text: PUBLIC VERSION 3

text: For more information on cyber crises, please refer to the ENISA Report on Cyber Crisis Cooperation and Management: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-cooperation/nis-cooperation-plans/ccc-management/ ccc-study

text: PUBLIC VERSIONPUBLIC VERSION 5 ENISA CE2014 After Action Report

text: PUBLIC VERSION 7 ENISA CE2014 After Action Report

text: Exercise overview

text: PUBLIC VERSION 9

text: ENISA CE2014 After Action Report

text: Figure 1: Mapping of the phases of Cyber Europe 2014 to the European Cyber Crisis Cooperation Framework (ECCCF) Model.

text: STRATEGIC EXERCISE 25 February 2015

text: OPERATION EXERCISE 30 October 2014

text: TECHNICAL EXERCISE 28-30 April 2014 16 scenarios on individuals657 countries29 organisations214 49 h

text: Exercise overview

text: PUBLIC VERSION 11 ENISA CE2014 After Action Report

text: PUBLIC VERSION 13

text: ENISA CE2014 After Action Report

text: Scenario overview

text: PUBLIC VERSION 15

text: ENISA CE2014 After Action Report

text: Key findings and recommendations

text: PUBLIC VERSION 17

text: ENISA CE2014 After Action Report

text: 1818 5. key recommendations from the exercise

text: PUBLIC VERSION 19

text: ENISA CE2014 After Action Report

text: Catalogue Number: TP-04-15-624-EN-N

identifier: ENISA Cyber Europe 2014 - After Action Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: European Union Agency for Network and Information Security ENISA CE2014

type: rubrik

text: After Action Report

text: Public version enisa.europa.eu

text: Authors ENISA Cyber Crisis Cooperation and Exercises (C3E) program team: Razvan Gavrila, Adrien Ogée, Panagiotis Trimintzios (Program Manager) and Alexandros Zacharis.

type: stycke

text: Acknowledgements ENISA would like to thank to all participants in Cyber Europe 2014 for their valuable contribution.

text: Contact Cyber Crisis Cooperation team: c3@enisa.europa.eu

text: Disclaimer A full version of the After Action Report, containing detailed observations, challenges, recommendations and actions has been made available to all national cybersecurity authorities which participated in Cyber Europe 2014. All participants to the exercise interested in the full version shall liaise with their national cybersecurity authority.

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its MS, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU MS in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU MS by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at http://www.enisa.europa.eu.

text: Follow ENISA on Facebook Twitter LinkedIn YouTube and RSS feeds

text: Contact details For contacting ENISA or for general enquiries on Privacy please use the following details: Email: sta@enisa.europa.eu Internet: http://www.enisa.europa.eu

text: Legal notice Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice © European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged. ISBN: 978-92-9204-128-1 DOI: 10.2824/123012 Catalogue number: TP-04-15-624-EN-N

text: Executive Summary

text: Cyber Europe offers to 32 different countries, Member States of the European Union (EU) and the European Free Trade Association, hereafter collectively referred to as the Member States (MS), the possibility to engage in cooperation activities at various levels with the shared objective to mitigate jointly large-scale cybersecurity incidents. The EU Standard Operational Procedures (EU-SOPs), used to support these cooperation activities, provide Member States with guidelines which they can use in the face of large-scale cybersecurity incidents.

text: The main goal of Cyber Europe 2014 was to train Member States to cooperate during a cyber crisis . The exercise also aimed at providing an opportunity to Member States to test national capabilities, including the level of cybersecurity expertise and national contingency plans, involving both public and private sector organisations. In order to address the different layers of cyber crisis management, Cyber Europe 2014 was divided in three escalating phases, spread over 2014 and early 2015.

text: The exercise was a success, for it allowed ENISA to draw numerous lessons, recommendations and concrete actions, which will help to enhance cyber crisis preparedness in Europe. The common ability to mitigate large scale cybersecurity incidents in Europe has progressed significantly since 2010 when the first Cyber Europe exercise was organised. In particular, Cyber Europe 2014 has shown how valuable it is to share information from many different countries in real-time in order to facilitate high-level situation awareness and swift decision-making. Nevertheless, such processes are unprecedented in real-life and hence requires primarily capability development and possibly also policy guidance from both the Member States as well as the EU Institutions and Agencies.

