Challenge 18

text: 4.9 GALA NIGHT SPEAKER 19

text: 4.10SOCIAL MEDIA IMPACT 20

text: 4.11CONTINOUS IMPROVEMENT: IMPROVEMENTS TO THIS YEAR EDITIONS 20

text: 5. FINAL RESULTS 21

text: 5.1 POST EVENT ACTIVITIES 21

text: 6. LESSONS LEARNT 23

text: 6.1 GOVERNANCE AND DECISION-MAKING ASPECTS 23

text: 6.2 PUBLIC AFFAIRS 24

text: ECSC 2019 ANALYSIS REPORT

text: 6.3 CHALLENGE 25

text: 6.4 LOGISTICS 27

text: 6.5 SIDE EVENTS 28

text: 6.6 COMPLIANCE 28

text: 7. MATURITY ASSESSMENT RESULTS 29 8. ECSC 2020 31 ECSC 2019 ANALYSIS REPORT

text: EXECUTIVE SUMMARY

text: The 6th Edition of the European Cyber Security Challenge, ECSC2019 was hosted in Bucharest during 9th to 11th October. The event was organised by ANSSI (Asociatia Nationala pentru Securitatea Sistemelor Informatice) and CERT.RO (Centrul national de raspuns la incidente de securitate cibernetica) at Palace of the Parliament.

text: Each country was represented at the ECSC final by a team of 10 contestants, comprised of the winners of the national competitions. Half of the team members are within the range of ages of 14-20 years old and half in the 21-25 range. In total, 300 people (contestants, coaches and judges) representing 20 EU and EFTA countries (Austria, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Ireland, Liechtenstein, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania, Spain, Switzerland, United Kingdom) competed in the ECSC final in Bucharest. The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hacked hardware systems. However, technical skills are just one part of the whole story. Teamwork and presentation skills were also evaluated. A significant part of the skillset, which is important for working in an IT security team, is thus tested. The finalists of ECSC 2019 were the teams from Romania, Italia and Austria.

text: ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: ECSC main website, ECSC planning platform, public affairs strategy, challenges creation, governance framework of the competition, secretariat support, etc…

text: In order to ensure appropriate and transparent reporting to the Steering Committee, the following key observations were made by independent third-party observers that have attended the ECSC planning meetings and the actual event. These observations have been produced based on the feedback collected from participants, members of the ECSC Jury, members of the ECSC Steering Committee, and attendees to the event. In addition, these observations reflect the feedback provided by organisers and participants collected by an online evaluation survey:

text:  Roles and responsibilities were clearly defined and respected during ECSC planning meetings. The different organisational stakeholders and ECSC Steering Committee members were documented in an ECSC WhoisWho, which aimed at ensuring transparency about the individual stakeholders and their role in the competition.  The total reach on social media for the #ECSC2019 campaign from February 1st, 2019 up until October 21st, 2019 is estimated at 1.2 million people and the total amount of mentions on social media is estimated at 2113.The total amount of interactions on social media is estimated at 22 240.  The introduction of an independent jury body in the competition was considered a great achievement for this year edition.  The participating teams have successfully adopted the key messages embedded in the ECSC Public Affairs Strategy. An increased level of activity by the national teams has been observed.  The network infrastructure for the platform was reliable and stable. No major issues or incidents took place with regards to the availability of network infrastructure. Network capacity and speed was meeting expectations.

text: ECSC 2019 ANALYSIS REPORT

text: A maturity assessment on different areas was developed based on the feedback collected from participants, members of the ECSC Jury, members of the ECSC Steering Committee, and attendees to the event.

text: The graphical representation of the obtained values are the following:

text: Figure 1: ECSC maturity assessment

text: Challenge 4 3,5 3 2,5 Side Events 2 Compliance 1,5 1 0,5 0 ECSC2019

text: Governance Public Affairs and decisionmaking

text: Logistics

text: The 2020 edition of the European Cyber Security Challenge will take place Vienna Austria, in November 2020.

text: This report is not for public dissemination. It concerns only ENISA and the members of the ECSC Steering Committee, namely the representatives of the countries that participate in the ECSC competition.

