text: Joint Publication Structured Cooperation between CERT-EU and ENISA TLP:WHITE | 14/02/2022 | JP-22-01

identifier: Boosting your Organisation's Cyber Resilience - Joint Publication

text: Joint Publication 22-01

text: Executive summary

text: Based on the continuously increasing threat level ENISA, The EU Agency for Cybersecurity, and CERT-EU, the CERT of all the EU institutions, bodies and agencies, strongly encourage all public and private sector organisations in the EU to apply, at a minimum, the cybersecurity best practices hereunder.

text: ENISA and CERT-EU remain confident that, by applying this set of recommendations in a consistent, systematic manner, organisations in the EU will be able to substantially improve their cybersecurity posture and enhance their overall attack resilience.

text: Best practices

text: The following best practices may complement but do not replace guidance issued by your national or governmental cybersecurity authority. They are provided in no particular order. Organisations should prioritise their actions according to their specific business needs.

text: 1. Ensure remotely accessible services require multi-factor authentication (MFA). These include, but are not limited to, VPN services, external facing corporate portals (extranets) and email access (e.g. OWA or Exchange Online). If possible, avoid using SMS and voice calls to provide one-time codes and consider deploying phishing resistant tokens such as smart cards and FIDO2 (Fast IDentity Online) security keys.

text: 2. Ensure users do not re-use passwords, encourage users to use Multiple Factor Authentication (MFA) whenever supported by an application (on social media for instance) Threat actors often compromise organisations by performing credential stuffing attacks. These attacks use credentials obtained from previous data breaches, such as leaked user names and passwords, against another unrelated service. These attacks are made possible because users tend to re-use the same username/password combination. Users are therefore encouraged to never reuse a password. In addition, users are advised to use trusted leak checkers to see if their personal email addresses are present in any known data breach and to change immediately any compromised password on the relevant websites and/or applications. The use of a corporate password manager should be encouraged whenever possible.

text: 3. Ensure all software is up-to-date Updates addressing known vulnerabilities should be prioritised. Reengineering vulnerability management processes is also needed and recommended in order to deploy high and critical severity patches as quickly as possible. Ensure all actions related to patching of endpoints and servers have been completed (e.g. system reboots). Remember to strongly encourage your users to patch their personal systems at home and as regularly as possible (e.g. computers, smartphones, tablets, connected devices like TV sets, videogame consoles, home routers, etc.).

text: 4. Tightly control third party access to your internal networks and systems. This will improve your ability to prevent and detect potential attacks should a third party be compromised and used as a beachhead to breach your organisation.

text: 5. Pay special attention to hardening your cloud environments before moving critical loads to the Cloud. Use the strong security controls available on cloud platforms and separate cloud system management from on-premise system management to ensure threat actors cannot jump from one environment to the other because of discrepancies in security controls.

text: 6. Review your data backup strategy and use the so-called 3-2-1 rule approach Addressed to organisations, the rule consists in keeping three complete copies of their data, with two of them locally stored but on different types of media, and at least one copy stored off-site. Your organisation’s backup strategy should be fully aligned with your business needs by setting explicit recovery time (RTOs) and recovery point objectives (RPOs). Ensure access to backups is controlled, limited and logged. Confirm your restore procedures are well documented and tested regularly. Given the proliferation of ransomware attacks, it is strongly recommended to increase the frequency of backups for critical data. The latest storage technologies facilitate rapid backups of almost any data set in a matter of minutes. Users should be trained to save data only on storage devices allowed by your cybersecurity policy or, if applicable, on the corporate cloud storage and not on their workstations. In addition, you should ensure that your backup software itself is up to date.

text: 7. Change all default credentials and disable protocols that do not support multi-factor authentication or use weak authentication (e.g. cleartext passwords, or outdated and vulnerable authentication or encryption protocols).

text: 8. Employ appropriate network segmentation and restrictions to limit access and utilise additional attributes (such as device information, environment and access paths) when making access decisions.

text: 9. Conduct regular training to ensure that IT and system administrators have a solid understanding of your organisation’s security policy and associated procedures. Vigilantly monitoring the misuse of sysadmin tools can help you prevent attackers from breaching your network and moving laterally.

text: 10. Create a resilient email security environment by enabling antispam filtering, adding a secure email gateway configured to automatically follow field-tested policies and playbooks designed to prevent malicious emails from reaching mailboxes.

text: 11. Organise regular cyber awareness events to train your users on common phishing techniques (e.g. identifying spoofed/suspicious messages) and the effects of phishing attacks.

text: 12. Protect your web assets from denial-of-service attacks. Using a CDN (Content Delivery Network) will expand your web assets’ footprint across multiple servers or use the native high-availability features of cloud platforms. Automate the disaster recovery runbooks for on-premise systems and ensure that you can move workloads to the disaster recovery site with a single click if possible.

text: 13. Block or severely limit internet access for servers or other devices that are seldom rebooted, as they are coveted by threat actors for establishing backdoors and creating persistent beacons to Command and Control (C2) infrastructure.

text: 14. Make sure you have the procedures to reach out and swiftly communicate with your CSIRT. Contact details can be found on the matching websites available via https://csirtsnetwork.eu/.

text: Publications

text: CSIRT publications

text: For best practices issued by your relevant CSIRT, please refer to their local websites.

text: CERT-EU Security Advisories

text: You may also refer to CERT-EU’s Security Advisories for information about critical vulnerabilities.

text: ENISA publications

text: You may also refer to the following ENISA publications for additional information: • ENISA Threat Landscape 2021, issued in October 2021. • Guidance on Secure Backups, including the 3-2-1 rule, issued on 1 September 2021. • Proactive Detection, section on monitoring, pp. 12 - 18, issued on 26 May 2020. • Proactive detection – Measures and information sources, issued on 26 May 2020. • How to set up CSIRT and SOC, issued on 10 December 2020. • Standards and tools for exchange and processing of actionable information, issued on 19 January 2015.

text: History

text: 14/02/2022 - 1.0 Initial Release


text: This report has been edited by: Giles Hogben, email: Giles.hogben@enisa.europa.eu

text: Legal notice: Notice must be taken that this publication represents the views and interpretations of the editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to ENISA

text: Regulation (EC) No 460/2004

text: . This publication does not necessarily represent the state-of the-art in cloud computing and it may be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2009

text: ENISA Briefing

text: ENISA Briefing

text: ENISA Briefing

identifier: Briefing: Quantum Key Distribution

nummer: briefing-quantum-key-distribution

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Briefing: Quantum Key Distribution

serie: rapporter

text: Quantum Key Distribution

type: stycke

text: November 09

text: ENISA Briefing

text: ENISA Briefing: Quantum Key Distribution

type: rubrik

text: ENISA Briefings are short descriptions of emerging issues in security aimed at policy and decision makers. They give a brief introduction to the topic, areas of debate and propose a reasoned opinion on controversial points.

text: About ENISA: The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard for information on good practices. Moreover, the agency facilitates contacts between European institutions, the Member States, and private business

text: and industry actors. Internet: http://www.enisa.europa.eu/

text: Contact details:

text: Acknowledgements:

text: We would like to thank the following for their input and advice:

text:  Rainer Plaga, BSI, Germany  Johannes Skaar, Norwegian University of Science and Technology

text: Quantum Key Distribution

text: The purpose of this briefing is to give an introduction to the possibilities offered by quantum key distribution (QKD), as well as its limitations and the main issues of disagreement between experts in the field. The algorithms and their basis in quantum mechanical theory are not covered in detail, but those interested can find suggestions for further reading in [Sources and further reading].

text: Key points

text:  The main use-case for QKD is the sharing of very long keys which may be used to provide message confidentiality using one-time-pad encryption. Due to its high cost, this means its main area of application is very high assurance applications (particularly related to national security and government use-cases).  QKD provides future-proof secrecy – because the security of key material does not depend on the computational intractability of the algorithm used, but on physical properties which do not change over time.  QKD relies on a security mechanism which is completely separate from traditional methods used for key exchange. It is therefore useful to develop as an alternative method which could be an essential fall-back in case other regimes become unusable (for example in case quantum computers become practical for factorisation problems, rendering traditional encryption useless).

text: Introduction

text: Quantum Key Distribution (QKD) is a method for remotely agreeing encryption keys between two parties. The most important feature of QKD is that it can be used to distribute very long secret keys in such a way that it is known that no eavesdropping could be successful.

text: QKD enables the encryption of data using random keys of the same length as the data being transmitted, in other words, using a true one-time-pad encryption (1). Encryption using a one-timepad can only be provably unbreakable provided that the key generation algorithm uses a true random number generator and randomness is not lost in key agreement. As an aside, truly random key generation can also be achieved using techniques based on quantum mechanical properties (see (2)).

text: The use of one-time-pads for encryption, in combination with eavesdrop protection based on QKD promises unconditionally secure transmission of messages – i.e. an attacker can gain no knowledge

text: Quantum Key Distribution

text: ENISA Briefing

text: about the message. This can now be achieved at speeds which make it practical for certain real-world applications.

text: QKD uses the physical property of quantum mechanical states, that they are altered by certain acts of observation. At a small scale (approximately single photons or the wavelength of light), such alterations and therefore the observation (eavesdropping) that caused them, can be reliably detected. QKD provides protocols (e.g. BB84, E91) and implementations (see (2)) for using this property to detect eavesdropping of secret key material. In QKD, a secret key is encoded as a set of quantum mechanical states, such that any act of observation which might lead to knowledge about the message is detected through its effect on those states. Only parts of the message which are known not to have been observed are retained.

text: QKD relies on physical properties rather than the intractability of a mathematical property (asymmetric cryptography, for example, relies on the intractability of certain mathematical problems, such as the factorisation of large numbers). This means that, unlike current classical cryptography techniques, the message security provided by QKD does not have a “sell-by-date” determined by the inexorable progress in computing power. In other words, it provides “forward security”.

text: What it is not

text:  QKD is not an encryption technique. Quantum Key Distribution is sometimes described as “quantum cryptography” but it is not a technique for encrypting data, only for distributing keys in such a way that any eavesdropping is known. Given knowledge of eavesdropping, only key material which is known not to have been eavesdropped is then used to encrypt data.  QKD is not exclusively quantum mechanical - it requires an initial secret, which must be established using a classical method (such as PKI) in order to authenticate both parties. This initial secret is then “grown” using QKD into a secret which is suitable for one-timepad encryption.  QKD is not possible over unlimited distances, with current implementations. The current maximum range is of the order of 100km. This problem could be solved using repeaters, but repeaters which do not have to be trusted (i.e. do not read and re-encode the key material) are not currently available. Therefore such a repeater has to be trusted and such “QKD networking devices” are in the early stages of development.  It does not replace end-to-end security. QKD represents one link in a chain of security measures used for encrypting data. If, for example, initial authentication of the parties is compromised, the vetting of the staff with access to the secrets is not sufficient, or the

text: Quantum Key Distribution

text: equipment used has back-doors, then the investment in security provided by QKD is wasted. In other words, QKD is only one link in a chain and if the other links are of unequal strength, it may not be a rational investment.  QKD has nothing to do with Quantum Computing or Quantum Cryptanalysis – other than the encoding of information using quantum states. Quantum computing and quantum cryptanalysis use information encoded in quantum states to process information. This can be used to perform certain computing operations (such as factorisation) much more efficiently than classical computing machines.  QKD cannot be used to transmit specific predetermined information, only to agree on a randomised secret. Since vulnerable parts of the message are routinely discarded as part of the BB84 algorithm (a process known as “sifting”), any predetermined message would be corrupted.

text: Implementations and weaknesses

text: There are currently a number of (high cost) commercial implementations of the theory. These implementations use either :  Discrete Variable measurements: this is typically based on the measurement of the polarisation of individual photons. This was the first type of system to be implemented and therefore may be considered more mature in terms of implementation security and robustness. However, compared to continuous variable systems, the data transmission rate is much lower, because of the need to isolate individual particles (of the order of KB/Sec).  Continuous Variable measurements: this is typically based on the measurement of the phase and amplitude of a laser beam to encode information. This is a relatively recent development and therefore has less maturity in terms of security testing, but promises considerably higher data transmission (of the order of MB/Sec). Another advantage of continuous variable approaches is that they are possible using off-the-shelf equipment.

text: There are a number of well-documented attacks against implementations, although these generally only show a slight weakening of the unconditional security offered and not a practical attack. For more information, see: (3) (4) .

text: Quantum Key Distribution

text: ENISA Briefing

text: Areas of controversy and open issues.

text: The following are important areas of uncertainty and debate in this area:  Which use-cases justify the cost and complexity of implementation? Given that the security of QKD lies in its ability to exchange very large keys in a way which provides so-called “forward security” – i.e. Given that QKD only grows keys, at what point does it become worthwhile to invest in QKD equipment rather than, for example, the exchange of very large keys e.g. stored on hard drives.  The concept of “unconditional security”: when the models used to prove unconditional security will always rely on a set of assumptions, which is necessarily incomplete. Attacks on QKD all rely on inaccurate modelling of theory in implementation because of hidden assumptions. It is clearly impossible for any implementation to be immune to the discovery of a new assumption which was not previously considered.  Is it worth having one link in the security chain so strong when all the other links are weaker?

text: Future trends and research

text: The following are areas where significant developments can be expected in QKD:  Range – the distance over which key agreement is possible can be expected to increase. Quantum repeaters are one way of achieving this. These are devices which can increase the range of transmission without having to be trusted. Although quantum states cannot be cloned (5), they can be stored and retransmitted without being observed. Quantum repeaters use this possibility, but practical commercial implementations are not yet available.  Bandwidth – the bit-rate of transmission can be expected to increase.  Cost – the cost of equipment can be expected to decrease.  Quantum Random Number Generation: keys used for one-time pads are only unconditionally secure if the process used to generate the keys is perfectly random. Measurements of quantum states can be used to create perfectly random strings (see (2)).

text: Quantum Key Distribution

text: Sources and further reading

text: 1. Anderson, Ross. Security Engineering. s.l. : Wiley, 2008. pp. 132-134. 9780470068526.

text: 2. Assche, Gilles Van. Quantum Cryptography and Secret-Key Distillation. s.l. : Cambridge University Press, 2006. ISBN-13: 9780521864855.

text: 3. Vadim Makarov, Andrey Anisimov, Sebastien Sauge. Quantum hacking: adding a commercial actively-quenched module to the list of single-photon detectors controllable by Eve. [Online] http://arxiv.org/PS_cache/arxiv/pdf/0809/0809.3408v2.pdf.

text: 4. Bing Qi, Chi-Hang Fred Fung, Yi Zhao, and Xiongfeng Ma. Quantum hacking: attacking practical quantum key distribution systems. [Online] 2007. http://spiedl.aip.org/getabs/servlet/GetabsServlet?prog=normal&id=PSISDG00671000000167100I000 001&idtype=cvips&gifs=yes.

text: 5. A Single Quantum Cannot be Cloned, Nature. Zurek, W.K. Wootters and W.H. 1982, Nature, Vol. 299, pp. 802–803.

text: 6. Quantum Cryptography, Quantum Teleportation, Quantum Computation, Bouwmeester, Dirk; Ekert, Artur K.; Zeilinger, Anton (Eds.) 2000, ISBN: 978-3-540-66778-0

text: 7. "The case for quantum key distribution" by Stebila et al, arXiv:0902.2839.

type: vagledning

utgivare: enisa


text: Case studies

text: ( ) Národní centrum bezpečnějšího internet, Prvního pluku 347/12a, Česká republika, (http://www.saferinternet.cz) (http://www.bezpecne-online.cz). ( ) Birgitte Førsund, Norwegian Centre for information Security (http://www.norsis.no). ( ) Bundesamt für Sicherheit in der Informationstechnik (http://www.bsi.bund.de) (http://www.bsi-fuerbuerger.de).

text: Case studies

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referred to in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-9204-080-2 doi: 10.2824/29145

text: Case studies

text: - Learning experiences on hacking should be organized with a clear focus on educational purpose vs legal implications of misbehaviour;

text: - Hacker contests and Cyber Challenges should be focusing on protection and receiving tips on preventive actions;

text: - The community education model should be given further considerations;

text: - Emphasize on the importance of awareness-raising measures as a continuos cooperation at both national and international levels;

text: - Relying on more interdisciplinary solutions.

text: ENISA and EC should address Cyber Security awareness at all levels in different arenas for sharing information.

text: Awareness organisations should pursue Public-Private partnerships in their Educational attempts towards the digital users.

text: NIS in Education community members should target specific stakeholders with different methods and specific content

text: Essential questions: What content in particular should we share? Which stakeholders do we involve? What are the methods that we deploy?

text: Case studies

text: 1.1. Case study: Hacking for good or for bad 2

text: 2.1. The Czech Republic: strategy of community education in the ‘Praha bezpecne online’/‘Prague safe online’ project 6

text: 2.2. Germany: 10th anniversary of the ‘Safer Internet Day’ provides an opportunity to increase awareness 10

text: 2.3. Norway: Norwegian Centre for Information Security 13

text: Case studies

text: ( ) ENISA Report (2012), https://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage- 1/collaborative-solutions-for-network-information-security-in-education ( ) ENISA Report (2011), https://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage- 1/nis-in-education

text: Case studies

text: ( )Many ENISA colleagues contributed with opinions in a thematic discussion and we thank them all; also Annex A contains direct links to thematic materials. ( ) Involving Intermediaries in Cyber-security Awareness Raising http://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage-1/eu-u.s.-event-onintermediaries-in-cybersecurity-awareness-raising/involving-intermediaries-in-cyber-security-awarenessraising

text: Case studies

text: ( ) Darknet’s motto ( ) Reference to MEP Marietje Schaake speeches.

text: Case studies

text: Case studies

text: ( ) http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667 (accessed in October 2013). ( ) As recommended in the ENISA report, (2012), Collaborative solutions for network information security in education.

text: Case studies

text: ( ) Contributor Sarka Soudkova, Národní centrum bezpečnějšího internet (http://www.saferinternet.cz).

text: Case studies

text: Case studies

text: Case studies

text: Case studies

text: Case studies

text: TNS Emnid BSI

text: Case studies

text: Case studies

text: ( ) Birgitte Førsund, Norwegian Centre for Information Security (http://www.norsis.no). ( ) http://www.regjeringen.no/en/dep/jd.html?id=463

text: Case studies

text: ( ) For more information: http://www.regjeringen.no/en/dep/krd/press/press-releases/2012/new-pilotwith-internet-voting-in-2013.html?id=710138 ( ) http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-2013-get-involved ( ) http://www.slettmeg.no/English

text: Case studies

text: Case studies

text: Case studies

text: Case studies

text: Case studies

text: Case studies

text: Case studies

identifier: Brokerage model for Network and Information Security in Education

title: Brokerage model for Network and Information Security in Education

text: Case studies

text: European Union Agency for Network and Information Security http://www.enisa.euro pa.eu

text: Brokerage model for network information security in education

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at http://www.enisa.europa.eu

text: Author

text: For enquiries on EDUCATION refer to Daria CĂTĂLUI, editor of this report, using the following e-mails: For contacting the editor please use StakeholderRelations@enisa.europa.eu For media enquires about this report, please use press@enisa.europa.eu

text: Acknowledgements

text: We would like to thank the following contributors who joined our effort with valuable insights at 1 2 3 country level experience: Sarka Soudkova ( ), Birgitte Førsund ( ) and Julia Schaub ( ).

text: Page ii

text: Legal notice

text: Copyright Notice

text: Page iii

text: Executive summary

text: By publishing the Brokerage model for Network & Information Security (NIS) in Education report, we aim to provide content and promote digital education on network and information security at all levels. The target group is composed of educators such as trainers, teachers and peers involved in formal education and non-formal education, including lifelong learning.In our current brokerage effort we try to connect the nodes in the best way possible by presenting three case studies with countries perspective, from the Czech Safer Internet Centre (NCBI), ‘Strategy of community education in project — Prague safe online’, from German partners, the Federal Office for Information Security (BSI), ‘10th anniversary of the Safer Internet Day provides an opportunity to increase awareness’, and from Norwegian partners, ‘Norwegian Centre for Information Security’. Furthermore we open a discussion about hacking. ‘Hacking for good or for bad’ is a case study to advance the use of appropriate terms by the NIS in Education community, taking into account the particularity of the given ecosystem. In order to raise awareness of our target group we share the view that everybody should take part in the discussion and share the responsibility of a secure global digital community. As recommendations to be taken into account by NIS in Education stakeholders from Member States we mention:

text: Regarding the general procees we draw the attention on the following recommendations:

text: The brokerage model for education is thus in focus in the three case studies and we are interested in consulting more partners in the future to identify their brokerage model.

text: Page iv

text: Contents

text: 1. Introduction Error! Bookmark not defined. 2. Case studies at country level experience 5 3. Conclusion 16 References 18

text: Page v

text: 1. Introduction

text: The Brokerage model for Network and Information Security in Education report is a continuation of Collaborative solutions for network information security in education ( ) (2012), and Network information security in education: consolidated ENISA contribution ( ) (2011). In 2012, we argued that brokerage of information is at the root of the learning cycle and we provided details to justify this by using practical examples from Austria, Denmark and Luxembourg. Our main recommendations were that we should all learn from our peers’ best practices and share our own experiences. We also recommended that a ‘can do attitude’ should be deployed both by educators and by their students of different age groups. We started with digital education work at ENISA and in this spirit we have been working, throughout 2013, in order to gather evidence on the newest developments and to share ideas among NIS communities. Furthermore, our main goal in publishing this report was to provide material to the target group and promote digital education on network information security. The main target group of our report is the same as in previous years. It consists of educators such as trainers, teachers and peers involved in formal education and non-formal education including lifelong learning.

text: The significant role of educators must not be omitted from any ICT stakeholder map!

text: We consider cyber security as an enabler and not as a burden, and by concentrating on education we want to emphasise the need to bring the various competences and capabilities of the EU Member States up to speed. Our main goals are to achieve ‘Cyber hygiene’, ‘Netiquette’ and being a ‘good digital citizen’ by involving the users through our partners and specialized communities. In our current brokerage effort we try to connect the nodes in the best way possible and as a result we present three case studies with countries perspectives, from Czech partners, ‘Strategy of community education in project —Prague safe online’, from German partners, ‘10th anniversary of the Safer Internet Day provides an opportunity to increase awareness’, and from Norwegian partners, ‘Norwegian Centre for Information Security’. The brokerage model for education is in the spotlight in the three case studies and we are interested in consulting more partners in the future regarding their brokerage model.

text: Page 1

text: 1.1 Case study: Hacking for good or for bad ( )

text: Background

text: Following up on previous recommendations and trying to monitor their implementations makes an important part of ENISA’s work. As mentioned in current and previous education work our main goals are to achieve ‘Cyber hygiene’ or ‘Netiquette’ by involving the users through our partners and specialized communities like this one of educators. In June 2012, 45 EU and US representatives from the private and public sectors gathered in Brussels to discuss the topic of involving Intermediaries in Cyber Security awareness, summarized in an ENISA report . In that event Dr. Timmers the EC CONNECT’s keynote speaker set the challenge to find ways to make hacking better understood and more suitable as use. It was mentioned that awareness effort may concentrate on ‘finding ways to make hacking uncool’. We follow up with a case study on the current use of the term, because we believe that the education practitioners and all other partners in awareness raising should have a clear and common understanding of the term and a unified message to transmit. How many times a week do you read an article on cyber security and hacking? Although both are popular buzz words and powerful hash tags on social networks, they are also of paramount importance in our daily life at work or during our spare time. In order to raise awareness we are of the opinion that everybody should be part of the discussion and share the responsibility of a secure global digital community. We therefore want to develop on a few considerations about hacking. ‘Hacking for good or for bad’ is an attempt to advance the use of appropriate terms by the NIS in Education community, taking into account the particularity of the given ecosystem. The network and information security world uses technical terms on a daily basis and we might easily get caught in discussions about ‘botnets’, ‘bullying’, ‘spamming’, ‘identity theft’, ‘denial of

text: Page 2

text: service’, ‘malware’ and ‘grooming’ and find ourselves using the same term for opposite meanings. Not always do experts or outsiders agree on the definition of these terms – and often terms start to live a life of their own. A good example is hacking. Do we use hacking for good or for bad? What do you think?

text: Objective

text: Following the whole debate and reading publications of various actors, we observed that the controversy about the term ‘hacking’ is still very much alive. It is not a new debate and we do not think that it will end soon as the term is evolving. However, we felt the need to participate with a short summary of the current status. It will represent a common ground for the NIS education community to further transmit a common message to European users. The purpose of the trial is to emphasize on the contextual meaning of the term ‘hacking’.

text: Considerations to take into account

text: Hacking is what hackers do with the high skills and knowledge they possess. However, the term can have different meanings depending on the context in which it is used. In ENISA’s education reports we advocate for good cyber security education in the EU, mentioning labs and hands on experience. Furthermore, we promote the saying ‘do not learn to hack, but hack to learn’ ( ). The shared opinion is that hacking is a neutral term, and that the discussion about ethical-‘good hackingֹ’ and unethical- ‘bad hacking’ has to be put into context. For example, hacking is ‘uncool’ when it is done with malicious intent and hacking is ‘cool’ when it is done with good intent ( ). Hacking is neither good nor bad. ‘Cracking’ would be a better term to use when speaking about bad hacking. However, it is primarily a mind-set: a way of thinking about security. Its main focus is on attacking systems, but at the same time it is also invaluable for defending those same systems. Because computer systems are very complex, defending them often requires experts to think like attackers. Admittedly, there is a big difference between thinking like an attacker and acting unlawfully; and also between researching vulnerabilities in fielded systems and exploiting those vulnerabilities for personal gain.

text: The terms hackers and hacking should be used, taking into consideration the context, the background and the community behind it.

text: Hackers have been around in our society for a long time. Hackers are sometimes described as curious, analytical, innovation-oriented and open-minded experts. However, the sword is doubleedged, in the same way that a locksmith’s skills is used to help people, but his expertise could also be used to break into somebody’s home. Such skills, which can be used to cause great harm, create fear and suspicion in people. However they can also be of great educational value. People are all different. For some it is educational and interesting to see how computers and applications work in depth, whilst others make a living by finding vulnerabilities in computer software and hardware and selling them to people who are willing to pay for the ability to easily break into computers.

text: Page 3

text: Next steps

text: In order to clearly set the objective on the learning experience and fill the gaps between the roles of ethical and unethical hacking in society, we recommend the following for a better use of the term: - Labs, classes and trainings on hacking should be organized with a clear focus on understanding the educational purpose vs. legal implications of misbehaviour; - Hacker contests and Cyber Challenges should be focusing on protection and receiving tips on preventive actions.

text: As a conclusion for good cyber security in the EU, MSs should better integrate NIS in public policies in education meant to enhance the technical skills of users and the general understanding of concepts. A summary with remarks is depicted in the graph below:

text: Page 4

text: 2. Case studies at country level experience

text: In this chapter we describe experiences at country level, in the Czech Republic, Germany and Norway. We are looking for a brokerage model for network and information security in education that could be shared across European countries to actively educate the digital citizen.

text: The EU cyber security ‘An open, safe and secure cyberspace’ strategy ( ) mentions the development of a roadmap for a ‘network and information security driving licence’ as a voluntary certification programme to promote enhanced skills and IT competence and other techniques for user empowerment such as cyber security championships, ‘Capture the flag’ competitions, the ‘European Cyber Security Month’ advocacy campaign, aligned with other global efforts. Additionally, the strategy calls to ‘step up national efforts on NIS education and training’ ( ), by introducing training on NIS in schools by 2014, training on NIS and secure software development and personal data protection for computer science students, and NIS basic training for staff working in public administrations. ENISA has started the consultation process in order to involve the relevant stakeholders and guide the process for quality results during the next years. We are also keen to search for best practices at country level and pick up the practice to be scaled up to regional, European and international levels.

text: Promote cyber security awareness at all levels!

text: Page 5

text: 2.1. The Czech Republic: strategy of community education in the

text: ‘Praha bezpecne online‘/‘Prague safe online’ project ( )

text: Background

text: The Národní centrum bezpecnejsiho internetu/Czech Safer Internet Centre (NCBI) is a nongovernmental, non-profit-making working association established to carry out the tasks related to knowledge-building, education and exchange of best practice in the field of safer use of the Internet and new media. It carries out various awareness-raising activities focused on children, their parents and teachers, and strives to engage Czech stakeholders in the promotion of safer use of the Internet.

text: Objective

text: The main objective of educational project ‘Praha bezpecne online‘/‘Prague safe online’ is the social protection, especially of children and young people, from the risky phenomena arising online and thus preventing online crime targeting children or committed by the youth themselves. The project raises awareness about safer use of the Internet and new media, and reduces the risk factors of online delinquency. The most important risk factors were determined as:  minimum knowledge of elementary school pupils and high schools students about the risks of online communication and onlinedelinquency;  high level of technical knowledge of pupils and students concerning information and communication technologies;  high accessibility of information and communication devices;  immature personal, social and moral competences of young Internet users ;  Low awareness of the legal consequences of some acts performed online (criminal consequences of some patterns of online behaviour, protection of personal rights and copyrights by the criminal code, etc.);  low (or zero) awareness of educators and prevention school specialists of online risks and online delinquency;  Low (or zero) knowledge of information and communication technology teachers, especially about Internet services (social networks, instant messengers, etc.);  absence of education on the safe and ethical use of the Internet and new media in the elementary and high school curricula;  low awareness of the public, especially parents, about the online risks and delinquency connected to the use of the Internet and the possibilities of children and youth protection;  Limited time parents spent with their children.

text: Page 6

text: Method

text: In the Czech experience-based approach they work on the assumption that prevention efforts focusing on one target group are, by far, not as efficient as if they cover the local community surrounding this target group as a whole. This is the main idea behind the community education, which focuses on the maximum number of specialists who can solve crisis situations connected with the online behaviour of pupils. By linking up these specialists, a ‘safety net’ that can efficiently operate at the local basis, is created. In the same time frame, they work with the parents of the pupils of all the local elementary schools, and of course also with the children themselves.

text: The following groups were involved in the project: — Elementary school children; — parents; — Educators (teachers, headmasters, school prevention specialists); — Specialists working with children (social workers, pedagogical-psychological counseling workers); — The municipality’s prevention specialists; — police officers from the area (mostly prevention specialists working with schools), probation and mediation service specialists.

text: Working with all the above-mentioned groups in the same time frame increases the motivation and interest about the topics of the particular groups. In a relatively short period of time, online safety literacy increases in the local community. All the groups involved start communicating with one another, share their newly gained knowledge and experience, and recommend further activities. Schools gain concrete partners for solving problematic situations from the municipality, the police, pedagogical-psychological counseling services; parents, one of the least easily accessible groups, become aware of the extent of the problem and their motivation to actively participate increases.

text: Page 7

text: To target the widest public, the project is accompanied by public awareness campaigns: — PR in conventional media (articles in newspapers, TV shots, reports from the events, interviews mostly on local TV, radio broadcasting, etc.); — Outdoor campaigns (posters, city light screens); — Internet (http://www.saferinternet.cz) websites and websites of cooperating institutions (municipality, Ministry of the Interior, information stalls in schools and other institutions); — Indoor campaigns (using school facilities, offices of cooperating institutions, etc.).

text: Every session of the project ends with a national conference. The audience consists of professionals from the groups mentioned above, and of an interested public. These events also attract the media and stakeholders.

text: Results

text: The ‘Praha bezpecne online’/‘Prague safe online’ educational project is one of the successful and dynamic developing NCBI projects. In 2011, the pilot of the project started raising the awareness of all the competent people of the selected Prague districts, the municipality prevention officers, school representatives, social workers and police officers. The model gave very good results. This is why, in 2012, the project, focusing on other Prague districts were run on the basis of community education. In 2013 the project is still running in Prague with increased number of participants and the same model is also used for the other regions of the Czech Republic. The Czech community education model has proved to be an efficient way of involving all the groups dealing with children and young people at risk of online communication. The participants’ feedback was very positive, evaluating the activities as very useful and professional.

text: Page 8

text: Next steps

text: The NCBI will also pursue its community model of education focusing on the awareness raising and prevention of online delinquency and crime committed against and by children and young people in other localities of the Czech Republic.

text: Impact of Prague safer online project in 2013:

text: ACTIVITY Number of IMPACT seminars

text: One day workshops for social workers 12 120 social workers

text: One day workshop for police officers 2 50 police officers

text: One day workshop for prevention specialists 13 120 prevention specialists

text: One evening seminars for parents 30 600 parents

text: Primary prevention seminars for children 170 4 250 pupils

text: Total 227 events 5 140 people

text: Page 9

text: 2.2. Germany: the 10th anniversary of the Safer Internet Day provides an opportunity to

text: increase awareness ( )

text: Background

text: The Federal Office for Information Security (BSI) is responsible for raising the awareness of German citizens in the various subjects of Internet and IT security. The BSI provides practical guidance on the secure handling of electronic communication media. To this end, a series of measures to raise public awareness are implemented continuously, e.g. regular press activities, events like trade fairs or open days, material such as brochures and posters, the citizens’ online portal (http://www.bsi-fuerbuerger.de) and the citizen CERT newsletter providing information on general developments and warnings in case of security incidents and security gaps. Furthermore, since 2010, the BSI runs a service centre as point of contact for citizens, on all questions regarding IT and Internet security issues. It offers independent advice and guidance to private users. The service centre is available via phone and email from Monday to Friday between 8 am and 6 pm. In case of enquiries beyond the so-called first level, the BSI’s various technical departments are called upon to assist in answering citizens’ questions. In addition to these regular activities, the BSI also makes use of further suitable opportunities to raise public awareness of IT security, one of these being the 10th anniversary of the Safer Internet Day, on 5 February 2013.

text: Definition of subjects for concrete assistance

text: In order to provide direct access to private users as a target group and to offer simple and viable solutions, the activities focused on two main topics: 1. Secure mobile use of the Internet; 2. Strong passwords to increase security. The PR activities started with a radio feature on mobile Internet. The aim was to make private users aware that their mobile devices are small computers which need to be protected against unauthorised access. Another aim was to create awareness that — due to their capability of providing Internet access — smartphones have the same protection requirements as the PC at home. A description of the risks was linked to associated information on security.

text: ( ) Julia Schaub, Bundesamt für Sicherheit in der Informationstechnik (http://www.bsi.bund.de) (http://www.bsi-fuer-buerger.de).

text: Page 10

text: The programme focused, on the following advice: 1. Do not leave the device unattended 2. Enable all existing locking mechanisms such as PIN and display lock 3. Avoid entering sensitive data using public networks

text: 4. Install apps only from trusted sources and check the rights granted to the application

text: 5. Install all available software updates on your device.

text: To reach a wide audience, the topic was tackled with the help of a broadcast service provider. In addition to the inclusion of an expert interview with previously defined questions, an independent ready-to-broadcast programme was produced. Both elements, radio programme and interview, were offered in the German-speaking broadcast area in the week prior to and on the Safer Internet Day on 5 February 2013, and aired around 40 times around the anniversary date. The programmes thus reached an audience of nearly 4 million radio listeners.

text: Strong passwords and strong partners

text: To increase the awareness of password security, the BSI decided to cooperate with a strong partner. The Police Crime Prevention of the Federal States and the Federal Government (ProPK) supported the concept and implementation of the activities. A representative survey among German Internet users was conducted by the market research institute, TNS Emnid, in order to obtain up-to-date and reliable figures regarding the use of passwords by German Internet users.

text: Password security among German Internet users

text: The results of the survey allowed some interesting conclusions regarding the way in which the respondents use their passwords. In order to keep the message on how to generate a secure password short, the presentation focused on a particularly distinctive fact: the survey showed that more than half of the Internet users questioned do not assign an individual password for each online service they use.

text: Page 11

text: This fact was used as a message and paired with the most important advice on secure password generation. While the BSI focused on technical assistance, their cooperation partner, ProPK, outlined the potential consequences under criminal law. These two perspectives ideally complemented each other to highlight the importance of a well-chosen password. The message was published via the various communication channels of the BSI and ProPK on 29 January 2013, one week before the Safer Internet Day. In addition, the topic was featured in a prominent place and complemented by additional information and further references on the BSI’s citizens’ portal (http://www.bsi-fuerbuerger.de) and the website of ProPK.

text: Multipliers increase public awareness

text: As well as the BSI’s and ProPK’s various newsletters, the message was also sent to different multiplier groups and journalists. This generated further synergy effects such as subject-related interview requests by radio stations. Furthermore, BSI successfully addressed women on IT security matters in the online environment via women-specific media. The BSI used the International Safer Internet Day to place a number of important IT security topics attracting media coverage. Thanks to the support of cooperation partner ProPK, it was possible to address important target groups beyond the BSI channels to make them aware of the relevance of IT security. The qualitative and quantitative responses to the implemented measures prove that continuous cooperation at a national and international level is an important component of awareness-raising measures for private users on IT security.

text: Page 12

text: 2.3. Norway: Norwegian Centre for Information Security ( )

text: Background

text: The Norwegian Centre for Information Security (NorSIS) is part of Norway’s focus on information security. Their aim is to make information security a natural part of everyone’s daily life. The primary target groups are small and medium-sized enterprises as well as public authorities. They also try to accommodate requests from the public. Their ambition is to provide services for every part of the society. NorSIS will try to reach its objectives through:  raising awareness about information security through training and information;  the compilation and creation of guidelines and tutorials concerning information security topics;  Establishing an overall awareness towards information security.

text: NorSIS has over 10 years of experience and has nine employees. NorSIS reports to the Ministry of Justice ( ) and public security.

text: Our tools to do our job

text: To reach out with the message, they need to structure their communication and actions through the media. They have a very good relationship with the Norwegian press, and are also often contacted by journalists as experts in matters concerning ‘information security’, trends and threat reports. Since NorSIS is an independent organisation, their voice and guiding are valued by journalists from all types of media (daily press/finance). They also present new research to the media, together with the public and the private sector.

text: ‘Arena that they created’

text: Since they are asked to assist both the public and private sector, they work hard to create different arenas for sharing information and knowledge about information security. For instance: − organise presentations when requested for businesses, the public or schools; − arrange about 15 different conferences each year — some are specific adjusted to different branches as oil, energy/power industry, maritime and public sector; − Arrange ‘Security top meetings’ that are for invited guests only and limited to about 40 participants from the public and the private sector. This meeting is based on the ‘Chatham’s rules’ and a report is made afterwards for participants only; − also communicate through four different webpages: 1. http://www.norsis.no (about organisation, what they do, information, updates and how they work), 2. http://www.sikkert.no (about National Security Month), 3. http://www.slettmeg.no (about help to delete info/pictures/films ),

text: Page 13

text: 4. http://www.idtyveri.info (about ID theft), − use social media such as Facebook and twitter; − educational movies and advertising films are also launched (http:www.youtube.com); − Work together with all kinds of businesses in Norway to promote awareness about information security. This work is made possible through the sponsor of the program which invites businesses to join the work. The sponsor program for National Security Month is the most popular and they had more than 20 sponsors this year.

text: Examples of what they do and how

text: 1. Internet voting/2013

text: The government conducted another pilot of Internet voting for the parliamentary election of 2013, due to the positive experience from the pilot scheme in 2011. The Ministry of Local Government and Regional Development therefore contacted NorSIS. Their job in this matter is to arrange courses in each of the 12 municipalities which were chosen for this pilot scheme. NorSIS developed courses based on guiding from the ministry. This means teaching voters to be ‘digital election observers’. Recruiting volunteer observers was done together with the municipalities. They used the local press to get publicity and the municipalities' webpages and social media. In August 2013, NorSIS advisors travelled around Norway to teach voters how to be ‘digital election observers’ ( ). If anyone experiences anything wrong, they can report to the helpdesk at the ministry.

text: 2. National Security Month/October 2013

text: NorSIS is responsible for ‘National Security Month’ based on an initiative from ENISA ( ). This is the third year they organise the National Security Month in Norway and interest in the event has grown — from the government, press, businesses, sponsors and people in general. This year they already have more sponsors than last year, as for instance, the National Cyber Force and Norman (http://www.norman.com). More information can be found, but only in Norwegian (http://www.sikkert.no). They also aimed to sell training packages for employees about information security to businesses all over the country, and work hard to get media coverage. They arranged a press conference and a kick-off event. In October, they shared speeches/communications from voluntary security experts for businesses in Norway.

text: 3. Slettmeg.no (translated to ‘delete me’)

text: ‘Slettmeg’ ( ) is a service from the Norwegian Centre for Information Security (NorSIS). The purpose of this service is to help people who experience privacy violations online. The service was launched in March 2010. It is often referred to in the media and young people in particular need this service — for instance when it comes to Facebook pictures, bullying, or other offensive things.

text: Page 14

text: Summary

text: In Norway, NorSIS has established itself as a ‘voice of authority’ with more than 10 years of experience in promoting awareness about information security. As an independent organisation, they continue to create arenas for sharing, education and increased awareness about information security. The National Security Month has been important for them to create a stronger public– private partnership and to get public attention about a topic that affects us all. Their role as ‘coordinator’ and ‘facilitator’ in the security branch in Norway has been even more important lately, since they are now, and will in the future be, relaying on more interdisciplinary solutions to handle cybercrime.

text: Page 15

text: 3. Conclusion

text: The Brokerage model for Network and Information security in Education report provides content and promotes digital education on network and information security at all levels. In an attempt to draw the conclusions we would like to mention the following:  The terms hackers and hacking should be used taking into consideration the context, the background and the community behind it;  From the Czech example we found out that online safety literacy increased in local communities by involving all competent groups and encouraging them to start communicating with each other, share their newly gained knowledge and experience, and recommend further activities. The community education model proved to be an efficient way to involve all the groups dealing with the risks of online communication. The Czech Safer Internet Centre (NCBI) is going to use the model in other regions too.  From the German example, we note that Safer Internet Day may be used for a larger purpose, to raise awareness and attract media coverage. With the support of cooperation partner, ProPK, it was possible to address important target groups beyond the BSI channels to make them aware of the relevance of IT security. The qualitative and quantitative responses to the implemented measures prove that continuous cooperation at a national and international level is an important component of awareness-raising measures for private users on IT security.  From the Norwegian example we learn the importance of creating different arenas for sharing information and knowledge about information security. NorSIS, established as a ‘voice of authority’, continues to generate arenas for sharing and for education. The National Security Month has been important to build a stronger public–private partnership and to get public attention. In future, they will be relying on more interdisciplinary solutions.

text: With these examples we have seen different brokerage models for network and information security in education that can be shared across European countries to actively educate the ‘digital citizens’. As recommendations to be taken into account by NIS in Education stakeholders from Member States we mention:

text: - Learning experiences on hacking should be organized with a clear focus on educational purpose vs. legal implications of misbehaviour;

text: - Emphasize on the importance of awareness-raising measures as a continuous cooperation at both national and international levels;

text: Page 16

text: Regarding the general process we draw the attention on the following recommendations: 1. ENISA and EC should address Cyber Security awareness at all levels in different arenas for sharing information. 2. Awareness organisations should pursue Public-Private partnerships in their Educational attempts towards the digital users. 3. NIS in Education community members should target specific stakeholders with different methods and specific content Stepping up the national effort on network information security education and training are the main priorities Our future target will be to search for best practices at country level and pick up top practices to be scaled up at regional, European and international levels.

text: Page 17

text: References

text: All references were accessed during the period August–November 2013.

text: Related ENISA papers:

text: (1) ENISA report (2012), https://www.enisa.europa.eu/activities/stakeholder-relations/nisbrokerage-1/collaborative-solutions-for-network-information-security-in-education (2) ENISA report (2012) http://www.enisa.europa.eu/activities/stakeholder-relations/nisbrokerage-1/eu-u.s.-event-on-intermediaries-in-cybersecurity-awareness-raising/involvingintermediaries-in-cyber-security-awareness-raising (3) ENISA report (2011), https://www.enisa.europa.eu/activities/stakeholder-relations/nisbrokerage-1/nis-in-education

text: Legislation:

text: (1) EU cyber security strategy ‘An open, safe and secure cyberspace’ http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667

text: Articles/websites/multimedia:

text: (1) http://www.saferinternet.cz (2) http://www.bsi-fuer-buerger.de (3) http://www.norsis.no (4) http://www.sikkert.no (5) http://www.slettmeg.no (6) http://www.idtyveri.info (7) http://www.regjeringen.no/en/dep/jd.html?id=463 (8) Darknet’s motto: http://www.darknet.org.uk/ (9) Internet Security System, Hacking http://www.iss.net/security_center/advice/Underground/Hacking/default.htm (10) Search Security by Margaret Rouse (10.2006) http://searchsecurity.techtarget.com/definition/hacker (11) https://citizenlab.org/ (12) http://www.hackthissite.org/ (13) https://www.hacking-lab.com/ (14) https://www.owasp.org/index.php/Main_Page (15) Eric S. Raymond’s Jargon File, The Meaning of ‘Hack’ http://catb.org/jargon/html/meaning-of-hack.html (16) Exploding the Myth of the ‘Ethical Hacker’ in Forbes by Parmy Olson (31.7.2012) http://www.forbes.com/sites/parmyolson/2012/07/31/exploding-the-myth-of-the-ethicalhacker/ (17) Schneier on Security, ‘Hiring Hackers’ (10.6.2010) http://www.schneier.com/blog/archives/2010/06/hiring_hackers.html (18) Students think hacking is ‘cool’, in Homeland Security News Wire (23. 9.2010) http://www.homelandsecuritynewswire.com/students-think-hacking-cool (19) Can hackers be heroes? |PBS Digital Studios (28.3.2013) https://www.youtube.com/watch?feature=player_embedded&v=NVtrA7juc-w

text: Page 18

text: Annex A: Definitions, quotes and different materials

text: On hacking

text:  The word ‘hacking’ has two definitions. The first definition refers to the hobby/profession of working with computers. The second definition refers to breaking into computer systems. While the first definition is older and is still used by many computer enthusiasts (who refer to cyber criminals as ‘crackers’), the second definition is much more commonly used. In particular, the webpages here refer to ‘hackers’ simply because our web-server logs show that everyone who reaches these pages are using the second definition as part of their search criteria. Internet Security System, Hacking http://www.iss.net/security_center/advice/Underground/Hacking/default.htm

text:  Hacker is a term used by some to mean ‘a clever programmer’ and by others, especially those in popular media, to mean ‘someone who tries to break into computer systems’. (1) Eric Raymond, compiler of The New Hacker’s Dictionary, defines a hacker as a clever programmer. A ‘good hack’ is a clever solution to a programming problem and ‘hacking’ is the act of doing it. Raymond lists five possible characteristics that qualify one as a hacker, which we paraphrase here as:  a person who enjoys learning details of a programming language or system;  a person who enjoys actually doing the programming rather than just theorizing about it;  a person capable of appreciating someone else’s hacking;  a person who picks up programming quickly;  A person who is an expert at a particular programming language or system, as in ‘UNIX hacker’. Raymond deprecates the use of this term for someone who attempts to crack someone else’s system or otherwise uses programming or expert knowledge to act maliciously. He prefers the term cracker for this meaning. (2) The term hacker is used in popular media to describe someone who attempts to break into computer systems. Typically, this kind of hacker would be a proficient programmer or engineer with sufficient technical knowledge to understand the weak points in a security system. For more on this usage, see cracker. Search Security by Margaret Rouse (10.2006]) http://searchsecurity.techtarget.com/definition/hacker  Hackctivism? freedom of speech experiments with technology https://citizenlab.org/  Hack This Site http://www.hackthissite.org/  Hacking Lab https://www.hacking-lab.com/  OWASP hack labs and courses https://www.owasp.org/index.php/Main_Page

text: Page 19

text: Thematic articles

text:  Eric S. Raymond’s Jargon File, The Meaning of ‘Hack’ http://catb.org/jargon/html/meaning-of-hack.html  Exploding the Myth of the ‘Ethical Hacker’ in Forbes by Parmy Olson (31.7.2012) http://www.forbes.com/sites/parmyolson/2012/07/31/exploding-the-myth-of-the-ethical-hacker/  Schneier on Security , Hiring Hackers (10.6.2010) http://www.schneier.com/blog/archives/2010/06/hiring_hackers.html  Students think hacking is ‘cool’ in Homeland Security News Wire (23.9.2010) http://www.homelandsecuritynewswire.com/students-think-hacking-cool

text: Multimedia

text:  Can hackers be heroes? |PBS Digital Studios (28.3.2013) https://www.youtube.com/watch?feature=player_embedded&v=NVtrA7juc-w

text: Page 20

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, GREECE

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, GREECE

text: P.O. Box 1309, 710 01 Heraklion, GREECE Tel. +30 2814409710 info@enisa.europa.eu Page 21 http://www.enisa.europa.eu