text: It is crucial that Member States continue to rely upon and improve multilateral cooperation mechanisms, which complement the bilateral and regional relations they have with trusted partners. The EU-SOPs, which are meant to support the former, will be further improved to better take into account the evolving cybersecurity policy context in Europe. In addition, experience gathered throughout this exercise and the previous ones will strongly guide the development of future EU cyber cooperation instruments and exercises.

text: The full after action report includes an engaging action plan which ENISA and Member States are committed to implement.

text: 1. Exercise overview

text: 1.1 Objectives and setup

text: The goal of this exercise has been to contribute to the training of Member States’ participating organisations with a view to help them cooperate during a cyber crisis. More specifically, this exercise provided opportunities to assess the effectiveness of cooperation and escalation procedures in the face of cross-border cyber incidents which impact the security of vital services and infrastructure.

text: CE2014 had the following key objectives: 1. Test the European alerting, cooperation and information exchange procedures between nationallevel authorities responsible for cyber incidents.

text: 2. Provide an opportunity for Member States to test internally their national NIS contingency plans and capabilities.

text: 3. Explore the effect of multiple and parallel information exchanges between private-public and private-private.

text: 4. Explore the NIS incident response escalation and de-escalation processes (technical-operationalpolitical).

text: 5. Explore the public affairs handling of large-scale cyber incidents.

text: In order to better tackle the challenges of each layer involved in crisis management, the exercise was divided into three phases: technical, operational and strategic, each phase escalating into the next one.

text: 1.2 Planning

text: The exercise was organised by ENISA and planned jointly with representatives from the participating Member States. It required six planning conferences which took place in Belgium, Greece (twice), Luxembourg, Netherlands and Spain.

text: 1.3 Exercise platform

text: The exercise planning, conduct and evaluation was supported by the ENISA Cyber Exercise Platform (CEP). Developed by ENISA, CEP allows to: ● Work on all planning documentation (including Exercise Plan, Scenarios, Incidents/Injects, Policies, Press Releases, etc.). ● Facilitate the exercise communication. ● Support the development of incidents and injects. ● Conduct the exercise (send injects, monitor progress, reporting, etc.). ● Simulate the exercise world (news and media, social media, videos, etc.). ● Evaluate the exercise (polls, surveys, after action report production). ● Stay up-to-date with the exercise events and logistics.

text: CEP is currently being further developed by ENISA in order to be leveraged in future cyber exercises. ENISA accepts requests to contribute to future developments of the platform. In case of interest, please contact the ENISA Cyber Crisis Cooperation team (c3e@enisa.europa.eu). Any requests received will be evaluated and requesting parties will be informed accordingly of their expected contribution and role as appropriate.

text: 2. Participation

text: The recruitment of participants was the responsibility of the exercise planners (one per Member State and Institution).

text: Participation Nb Countries 29 Organisations 214 Individuals 657 Cybersecurity agencies 23 CSIRTs 48 Other Public Sector Institutions 50 Energy sector 27 Telecom sector 25 ICT Vendors 22 Financial sector 8 EU institutions 11

text: 2.1 Technical level exercise (TLEx) Participants of TLEx came from 29 countries and the EU Institutions. The participatin teams were composed of technical experts from public and private CERTs.

text: 2.2 Operational level exercise (OLEx) Participants to OLEx were operational crisis management teams from cybersecurity agencies, national and/ or governmental CERTs, as well as crisis management teams from private companies in the telecom and energy sectors.