text: ECSC 2019 ANALYSIS REPORT

text: 1. INTRODUCTION

text: The growing need for IT security professionals is widely acknowledged. According to recent

text: ECSC is the

text: estimates, is expected that more than 3,5 million cybersecurity professionals will be needed

text: 1 annual European

text: worldwide by 2021 in order to be able to prevent, react and protect their citizens against cyber

text: event that brings

text: threats. Europe has to make an effort to retain and attract talent to cybersecurity and, at the same time, create solid and powerful education, entrepreneur and business structures on cyber together young

text: security. talent from across Europe to

text: To help mitigate this shortage of skills, many countries launched national cyber security

text: have fun and

text: competitions addressed towards students, university graduates or even non-ICT professionals

text: compete in cyber

text: with a clear aim:

text: security.

text: ‘Identify new and young cyber talents and encourage young people to pursue a career in cyber

text: security.’

text: The European Cyber Security Challenge (ECSC) https://www.europeancybersecuritychallenge.eu/ leverages on these competitions by adding a pan-European layer. Top cyber talents from each participating country meet to network and collaborate and finally compete against each other. Contestants are challenged in solving security related tasks from different domains.

text: In a nutshell, ECSC is the annual European event that brings together young talent from across Europe to have fun and compete in cyber security. Its main aim is to highlight the importance of the national competition.

text: 1.1 ECSC BACKGROUND

text: The project was initiated under the umbrella of the EU Cyber Security Strategy (Feb 2013):

text: ‘The European Commission will organise, with the support of ENISA, a cybersecurity Championship in 2014, where university students will compete in proposing NIS solutions.’

text: As of 2014, ENISA has been supporting the organisation of the ECSC. ENISA is actively organising the meetings of the governance structures, supporting the development of the competition rules and games and is part of the ECSC Jury. As of 2016, ENISA is the acting secretariat of the ESCS Steering Committee.

text: In the edition of 2018, 200 participants (contestants, coaches and judges) representing 17 EU and EFTA countries (Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, and United Kingdom) competed in the ECSC final at London.

text: The 2019 edition of the European Cyber Security Challenge took place in the Parliament building in Bucharest, Romania, from 9th to11th October 2019. For the first time, teams from 20 countries participated at the final (Austria, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Ireland, Liechtenstein, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania, Spain, Switzerland, United Kingdom).The participants investigated vulnerabilities in web applications, binaries and document files, solved crypto puzzles and hack

text: ECSC 2019 ANALYSIS REPORT

text: hardware systems. However, technical skills are just one part of the whole story. As time and resources were limited, teamwork and presentation skills were also evaluated. The finalists of ECSC 2019 were the teams from Romania, Italy and Austria.

text: The 2020 edition of the European Cyber Security Challenge will take place Vienna, Austria rd th between 3 and 7 November

text: 1.2 ECSC SETUP

text: Each country is represented at the ECSC final by a team of 10 contestants, comprised by the winners of the national round. Half of them are within the range of ages of 14-20 years old and half in the 21-25 range.

text: Two preparatory pilot phases of ECSC have been held in 2014 (in Austria) and 2015 (in Switzerland) with attendance by 3 and 6 countries, respectively. Since 2015, ENISA is lending its experience and position to coordinate and organise the ECSC effort to reach its full maturity by 2020.

text: The activities of the ECSC are supervised by a Steering Committee, composed of representatives of the attending countries. ENISA facilitates the meetings of this group and provides strategic guidance. The decision-making processes are described in the ECSC Charter, which is revised and approved every year by the ECSC Steering Committee.

text: ENISA is currently hosting different platforms and performing different activities to support the European Cyber Security Challenge hosting country and the evolution of the project, this includes among others: the ECSC main website, the ECSC information-sharing platform, the public affairs strategy, challenges creation, etc…

text: In addition, ENISA is working closely with the host of each edition, in order to ensure appropriate and transparent reporting to the Steering Committee.

text: During the year, two Steering Committee meetings are held prior the execution of the event:

text: ENISA organised these preparatory events and was overall responsible for the efficient running of the project, including meetings minutes and the follow-up of the proposed actions.

