text: July 2025

text: July 2025

text: July 2025

text: ( ) The reporting of security incidents has been part of the EU’s regulatory framework for telecoms since the 2009 reform of the telecoms package, in line with

text: Article 13

text: a of the framework directive (

text: ) that came into force in 2011. ( ) It is worth noting that since 2016 security incident reporting is also mandatory for trust service providers in the EU under Article 19 of the eiDAS regulation. In 2018, under the NIS directive, security incident reporting became mandatory for operators of essential services in the EU and for digital service providers, under

text: Article 14

text: and Article 16 of the NIS directive. ( ) ENISA technical guidelines on incident reporting under the EECC, including on thresholds and calculation of hours lost. ( ) available onhttps://ciras.enisa.europa.eu ( ) Derived by multiplying for each incident the number of users by the number of hours.

text: July 2025

text: July 2025

text: July 2025

text: ( ) Note that conclusions about trends and comparisons with previous years have to be made with caution, as national reporting thresholds change over the years. Indeed, reporting thresholds have been lowered in most countries in recent years, and reporting only covers the most significant incidents (not smaller incidents that may well be more frequent).

text: July 2025

text: ( ) Note that the telecom security incidents that are reported to national authorities are only the major incidents, i.e. those with significant impacts. ( ) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX %3A32018L1972 ( ) https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-theeecc

text: July 2025

text: ( ) https://resilience.enisa.europa.eu/article-13/guideline-for-incident-reporting ( ) Security supervision changes in the new EU telecoms legislation – ENISA (europa.eu)

text: July 2025

text: July 2025

text: ( ) see https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc.

text: July 2025

text: ( ) Multiple causes can be reported under one incident

text: July 2025

text: July 2025

text: One incident can have multiple causes

text: July 2025

text: ( ) For instance, an incident may be triggered by a storm, which tears down power supply infrastructure, cutting cables and thus power, which in turn results in a telecom outage. In this example, the root cause of the incident would be natural phenomenon and the detailed causes would be: heavy wind, cable cut, power cut and battery depletion.

text: July 2025

text: One incident can affect multiple services

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: ( ) Caveat ‘Methodology”. It bears noting that for most reported incidents there was an impact on more than one service, which explains why the percentages in Figure add up to more than 100 %. ( ) These newly introduced services and data still need to be consolidated and normalised over 3 years. In 2022, these services counted for 26 % of total incidents, when in 2021, OTT represented 4 %.

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: July 2025

text: ( ) https://www.enisa.europa.eu/publications/enisa-technical-guideline-on-incident-reporting-under-the-eecc, March 2021.

text: July 2025

text: July 2025

identifier: Telecom Security Incidents 2024

title: Telecom Security Incidents 2024

text: JULY 2025 0 TELECOM SECURITY INCIDENTS 2024 ABOUT ENISA

text: More information about ENISA and its work can be found here: www.enisa.europa.eu

text: CONTACT

text: For content queries about this report, please email incidentreporting@enisa.europa.eu For media or general queries about this document, please use info@enisa.europa.eu

text: Authors

text: Rossen Naydenov (ENISA), Nuno Rodrigues Carvalho (ENISA), Edgars Taurins (ENISA)

text: Acknowledgements

text: We are grateful for the review and input received from the members of the ENISA ECASEC expert group, which comprises national telecom regulatory authorities (NRAs) from the EU and European Economic Area, European Free Trade Association and EU candidate countries.

text: Legal notice

text: It should be noted that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed as a legal action of ENISA or ENISA bodies unless adopted pursuant to

text: Regulation (EU) No 526/2013

text: . This publication may be updated by ENISA from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright notice

text: © European Union Agency for Cybersecurity (ENISA), 2025

text: Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided appropriate credit is given and any changes are indicated.

text: Copyright for the image on the cover: © Shutterstock For any use or reproduction of elements that are not owned by the European Union Agency for Cybersecurity, permission may need to be sought directly from the respective right holders. ISBN: 978-92-9204-717-7 DOI: 10.2824/3702896

text: TELECOM SECURITY INCIDENTS 2024

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 7 2. BACKGROUND AND CONTEXT 8

text: 2.1 POLICY CONTEXT 8

text: 2.2 INCIDENT REPORTING FRAMEWORK 8

text: 2.3 INCIDENT REPORTING TOOL 9

text: 3. ROOT CAUSE ANALYSIS 11

text: 3.1 ROOT CAUSES CATEGORIES 11

text: 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES 13

text: 3.2.1 Detailed technical causes and user hours lost 14

text: 4. OVERVIEW OF AFFECTED SERVICES 23 5. OVERVIEW OF AFFECTED TECHNICAL ASSETS 24 6. OVERVIEW OF THE TECHNICAL CAUSES 25 7. MULTIANNUAL TRENDS 26

text: 7.1 ROOT CAUSE MULTIANNUAL TRENDS 27

text: 7.2 MULTIANNUAL TRENDS – SERVICE IMPACT 29

text: 7.3 MULTIANNUAL TRENDS – SEVERITY OF IMPACT OF INCIDENTS 30

text: 7.4 MULTIANNUAL TRENDS – NUMBER OF INCIDENTS AND USER HOURS LOST 31

text: 8. CONCLUSIONS 32 TELECOM SECURITY INCIDENTS 2024

text: EXECUTIVE SUMMARY

text: The present report provides anonymised and aggregated information about major telecom security incidents which occurred during 2024. Incident reporting is an important enabler of cybersecurity supervision and a support tool for policymaking at the national and EU levels.

text: In the EU, telecom operators notify significant security incidents to their national authorities. The national authorities send summary reports to ENISA. Under

text: Article 40

text: , the European Electronic Communications Code (EECC 2018/1972) reinforces the provisions ( ) for reporting incidents, 2 3 clarifying what incidents fall within its scope ( ), as well as the technical guidelines ( ) and the notification criteria. CIRAS is a platform that provides statistics, collects data from national authorities and provides a visual tool for displaying incidents through specific graphs ( ). The st th incident reporting period for 2024 was from January 1 to February 24 2025.

text: It is worth mentioning that as of 18 October 2024, the NIS2 Directive repeals

text: Articles 40

text: – 41 of the EECC, which will consolidate the reporting of breaches of integrity and availability across multiple sectors including but not limited to providers of public electronic communications networks and providers of publicly available electronic communications services. The present report covers only 2024, where

text: articles 40

text: - 41 of the ECCC are still valid.

text: Key findings in 2024 summary report

text: The 2024 annual summary contains reports of 188 incidents submitted by national authorities from 26 EU Member States and 2 European Free Trade Association (EFTA) countries. This is an increase of 20,5% over the 2023 with 156 incidents from 26 EU Member States and 1 EFTA country.

text: Compared to 2022 and 2023, 2024 shows a significant drop in user hours lost.

text: A significant decrease of more than 50% of user hours lost was observed in 2024 compared to 2023. According to the data received, 1743 million user hours ( ) were lost in 2024 while 3906 million user hours were lost in 2023. This is clearly a much lower number compared to last year, and returns at the levels of a decade ago, as we can see in Figure 1. A plausible hypothesis is that the trend may indicate the possibility of improved outage management, enhanced infrastructure, and increased system resilience.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 1: Number of incidents submitted by countries and user hours lost (2023–2024)

text: Additionally, the following findings can also be highlighted:

text: • Highest number of incidents to date (188) reported in electronic communications incident reporting to ENISA. Despite the rise in reported incidents, there was no corresponding increase in user hours lost. • The distribution of incidents was as follows: service outage - 178, other impact on service - 4, Impact on other systems - 1, threat or vulnerability - 1, impact on redundancy - 2 and near miss - 1. • 19,5% Increase in incidents with very large impact from 77 (2023) to 92 (2024). • Root causes key statistics: o System failures continued to largely dominate in terms of impact, reaching 60% in 2024 with 113 incidents, which is a slight decrease from 2023 (61%). They accounted for 548 million user hours lost or almost a third of all the user hours lost for 2024. o Human errors make a small decrease in percentage of incidents to 19% coming from 21% in 2023, however there is more than two times increase of user hours lost from 181 million to 402 million in 2024. o Incidents due to natural phenomena increased to 25 reaching a share of 13% leading to 605 million user hours lost, which is an increase of almost than 9 times the previous year (2023 - 72 million user hours lost). o Malicious actions accounted for 15 incidents representing 8% share of total incidents for 184 million user hours lost, which is lower than in 2023 with 16 incidents representing 10% and 214 million user hours lost. • Affected services key statistics o Mobile telephony and mobile internet were again the most impacted sectors, with respectively 100 and 86 incidents, for a share of 57% and 49% similar to 2023. o Fhe fixed internet increased their share of incidents from 16% in 2023 to 26% in 2024. • Technical causes o In 2024, 41 incidents were marked as cable cuts (23%), which gives it a 10 % lead over the next two technical causes, such as faulty software change/update (14%) and software

text: TELECOM SECURITY INCIDENTS 2024

text: bugs (13%). The positions of cable cuts and faulty software change/update swap if we take into account the resulted user hours lost. Faulty software change/update incidents lead to 515 million user hours lost, while cable cuts to 331 million. • In 2024, 65 incidents were flagged as failures by third parties which is a 25% increase compared to 2023 where 52 were reported. • No cross-border incidents were reported.