text: Participation Nb Countries 26 Organisations 269 Individuals 841 Public sector (expert: cybersecurity agencies, national and governmental CERTs) 121 Public sector (non-expert: ministries, etc.) 61 Private sector: telecom 41 Private sector: energy 50

text: 2.3 Strategic level (SLEx) Participants to SLEx were senior officials responsible for the management of the cybersecurity components of a crisis within the relevant national authorities. Participation Nb Countries 20 Individuals (public sector) 58

text: 3. Scenario overview

text: The scenario of Cyber Europe 2014 revolved around a proposal for an EU regulation related to Member States’ importing of energy resources. The regulation aimed to introduce a tax to fund the development of green technologies such as wind farms, solar roads and electric cars. Opponents to the regulation claimed its objective was merely to increase taxes in the midst of the economic crisis. Several countries around the world, potentially impacted by such regulation, claimed that it was a geopolitical manoeuver aimed at undermining their development. Large lobbying and disinformation campaigns were organised to influence the decision on the EU regulation. Despite these efforts, negotiations moved forward and Member States and EU Institutions became the target of cyber attacks aimed at exfiltrating information about the regulation and destabilizing its energy market. The technical phase (TLEx) of Cyber Europe 2014 was organised at this point in the scenario, with incidents ranging from open source intelligence gathering on social media, mobile phone malware analysis to denial of service attacks and advanced persistent threats. The disruptions caused by these attacks did not prevent the regulation from passing. This led to a series of large-scale cyber attacks, with the goal to instigate fear and prevent the voting of the regulation. Several 0-day vulnerabilities were used to develop advanced exploits, attack various critical infrastructure operators’ networks and numerous online services. The operational phase of Cyber Europe 2014 (OLEx) was organised at this point in the scenario. The crisis then escalated further, with several energy infrastructure operators severely impacted in the midst of a harsh winter, key critical technologies breached and an increasingly worried public opinion. The strategic phase of Cyber Europe 2014 (SLEx) was organised at this point in the scenario.

text: 4. Key findings and recommendations

text: The key findings from Cyber Europe 2014 are the following: ● Cyber Europe 2014 proved to be an excellent opportunity to explore, understand and evaluate existing European cyber cooperation mechanisms at the technical, operational and strategic levels. The exercise strengthened the European cybersecurity community. ● Participants were fully engaged in cooperation at national and European levels, which led to a shared understanding of all facets of the crisis within a few hours. ● During the exercise, many multilateral interactions at the international level took place, highlighting the importance of regional cooperation. ● The EU Standard Operational Procedures and communication tools helped to provide higher situational awareness and structured cooperation activities during the simulated cyber crisis. ● Increased familiarity with these procedures could allow for a faster response. ● The large majority of participants recognised the benefits of exercising for the first time a strategiclevel cooperation. ● Cyber Europe 2014 contributed to trust building between Member States as it fostered new relationships and strengthened existing ones. ● The participating organisations took the scenario seriously and responded adequately to all challenges, either mitigating incidents at the technical level or using their respective contingency and business continuity plans. ● Participants to the technical phase recognised that it refreshed, if not increased their cybersecurity capabilities: 98% indicated interest to participate in the next exercise. ● The Cyber Exercise Platform proved to be a powerful tool to plan, conduct and evaluate the exercise. ● The introduction for the first time of the three phases in Cyber Europe was an important step towards understanding the inner challenges of such large scale crisis management processes. ● Large scale cyber exercises such as Cyber Europe 2014 are complex projects which require a long planning phase (over 2 years) and the contribution of scarce expertise, both from ENISA and the Member States.

text: The following are the key recommendations from the exercise:

text: 1. Cyber Europe exercises, as well as any cooperation activity at European level during real cyber crises, build upon existing relations between Member States. ENISA and the Member States will continue to invest in trust building activities to maintain and further develop existing trust. 2. ENISA and the Member States should further develop the operational procedures which drive the cooperation activities during a cyber crisis, taking into account existing and future cooperation frameworks, to bring these procedures to a maturity level similar to those found in other sectors such as civil protection and aviation. 3. ENISA and the Member States will seek further integration with national and regional activities. 4. ENISA will address future Cyber Europe activities as a programme containing both trainings as well as small and large scale exercises, in order to provide a better experience and achieve greater impact. 5. Lastly, ENISA will further develop the Cyber Exercise Platform to offer a richer experience to both players and planners, as well as to support the organisation of national and regional exercises, fostering the development of a cyber exercise community.