text: ECSC 2019 ANALYSIS REPORT

text: 2. ECSC ATTENDANCE EVOLUTION

text: From the first edition of the ECSC in 2014 the evolution of the attendant’s countries has been the following:  2014 [3]: Austria, Germany, Switzerland  2015 [6]: Austria, Germany, Switzerland, Spain, Romania, United Kingdom  2016 [10]: Austria, Estonia, Germany, Greece, Ireland, Liechtenstein, Romania, Spain, Switzerland, United Kingdom  2017 [15]: Austria, Cyprus, Czech Republic, Denmark, Estonia, Germany, Greece, Ireland, Italy, Liechtenstein, Norway, Romania, Spain, Switzerland, United Kingdom  2018 [17]: Austria, Belgium, Cyprus, Czech Republic, Denmark, Estonia, France, Germany, Greece, Italy, Liechtenstein, Norway, Poland, Romania, Spain, Switzerland, United Kingdom  2019 [20]: Austria, Cyprus, Czech Republic, Denmark, Estonia, France, Germany,  Greece, Italy, Ireland, Liechtenstein, Luxembourg, Netherlands, Norway, Poland, Portugal, Romania, Spain, Switzerland, United Kingdom

text: Figure 2, depicts the growth of the ECSC since the involvement of ENISA in the competition back in 2014.

text: Figure 2: ECSC evolution in participation

text: ECSC 2019 ANALYSIS REPORT

text: 3. ECSC 2019 HOSTING COUNTRY

text: The 6th Edition of the European Cyber Security Challenge, ECSC2019 was hosted in Bucharest from 9th to 11th October. The event was organised by ANSSI (Asociatia Nationala pentru Securitatea Sistemelor Informatice) and CERT.RO (Centrul national de raspuns la incidente de securitate cibernetica) at Palace of the Parliament, the heaviest building in the world .

text: Palace of the Parliament, Bucharest (Romania).

text: The organization provided different useful information about how to get to the event, a selection of recommended hotels and the different facilities provided during the execution of the competition. In addition, different activities were performed for the participants:

text: ECSC 2019 ANALYSIS REPORT

text: 4. ENISA CONTRIBUTION TO ECSC2019

text: 4.1 STEERING COMMITTEE MANAGEMENT

text: The activities of the ECSC are supervised by a Steering Committee (SC) composed of representatives of the attending countries. ENISA facilitates the meetings of this group and provides strategic guidance. The decision-making processes are described in the ECSC Charter, which is approved every year.

text: During the preparation of ECSC 2019, ENISA was responsible for the following activities related with the management of the Steering Committee:

text:  Platforms maintenance and update  Mail list management  Update and creation of SC related documentation  Organization of the IPC in Brussels  Support the organization of the MPC in Bucharest  Accommodation, execution and follow-up of SC requests  Implementation of changes and suggestions collected using surveys and the feedback from previous editions  Creation and management of an independent jury  Creation of an internal ‘Who is who’ document to support the jury and teams activities  Realisation of a ‘Comcheck’ prior to the competition  Organization of a Hot wash meeting after the execution of the competition in Bucharest  Feedback collection: Lessons learnt report and surveys to the participants

text: 4.2 JURY MANAGEMENT

text: The proposal for this year edition was the creation of an independent jury body, instead of the format of the previous editions of having ‘jury members’ appointed by each participating country. By Steering Committee decision, the independent jury was composed of 5 members: 3 independent + 2 members by the following organizing countries, Austria and Czech Republic

text: To guarantee the full transparency and the independency of the selection of Jury members, the procedure for selecting the jury was the following:

text:  ENISA opened a period to nominate candidates in order to collect as many potential candidates as possible. ENISA also contributed to the list by providing names from its stakeholders’ lists.  Creation of a list of candidates: The list is a living document and is and is updated/refreshed at regular intervals. After the release of each update, there is a period where any member of the SC has the right to exercise his/her reservations to any proposed candidate in the list.  If a SC member decides to exercise the right to veto to any of the candidates in the list, the name will be removed after official communication.  Once the final deadline for exercising the possibility of veto, the list of candidates is considered final. Any name in the list is considered equally eligible  The final selection of candidates was done by ENISA who is also responsible for contacting the candidates and check for availability

text: ECSC 2019 ANALYSIS REPORT

text:  The final jury was kept in secret until the day of the competition, to avoid possible interferences or contacts with the jury members

text: The final composition of the jury was the following:  Alex Zacharis: Security Engineer for the European Global Navigation Satellite Systems Agency (GSA).  Simone Fisher: Professor at the Department of Computer Science at Karlstad University. Member of the Information Security Council at the Swedish Civil Contingencies Agency  Mateusz Szymaniec: Security specialist at CERT Polska,  Paul Varga: Teacher for IT Security at the university of applied sciences Technikum- Wien. Representative by Austria  Petr Jirásek: AFCEA Regional Vice President for Central Eastern European and Baltic Region. Representative by Czech Republic