text: Figure 2: Root cause category

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 3: Share of user hours lost for each root cause category

text: Multiannual trends over the period 2012–2024

text: Over the 13 years, EU Member States reported 1 930 telecom security incidents, stored in the ENISA cybersecurity incident reporting and analysis system (CIRAS). The statistics are accessible online ( ).

text: Figure 4: Root cause categories for telecom security incidents in the EU reported over the 2012–2024 period

text: An analysis of incident reports over the years suggests that European telecommunication networks may be becoming more robust and resilient, as the rising number of incidents has not resulted in an increase in user hours lost.

text: The following trends, in particular, have emerged:

text: • System failures (Blue) remains the top root cause over the years. • Malicious actions (Red) remain relatively stable over time with minimal impact, suggesting they are not primary causes of major disruptions. • The most impacted services remain mobile telephony and mobile internet, which is valid for the last 8 years.

text: ENISA will continue to work with the national authorities responsible for telecom security and the NIS Cooperation Group to find and exploit synergies between various pieces of EU legislation, particularly when it comes to incident reporting, incl. cross-border incidents.

text: TELECOM SECURITY INCIDENTS 2024

text: 1. INTRODUCTION

text: Electronic communication providers in the EU have to report security incidents that have a significant ( ) impact on the continuity of electronic communication services to the national telecom regulatory authorities (NRAs) in each EU Member State.

text: This is the annual

text: Every year the NRAs provide ENISA with a summary of the most significant incidents based on

text: ENISA report on

text: a set of agreed EU-wide thresholds. This document, Telecom Security Incidents Report 2024,

text: Incident Reporting

text: aggregates the 188 incident reports received in 2024 and provides an overview of telecom

text: for the electronic

text: security incidents in the EU.

text: communications

text: 8 sector. The European Electronic Communications Code ( ) (Art. 40 EECC), includes a broader scope on the requirements for incident reporting and requires mandatory incident reporting with a

text: Mandatory incident

text: specific focus on security incidents with a significant impact on the functioning of each category

text: reporting has been

text: of telecommunication services.

text: a part of the EU’s telecom regulatory

text: Over the years, the regulatory authorities (Art. 41 EECC) have agreed to primarily focus on

text: framework since

text: network/service outages. ENISA has published guidelines for incident reporting under the 9 2009. ECCC ( ). These guidelines outline the formats and procedures for cross-border and annual summary incident reporting. They focus specifically on two types of reporting: ad-hoc reporting

text: Article 40 of the

text: between competent authorities and ENISA, and annual summary reporting from national authorities to the European Commission and ENISA. European

text: Electronic Communications Code is the legal basis for this document.

text: TELECOM SECURITY INCIDENTS 2024

text: 2. BACKGROUND AND CONTEXT

text: In this chapter, the policy context is explained, along with the main features of the incident reporting process, as described in ENISA Technical Guideline on Incident Reporting ( ), which was developed in collaboration with national authorities.

text: 2.1 POLICY CONTEXT

text: The European Electronic Communications Code (EECC), adopted in 2018 ( ) and enforced from late 2020, modernised the EU telecom rules by broadening regulatory coverage to include over-the-top (OTT) communication providers like WhatsApp and Skype. A key pillar of the EECC is enhancing cybersecurity across all electronic communications services—requiring operators and OTT providers alike to implement strong security measures and incident reporting to safeguard networks and user data. This report stems from the art 40 of the EECC, which requires that MS provide annual summary reports to ENISA.

text: 2.2 INCIDENT REPORTING FRAMEWORK

text: There are three types of incident reporting:

text: 1) national incident reporting from providers to National Competent Authorities (NCA); 2) ad hoc incident reporting between NCAs and ENISA; and 3) annual summary reporting from national authorities to the European Commission and ENISA.

text: It bears noting that in this setup ENISA acts as a collection point, anonymising, aggregating and analysing the incident reports.

text: The different types of reporting are shown in Figure 5 next page.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 5: Incident reporting under Article 40 of the EECC

text: 2.3 INCIDENT REPORTING TOOL

text: ENISA maintains the Cybersecurity Incident Reporting and Analysis System (CIRAS), for the authorities to upload reports and search for and study specific incidents.

text: For the general public, ENISA also displays an online visual tool, which is publicly accessible and can be used for custom analysis of data. This tool anonymises the country or operator involved.

text: Link: https://ciras.enisa.europa.eu/

text: CIRAS is a free online tool where ENISA stores reported incidents and provides annual and multiannual statistics.

text: The reporting template starts with the type of incident (choice between six types of cybersecurity incidents, explained in Figure 6.

text: The field contains three parts:

text: 1. impact of the incident: communication services impacted and by how much; 2. nature of the incident: the cause of the incident; 3. details of the incident: detailed information about the incident, including a short description, the types of networks, the types of assets, the severity level, etc.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 6: Types of cybersecurity incidents

text: ▪ Type A. Service outage (e.g., continuity, availability). For example, an outage caused by a cable cut due to a mistake by the operator of an excavation machine used for building a new road would be categorised as a type A incident.

text: ▪ Type B. Other impact on service (e.g., confidentiality, authenticity, integrity). For example, a popular collaboration tool has not encrypted the content of the media channels, which are being established when a session is started, between the endpoints participating in the shared session. This leads to the interception of the media (voice, pictures, video, files, etc.) through a man-in-the-middle attack. This incident would be categorised as a type B incident.

text: ▪ Type C. Impact on other systems (e.g., ransomware in an office network, no impact on the service). For example, a malware being detected on several workstations and servers of the office network of a telecom provider would be categorised as a type C incident.

text: ▪ Type D. Threat or vulnerability (e.g., discovery of crypto flaw). For instance, the discovery of a cryptographic weakness would be categorised as a type D incident.

text: ▪ Type E. Impact on redundancy (e.g., failover or backup system). For example, one of two redundant submarine cables breaking would be categorised as a type E incident.

text: ▪ Type F. Near-miss incident (e.g., activation of security measures). For instance, a malicious attempt that ends up in the honeypot network of a telecom provider would be categorised as a type F incident.

text: For more information about the incident reporting process, please refer to: Technical Guideline on Incident Reporting under the EECC ( )

text: TELECOM SECURITY INCIDENTS 2024

text: 3. ROOT CAUSE ANALYSIS

text: For the year 2024, 25 EU Member States, two European Free Trade Association countries participated in the annual process, reporting 188 significant incidents, compared to 156 in 2023, where we had 26 MS and 1 EFTA country.

text: telecom security 3.1 ROOT CAUSES CATEGORIES

text: In 2024, there was a slight increase in incidents (113) related to system failures, representing incidents

text: 60% of the total compared to 2023 where 96 system failure (61%) of telecom incidents were

text: reported in

text: reported. Software bugs and hardware failures each representing 19% of the top two technical causes for system failures in 2024. 2024 by EU

text: Member

text: Human errors consistently rank second after system failures, with 35 incidents representing

text: States.

text: 19% in 2024, which is similar in terms of percentage (20 %) for 2023 with 32 incidents reported. Cable cuts and faulty software/change update being the major technical cause with 40% and 37% for human errors in 2024.

text: Natural phenomena increased to 12% compared to 7% in 2023, with more than double the incidents in 2024 increasing to 25 from 12 in 2023. The most common technical causes were heavy wind (44%) and external causes (36%)( )

text: Malicious actions accounted for 15 incidents in 2024 representing 8%, compared to 16 in 2023 for 10% representation. Major technical causes for the malicious actions were cable cuts representing 46% of all causes.

text: Figure 7: Root cause categories 2024

text: TELECOM SECURITY INCIDENTS 2024

text: In 2024, 65 incidents of all the 188 incidents were flagged as failures by third parties represented 37% of incidents compared to 38 incidents reported in 2023 for a representation of 24% of all incidents. This marks a more than 70% increase in incidents by third party failures for 2024. The majority of incident reports, 42 of them, originated from system failures (65%), 19 from human errors (29%), 2 from malicious actions (3%) and 2 from natural phenomena (3 %) as shown in Figure 8.

text: Nature of the incident

text: 3% 3%

text: Malicious actions Natural phenomena Human errors System failures

text: Figure 8: Root cause categories – third-party failures

text: TELECOM SECURITY INCIDENTS 2024 3.2 USER HOURS LOST IN EACH CATEGORY OF ROOT CAUSES

text: • System failures accounted for 548 million user hours lost compared to 3 439 million in 2023. This is a decrease of more than 6 times compared to 2023. Faulty software changes/updates were among the top three with 183 million user hours lost. Power The most cuts come second with 160 million user hours lost. Third comes software bugs with

text: impactful root

text: 142 million hours lost. • Human errors accounts for 402 million of user hours lost in 2023 for 35 incidents, cause in 2024 compared to 181 million in 2023 for 32 incidents. Faulty software changes/updates is

text: is natural

text: the top cause here with 341 user hours lost. Policy and procedure errors is the distant second cause with 27 Million user hours lost. phenomena. • User hours lost due to natural phenomena have increased significantly to 605 Million compared to 72 million in 2023. The main causes for that are floods (318 million), Heavy wind (277 million), External environmental causes (243 million) and cable cuts (216 million( )). Natural phenomena ia also the most impactful root cause with 24.20 million user hours lost per incident with a total of 25 incidents reported for 2024. • Malicious actions’ number of user hours lost continue to decrease in 2024, reaching 184 million hours lost (for 15 incidents), compared to 214 million in 2023( for 16 inidents). Top three cause fo these losses were arson with 93 million, cable cut with 61 million and cable theft with 30 million user hours lost.