text: ENISA European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office 1 Vasilissis Sofias Str. ENISA building Marousi 151 24, Athens, Greece

text: enisa.europa.eu

type: vagledning

utgivare: enisa


identifier: Cyber Europe 2016: After Action Report

title: Cyber Europe 2016: After Action Report

text: THE EU CYBER SECURITY AGENCY

text: CYBER EUROPE 2016: AFTER ACTION REPORT

text: Findings from a cyber crisis exercise in Europe JUNE 2017 CONTACT For queries in relation to this paper, please email: c3@enisa.europa.eu For media enquiries about this paper, please email: press@enisa.europa.eu LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent the current state of affairs and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources, including external websites, referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. COPYRIGHT NOTICE © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. Catalogue number: TP-01-17-327-EN-N ISBN: 978-92-9204-224-0 DOI: 10.2824/218244 Copyright for the images on the cover and pages 31 and 45: © Shutterstock. For reproduction or use of these photos, permission must be sought directly with the copyright holder.

text: CYBER EUROPE 2016: AFTER ACTION REPORT

text: Findings from a cyber crisis exercise in Europe 2

text: TABLE OF CONTENTS

text: Executive summary 6 Key findings and recommendations 8 SECTION I EXERCISE OVERVIEW 11 1.1 GOALS AND OBJECTIVES 11 1.2 TARGET AUDIENCE 11 1.3 SET-UP 11 1.4 SCENARIO 13 1.5 PLANNING 13 1.6 EVALUATION PROCESS 15

text: CYBER EUROPE 2016: AFTER ACTION REPORT 3

text: EXECUTIVE SUMMARY

text: Cyber Europe 2016 was the fourth pan-European cyber crisis exercise organised by the European Union Agency for Network and Information Security (ENISA). Over 1 000 participants working mostly in the ICT sector, from public and private organisations from all 28 Member States of the European Union and two from the European Free Trade Association (EFTA), joined in a programme of activities ranging from training sessions and communication checks to technical competitions and cooperation exercises. The exercise simulated a realistic crisis build-up over an actual period of 6 months, culminating in a 48 hour event on 13 and 14 October 2016. Cyber Europe 2016 was based on three pillars essential to the successful mitigation of large-scale crises caused by cybersecurity incidents: cooperation at national and international levels and sound cybersecurity capabilities. First, the exercise fostered cooperation between targets of simulated cybersecurity incidents, security providers and national authorities, shedding light on national-level public–private and private–private cooperation. Participants had to follow existing business processes, agreements, communication protocols and regulations to mitigate effectively the situations presented to them. Such mechanisms were not always in place for all participants, which hindered the overall ability to reach full EU-level situational awareness. The EU network and information security directive identifies many of the associated shortcomings and proposes measures that ENISA and Member States are already implementing to improve the situation. Second, Cyber Europe 2016 helped participants understand how cybersecurity authorities would cooperate with each other and EU bodies in the event of a large-scale crisis. Undoubtedly, crisis cooperation at EU level is very much maturing and improving. Most, if not all, Member States have come to realise the importance of sharing structured information across national borders. With the active support of ENISA, they have leveraged the benefits of EU-level situational awareness for their own crisis management activities. Yet despite such progress, Cyber Europe 2016 highlighted, as previous exercises did, the absence of a cooperation framework at EU level for crises stemming from cybersecurity incidents, officially endorsed cooperation procedures or a centralised

text: hub. The creation of the EU CSIRTs Network and the European Commission initiative to publish a crisis cooperation blueprint in 2017 are excellent developments in that regard. They will surely benefit from the detailed findings in this report. Last, the exercise offered countless opportunities for participants to enhance their cybersecurity capabilities, from their technical and operational expertise to their capacity to handle crisis communication. Organisational and individual cybersecurity preparedness and capabilities in the EU were excellent overall. Technical expertise, business continuity and crisis communications procedures were of a high standard. Nevertheless, the vision required to link technical- and operational-level response activities to strategic crisis management mechanisms was sometimes lacking, which proved detrimental to fostering crisis exit strategies supporting decision-making. Additionally, many lessons were learned from the use of the prototype platforms developed by ENISA to support cooperation at EU level; they will reflect positively on the development of the EU-level crisis cooperation infrastructure financed by the Connecting Europe Facility (CEF).

text: CYBER EUROPE 2016: AFTER ACTION REPORT 5

text: KEY FINDINGS AND RECOMMENDATIONS

text: KEY FINDINGS Participating organisations responded adequately to most challenges they faced during the exercise. Cybersecurity experts employed in a wide array of sectors in the EU demonstrated high levels of expertise and appetite to resolve complex cybersecurity issues. Their ability to cooperate in the most difficult times is an important finding. No participant questioned the essence of cyber incident cooperation at EU level. Rather, all actors focussed their efforts on lifting the remaining barriers. Such cooperation was particularly insightful and led to a full understanding of all facets of the crisis within a few hours, which supported the swift mitigation of a simulated large-scale attack against EU interests. In particular, the EU Cyber Standard Operational Procedures helped to provide EU-level situational awareness and structured cooperation activities. The exercise in itself proved to be an excellent opportunity to increase individual and collective knowledge in the field of cybersecurity. Participants developed skills, procedures and relationships. Most importantly, they reiterated their appreciation in the exercise series: 99% indicated interest to participate in the next exercise. Innovation and transformation were at the heart of Cyber Europe 2016. From a product, process, rhetoric and service perspectives, the exercise planning team, composed of Member States and ENISA representatives, pushed established boundaries to transform the EU cybersecurity society. The European Union Ombudsman underlined this joint effort in March 2017 with an award for excellence in innovation and transformation. Participants repeatedly asked for more opportunities to test their technical skills regularly against a variety of advanced scenarios. Many were grateful for the multiple options offered by ENISA to involve media, legal and financial policy experts and hope for more to come as leaders across the EU realise that cybersecurity goes beyond information security.

text: The Cyber Crisis Cooperation Platform prototype developed by ENISA provided numerous insights into technical means supporting EU-level cooperation. These will be of paramount importance in order to ensure the buy-in from Member States in such a cooperation platform, currently under development. The Cyber Exercise Platform proved to be a powerful tool to plan, conduct and evaluate the exercise. In particular, the simulated environment developed by ENISA supported the crisis build-up in a realistic fashion with an unprecedented emphasis on written and visual storytelling. Key recommendations 1. Following their revision, the operational procedures which drive the cooperation activities during a cyber crisis should be endorsed by the CSIRTs Network established by the Network and Information Security Directive. Training opportunities on the use of these procedures and tailored exercises should be offered regularly. 2. An EU-level cyber crisis cooperation framework is currently being developed by the European Commission. It should build upon these findings to develop interconnections between cooperation mechanisms, identify and empower key actors, from CSIRTs to law enforcement, and set a clear vision for the future of EU cyber response. 3. Future Cyber Europe should focus on cooperation activities on technical and operational topics. Other options should be pursued to offer training and exercise opportunities on a variety of other topics increasingly associated with cybersecurity. In particular, ENISA should support EU-wide capacity building on cyber crisis communication.

text: CYBER EUROPE 2016: AFTER ACTION REPORT 7

text: I

text: SECTION I EXERCISE OVERVIEW

text: 1.1 GOALS AND OBJECTIVES Some Member States chose to involve individuals and organisations from other sectors as well, as The three goals of the Cyber Europe 2016 exercise indicated in Figure 1. built upon those set in Cyber Europe 2014, following an in-depth assessment of their relevance performed In total, 948 participants officially registered for in the after action report of the latter exercise . the exercise, of whom two thirds came from the private sector. G1. Test EU-level cooperation processes. G2. Provide opportunities for Member States to test NB: These figures account only for those participants their national-level cooperation processes. who registered in the Cyber Exercise Platform. G3. Train EU- and national-level capabilities. Several organisations chose to use one account and distribute exercise information between multiple Consequent objectives were derived from the participants. As a result, one can assume the actual high-level goals in order to drive the development total number of participants to be significantly higher. of the exercise, as presented in Table 1 (next page). 1.3 SET-UP 1.2 TARGET AUDIENCE Cyber Europe 2010 and 2012 were 1-day all-inclusive Participation in Cyber Europe 2016 was limited to exercises. Cyber Europe 2014 was the first exercise organisations from the European Union institutions, in the series in which technical cybersecurity incident European Member States and European Free Trade handling was combined with operational crisis Association Member States (collectively called management activities in three different phases. Member States hereafter), and private companies Building upon the latter, Cyber Europe 2016 was operating in the latter countries. a collection of exercising activities, offering prolonged opportunities to participants to learn, train and The main target audience of the exercise exercise their technical and operational capabilities. was individuals and organisations involved in information security activities in the information and telecommunications technology (ICT) sector.

text: CYBER EUROPE 2016: AFTER ACTION REPORT 9

text: Table 1 — Goals and objectives

text: STRATEGIC OBJECTIVE METRICS/QUALITATIVE INDICATORS GOAL

text: Timeliness, usefulness, structured

text: O1. Assess the quality of information sharing

text: vs unstructured

text: Number of EU CSOPs cooperation activities O2. Monitor occurrences of cooperation activities held, e.g. meetings/audioconferences, during the exercise

text: Completeness, timeliness, usefulness

text: O3. Evaluate situational awareness

text: of EU cyber integrated situation report

text: Appropriateness and usefulness of the

text: O4. Assess the ability to develop exit strategies

text: proposed actions

text: O5. Provide opportunities to participants to test

text: Number of opportunities provided to and used their intra-organisational procedures, if they by participants exist (BCPs, crisis management plans, etc.)

text: O6. Provide opportunities to participants to test

text: Number of opportunities provided to and used G2 cross-organisational cooperation processes, by participants if any

text: O7. Provide opportunities to participants to test

text: Number of opportunities provided to and used national-level cooperation activities and/or by participants contingency plans, if they exist

text: Number of different types of training opportunities offered, number

text: O8. Provide opportunities to train a wide variety

text: of participants who used the training of cybersecurity-related skills opportunities, level of satisfaction of participants in training opportunities

text: Number of learning opportunities offered

text: G3 O9. Provide learning opportunities

text: to participants

text: Types of self-assessment opportunities offered

text: O10. Provide self-assessment opportunities

text: to and used by participants

text: Number of different types of training

text: O11. Identify training needs for the future

text: needs identified

text: Figure 1 — Participation

text: ICT

text: Public/government facilities and services

text: Defence/military

text: Financial services

text: ICT

text: Emergency and security SECTORIAL PARTICIPATION

text: services PARTICIPATION

text: Other

text: Consultancy services

text: Academia and Research

text: Energy Information security

text: Telecommunications

text: Internet and digital services

text: Security companies

text: Hardware/software industry

text: SECTION I Exercise overview The Cyber Europe 2016 programme was comprised thousands of new jobs. The pervasiveness of highof activities in three areas. speed connectivity and the richness and quality of online services in the European Union are among 1. Training sessions (from September 2015 to the best globally. Such advantages have considerably October 2016) increased the dependability of EU citizens on ICT services. These two elements — quality of On-site training on exercise planning provided services and customer base — make this industry during the initial and main planning conferences. particularly appealing to global business. What if On-site crisis planning and management training this important piece of the global economy becomes for public participants. a target? Computer security attacks are increasingly Online training on the EU cyber standard used to perform industrial reconnaissance, lead operational procedures (EU-CSOPs) and the pilot disinformation campaigns, manipulate stock markets, cooperation platform offered to representatives leak sensitive information, tamper with customer data of EU national and governmental computer and sabotage critical infrastructures. security incident response teams (CSIRTs). The detailed scenario of the exercise consisted of 2. Preparatory exercises hundreds of documents including: (from April to October 2016) structured and unstructured, useful and Technical cybersecurity challenges released every misleading data scattered in simulated online month between April and October 2016, all part blogs, magazines, forums and file storage of the overall Cyber Europe 2016 scenario, building infrastructure; up into a crisis in a realistic fashion over the course thousands of simulated personal and professional of 6 months. social media profiles on simulated platforms; EuroSOPex, an exercise organised in June a simulated news channel, depicting the event 2016 involving 24 countries split into four through filmed news reports in a realistic fashion, separate groups. This exercise helped to train supported by simulated formal written news the representatives of the EU national and websites containing hundreds of news articles; governmental CSIRTs on the use of the EU-CSOPs. hundreds of tailor-made documents supporting the scenario for participants to analyse, from 3. Main exercise (13–14 October 2016) technical incident material to legal and public An all-inclusive cybersecurity exercise building upon: affairs documents. technical cybersecurity incident analysis; business continuity and crisis management, 1.5 PLANNING including media pressure handling; intra- and inter-organisational cooperation at Key dates of exercise programme planning and national and international levels; delivery of activities were: escalation; 12–13 May 2015: concept development situational awareness. conference — Rome; 26–27 October 2015: initial planning conference — Athens; 1.4 SCENARIO 17–18 February 2016: main planning conference — Lisbon; In the midst of the finalisation of the NIS directive , late May-early June 2016: EuroSOPex exercise; physical sabotage attempts via cyber means and 13–17 June 2016: final planning attacks against the digital market, the following conference — Athens; narrative ark was used as a driver for the April-Oct 2016: pre-exercise release of development of the scenario material: technical challenges; The European ICT industry is one of the most 14–15 September 2016: dry run — Athens; advanced in the world. Making the EU’s single market 13–14 October 2016: main exercise event fit for the digital age could contribute EUR 415 billion — distributed/exercise control in Athens. per year to our economy and create hundreds of

text: CYBER EUROPE 2016: AFTER ACTION REPORT 11

text: A graphical timeline of the Cyber Europe 2016 programme planning process and the programme activities is shown in Figure 2.

text: Figure 2

text: TIMING 2015 CYBER PLAN 12–13 May EUROPE 2016

text: Concept development

text: PROGRAMME

text: conference

text: PLANNING TRAIN

text: Training 26–27 October on CEP Initial Planning usage Conference

text: Training on 2016 exercise planning

text: 17–18 February

text: Main Planning SOP Conference e-learning

text: TEST TEST via CEP

text: 1 available

text: 14–16 June 1

text: Final Planning 3 Training on Conference MSEL usage

text: April– September

text: Technical June incidents SOP small (bi-monthly scale exercise release) (EuroSOPex)

text: CYBER EUROPE ARN 13–14 OCTOBER CONFERENCE TRACKS LE PLAN MAIN TRAIN EVENT

text: 10 May 2017 2017 TEST

text: After Action

text: LEARN

text: Conference

text: SECTION I Exercise overview A graphical timeline of the Cyber Europe 2016 Observations, challenges, recommendations and programme planning process and the programme actions drawn from the analysis of the findings activities is shown in Figure 2. highlighted in the elements mentioned above, are analysed as follows: Chapter 2: findings related to EU-level cooperation; 1.6 EVALUATION PROCESS Chapter 3: findings related to national-level cooperation; In order to evaluate the exercise against the objectives and key performance indicators Chapter 4: findings related to training at national presented in Section 1.1, ENISA collected feedback and EU levels; from participants to the various activities of the Chapter 5: findings related to exercise organisation. Cyber Europe 2016 programme, as well as statistics from the different exercise platforms. An action plan summary and four annexes containing detailed results complement the report. Technical cybersecurity challenges Given the sensitivity of some of the lessons learned, Anonymised statistics about incident results three versions of this report exist: (see Annex 2). Incident-specific feedback forms. a full version, available only to EU national and governmental CSIRTs (TLP AMBER) and Member EuroSOPex States’ exercise planners; Evaluation survey results (see Annex 1). a version without the findings related to Platform and chat logs. EU-level cooperation, available to all participants National and EU integrated situation reports. in Cyber Europe 2016 (TLP GREEN); a public version (TLP WHITE), containing Audioconference minutes. only Chapter 1. Main event NB: ENISA consulted planners from the respective Evaluation survey results (see Annex 3). participating Member States upon drafting this report Observation and status reports. and integrated consensual feedback. Non-consensual Platform logs. feedback was added to Annex 5. National and EU integrated situation reports. Audioconference minutes.

text: CYBER EUROPE 2016: AFTER ACTION REPORT 13

text: ABOUT ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. ENISA European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece Athens Office 1 Vasilissis Sofias Str 151 24 Marousi, Attiki, Greece Catalogue number: TP-01-17-327-EN-N ISBN: 978-92-9204-224-0 DOI: 10.2824/218244 enisa.europa.eu