text: As for previous editions, the following activities related to jury management were carried out:  An updated “Jury guidelines” document was populated, summing up the most important points to take in to account. The Jury members and captains from all teams could use this document as a reference.  Jury meetings were scheduled at regular intervals in order to improve the efficiency of the competition: Jury members met at predefined times during the competition to discuss and resolve complaints and queries received during the period in between two jury meetings. In addition, a framework was created in the case an “extraordinary jury meeting” was necessary for issues that may affect severely the running of the competition.  The jury coordinator: In charge of acting as a PoC, receiving and collecting complains from participants, captains and jury members.

text: In general, during the competition the role of the jury was:  Attend jury meetings  Resolve disputes with impartiality  Attend and evaluate presentations  Attend to any other issue that may need the expertise of the jury.

text: Definition of a clear workflow in case of complaints. The workflow is depicted in Fig. 3.

text: ECSC 2019 ANALYSIS REPORT

text: Figure 3: ECSC Complaints to jury workflow

text: 4.3 PRESENTATIONS MANAGEMENT

text: For ECSC 2019, ENISA by SC decision updated and incorporated new guidelines and rules for the presentation of the contracts (released on the document “ECSC contract presentations guidelines”). During the event, the teams had the chance to present a contract of their choice, earning additional cash rewards. The final grade varied between:  Good (extra 60% cash reward of a contract)  Very good (extra 80% cash reward of a contract)  Excellent (extra 100% cash reward of a contract)

text: All the 20 teams presented during the competition with the following grades.

text: ECSC 2019 ANALYSIS REPORT

text: Table 1: Results of the presentations Grade Number of teams Excellent 13 Very good 7 Good 0

text: 4.4 PLATFORMS

text: For the planning, testing and execution of the ECSC, ENISA supported the development of the competition by deploying different platforms:  Test Scoreboard and contracts platform: https://board.ecsc.eu  File Sharing platform (owncloud): Used for information sharing and contingency mechanism: https://storage.ecsc.eu/  ECSC Website: Promotion of the event. Real time scoring information was provided during the challenge to externals interested parties: https://www.europeancybersecuritychallenge.eu/

text: 4.5 SCORING PLATFORM (SCORE BOARD)

text: In order to manage the scores and the contract resolution, ENISA coordinated the improvement of the scoreboard platform created and used last year. Figure 1: ECSC 2019 Scoreboard

text: ECSC 2019 ANALYSIS REPORT

text: The following improvements were collected and implemented for 2019 edition:

text:  Dynamic Scores  Improved and detailed boards: Providing detailed information about teams / resolved tasks, which team is working in which contract, etc.  Improved system logging capabilities: Capture of errors, flags introduced system information, etc.  Improvements on flag introduction: Flag Types: Static, Regex, Date time, Multiple Choice, File - w/options for case sensitivity  Reports: Ability to create and get reports (exportable in CSV or other format) that includes different information about the resolution of the contracts  Chat improvements: Separation between Announcement chats, general chat, team chat  Option for exporting/access information in real time: Export of the scoreboard in different formats (JSON/XML, etc.), that provides integration with other systems  Brute force protection  Time Management: Automatic competition and contracts starting and ending, score freezing at specific time  Team Management improvement  Scores management: Penalties, Hints, Attempts, Level Bonuses, Dynamic Scoring, Categories and more  Dockerization of the platform

text: In addition, onsite support by the main developer was provided during the challenge.

text: The code of the platform is released to the community under EUPL licensing and can be found on Github (https://github.com/enisaeu/ecsc-gameboard). For ECSC 2020 it is expected that this platform will be further improved and many changes requested and identified during the challenge will be implemented.

text: 4.5.1 The use of GitHub

text: In order to improve the coordination of the requested changes, for the first year, GitHub was used as the standard way of requesting changes, notify issues to the main developer and keep track of them.

text: Figure 2: Contributions to master

text: ECSC 2019 ANALYSIS REPORT

text: The full track of comments, issues and pull request can be found on GitHub https://github.com/enisaeu/ecsc-gameboard/issues?q=is%3Aissue+is%3Aclosed. 15

text: ECSC 2019 ANALYSIS REPORT 4.6 ECSC NEW WEBSITE

text: The European Cyber Security Challenge website was updated: a new CMS platform was included in order to be able to include new information easily.