text: Figure 9: Share of user hours lost for each root cause category 2024

text: TELECOM SECURITY INCIDENTS 2024 3.2.1 Detailed technical causes and user hours lost

text: Detailed technical causes for all incidents are tracked across all root cause categories in The most impactful Figure 10. An incident is often a chain of events ( ), therefore many technical causes can technical cause is be part of an incident. flooding. The most frequent technical cause appearing in incident reports for 2024 is cable cuts with 41 incidents. The most user hours lost is due to the faulty software change/updates. The most impactful technical cause are the floods, which with 8 incidents are able to cause 318 million user hours lost of damage. The impact is more than 39 million user hours lost per incident.

text: The most impactful technical

text: Figure 10: Detailed technical root causes

text: cause of the

text: What follows is an overview of detailed causes and user hours lost for each category of incident system failures is in an effort to provide precision for each root cause, giving details about affected service, assets

text: external

text: and technical causes.

text: environmental

text: 3.2.1.1 Breakdown of system failures

text: factors.

text: System failures accounted for 113 incidents reports, meaning 60% of total incidents for 548 million user hours lost.

text: Faulty software change/update remains top technical cause in terms of user hours lost, with 183 million. However, in terms of number of incidents, software bugs and hardware failures with 22 incidents each come first.

text: TELECOM SECURITY INCIDENTS 2024

text: It is worth noting that external environmental causes represent only 2 incidents but the user hours lost is 58 million, which makes it the most impactful root cause in system failures.

text: Figure 11: Root causes of system failure incidents vs user hours lost

text: Services affected by system failures

text: The most affected services by system failures are the mobile telephony (53% of the incidents) and the mobile internet (45 % of the incidents ( )). The over the top (OTT) service providers account of the 23% of the incidents associated with the system failures. The fixed internet and fixed telephony are fourth and fifth impacted by the system failures with 20% and 19% respectively.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 12: Services affected by system failure

text: Assets affected by system failures

text: The most affected technical assets by system failures are the switches and routers (18%), which is a decrease from 2023, where it was 30%. The mobile base stations and controllers remain the same as 2023 at 17%. Transmission nodes have not been reported for 2023, they remain last in 2024 with 16%. Mobile switches mark a small decrease with 13%, compared to 15% in 2023.

text: Figure 13: Assets affected by system failure 16

text: TELECOM SECURITY INCIDENTS 2024

text: 3.2.1.2 Breakdown of human errors

text: Human error remains similar to the previous year, reaching 19% of total incidents. The 35 incidents accounted for 402 million user hours lost which is more than twice the amount lost in 2023 (180 million) from 32 incidents. Faulty software change\update with 13 incidents rank top in terms of number of user hours lost. This cause is also the most impactful one with above 26 million user hours lost per incident. Policy/procedure flaw comes second in terms of number of user hours lost with 27 million, with only 3 incidents reported. Cable cut comes third with 14 incidents and 17 million of user hours lost.

text: Figure 14: Technical causes –human errors The most

text: impactful technical factor

text: Services affected by human errors

text: contributing to

text: The most affected service by human errors is the mobile telephony with 57%, which is lower than the previous year with 62% for 2023. The second affected service is the mobile internet the human error with 48%, with also lower than 2023, where it was 53%. Third and fourth are the fixed telephony

text: root cause is a

text: and fixed internet with an increase to 28% for 2024, while in 2023 fixed telephony was 25% and fixed internet was much lower with 15%. OTT remains with 25% for both years. faulty software

text: change or update. TELECOM SECURITY INCIDENTS 2024

text: Figure 15: Services affected by human errors

text: Technical assets affected by human errors

text: The most affected asset by human errors are the mobile base stations and controllers with an increase to 31%, coming from 28% for 2023. Underground cables come second with 31%, while in 2023 no such incidents were reported. Mobile switches remain third with the similar results as in 2023 with 14%. Switches and router show a decline to 11% coming down from 25% for 2023. Addressing servers are last with 9% and no similar incidents reported in 2023.

text: Figure 16: technical assets affected by human errors

text: TELECOM SECURITY INCIDENTS 2024

text: 3.2.1.3 Breakdown of natural phenomena

text: Natural phenomena accounted for 25 incidents and 13% of total incidents for 605 million user hours lost. This is an increase of almost 9 times the previous year with 72 million user hours lost and 12 incidents.

text: The floods are the top leading cause with 318 million user hours lost, which is a staggering increase compared to 6 million user hours lost in 2023. This technical cause is also the most impactful one with almost 40 million user hours lost per incident.

text: The most

text: The heavy wind is the second leading cause for the natural phenomena with 277 million user

text: impactful

text: hours lost. This constitutes an increase of almost 100 times compared to the previous year which was 3 million. technical cause

text: under the natural

text: The external environmental causes are the third leading cause with 243 million user hours lost, which was not even registered last year as a cause for natural phenomena. phenomena root

text: cause is

text: Forth in the leading causes is the cable cut which accounts for 216 million user hours lost. The cable cuts were not identified as a technical cause for the last 6 years. flooding.

text: Figure 17: Root causes of natural phenomena incidents vs user hours lost

text: Services affected by natural phenomena

text: The most affected services by natural phenomena are the mobile telephony with 80%, which is lower than 2023 where it was with 91%. The mobile internet also marks a big decline in the affected services with 68%, compared to 91% in 2023. Fixed internet (52%) and fixed telephony (44%) show an increase of affected services in 2024, compared to 41% and 33% for 2023. Broadcasting also shows an increase in affected services to 20% from 8% for 2023. It seems that OTT services are the least affected services by natural phenomena with 4% a decrease from 8% in 2023.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 18: Services affected by natural phenomena

text: Technical assets affected by natural phenomena

text: The most affected assets by natural phenomena remain the mobile base stations and controllers marking a decrease from 83% in 2023 to 80% in 2024. Power supplies remain second with an increase to 44%, compared to 25% in 2023. Transmission nodes are third with 28% of incidents affected by natural phenomena, and no such incidents reported in 2023. Backup power supplies mark a decline to 12% in 2024 coming down from 17% in 2023. Overhead cables are last with 12% of incidents reported under natural phenomena, with non being reported for 2023.

text: Figure 19: technical assets affected by natural phenomena

text: TELECOM SECURITY INCIDENTS 2024

text: 3.2.1.4 Breakdown of malicious actions

text: Malicious actions counted for 15 incidents representing 8% of all incidents, which is a decrease compared to 10% for 2023, although number of incidents is actually higher -16. The malicious actions lead to less user hours lost in 2024 - 184 million, compared to 214 million user hours lost in 2023.

text: The top cause for the malicious actions was arson with 93 million user hours lost and 3

text: The most

text: incidents, which is an increase compared to 2023 where we had only 2 million user hours lost with one incident. Arson is also the most impactful technical cause with more than 30 million impactful user hours lost per incident in average. This is likely to the fact that fire damages severely

text: technical cause

text: physical assets and leading to their replacement and/or rebuilding which requires time.

text: under the

text: The second cause for malicious actions was cable cuts, with 7 incidents and 61 million user

text: malicious

text: hours lost. In the previous year no cable cuts were reported under malicious actions.

text: actions root

text: The third cause for malicious actions was cable theft with 3 incidents and 30 million user hours

text: cause is arson.

text: lost. This is almost identical to 2023 where we had 4 incidents and 33 million user hours lost.

text: Figure 20: Root causes of malicious action incidents v user hours lost

text: Services affected by malicious actions

text: The most affected service in 2024 by malicious actions are the mobile telephony with 66%, an increase from 56% in 2023. The OTT affected services come into strong second place with an increase to 60%, compared to 31% in 2023. The mobile internet comes third with an increase to 60%, coming from 50% for 2023. Fixed internet is least affected with a decrease to 26%, compared to 37% in 2023. Broadcasting and fixed telephony do not have reported incidents for 2024, while in 2023 we had 18% and 31% respectively.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 21: Services affected by malicious actions

text: Technical assets affected by malicious actions

text: Mobile ase stations and controllers remain the most affected asset by nalicious actions with a decrease of 27%, compared to 31 % in 2023. Mobile switches have the same percentage of incidents affecting them for 2024 with 27%, and no incidents reported in 2023. The next three assetss are similar with 20% shares of the incidents in malicious actions. The addressing servers are showing an increase compared to 6% in 2023. Submarine cables have no similar incidents reported in 2023. Switches and routers remain similar share with 19% in 2023.

text: Figure 22: Technical assets affected by malicious actions

text: TELECOM SECURITY INCIDENTS 2024

text: 4. OVERVIEW OF AFFECTED SERVICES

text: This paragraph examines in Figure 24 the services affected by incidents – from mobile and internet telephony, fixed internet and telephony, broadcasting and OTT services according to EECC-type of services.

text: Figure 24: Services affected ( ) – all incidents 2024

text: Again, most of the reported incidents affected mobile services. In 2024, 58% of reported incidents had an impact on mobile telephony which is similar to 2023 with 57%. Mobile telephony remains the top affected service for the last 8 years.

text: Mobile internet followed with 50% in 2024, a slight increase compared to 47% in 2023. Mobile internet has been the seond most affected services for the last 8 years, while in 2016 it was the most affected service.

text: Reported incidents affecting OTT services ( ) marks a slight increase to 23%, with 22 % in 2023. The OTT services remain at the level of 22-25% since the reporting period 3 years ago.

text: Traditional services like fixed internet services mark a increase of incidents with 26%, coming from 16% in 2023. Fixed telephony remains similar share of incidents with 21% in 2023 and 22% in 2024. Broadcasting incidents have decreased to 6%, coming down from 12% in 2023.

text: TELECOM SECURITY INCIDENTS 2024

text: 5. OVERVIEW OF AFFECTED TECHNICAL ASSETS

text: Each incident report also describes the (secondary) assets affected during the incident. Figure 25 shows the assets most affected, knowing that “other” means that detailed information was not provided ( ).

text: Figure 25: Assets affected – all incidents 2024 Mobile base stations and controllers constitute the most affected assets with 29%, which is a small increase to what we have seen 26% in 2023. These assets have been the most affected for the last three years. Switches and routers mark a decrease for 2024 with 15%, compared to 26% in 2023. These assets have also been second most affected assets for the last three years, while in 2021 they were the most affected assets. Transmission nodes are third with 14% of incidents while none were reported for 2023. Mobile switches remain at the same level as 2023 with 13% of incidents affecting them. For the last three years mobile switches have increased their share of incidents coming from 8% in 2022. ( ) Caveat ‘Other”. In the future, more information will need to be provided by Member States to improve the analysis of incidents. Caveat ‘Taxonomy’. Incidentally, reassessing the asset taxonomy will also be needed to improve incident reporting. 24

text: TELECOM SECURITY INCIDENTS 2024

text: 6. OVERVIEW OF THE TECHNICAL CAUSES

text: This section contains an in-depth review of the most high-profile technical causes behind reported incidents, focusing on 2024 comparing it with the prevoious year. We will focus on the top three causes.

text: Figure 26 – Technical causes – all incidents 2024

text: In 2024 41 cable cuts incidents were reported overall. Cable cuts have steadily increased their share of incidents from 2022 with 5%, to 2023 with 11% and to 21% in 2024. Cable cuts also represent 331 million of user hours lost for 2024, which is the second most hours lost only to Faulty software changes or updates. It should be noted that for 2023 almost zero hours were lost due to cable cuts.

text: Faulty software changes or updates represent 15% of the incidents, which is exactly the same to what was in 2023. It marks a slow decrease over the last five years where it was 24% of all incidents (top cause). For 2024 with its 29 incidents, it led to 524 million user hours lost which is the most user hours lost due to a cause. This is still more than 5 times less than what was lost in 2023 where we have seen 2731 million hours lost.

text: Software bugs mark an increase of their share of incidents to 12% coming from 10% for 2023, this also represent an increase in number of incidents with 16 for 2023 to 23 for 2024. The impact however on user hours lost is diminishing with 142 million user hours lost in 2024, while in 2023 they were 222 million user hours lost.

text: TELECOM SECURITY INCIDENTS 2024

text: 7. MULTIANNUAL TRENDS

text: ENISA has been collecting and aggregating incident reports since 2012. This is the highest number of incidents (188) recorded by ENISA so far in electronic communication incident reporting. In this section, we present multiannual trends over the last 13 years, from 2012 to 2024. This dataset contains 1930 reported incidents in total, as we can see in Figure 27.

text: Figure 27: Number of incidents reported per year (2012–2024) Over the course of the last 10 years, the number of reported incidents has been steadily increasing. Nevertheless, the numbers of user hours lost has not increased, in fact it has remained at the same level as 10 years ago. Based on the number of incidents an average of one incident occurs every 2 days. The peak of incidents in 2021 and 2022 can be due to the new type of area covered in incident reporting, namely the over-the-top providers.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 28: Number of outages and user hours lost over the years 2012-2024

text: 7.1 ROOT CAUSE MULTIANNUAL TRENDS

text: Over the years we can see a steady increase of natural phenomena incident especially in the last three years. Human errors remain at the 20% mark, while malicious actions and system failures mark a small decrease over the previous one year.

text: Figure 29: Root cause categories – Telecom security incidents in the EU reported over 2012–2024 27

text: TELECOM SECURITY INCIDENTS 2024

text: Every year, from 2012 to 2024, system failures were the most common root cause with average 65% of all incidents. In total, system failures accounted for 1 245 incident reports. The top three causes for system failures over the 13 years are hardware and software bugs, as well as the faulty changes of software or updates.

text: The second most common root cause was human errors, with nearly a fifth of total incidents (20%, 376 incidents in total). The top three causes for the human errors were faulty changes of software or updates, cable cuts and policy or procedure flaws.

text: Natural phenomena come third, with a tenth of total incidents (10 %, 186 incidents in total). Top three causes during the years were power cuts, heavy wind and heavy snow or ice.

text: Only 6% of incidents have been categorised as malicious actions, with 114 incidents over the course of 13 years.

text: In the 2012–2024 period, nearly half of malicious actions consisted of denial-of-service attacks (48%), while the next two cause were cable cuts (16%) and arson (9%). Only 2% was attributed to vulnerability exploitation (former malware and viruses). Additionally, 28% of technical causes are being classified as ‘other’. This highlights the need to update the taxonomy of malicious actions – something that has been noted before.

text: Figure 30: Root cause categories – Telecom security incidents in the EU reported over 2012–2024

text: Interestingly, the assets affected by malicious actions differ significantly from the overall categorisation of affected assets. Addressing servers came first, with 20%, followed by switches and routers, at 19%. Mobile base stations are forth with 13% and last are the underground cables with 9% overall. “Other” category remains with 19%.

text: Moreover, with respect to services affected by malicious actions, 52% were associated to fixed internet and 44% to mobile internet services, whereas 15% referred to OTT services.

text: TELECOM SECURITY INCIDENTS 2024

text: Figure 31: affected technical assets by malicious actions 2012–2024

text: 7.2 MULTIANNUAL TRENDS – SERVICE IMPACT

text: Over the period, mobile telephony and mobile internet were once more the most impacted by incidents - 58% and 50%, respectively in 2024.

text: Figure 32: Trends on impact for each service reported over 2012–2024

text: TELECOM SECURITY INCIDENTS 2024

text: Fixed internet incidents continue their rising since 2022 to 26% in 2024, while fixed telephony services remained at almost the same level as in 2023. Interesting to note that incidents in machine to machine continue to be very low compared to all other, but they mark an increase from 1% to 2%.

text: 7.3 MULTIANNUAL TRENDS – SEVERITY OF IMPACT OF INCIDENTS

text: ENISA has published technical guidelines on incident reporting under the EECC ( ), including on thresholds, severity estimation and calculating hours lost. Relevant multiannual trends may be found in Figure 33.

text: Since 2021, an increase in reports of very large incidents is observed, from 62 in 2021 to 92 in 2024. Contrary to very large incidents, there has been a steady decline in large incidents since 2021, from 62 in 2021 to 52 in 2024. Minor incidents show an increase compared to last year coming from 26 to 44 in 2024, after a steady decline for about three years.

text: Figure 33: Severity of impact for each year – multiannual trends 2012–2024 (number of incidents)

text: TELECOM SECURITY INCIDENTS 2024 7.4 MULTIANNUAL TRENDS – NUMBER OF INCIDENTS AND USER HOURS LOST

text: Over the years, the number of incidents has increased steadily and is now at the highest point so far 188 incidents. Contrary to the increase of incidents the hours lost continue to decline and are around the same as 10 years ago.

text: Figure 34: Number of incidents and user hours lost each year over 2012-2024

text: TELECOM SECURITY INCIDENTS 2024

text: 8. CONCLUSIONS

text: To conclude, here are the main findings and some general observations about this process and the broader policy context.

text: Main findings

text: • Highest number of incidents to date (188) reported in electronic communications incident reporting to ENISA. • Steady Increase in incidents with very large impact for the last four years from 62 to 92 • Increase in numbers of incidents though doesn’t constitute an increase of user hours lost. It actually shows continuous decline over the last three years and returns to similar numbers as ten years ago in 2014. • In 2024, 65 incidents were flagged as failures by third parties which is an increase compared to 52 reported in 2023. • System failures continued to largely dominate in terms of impact, reaching 60% in 2024 with 113 incidents. They globally accounted for 548 million user hours, which compared to 2023 is 6 times less (3439 million). • While an increase of incidents is recorded, 188 compared to 156 in 2023, an enormous decrease in total user hours lost is documented. This leads to the conclusion that the telecom infrastructure and processes likely are becoming more resilient to incidents. • Incidents due to natural phenomena continue to increase reaching a share of 13% with an increase from 72 million user hours lost to 605 million for 2024. • Human errors incidents have stayed the same in terms of share of incidents at 19% compared to last year. However, we see an increase in user hours lost from 181 million to 402 million user hours lost. • Malicious actions continue to decrease in both share of incidents reported 15 for 204 with 16 for 2023, as well as the numbers of user hours lost from 184 million user hours lost in 2024 to 214 million in 2023. • Mobile telephony and mobile internet were the most impacted sectors, with respectively 58% and 50% of incidents. • Fixed internet continued to increase in terms of number of incident reports and share in the last three years from 12% to 26% in 2024. • No cross-border incidents were reported.

text: Policy observations

text: • It should be noted that as of 18 October 2024, the NIS2 Directive repeals

text: Articles 40

text: – 41 of the EECC, which will consolidate the reporting of breaches of integrity and availability across multiple sectors including but not limited to providers of public electronic communications networks and providers of publicly available electronic communications services. • During the transition period in 2025, ENISA will continue to work with national authorities through the ECASEC expert group, as well as the NIS Cooperation Group, to find and exploit synergies between different pieces of EU legislation, particularly when it comes to incident reporting and cross-border supervision. • Additionally, the CIRAS methodology and guidelines may also be reviewed during our regular discussions with member states to better reflect new developments and to facilitate reporting and alleviate the administrative burden.

text: ENISA will continue to work with the national authorities responsible for telecom security and the NIS Cooperation Group to implement security incident reporting efficiently and effectively, and takes the opportunity to thank all the contributors of this report.

text: -N -EN -022 -25 -01 TP

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ISBN: 978-92-9204-717-77 DOI: 10.2824/3702896


text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged.

text: Establish It is generally reported that Incident Classification incident and initial framework Management in the ITIL and ISO sense of support management the term are well managed within each 1 2 3 4 Telecom Operators’ boundaries , , , . The issue specific to Europe is indeed cross- Incident ownership, border, cross-companies Incident monitoring, Investigation tracking and and diagnosis Management. communicatio n The figure on the right shows what the Task Force considered, and the parallel can Incident Resolution and closure recovery be made to the ISO/IEC 27035-1 (which is still a draft document, to date):

text: https://www.ovh.com/fr/espacepresse/cp1028.ovhcom_obtient_la_certification_isoiec_27001_pour_la_fourniture_et_lexploitation_dinfrastr uctures_dediees_de_cloud_computing

text: Security Measures

text: Information Recovery Sharing Procedures

text: Early Warning

text: Cross Border Assistance Incident Preparedness Ad-hoc Improvement Mutual Aid agreements framework

text: Pan European Legal Framework

text: Cross Border Priority Calling Technological Scheme Convergence & Interoperability National Roaming

text: WAN / Messaging Initiator’s LAN / Initiator’s workstation Infrastructure (I) to the Market gateway and gateway to the (WS), gateway of the server, currency market, currency market,

text: WAN / Messaging Provider’s LAN / Provider’s LAN / Provider’s workstation Infrastructure (II) to gateway to the gateway to the (WS), the gateway of the currency market, settlement system(s), currency market,

text: WAN / Messaging Infrastructure (III) to Settlement system(s) the gateway of the gateway and server. settlement system(s),

text: European Public Sectors’ role would be to encourage the Contingenc y Plans participation in such a pan-European group, and

text: Incident Preparedness All case studies and analyses converge to Coordination concluding that there is a strong urge to

text: Provides Information recommendation of the Task Force, as a Coo Sharing Platform

text: Incident Detection and horizontal condition. Management Procedures

text: priority: Propose new measures

text: Share Early Incident à-vis the external world; Op Warning  ICT Key Emergency Contacts of ICT-

text: sector public and private actors Information Sharing Shares Past Incident Data

text: Shares Contact Details actors and maintained up to date

text: PanEU cooperation actors (after being defined); Sta er - Incident Information needs to be b Mutual Aid Legal Establish together m Framework Common Requirements collected and analysed to rationalise Me prevention costs;

text: MARIE Phase I report: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-andservices/mutual-aid-assistance

text: 8https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-infrastructure-and-services/mutual-aid-assistance 9http://www.enisa.europa.eu/activities/Resilience-and-CIIP/Incidents-reporting/national-roaming-for-resilience

identifier: Position Paper of the EP3R Task Forces on Incident Management and Mutual Aid Strategies (TF-MASIM)

nummer: tf-masim

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Position Paper of the EP3R Task Forces on Incident Management and Mutual Aid Strategies (TF-MASIM)

serie: rapporter

text: EP3R 2013 – Position Paper

type: rubrik

text: Position Paper of the EP3R Task Forces on Incident Management and Mutual Aid Strategies (TF-MASIM)

text: FINAL, 1.0, December 2013

type: stycke

text: www.enisa.europa.eu European Union Agency for Network and Information Security

text: EP3R 2013 – Position Paper Position Paper of the EP3R Task Forces on Incident Management and Mutual Aid Strategies (TF-MASIM)

text: FINAL, 1.0, December 2013

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Lionel Dupré, ENISA

text: Contact

text: For contacting the authors please use resilience@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Page ii

text: EP3R 2013 – Position Paper

text: Acknowledgements

text: FINAL, 1.0, December 2013 This Position Paper was prepared and developed by the following Experts:

text: - Peter Burnett, Quarter House Ltd - Genseric Cantournet, Telecom Italia - Manuel Carpio, Telefonica - Christian Doerr, University Delft - Olivier Duroyon, Alcatel-Lucent - Diego Fernandez Vazquez, Isdefe - Ingeniería de Sistemas para la Defensa de España - Stuart Goldman, The East West Institute - Bastiaan Goslings, AMS-IX - Chris Gow, Cisco - Matthew Holt, Intellium Group - Jeanette Innes, Independent Consultant - Richard Krock, Alcatel-Lucent - Nikolaos Loukeris Vodafone Group - Sam McLaughlin, Thales Group - Gerald McQuaid, Vodafone UK - Michael O'Reirdan, Comcast - Christian Proschinger, GovCERT Austria - Karl Rauscher, The East West Institute - Paul Smith, Austrian Institute of Technology - David Sutton, Tacit.Tel - Nikolaos Tsouroulas, Telefonica - Peter Wallström, Swedish Post and Telecom Agency – PTS

text: Page iii

text: Legal notice

text: FINAL, 1.0, December 2013 Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-79-00077-5 doi:10.2788/14231

text: Page iv

text: EP3R 2013 – Position Paper

text: Executive summary

text: FINAL, 1.0, December 2013 This document summarises the discussions that happened between April and September 2013 in the EP3R Task Force on Incident Management and Mutual Aid Strategies.

text: The task assigned to this Task Force was to reflect on the potential issues found when a large scale incident (Cyber, Natural Disasters, etc.) affects the Critical Information Infrastructures in a region across one or several borders.

text: While many aspects can be recovered from without the help of a neighbour country, some actually require external assistance, and therefore cooperation terms can be prepared in advance to plan for those conditions of intervention properly.

text: Also, the Task Force felt that systematic cooperation on incident preparedness would allow a much faster recovery, particularly for ‘black swan’ events, i.e. events that have a low probability but generate an extremely large impact.

text: Some agreements have been established, but they are mostly ad-hoc. The preparedness process could benefit from a higher level of maturity of its cross-border dimension in Europe.

text: Compared to other continents, Europe still faces significant barriers:

text: - Cooperation between counterparts in neighbour countries is ad-hoc; - National Regulations demonstrate several differences; - Private Sector operates mostly in Silos; - Mutual Aid Assistance could allow a much shorter Time to Recovery, and a more mature approach to Incident recovery.

text: The Task Force reflected on three different scenarios and identified a number of gaps.

text: This Task Force was composed of Public and Private Sector Experts who all contributed their observations in the course of 2013.

text: The major conclusions are the following:

text: - A ‘Incident Preparedness and Coordination Expert Group’ should pave the way to an improved cooperation in the Telecom Sector; - A RSS-syndication type of platform for sharing Incidents Preparedness procedures, Early Warnings, and Contact details should be designed and used; - The pan-European environment for Mutual Aid Assistance should be enhanced significantly by removing any relevant regulatory barriers; - Policies for cross-border traffic prioritisation should be developed and tested.

text: Page v

text: 1 Introduction

text: FINAL, 1.0, December 2013 In the view of identifying possible gaps and issues in Cross-Border Incident Management in Europe, we have, together with the EP3R Task Forces, imagined 4 different scenarios that we have then tried to reflect upon and draw a number of key conclusions.

text: Goal

text: While most of these conclusions might be well known already, this position paper will at least help to inventory them and further support the development of a course of action.

text: Detection Response Recovery • Causes • Actions • Measures • Actors • Coordination • Post Mortem

text: Transversal

text: •Data Exchange (CVRF) •Communication •Preparedness Procedures Sharing

text: Scope of the Work

text: The Task Force observed initially that “Incident Management” is a broad concept that encompasses a number of very different activities. ITIL (v3) terminology defines an incident as an unplanned interruption to an IT Service or a reduction in the Quality of an IT Service. Failure of a Configuration Item that has not yet impacted Service is also an Incident. ISO 20000 defines an incident (part 1, 2.7) as any event that is not part of the standard operation of a service and which causes or may cause an interruption to, or a reduction in, the quality of that service.

text: Page 1

text: EP3R 2013 – Position Paper

text: Generally, the process of Incident Evaluation of Incident incident detection and framework Management is composed of a number of recording FINAL, 1.0, December 2013 management activities (see figure on the right).

text: - Plan and prepare: establish an information security incident management policy, form Incident Response Team etc. - Detection and reporting: someone has to spot and report “events” that might be or turn into incidents; - Assessment and decision: someone must assess the situation to determine whether it is in fact an incident; - Responses: contain, eradicate, recover from and forensically analyse the incident, where appropriate; - Lessons learnt: make systematic improvements to the organisation’s management of information security risks as a consequence of incidents experienced.

text: Taken individually, these steps make sense at an organisation level. However, when the dimension is cross-organisations, cross borders, the need for a coordination mechanism arises and other compensating controls also need to happen.

text: As devised in the initial Work Objectives document, the disastrous events, and many incidents are global and cannot be addressed using a silo approach, and cooperation is more efficient when

text: Page 2

text: EP3R 2013 – Position Paper

text: properly planned. Responses also need to be coordinated and the most obvious cases have to be at least foreseen. FINAL, 1.0, December 2013 In the essence of time and work efficiency, the Task Force has decided to demonstrate by example the issues that must be resolved for quick recovery when the disaster or the incident is global.

text: The scope for each case Study was limited to “Black Swan” events, rare in likelihood but leading to a disastrous impact.

text: Target audience

text: This document addresses concerns that should draw the attention of Telecom Operators, ISPs, IXPs, Datacentre Operators, and most specifically their Decision Makers. CISOs, Business Continuity Managers, Risk Managers are the primary Audience of this report; however the Senior Experts from the Public Sector and Public Decision Makers also should be aware of the high-level recommendations.

text: Structure of this document

text: Three case studies were assessed:

text: - Case Study 1: Natural Disaster involving 3 countries and 5 major Telecom Operators (CII owners) - Case Study 2: Loss of communication for Health and Finance sector - Case Study 3: Technologic Implementation causing failure with Domino effect to competitors

text: The approach was to assess broadly the possible impact, and identify a number of specific measures to support faster recovery.

text: The ITIL and ISO terminology definitions of Incident management were used as a foundation for the overall discussions .

text: The Task Force proposed to perform the analysis from an empirical viewpoint and therefore requested ENISA to propose 3 Case Studies which could be used as the starting point for the brainstorming sessions of the Task Force.

text: The process was to determine important lessons learnt by sharing Task Force members’ experiences. These lessons learnt were then used to derive key measures.

text: Page 3

text: EP3R 2013 – Position Paper

text: The Task Force considered this process as a progressive one, possibly involving several iterations to reach a better level of detail with time and experience. FINAL, 1.0, December 2013 Although for the purpose of this report, the process only involved a single iteration, the iterative process should be pursued and recommendations could be refined and adapted.

text: The Task Force used case studies to identify a number of possible black-swan events (which have low probability, and high impact, e.g. 9/11 in the United States).

text: The initial scope covered the following topics:  Natural Disasters;  Global Power Outage;  Technological deployment cascaded failure, and chain of events. Recovery Measures These case studies were not meant to be limitative, and pave the way to draw conclusions in other areas. The logic observed for large-scale incident response might reasonably be similar in most situations, and therefore, this report makes recommendations that ex-post are generic enough to allow use in a variety of Analysis Incident and Lessons (Recovery) circumstances. Learnt

text: Page 4

text: EP3R 2013 – Position Paper

text: Three main areas are Operational, Technical and Strategic:

text: FINAL, 1.0, December 2013 - Information Sharing - Mutual Aid - Technology Convergence & Interoperability

text: In each domain, a number of measures were derived and are possible future recommendations in this area, since they are focused and close-ended.

text: Page 5

text: EP3R 2013 – Position Paper

text: 2 Case Studies

text: FINAL, 1.0, December 2013 The following scenarios were analysed by the participants:

text: - Natural Disaster involving 3 countries and 5 major Telecom Operators (CII owners) - Power Outage, loss of communication for Health and Finance sector - Technologic Implementation causing failure with Domino effect to competitors

text: 2.1 Case Study 1: Natural Disaster involving 3 countries and 5 major Telecom Operators (CII owners)

text: 2.1.1 Description

text: An earthquake in the Alsace plain impacts France, Germany and Switzerland and causes cable cuts, power outages, etc. All power generators are no longer functioning; GSM relays are out of order.

text: Initial assessment shows that there are many casualties; First Emergency Responders (FERs) rely on dogs to find them in the debris. Some CIIs sites are no longer accessible.

text: 2.1.2 Impact Analysis

text: A natural disaster such as an earthquake or large forest fire may require that communications continuity is ensured, or restored in the shortest delay.

text: All Natural Disasters will not present the same characteristics, but from a telecommunications point of view, the depending actions should be very similar, provided that the road access is at least cleared to the damaged area.

text: The Task Force perceived that communications between the Public and First Emergency Responders (FER) are crucial, but there is also a need for the Public to be able to contact their relatives, or coordinate their evacuation of the accident. Such communications traffic is unlikely however to be routed properly if the Critical Information Infrastructures (CIIs) are damaged or destroyed.

text: This raises immediately the question of a priority calling scheme to ensure that every call from the accident zone is appropriately routed and reaches its destination. (see recommendation 201304).

text: A number of gaps were noted:

text: - For large events, no supra-National coordination mechanism exists; (see recommendation TF-MASIM-201301) - Procedures are not established a priori along with affected public emergency co-ordination authorities to declare and manage the crisis; (see recommendation TF-MASIM-201301 and 02) - Congestions will occur due to significant incoming traffic to the affected areas; (see recommendation TF-MASIM-201304)

text: Page 6

text: EP3R 2013 – Position Paper

text: - Prioritisation of resumption of the communications of other critical infrastructures (power, transportation, financial, etc.) (such a recommendation could arise from TF-MASIM-201301, FINAL, 1.0, December 2013 when the Expert group defines which Authority takes the lead and how it is determined); - Critical nodes that may lack local generators need to be properly inventoried and this information shared; (see recommendation TF-MASIM-201301 and 02) - Key nodes and ISP providers have local generators, but their fuel stock capacity may not allow the maintenance of generators running in the long term; (see recommendation TF- MASIM-201301 and 02) - Specific risk analysis is not extensively carried out over environmental conditions of the local generators and oil tanks in those facilities having critical nodes of communications; (see recommendation TF-MASIM-201301) - Very careful assessment of the switching operations between power -> batteries -> generators and vice-versa to avoid glitches that can harm the equipment and cause even worse impact. (see recommendation TF-MASIM-201301)

text: 2.1.3 Mitigations

text: The Task Force identified some possible solutions to these issues. The list of these mitigations is not exhaustive, but provides already a number of key points to consider. Most of the recommendations could arise from the procedures decided by the Expert Group recommended in TF-MASIM-201301.

text: Alternative communications for FERs must not depend on affected infrastructure. i.e. Tetra/Tetrapol doesn’t rely on the same infrastructures as commercial services; - Policies for cross-border traffic prioritization should be developed and tested; (see recommendation TF-MASIM-201304) - Emergency satellite communications terminals shared among several countries can be moved quickly to the affected areas by FERs to support the resuming of basic services; - Voice and data service need to be provided to the Public. They could be supported by mobile modules (containers) that can be linked by means of satellite or radio; - Ad-hoc networks which do not depend on fixed infrastructure should be deployed; - Sharing of Materials (e.g. Mobile generators shared among several countries) can be moved quickly to those affected nodes or switching offices that doesn’t have local generators; - Management of Critical spare parts (for the power grid, some should be available for a period of time that will be in accordance with the requirements of the logistics of the critical nodes generators); - Improve Public access to backup solutions (e.g. public charging batteries points for mobile phones and computers scattered in the cities).

text: While most of these measures may exist at National level, there might be significant differences from one Member State to another. The cross border dimension is rarely taken into account but could help save lives: for example, the transport of emergency telecom equipment to an affected region may be faster if this equipment is geographically closer but in a neighbour country.

text: Cooperation costs could be settled at a later stage.

text: Page 7

text: EP3R 2013 – Position Paper

text: 2.2 Case Study 2: Loss of communication for dependent Critical Sectors, e.g.

text: Finance sector FINAL, 1.0, December 2013

text: 2.2.1 Description

text: A major power outage happens in Germany impacting areas in France, Luxembourg, Belgium and Netherlands:

text: - Telecom Operators located in these countries have lost connectivity - Several major Internet nodes are impacted; - The Finance sector is impacted with delays in the processing of hundreds of thousands financial transactions; - No victims directly due to power loss.

text: 2.2.2 Impact Analysis

text: Cross border coordination in catastrophic situations at the pan-European level is missing and may heavily impact Critical Finance Infrastructures through communication failures. Currently, the crisis may see regulators acting more locally without collaborating in studying cross-border implications of catastrophes. New players in financial markets bring also new risks.

text: These new players (e.g. cloud service providers) result in a significant value shift from traditional banks to technological providers, so called “processors”, and a value share between banks and intermediaries. Technological openness additionally entails more intense competition with the risk that adequate security measures are neglected in order to benefit from easy and cheap alternatives. A more diversified banking and financial ecosystem with more players becomes a more fragmented systems with additional failures and incidents.

text: The needs may largely differ between banks and their customers, for instance, Banks are looking for a seamless provision of liquidities, while Bank customers are looking for 100% available and seamless end-to-end trade procedures as well as finality of transactions.

text: Page 8

text: EP3R 2013 – Position Paper

text: The transaction chain is executed via a number of “nodes”: FINAL, 1.0, December 2013

text: Each one of these nodes relies entirely on electricity to operate. LAN, WAN gateways rely on electronic communications infrastructures, whether public or dedicated (privately leased).

text: Also, large customers were, at last, given access to interbank exchange systems like SWIFT, while medium- or small-size companies rely now also on Internet-based e-banking services, via their bank or via payment processors.

text: 2.2.3 Possible Mitigations

text: In response to the on-going trends, several infrastructures were put in place or modernised already. Also, Banks and their supply chain have established service contracts or service level agreements (SLAs).

text: For Banks, Incident Preparedness in their ICT Supply Chain is mostly achieved through their “Business Continuity Plans”.

text: For the European Central Bank (ECB) draft glossary, “Business Continuity” consists of “arrangements aimed at ensuring that a system meets agreed service levels, even if one or more components of the system fail or if it is affected by an abnormal event.”

text: In the financial sector, one of the leading authorities has been the Joint Forum, a group of IT Experts from Central banks worldwide, who are focussing on prevention and protection issues in the banking sector.

text: Page 9

text: EP3R 2013 – Position Paper

text: Dealing with business continuity will lead to activities that can progress along the following steps: FINAL, 1.0, December 2013 Outlining Developing Returning Managing the the to normal problems business business operation when they continuity continuity after a occur strategy plan problem

text: Regarding Business Continuity, MiFID obliges banks and other investment institutions to establish, implement and maintain a business continuity policy to ensure continuity of investment services in the case of an interruption of its systems and procedures. The major milestone reached by MiFID is the increasing importance of “a good practice” to a regulatory requirement that compliance responsibilities fall on the Board.

text: In parallel with that regulatory framework, several business continuity related security criteria, good practices and international standards have been issued (See the “Standards” section in the “References” chapter).

text: Mostly, for the Finance Sector, the reliance on ICT means also that unless the ICT providers are generally of poor reliability, their approach is currently to establish SLAs and no further compensate for a loss of connectivity.

text: In most cases, the “Management of the Incident” implies here that a critical Sector depending on ICT (and therefore on Energy) can only improve its preparedness to incidents, and consider appropriate Business Continuity measures to keep Operations running in Autonomy where possible.

text: 2.3 Case Study 3: Technologic Implementation causing failure with Domino effect to competitors

text: 2.3.1 Description

text: A major technological implementation fails and leads to a cascaded failure and later on, a large-scale outage, which impacts several millions of Users. Mobile Communications are mostly impacted; emergency services cannot be reached from GSM Networks.

text: There is no fallback scenario: no National Roaming is in place, Telecom operators have sometimes to intervene on sites to re-establish operations.

text: 2.3.2 Impact Analysis

text: As mobile telecommunication networks are extremely complex systems comprising of thousands of service nodes of several different types, interfaced by diverse control protocols via hundreds of data elements, it is difficult to predict all the cascading effects of a single node failure. This cascading effect is made possible due to the relationships (also called dependencies) between the various components within the mobile telecommunication network. Cascading attacks are so named because local effects of corrupt data items propagates or cascades to data items on remote service

text: Page 10

text: EP3R 2013 – Position Paper

text: nodes through vehicles such as signalling messages, cached data items, and shared databases. When the cascade attack is originated outside of the 3G networks, i.e. the Internet as a launching pad, we FINAL, 1.0, December 2013 refer it as a "cross infrastructure cyber-attack".

text: The impact of such attacks, among others, can lead to a Denial of Service or Interruption of the Service. In the case of Denial of the Service, the issue causes an overload or a disruption in the system such that network functions in an abnormal manner. The abnormal behaviour could be legitimate subscribers not receiving some of the services, illegitimate subscribers receiving services or even the entire network may be disabled as a result of the attack. In the Interruption scenario the issue causes an interruption by destroying resources, for example, the adversary may delete signalling messages, mislead or delete subscriber data in the entity such as a Home Location Register (HLR) .

text: 2.3.3 Possible Mitigations

text: A vulnerability assessment toolkit should be used to be able to predict, not only all the diverse cascading effects of corruption but also detect the vulnerabilities that may be exploited to launch the attack.

text: Apply attack-graph technologies specifically designed to handle 3G semantics i.e. dependencies, and infection propagation rules. An attack graph is a diagrammatic representation of an attack on a real system. It shows the various ways an adversary may use to break-in to a system or cause corruption, and the various ways in which the corruption may propagate to remote parts of the network. Attack graphs are typically produced manually by “red teams”, and used by system administrators for protection. Model checking is a major technique for automatic attack graph generation. Logicprogramming methods can be used for scalable network vulnerability analysis in terms of properties such as survivability, reliability, etc.

text: Standard network equipment configurations must be maintained centrally and audited daily. When needed, configuration updates go through a rigorous control change process, and then are downloaded from the Network Operations Center (NOC) at the company’s headquarters. These controls reduce the need for manual configuration of routers, switches, and other network elements, and lower the associated risk of error.

text: Mutual Aid Assistance is also considered as mitigation for this case.

text: A possible response lies in a few pragmatic steps:

text: - The use of multivendor technologies as well as the design of a compartmented network, either by regions or services, can help in quickly diagnosing, and avoiding the spread of the problem.

text: Page 11

text: EP3R 2013 – Position Paper

text: - The application of specific Contingency Planning Procedures as part of Business Continuity Plan. Exercises checking the ability of rollback procedures in order to restore to the previous FINAL, 1.0, December 2013 stable state. (see recommendation TF-MASIM-201301 and 02) - Regular Penetration testing checks from external networks towards both management system and signalling network, in 3G and LTE. (see recommendation TF-MASIM-201301) - The usage of a syndication system of web feeds to broadcast, in real time, warnings and alerts about bugs, patches and change management, service support conditions or changes of the contact details of the key support staff. Privacy and security of such a system can be guaranteed through of tunnelling for communications channels and information rights management on the XML items. (see recommendation TF-MASIM-201302)

text: Page 12

text: EP3R 2013 – Position Paper

text: Position Paper of the EP3R Task Forces on Incident Management and Mutual Aid

text: Strategies (TF-MASIM)

text: 3 Recommendations

text: FINAL, 1.0, December 2013 The situation in Europe (Borders, Market Preparedness and Coordination Committee Concentration) creates a number of challenges

text: that could be compensated by a set of control ICT Operators mechanisms. These mechanisms proposed are NRAs reported in the “recommendations” section, Supply Chain Energy could allow addressing a number of the issues

text: noted in the Case Studies.

text: The Task Force felt that a dedicated horizontal organisation was missing, and considering the extent

text: of the topics covered, its mission could last on the long term. Such a group does not need to be an

text: initiative driven by the Public Sector: it could instead be volunteered and committed by Telecom

text: Operators, organised in a Peer-to-Peer mode and self-committed to adopt relevant procedures and

text: standards. The engagement of Public Sector would allow the implementation or adaptation of

text: regulations where necessary. Furthermore, the

text: Issue ensure that such information sharing cannot be Emergency Guidelines / Call to / seen as “anti-monopoly” type of agreement Arms Recommen Procedures dations (which is usually forbidden and prosecuted).

text: Share Past promote and facilitate pan-European Mutual Aid Incidents Assistance Data cooperation on ICT Security matters in all CIIP-

text: European dependent sectors. Emergency Contacts lists Those conclusions of the case studies intervene

text: at several different levels, but have a number of

text: common characteristics:

text:  They require a top-down implementation;

text:  They depend heavily on an Information Sharing platform;

text:  There must be a commitment to implement measures in a coordinated way;

text:  There must be a way to ensure the proper implementation of the measures.

text: Page 13

text: EP3R 2013 – Position Paper

text: Strategies (TF-MASIM)

text: The Observations above led to conclude on a

text: number of initial steps to take so the topic could FINAL, 1.0, December 2013 p Engages Stakeholders u be later on widely addressed. The ro d G recommendations typically address each of the Establish Operational an Rational Cases Scenarii s ert Procedures three domains identified in the initial scope es xp n E d Exercise Operational (Information Sharing, Mutual Aid, Technology Contact Details ion Procedures are Convergence & Interoperability) and fit globally p at in within the Expert Group that is the first Pre rd Roles and Responsibilities

text: This report therefore raises first a number of Lessons Learnt Database

text: important recommendations to consider as a

text: - Systematic and Compulsory Information Commitment to apply Establish Lessons Learnt Security Measures Sharing for Incident Preparedness needs rs Promote Security to be established, such as: to Measures to Suppliers  Incident Response Procedures vis- era

text: details shared among all key

text: at European level;

text:  Roles and Responsibilities of all tes Adapt Regulations for

text: - For medium sized incidents, a lighter

text: process such as Mutual-Aid mechanism

text: could be promoted in a cross-border de-

text: regulated bubble (with finite timeframe of operation).

text: These recommendations are further developed below.

text: Page 14

text: EP3R 2013 – Position Paper

text: 3.1 EP3R-TF-MASIM 201301 – Establish a ‘Incident Preparedness and Coordination Expert Group’ FINAL, 1.0, December 2013

text: The Task Force recommends to the Telecom Operators, ICT Stakeholders, the European Commission and the Member States to initiate the creation of a Pan-European Expert Group with Operational capabilities, where key stakeholders can formally plan and organise both Strategic and Operational functions of Incident Preparedness procedures.

text: A top-down approach is recommended: Senior Executives and Public Decision makers should initiate the commitment and define clear objectives.

text: The key objective is the pursuit of faster recovery and the avoidance of the Tail-Event Syndrome7 i.e. which is only reacting after the incident happens, lacking preparedness, and not being able to manage events timely.

text: The core mission of this Expert Group should be to address all Incident Preparedness Prerequisites that need to be dealt with horizontally, with a cross-border dimension.

text: Initially, the following actions were considered and recommended by the Task Force:

text: - Engage and commit Key European ICT Stakeholders in discussions; - Establish Operational Pan-European Incident Response Procedures; - Implement an Information Sharing Platform for Incidents Early Warning; - Establish and share centrally Procedures, and Key Responsible Contact Details; - Plan the Exercising of these functions.

text: At a later stage, the Expert Group could deal with more complex issues, after issuing a detailed roadmap. Some tasks are crucial in this approach, such as ensuring Actors’ self-commitment to implement them, coordinating and harmonising National Contingency Plans, defining guidelines for establishing Business Continuity Plans, harmonising Incident Detection measures, promoting the establishment of Mutual Assistance agreements, etc.

text: Such an Expert Group membership should be composed of representatives of:

text: - European telecom operators; - European NRAs; - CERTs; - European Commission.

text: Page 15

text: EP3R 2013 – Position Paper

text: 3.2 EP3R-TF-MASIM 201302 – Implement a RSS-syndication type of platform for sharing Incidents Preparedness procedures, Early Warnings, and FINAL, 1.0, December 2013 Contact details

text: The Task Force highlighted the need for a private initiative for Telecom Operators and CII Stakeholders to implement a systematic sharing of information. Currently, Telecom Operators generally consider the sharing of information as potentially damageable to competition, and in some cases (e.g. for the set of prices), such an exchange could be considered illegal and a jeopardy of competition rules.

text: The sharing of technical incidents data should however not be considered as hindering antimonopoly rules, on the contrary: such a sharing of information would benefit immediately the Citizens since Incident Preparedness allows a much faster recovery.

text: The data that should be shared potentially relates to:

text: - Incident Preparedness Procedures; - Cooperation Details (Mutual Aid Assistance Agreements); - Emergency Response Procedures; - Emergency Contact Details; - Incident Early Warning.

text: This platform could implement the Functional, Management requirements and recommendations of the EP3R Task Force on Trusted Information Sharing, and allow a closed community of Telecom Operators’ representatives, Security Officers, Network Managers, IT Production Managers, Business Continuity Coordinators and Managers to share IT Security and Risk Management relevant information.

text: A syndication mechanism could also technically implement a distribution of information updates to all members via a pseudo-push mechanism, and therefore spread changes easily to avoid obsolete records stored at local sites. Such a centralised system could be of great value to Telecom Operators, and was actually proposed by one major European Telecom Operator during the Task Forces discussions.

text: 3.3 EP3R-TF-MASIM 201303 - Establish a Favourable pan-European environment for Mutual Aid Assistance

text: Mutual-Aid Assistance was perceived within the Task Force as a “Quick-Win”.

text: Such framework is easy to establish, could allow an initiation of regular contacts between ICT Stakeholders and later develop cooperation on larger assignments.

text: The key recommendations from the Task Force are to:

text: - Promote the use of Mutual Aid Assistance (MAA) across Europe;

text: Page 16

text: EP3R 2013 – Position Paper

text: - Develop a MAA template / catalogue where possible topics are listed (and therefore not forgotten); FINAL, 1.0, December 2013 - Ensure MAAs are endorsed, supported and promoted by Public Authorities and Regulators.

text: The MARIE Phase II report also lists a number of more specific requirements and recommended approach that the Task Force endorses fully.

text: 3.4 EP3R-TF-MASIM 201304 - Policies for cross-border traffic prioritisation should be developed and tested

text: On the technological side, the Task Force noted that one of the most important technological issues in Europe concerns the dismissal of Priority Calling Scheme when calls are routed cross border (and in some cases between operators). The ENISA Report on National Roaming also recommends traffic prioritisation at national level (and also favours Mutual Aid Agreements). This recommendation adds the cross border dimension.

text: Compared to Foreign Continents/Countries , a disaster involving several countries may be extremely complex to resolve, and since such a scheme is not in place, the odds that important communications reach the First Emergency Responders is decreased and possibly fully compromised.

text: Page 17

text: EP3R 2013 – Position Paper

text: 4 Conclusion

text: FINAL, 1.0, December 2013 Improving Incident preparedness at pan-European level implies that a global cross-border dialogue emerges in Europe and that every key actor actually engages and commits to an implementation roadmap.

text: The overall process could be driven top-down by the European Commission, but it is more likely that a Peer-to-Peer approach based on Self Commitment works better: indeed, the incentives are mainly financial, since they tend to reduce recovery time for ICT Operators.

text: The Expert Group should develop a portfolio of Strategic, Governance, and Technical tools which will improve cross-border incident preparedness. Such platform for effective Information Sharing, Mutual Aid Assistance, and allow proper Technological Interoperability.

text: Formalising such a partnership will however require solutions to a number of challenges and barriers, for instance:

text: - Regulatory fragmentation preventing effecting cross-border information sharing on Security and Resilience topics; - Non-Disclosure Agreements, to ensure Security and Preparedness matters are never considered a competitive advantage; - Ensure Information Sharing cross border is not considered illegal or Competitive preagreement (which is against anti-monopoly rules);

text: In some cases, the solutions recommended will also require operational capabilities, which should be the responsibility of a neutral body or institution. The solutions should then be then envisaged in a pragmatic way. Possibly, the European Commission may be the most appropriate Authority to solve certain issues together with Member States, but the needs will lead to raising recommendations where appropriate.

text: Page 18

text: References

text: FINAL, 1.0, December 2013

text: Standards

text: BCI — The BCI Good Practice Guidelines BSI — Business continuity management Specification (BS25999-1:2006, BS 25999-2:2007) BSI — BS 25777:2008, Information and communications technology continuity management. Code of practice International Organization for Standardization ISO/IEC 27002:2005, Information technology -- Security techniques -- Code of practice for information security management ISO/IEC 22399:2007, Societal security - Guideline for incident preparedness and operational continuity management ISO/IEC 24762:2008, Information technology -- Security techniques -- Guidelines for information and communications technology disaster recovery services National Institute of Standards and Technology (NIST) SP 800-34 NFPA 1600 — Standard on Disaster/Emergency Management and Business Continuity Programs (2007 Edition)

text: Related ENISA papers

text: Mutual Aid for Resilient Infrastructure in Europe: https://www.enisa.europa.eu/activities/Resilienceand-CIIP/critical-infrastructure-and-services/mutual-aid-assistance

text: Other Publications

text: Karl F. Rauscher, Richard E. Krock, and James P. Runyon, 2006, Eight Ingredients of Communications Infrastructure: A Systematic and Comprehensive Framework for Enhancing Network Reliability and Security, Bell Labs Technical Journal, (c) Lucent Technologies Inc. Downloaded from: www3.alcatellucent.com/enrich/v1i22007/pdf/BLTJ_20179.pdf

text: Page 19

text: Annex A: PPP 5 Pillars

text: FINAL, 1.0, December 2013 This figure shows the key characteristics of a Partnership.

text: Page 20

text: Annex B: PPP Framework

text: FINAL, 1.0, December 2013

text: Source: Good Practice Guide on Cooperative Models for Effective Public Private Partnerships (http://www.enisa.europa.eu/activities/Resilience-and-CIIP/public-privatepartnership/national-public-private-partnerships-ppps)

text: Page 1

text: Annex C: 8 Ingredients for Mutual Aid

text: FINAL, 1.0, December 2013 Karl F. Rauscher, Richard E. Krock, and James P. Runyon, 2006, Eight Ingredients of Communications Infrastructure: A Systematic and Comprehensive Framework for Enhancing Network Reliability and Security, Bell Labs Technical Journal, (c) Lucent Technologies Inc. Downloaded from: www3.alcatel-lucent.com/enrich/v1i22007/pdf/BLTJ_20179.pdf

text: Ingredient Example of Asset Environment space in a strategically located data centre Power diesel generator Hardware cell on wheels (COW) Software program on hardware provided (above) Network spare critical ingress or egress capacity Payload creating, processing, storing or transporting data Human cable splicer ASPR Agreements, Standards, Policy and Regulation

text: Page 1

text: EP3R 2013 – Position Paper

text: FINAL, 1.0, December 2013

text: ENISA European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 Page 2 info@enisa.europa.eu www.enisa.europa.eu