text: New ECSC Website In the ECSC website (https://ecsc.eu/ or https://europeancybersecuritychallenge.eu/ ) it is possible to find:  Information about the competition  Information about the hosting country  Information about participant countries and national competitions  Live scoreboard during the event  Information about past events

text: 4.7 COMPETITION CHALLENGES

text: For ECSC 2019, 38 challenges or “contracts” were provided to participants during the two days of the competition divided into 78 different tasks, these includes activities involving different skills like Crypto, forensics, malware and artefacts analysis, reverse engineering, network forensics, hardware, mobile, steganography, and Capture the flag (CTF) challenges.

text: The Final list of challenges executed in the event was the following:

text: ECSC 2019 ANALYSIS REPORT

text: Table 2: Challenges released

text: ID Name Type

text: ECSC 2019 ANALYSIS REPORT 4.8 PUBLIC AFFAIRS STRATEGY

text: The European Cyber Security Challenge (ECSC) Steering Committee decided per ECSC Charter to develop a Public Affairs Strategy for every edition. The main objective of this Public Affairs strategy is to create, distribute and manage a coherent information flow to inform relevant audiences and participating countries about the ECSC final. Moreover, the Strategy provides the input for the Dissemination plan that ensures coherent and synchronised communication.

text: These documents will contribute to the maturity enhancement of the European Cyber Security Challenge and increase brand exposure. This will draw interested parties from the private sector in context of sponsor opportunities and attract more countries and participants to enrol in future ECSC editions.

text: The hosting country and ENISA implemented the strategy and the participants were provided with an official media pack, which included the lines to take, brand identity information and press releases. In addition, ENISA provided a Dissemination Plan that facilitates timely and coordinated implementation of the strategy amongst all participants and ECSC stakeholders.

text: This year, also, a ECSC promotional video from ENISA was released and regular meetings during the competition were scheduled in order to align the media teams from different countries and try to share material and ideas.

text: 4.8.1 Women in Cybersecurity in the context of the European Cybersecurity Challenge

text: With its mission to address the shortage of cybersecurity talent in Europe, the ECSC is also concerned with gender diversity. As a well-established platform, the ECSC is an opportunity to attract more women to the cyber profession. As part of the public affairs campaign of the ECSC, ENISA is investing efforts to attract and identify young women in cyber to join the biggest hacking contest in Europe. The outputs achieved in raising awareness on the urgency to address the talent shortage in cybersecurity before, during and after the competition are the following:

text:  Before the competition, Deloitte conducted calls with ENISA Public Affairs Team and the Members of the Steering Board to gather their views on the topic and ask them to share national initiatives that aim to bridge the existing gender gap. Deloitte drafted a Whitepaper on women in cybersecurity in the context of the European Cyber Security Challenge.  During the competition, interviews to young females competing at the ECSC were conducted, and will be published soon.

text: ECSC 2019 ANALYSIS REPORT

text:  After the competition, the final version of the whitepaper on women in cyber was leveraged on social media channels of ENISA, published on the ECSC website and through the Deloitte Cyber Team social media powers. In addition, a collage with testimonials and gif animations on young females that participated to short interviews on the topic of women in cyber at the ECSC2019 (in progress). “Working together to change the gender diversity in cybersecurity” or “ lifting gender diversity in cybersecurity professions”

text: Female participants at ECSC2019

text: The intention in the medium-term is to continue and target these actions under a broader ENISA Women in Cyber initiative. Ultimately, the ECSC can serve as an enabler for achieving a more balanced cybersecurity workforce.

text: 4.9 GALA NIGHT SPEAKER

text: In a similar way to the way that the independent jury body was selected, a proposal from ENISA to bring a professional speaker to the gala night was launched.

text: Martina Lindorfer during her presentation

text: ECSC 2019 ANALYSIS REPORT

text: A list with names was proposed and the Steering committee members voted a selection of three preferred candidates. Finally, Martina Lindorfer was selected to perform a motivational speech to the young participants during the awards.

text: 4.10 SOCIAL MEDIA IMPACT

text: Together with the public affairs strategy a social media report was created, collecting the reactions during the event, according to the report, some of the most remarkable facts regarding to social media impact were the following:

text: Figure 8: Social media impact

text: 4.11 CONTINOUS IMPROVEMENT: IMPROVEMENTS TO THIS YEAR EDITIONS

text: Following the feedback from previous editions and the requests by the Steering committee representatives, the following improvements were implemented this year:

text:  No photo policy: Stickers to participants that do not want to be photographed  Improvements on jury management and independent jury body  Commcheck prior the competition  Release of the Who is who document  Telegram group for internal communication  Improvement on the problem troubleshooting during the competition  Improvements to ESCS scoreboard  Use of Github for pull request, issues and bug reporting  Alignment of the ECSC in woman in cyber security activities  Watchdogs, rules and jury enforcement role explained to participants before the competition  Creation of media meetings during the competition  Introduction of a speaker for the award dinner/ gala night dinner  New website with a new look and feel

text: ECSC 2019 ANALYSIS REPORT

text: 5. FINAL RESULTS

text: The final results were the following

text: Table 3: ECSC 2019 final results

text: Position Country Points

text: 5.1 POST EVENT ACTIVITIES

text: As post event activity and, in order to promote the competition and the work that is done at national level, representatives of the winning team of ECSC 2019 were invited by the European Commission to celebrate the 2019 European Cybersecurity Month. CONNECT University organised a special session focused on cybersecurity in practice that provided a great opportunity to get hands-on experience with the latest technology.

text: ECSC 2019 ANALYSIS REPORT

text: Romanian team during Connect University get away day

text: The representation of the team had the chance to:  Tour and visit CERT-EU premises in Brussels  Meet with key cybersecurity stakeholders and other EU officials  Have a meeting with the responsible for EU-FOSSA project  Participate in the CONNECT University "Cybersecurity Get Away Day", presenting to young high school students

text: ECSC 2019 ANALYSIS REPORT

text: 6. LESSONS LEARNT

text: A lesson-learnt report has been developed by an external observer on behalf of ENISA. It takes into account the feedback provided by ECSC organisers, the ECSC Steering Committee, the Jury, and participants regarding to the following domains:

text: 6.1 GOVERNANCE AND DECISION-MAKING ASPECTS

text: Table 4: Lesson learnt on governance and decision-making aspects

text: Parameter Observations /Recommendation

text: ECSC 2019 ANALYSIS REPORT 6.2 PUBLIC AFFAIRS

text: Table 5: Lesson learnt on public affairs

text: Parameter Recommendation

text: ECSC 2019 ANALYSIS REPORT 6.3 CHALLENGES

text: Table 6: Lesson learnt on challenges

text: Parameter Recommendation

text: ECSC 2019 ANALYSIS REPORT ECSC 2019 ANALYSIS REPORT 6.4 LOGISTICS

text: Table 7: Lesson learnt on logistic

text: Parameter Recommendation

text: ECSC 2019 ANALYSIS REPORT 6.5 SIDE EVENTS

text: Table 8: Lesson learnt on side events

text: Parameter Recommendation

text: 6.6 COMPLIANCE

text: Table 9: Lesson learnt on compliance

text: Parameter Recommendation

text: ECSC 2019 ANALYSIS REPORT

text: 7. MATURITY ASSESSMENT RESULTS

text: In order to measure the current status of the ECSC project, a maturity assessment, including observations on different areas was developed by an external contractor, these observations have been produced based on the feedback collected from participants, members of the ECSC Jury, members of the ECSC Steering Committee, and attendees to the event. In addition, these remarks reflect the feedback provided by organisers and participants collected by an online evaluation survey, the following domains and parameters were assessed:

text: Table 10: Lesson learnt on compliance

text: Domain Parameter

text: ECSC 2019 ANALYSIS REPORT

text: The main results on the report are summarised below:

text: Figure 9: Maturity Assessment results

text: Governance and Public Affairs decision-making

text: Logistics

text: Compared to the ECSC2018 edition, the results are the following:

text: Figure 5 Process maturity per year

text: Challenge 4 3,5 3 2,5 Side Events 2 Compliance 1,5 1 0,5 ECSC2018 0 ECSC2019

text: Logistics

text: ECSC 2019 ANALYSIS REPORT

text: 8. ECSC 2020

text: The final of the 2020 edition of the European Cyber Security Challenge will take place at Vienna in November 2020 where, at least, 22 countries are expected to participate. The latest updates will be published on ECSC 2020 website: https://www.europeancybersecuritychallenge.eu/

text: European Cyber Security Challenge 2020 logo

text: ABOUT ENIS A

text: The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing crossborder communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu.