text: December 2020

text: December 2020

text: December 2020

text: https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-report-shows-alarming-rate-of-cyberattacks-during- COVID-19 2 For example Energy ISAC https://www.ee-isac.eu/ and Aviation ISAC https://www.a-isac.com/ 3 https://www.enisa.europa.eu/publications/eu-ms-incident-response-development-status-report

text: December 2020

text: December 2020

text: December 2020

text: Strategies for Incident Response and Cyber Crisis Cooperation, ENISA, August 2016.

text: December 2020

text: Ibid. 7 https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/baseline-capabilities 8 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: December 2020

text: https://ec.europa.eu/digital-single-market/en/network-and-information-security-nis-directive https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: December 2020

text: December 2020

text: Albania, Bosnia-Herzegovina, Georgia, Iceland, Kosovo, Moldova, Montenegro, North Macedonia, Norway, Ukraine, the United Kingdom, Serbia and Switzerland.

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: The Federal Chancellery is the Strategic NIS authority and CERT.at, the national CSIRT, is the primary contact point for IT-security in a national context. CERT.at coordinates other CSIRTs operating in the area of critical or communication infrastructure provides basic IT-security information to SMEs. In case of significant online attacks against Austrian infrastructures,

text: CERT.at will coordinate the response by the targeted operators and local security teams. The Austrian Energy CERT (AEC) is the single contact point for incidents in the Energy sector. There is no dedicated entity for the Air Transport sector.

text: The Centre for Cybersecurity Belgium (CCB) acts as the national coordination authority, and acts as national CSIRT in the CSIRTs Network. In support of the national CSIRT, each sectoral authority may choose to develop a sectoral CSIRT, subject to compliance with the obligations set

text: out in Annex I of the transposition of the NIS Directive. The CCB acts as coordinator for all sectoral CSIRT at national level. Belgium is currently discussing the creation of a sectoral CSIRT for Oil.

text: CERT Bulgaria (English), is the National Computer Security Incident Response Team. Its mission is to provide information and assistance to its constituencies in implementing proactive Bulgaria measures to reduce the risks of computer security incidents as well as responding to such incidents when they occur. Bulgaria is currently creating sectoral CSIRTs to facilitate the implementation of the requirements of the NIS Directive.

text: Our desktop research delivered a general overview of Incident Response Set-up in the 27 Member States. In 8 Member States (Croatia, Denmark, Hungary, Ireland, Italy, Latvia, Malta, Slovenia), no formal confirmation of the existence of sectoral CSIRTs at national level could be found at the time of the production of the present report.

text: December 2020

text: National CSIRT (CERT.hr) is a department within the Croatian Academic and Research Network – CARNET established in accordance with the Information Security Act of the Republic of Croatia.

text: According to this Act, CERT.hr is a national body for the prevention of cyber threats and the protection of the security of public information systems in the Republic of Croatia. The department’s main task is to handlecomputer security incidents to preserve the security of information systems in Croatia. Furthermore, according to the Act on cybersecurity of operators of essential services and digital service providers CERT.hr workswith the Information Systems

text: Security Bureau (ISSB) of the Republic of Croatia on the coordination of prevention and response to computer threats to information systems security.

text: The Information Systems Security Bureau (ISSB) is the central state authority responsible for technical areas of information security of the Republic of Croatia state bodies, which includes standards of information security, security accreditation of information security, managing crypto material used in the exchange of classified information, and coordination of prevention and response to computer threats to information system security. ISSB, is a CSIRT for most of NIS sectors, including energy and transport.

text: The Office of the Commissioner of Electronic Communications and Postal Regulation (OCECPR) is an independent regulatory authority of the Republic of Cyprus in matters of electronic communications and postal services, with additional responsibilities in the areas of terminal equipment, network and information security and protection of critical information infrastructures. It was selected as the body responsible for coordinating the implementation of the National Cybersecurity Strategy of the Republic of Cyprus, in relation tothe pillars of network and Cyprus information security (cybersecurity), cybercrime, cyber defence and related external affairs.

text: OCECPR is responsible for the creation and coordination of a body or bodies for response to incidents related to Network and Information Security in Cyprus. It also supervises and regulates the activity of the above CSIRT entities. CSIRT-CY handles reported cyber incidents, proactively identifying potential threats and coordinating with relevant government agencies nationally, regionally and globally to reduce the impact of the cyberattacks.

text: The Czech Republic has two response teams: 1) a Government Computer Emergency Response Team (GovCERT.CZ) and 2) a national Computer Security Incident Response Team (CSIRT.CZ).

text: Republic The Government CSIRT (GovCERT.CZ), https://www.govcert.cz/ (Czech); https://www.govcert.cz/en/ (English), is based in Brno. Its main task is to collect reports of cyber incidents from specified entities, analyse them and provide assistance.

text: The principle of sectoral responsibility is the rule. It implies that the authority responsible for a given function on a day-to-day basis is also the responsible authority when a serious incident occurs. This responsibility also includes planning how to maintain and continue to supply functions in the event of an extraordinary incident. Consequently, responsibility for cyber and information security, and thus the task of protecting critical infrastructure, is divided between the Denmark authorities responsible for the critical sectors, i.e. the transport sector, the healthcare sector and the financial sector.

text: The 2018-2023 Defence Agreement significantly enhances the ability of the Danish Centre for Cyber Security (CFCS) to assist central government authorities responsible for the various sectors.

text: Estonia has opted fora centralised coordination and supervision of the sectoral IT security within the framework of the NIS directive's implementation. The activities falling within the scope of the NIS directive go to different units within the RIA. In addition to the operation centre, which also Estonia houses the CERT-EE, there is a standardisation and review unit whose task is to ensure compliance with the CSA (Cyber Security Act) and, in the long run, the NIS Directive. RIA CERT- EE plays the role of government CSIRT, which gives the authority good knowledge of the systems.

text: The National Cyber Security Centre Finland (Kyberturvallisuuskeskus, also referred to as NCSC- FI; previously CERT-FI) is responsible for the supervision of all Finnish CSIRTs. Its mandate includes incident response, preparedness, training, regulation and control. Sector-specific

text: authorities have competence for supervision, namely the Energy Authority, the Centre for Economic Development, Transport and the Environment and the Finnish Transport and Communications Agency.

text: CERT-FR is the Computer Emergency Response Team of the French national cyber security authority. Its mission is to coordinate and investigate IT security incident response for the French France government, critical national infrastructure operators and operators of essential services as defined by the French law. The primary constituency is composed of French territories and covers all ministries, administrations and state services; critical national infrastructure operators

text: December 2020

text: and operators of essential services as defined by the French law and other key players in sensitive sectors.

text: CERT-FR was created in 1999 as a governmental CSIRT and afterwards became the National CSIRT. There are CSIRTs specific to companies, such as EDF in the energy sector, but the creation of sectoral CSIRTs is currently under discussion, although not in the air transport sector.

text: The Federal Office for Information Security, BSI, has gained expanded powers with the entry into force of the NISD, in addition to being the supervisory authority for all sectors, CSIRT and Germany national contact points. BSI was previously primarily responsible for the security of critical infrastructures, but with the adoption of the NIS directive, the mandate has been extended to include network and information security.

text: GR-CSIRT was established in 2018. It is a National CSIRT. The GR - CSIRT is in charge of handling incidents (cyber attacks) affecting Operators of Essential Services (OES), is responsible

text: for incident detection, incident response coordination and decision-making, including coordination with other national stakeholders..

text: The core operational cyber security capabilities and cyber incident management are centralised in the governmental computer emergency response team in Hungary, GovCERT-Hungary, which is part of the National Cyber Defence Institute and supervised by the Ministry of Interior. GovCERT-Hungary provides services for the entire Hungarian governmental administration – Hungary especially for the government backbone system, for critical infrastructures and municipalities. Sectoral CSIRTs are being established: beyond the existing CIIP CERT (operating under the National Directorate General for Disaster Management), another two are being set up, one for defence within the Military National Security Service, and another one for civilian intelligence within the Information Office.

text: CSIRT-IE is the body within the NCSC providing assistance to constituents in responding to cybersecurity incidents at national level for Ireland. The team has a strictly defined constituency consisting mainly of Government bodies and Critical National Infrastructure providers.

text: CSIRT-IE provides incident response services to Government bodies and Critical National Ireland Infrastructure providers across Ireland. CSIRT-IE also acts as a national point of contact for international partners who wish to inform Irish-based entities of cybersecurity matters, which may affect them.

text: The Irish Reporting & Information Security Service (IRISS) is an independent not for profit CSIRT dedicated to the broader public rather than companies or government and entities.

text: Computer Security Incident Response Team - Italia sits within the Department of Security Information (DIS). Its missions consist in:

text: - monitoring incidents at national level; - warning interested parties of potential/ongoing attacks; - intervening in case of incidents; Italy - performing dynamic analysis of risks and incidents;

text: And includes situational awareness; participation to CSIRT networks.

text: Computer Security Incident Response Team - Italia cooperates with the private sector and promotes the use of common practices and standards in risk management and incidentresponse, as well as classification of incidents, risks and information.

text: The Latvian Computer Emergency Response Team - CERT.LV (Latvian: https://cert.lv/lv; English: cert.lv/en) is responsible for monitoring and analysing developments in cyberspace, reacting to incidents and coordinating incident prevention. It also carries out research, organises Latvia educational events and training, and supervises the implementation of obligations defined in the Law on Security Information.

text: CERT.LV is expected to develop resources with the public and private sectors for collecting intelligence on incidents for analysis and evaluation.

text: The National Cyber Security Centre (NCSC) at the Ministry of National Defence is the main Lithuanian cyber security institution responsible for unified management of cyber incidents, monitoring and control of the implementation of cybersecurity requirements, accreditation of Lithuania information resources. It was established after the entry into force of the Law on Cybersecurity in January 2015. The NCSC’s mission is to be the centre of cyber security expertise for effective cyber security incidents and a strong cyber security prevention system in the country.

text: December 2020

text: The Institut Luxembourgeois de Régulation (ILR) ensures regulation and supervises the following economic sectors: network and communication, electricity, natural gas, postal services, transport (rail and air), radio frequencies. CIRCL is the CSIRT for the private sector, Luxembourg municipalities and non-governmental entities in Luxembourg.

text: Luxembourg’s government CSIRT (govcert.lu) covers incidents targeting government and public or private OES.

text: CSIRTMalta is responsible for coordinating incident response measures for entities engaged with Maltese critical infrastructure.

text: The Information Security & Governance Department’s Security Engineering Team covers government IT security.

text: The National Cyber Security Centre (NCSC.NL) (Dutch, English) was established in 2012 and incorporates the Dutch Computer Emergency Response Team for the Dutch central government. NCSC.NL is responsible for the coordination of incident response measures for Dutch government institutions, as well as entities engaged with critical infrastructure. Netherlands The NCSC covers multiple functions, such as managing the reporting of cybersecurity incidents (The) with a multi-channel reporting structure to log said incidents. The Centre is also responsible for maintaining a national detection response network for the governmental sector and entities engaged in the event of a cybersecurity incident. The centre also actively participates in the work of the Information Sharing and Analysis Centres (ISACs) for sectors involved with critical infrastructure.

text: In Poland, entities involved in handling and responding to computer incidents at national level are the Computer Security Incident Response Team (CSIRT GOV), the Ministry of Defence Computer Emergency Response System (CSIRT MON) and the National Cybersecurity Centre Poland (NC Cyber or CSIRT NASK). Their mission is to counter cross-sectoral and cross-border cyberthreats, to coordinate the handling of major, substantial and critical incidents, and to provide information about incidents, both within the network of government organisations related to cybersecurity and to the general public.

text: The National Cybersecurity Centre (Centro Nacional de Cibersegurança) is the Portuguese cybersecurity national authority. It has regulatory, supervisory, enforcement and sanctioning functions and the power to issue cybersecurity instructions. It defines the national level of Portugal cybersecurity alert. In addition, a National Computer Security Incident Response Team (CERT.PT) operates within the National Cybersecurity Centre and its main competence is to: (i) Implement operational coordination in response to incidents, in particular in liaison with existing sectoral IT security incident response teams.

text: CERT-RO is the competent national authority for the implementation of the NIS Directive. CER- RO’s missions are to prevent, analyse, identify and respond to cybersecurity incidents related to Romanian cyberspace. CERT-RO acts as National contact point for cybersecurity incidents with

text: similar structures within or outside Romania. CERT-AV-RO, which runs within Romania Civil Aviation Authority (RO-CAA, acts as the Romanian civil aviation sectoral CSIRT and there are plans for setting up other sectoral CSIRTs in the near future.

text: Created in 2016, the National Cyber Security Authority SK-CERT provides national and strategic activities in the field of cyber security management, threat analysis as well as coordination of Slovakia national security incident resolution. The National Cyber Security Centre also supports governance, development, management and support of cybersecurity competence centres, including training, educational activities, and research.

text: The Slovenian Information Security Administration (Uprava RS za informacijsko varnost - ZlnfV) acts as a National CSIRT, the national response centre primarily responsible for examining security incidents. The ZInfV also provides for the establishment of state administration

text: authorities’ CSIRT. The Slovenian Information Security Administration operates under the authority of the Ministry of Government Administration. The Slovenian Information Security Administration began operating on 1 January 2020.

text: The CCN-CERT is responsible for the management of cyber-incidents affecting public or private sector organisations. In the case of critical public sector operators, the management of cyber-

text: incidents is carried out by the CCN-CERT in coordination with the Centro Nacional de Protección de Infraestructuras y Ciberseguridad (CNPIC).

text: CERT-SE is the National CSIRT of Sweden. Its constituency consists of Swedish society, Sweden including but not limited to, governmental authorities, regional authorities, municipalities, and companies. In addition, CERT-SE is also Sweden’s governmental CSIRT.

text: December 2020

text: December 2020

text: Austrian Energy CERT (AEC)

text: Background and context of creation

text: The Austrian energy sector regulator (E-Control Austria), the sector association (Oesterreichs Energie) and the most important energy companies in the electricity, oil and gas subsectors worked together on an analysis and evaluation of security of supply in 2015. This work intended to identify the risks arising from the use of ICT infrastructure and to examine them in detail. This resulted in a successful joint initiative in the form of a public-private partnership (PPP). This partnership further enhanced mutual understanding and trust. It also increased awareness and acceptance of preventative measures to boost resilience. One of these measures was the creation and operation of a computer emergency response team (CERT) for the Austrian electricity and gas sectors.

text: https://www.energy-cert.at/en/about-us/ http://www.aec.arge.or.at/index.php/en/about-us.html https://www.geode-eu.org/wp-content/uploads/2019/07/3-4-Selhofer-Armin.pdf

text: December 2020

text: https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=62799 17 https://fmn.dk/eng/news/Pages/New-sectoral-strategie-stop-repare-society-for-cyberattacks.aspx 18 https://www.energy-community.org/dam/jcr:23cf8d77-32dd-4152-b040-51e3a17bd19c/FPS Economy, Cybersecurity in the oil sector.pdf

text: December 2020

text: Background and context of the will to create Sectoral CSIRTs

text: In October 2018, the Bulgarian Parliament approved a new Cybersecurity Act, which is the transposition of the NIS Directive into national law. The Cyber Security Act determines the overall organisation, management and control of cybersecurity at national level and establishes new authorities and their responsibilities. According to the Act, the “Electronic Governance” State Agency (or the “E-Governance Agency”) is the national competent authority and is thus empowered to establish a national Computer Security Incident Response Team (CSIRT). Currently, a Bulgarian CSIRT Centre exists (https://govcert.bg), which assists in reducing the risks of information security incidents and resolving such incidents if they have already occurred. The Act states that Computer Security Incident Response Teams are to be established within competent local authorities in various sectors (i.e. energy, transport, banking, financial market infrastructures, health, and digital) and will coordinate their activities with the national CSIRT.

text: https://www.cms-lawnow.com/ealerts/2018/11/bulgaria-adopts-new-cyber-security-act http://www.aec.arge.or.at/index.php/en/about-us.html

text: December 2020

text: December 2020

text: Sectoral Aviation CSIRT’s mandate (CERT-AV- National CSIRT’s mandate (CERT-RO) RO)

text: CERT-RO is the competent national authority for CERT-AV-RO is responsible for integrated incident the implementation of NIS Directive. Its mandate management for the entire civil aviation sector. includes: Each civil aviation entity has full responsibility for – the prevention, analysis, identification and the management of cybersecurity incidents in their response to cyber security incidents related to organisations. CERT-AV-RO and RO CAA’s Romanian cyberspace. responsibility is limited to integrated and correlated monitoring and detection of cybersecurity events – a national contact point for cybersecurity and incidents, as well as to the coordination of incidents for similar structures within or outside incident response when an incident impacts more Romania. than one organisation. – the development of national IT security policies and strategies along with other Romanian public authorities and the proposition of regulations regarding the national cybersecurity strategy. – the official advisor of the national public authorities for the cyber-protection of critical infrastructure.

text: National CSIRT’s services Sectoral Aviation CSIRT’s specific services

text: Proactive Reactive

text: • Cybersecurity warnings and pre-announcements; • Coordination of incident response in the Civil • Cybersecurity audits and vulnerability Aviation sector; assessments; • Correlation & integration of cybersecurity events • Cybersecurity application development; and incidents detected in the Civil Aviation sector. • Security-related information and dissemination.

text: Compliance Reactive

text: • Cybersecurity alerts; • Facilitation of oversight and compliance of the civil aviation entities with respect to the • Incident coordination and response; cybersecurity regulation. • Incident analysis & investigation; Support to cybersecurity R&D • Incident management at national level. • Facilitation of the Research & Development & Innovation (R&D&I) efforts in order to ensure the

text: creation and implementation of dedicated • Training other CSIRT teams and security cybersecurity solutions. response teams; • Building cybersecurity awareness (events, conferences, courses etc.).

text: https://www.terena.org/activities/tf-csirt/meeting36/tofan-cert-ro.pdf Interview with CERT-AV-RO

text: December 2020

text: Case study

text: National CSIRT’s mandate (CERT-BE) Future Sectoral CSIRT’s mandate

text: The Centre for Cybersecurity Belgium acts as the Future sectoral CSIRT tasks include (in national coordination authority and as the national cooperation with CCB): CSIRT in the EU-CSIRTs Network. Its tasks include: - Monitoring sectoral incidents and obligations to - Coordination for all sectoral CSIRTs; notify CCB through the common notification - Monitoring incidents at national and international platform (www.nis-incident.be); level; - Issuing of early warnings, alerts, announcements - Issuing of early warnings, alerts, announcements, and dissemination of information on risks and dissemination; incidents to relevant stakeholders in the sector;

text: - Response to incidents; - Response to sectoral incidents;

text: - Provision of a dynamic risk and incident analysis - Dissemination of knowledge of the dynamics or risks of sectoral incidents and ensure situational - Detection, observation and analysis of computer awareness; security problems - Ensuring cooperation-oriented contacts with the - Promoting the use of common or standardised sector’s suppliers; practices in the field of procedures for the treatment of incidents and risks, and systems for - Participation in meetings of the CSIRTs Network the classification of indigents, risks and information dedicated to its sector.

text: - Ensuring cooperation-oriented contacts

text: - Participation in EU CSIRTs Network.

text: Implementation in Belgium of the Directive EU 2016 1148 of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, CCB

text: December 2020

text: Splunk, RSA, HIDS OSSEC SIEMs Darktrace, ManageEngine

text: ManageEngine DLP Systems DataSecurity

text: Resources/Inventory ITmanager management Security Incident Management (SIM), Log Information System, Security Service Desk Plus security event Helpdesk software Operation Management management (SOM), Business Process Modeling (BPM) , GRC/ IRP Incident Register, Others Sharepoint

text: Request Tracker (RT), Ticketing RTIR

text: MISP, IntelMQ, Threat intel sharing ThreatExchange, OTR (Open Threat Exchange)

text: SOARs (Security Active & passive Information Orchestration TheHive, Request monitoring tools, security OTRS security Automation Tracker, RTIR, IntelMQ assessment tools, RT incident Response) SIEM, IT-Servicemanagement Management, semi-public Analysis Tool Commercial Sandbox Free Sandbox or commercial feeds

text: Vulnerability Nexpose, Nessus, Opensource Nexpose scanners Tenable, Retina, SIM Nessus, Kali OpenVAS

text: Request Tracker (RT), Ticketing RTIR

text: ManageEngine Resources/Inventory Desktop Central, Ivanti

text: management Penetration testing

text: Antivirus, UTM (Unified Threat AD Audit Plus ADAudit Management):

text: Intrusion/Detection Vectra Cognito System

text: December 2020

text: SIEMs Splunk

text: IT park management Nagios, SCOM Social media, Cyber tools Threat Intelligence feeds, conferences, metrics, active & passive ONMSi, SOFTIKA, monitoring tools, security Other ProofPoint assessment tools, bulletins, training

text: MISP, Request Tracker platforms, Cybersecurity awareness Free (RT) solutions incorporating behavioural analytics, e- Intranet portals, learning policies and procedures, internal and business e-mail, websites, monitoring external notifications, TTP (Tactics, Techniques, and Generic Sharepoint and visibility tools, Dedicated alerting & Procedures) reporting dedicated portals

text: Free: MISP Generic: Wiki, file Trainings, policies and exchange platforms, procedures, governance; Knowledge Mattermost, TSM, TTP, metrics Conferences, Mail; Dedicated alerting transfer Microsoft Sharepoint, & reporting dedicated Twitter; portal business e-mail, GitLab, SMS notifications, websites

text: December 2020

text: December 2020

text: Notification template for Operators of Vital Notification template for Operators of Essential Importance (OVI) Services (OES)

text: OVI must report to the National Cybersecurity OES must report to the National Cybersecurity Agency any information security incident having a Agency any information security incident having a significant impact on continuity of service. significant impact on continuity of service.

text: Information reported: Information reported:

text: - General information: date, name of OVI, - General information: date, name of OES, reference of the vital information system, type; type, localisation, address; vital IS entry - Contact details of the person reporting at stake, vital IS description; the incident; - Technical information: main vital IS - Contact details of 1 to 3 persons to components and technical contact for additional information; characteristics, number of interconnections, connection to Internet; - Incident description: network and IS affected, physical localisation of the - Outsourcing information: outsourcing of network, date & time of the attack, IS hosting, exploitation or maintenance & incident description; name of providers; - Impact: number of users affected, - Security information: security needs, duration, geographical impact, reporting description of the impact, presence of an to other MS; event detection system & type, date of last audit & type of audit. - Significant impact: criterion from Directive EU 2018/151;

text: - Incident management: qualification, root Confidentiality & dissemination: Classified causes, modus operandi, current status, (“confidentiel défense”), notification and actions taken; assistance needed; dissemination restricted to secure channel adapted to classified documents. - Other: other reporting scheme implemented, reporting to law Notification template [In French] enforcement; https://www.ssi.gouv.fr/uploads/2016/04/formulairedeclaration-incident-lpm_anssi.pdf - Comments.

text: Confidentiality level & dissemination: Restricted, dissemination restricted

text: Notification template [In French] https://www.ssi.gouv.fr/uploads/2018/05/formulaireincidents-ose_anssi.pdf

text: Notification template for Digital Service Providers (DSPs)

text: DSPs must report to the National Cybersecurity Agency any information security incident having a significant impact on continuity of service.

text: Information reported:

text: - General information: date, name of DSP, type;

text: - Contact details of the person reporting the incident;

text: - Contact details of 1 to 3 persons to contact for complementary information;

text: - Incident description: network and IS affected, physical localisation of the network, date & time of the attack, incident description;

text: - Impact: number of users affected, duration, geographical impact, reporting to other MS;

text: - Significant impacts: criterion from Directive EU 2018/151;

text: - Incident management: qualification, root causes, modus operandi, current status, actions taken;

text: - Other: other reporting schemes implemented, reporting to law enforcement;

text: Some Air Transport and Energy stakeholders rely on the services of Digital Service Providers (DSPs) to conduct vulnerability management, incident management or other services. It is therefore interesting to also analyse their reporting requirements.

text: December 2020

text: - Comments. Confidentiality level & dissemination: Public, no restriction. Notification template [In French] https://www.ssi.gouv.fr/uploads/2018/05/formulaire-incidentsfsn_anssi.pdf

text: December 2020

text: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/csirt-maturity/csirt-maturity-self-assessment-survey 23 http://opencsirt.org/wp-content/uploads/2019/12/SIM3-mkXVIIIc.pdf

text: December 2020

text: https://www.energylivenews.com/2019/07/02/german-power-grid-operators-steel-themselves-for-cyber-attacks/ 25 https://www.ceer.eu/training/training_courses_2016/cyber_security_sept_2016#

text: December 2020

text: The Austrian Energy CERT organises frequent meetings with technical personnel as Austria well as frequent meetings with senior management in the energy sector with a focus on their performance and development.

text: State-organised workshops, exercises, methodology (a shared framework is currently

text: Czech Republic

text: being developed for all sectors) and supporting materials.

text: Electricity distribution system operators (DSO’s) can incorporate some of their

text: cybersecurity expenses in their revenue cap, which offsets cybersecurity investments.

text: Estonia State-organised trainings, penetration-testing, information-sharing facilitation.

text: Finland Technical support programmes.

text: Publication of guidelines, audits, architecture support, technical services, regular threat reports and information on vulnerabilities from the CERT-FR and ANSSI. In 2003 a France closed 'InterCERT-FR' CSIRT community was launched by ANSSI. It has since expanded and is now co-managed by ANSSI and community representatives. It is cross-sector and aims to support resilience and IR capacity building.

text: Set-up of a comprehensive ecosystem with free or low-cost offers. Such offers include regular trainings, conferences, awareness sessions, tools for risk assessment and management. In the NIS context, OES will benefit from a free, sector-specific,

text: customised risk assessment and management tool with integrated reporting to the competent authority and later from a centralised, one-stop notification platform for NIS, Telecom, GDPR and Critical Infrastructures. No fees will be recovered from OES.

text: Ongoing development of a public-private partnership under the control of the Ministry

text: for Energy to enhance cybersecurity.

text: https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=62799 Source: Op.Cit

text: December 2020

text: Training, awareness and maturity models for the assessment of the measures and Portugal procedures implemented is undertaken with the support of the Portuguese National Cybersecurity Centre.

text: US NGO: https://www.mitre.org/capabilities/cybersecurity/cyber-threat-intelligence 29 https://www.nist.gov/topics/cybersecurity 30 https://www.cisecurity.org/cybersecurity-best-practices/

text: December 2020

text: December 2020

text: EBF position on Cyber incident reporting, EBF, October 2019 source: https://www.ebf.eu/wpcontent/uploads/2019/10/EBF-position-paper-on-cyber-incident-reporting.pdf

text: December 2020

text: https://www.ee-isac.eu/ 33 https://h-isac.org/ 34 https://www.a-isac.com/

text: December 2020

text: For example Connecting Europe Facility https://ec.europa.eu/inea/en/connecting-europe-facility/cef-telecom

text: December 2020

text: December 2020

text: For example information on Electricity network codes and guidelines https://ec.europa.eu/energy/topics/markets-andconsumers/wholesale-energy-market/electricity-network-codes_en?redir=1 37 For example Empowering Information Sharing Analysis Centres https://www.isacs.eu/

text: December 2020

text: December 2020

text: December 2020

text: At the time of writing of this report

text: December 2020

text: December 2020

text: Nature of information collected Data collection

text: Summary of national approach toward IR in the

text: Identified in 14 MS and 8 non-EU countries

text: NISD sectors

text: Competent authorities for the two targeted Identified for the 27 MS and 10 non-EU sectors countries, partial data for 1 non-EU country Existing/newly created or planned CSIRT or IR 68 existing/newly created identified

text: planned identified Role of OES Identified for 24 MS Role of DSP Identified for 22 MS Cross-border IR aspects Minimal data in 5 MS and 4 non-EU countries Operational preparedness and capacities Minimal data for 5 MS and 10 non-EU countries Tools Minimal data for 2 MS and 1 non-EU country Minimal data for 9 MS and for 9 non-EU

text: Initiatives, communities, etc.

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: See the FIRST CSIRT framework for details: https://www.first.org/education/csirt_service-framework_v1.1

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: https://opencsirt.org/csirt-maturity/sim3-and-references/ 41 https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/csirt-maturity

text: December 2020

text: Service Area 1 – Information security event Management

text: Monitoring and detection

text: Event analysis

text: Service Area 2 - Information security incident management

text: Information security incident report acceptance

text: Information security incident analysis

text: Artifact and forensic evidence analysis

text: Mitigation and recovery

text: Information security incident coordination

text: Crisis management support

text: Service Area 3 - Vulnerability management

text: Vulnerability discovery / research

text: Vulnerability report intake

text: Vulnerability analysis

text: Vulnerability coordination

text: Vulnerability disclosure

text: Vulnerability response

text: Service area 4 – Situational awareness

text: Data acquisition

text: Analysis and synthesis

text: Service area 5 – Knowledge transfer

text: Awareness building

text: Training & Education

text: Technical and policy advisory

text: Example: Cyber Threat Intelligence system, Request tracker for Incident Response (RTIR), or equivalent, Open Technology Real Services, or equivalent, osTicket, or equivalent, dedicated alerting & reporting dedicated portal, Active & passive monitoring tools, Use of public, semi-public or commercial feed, Digital forensic tools, Security assessment tools)

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

identifier: Sectoral CSIRT Capabilities - Energy and Air Transport

amnesord:
Cybersecurity of Critical Sectors
State of cybersecurity in the EU

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Sectoral CSIRT Capabilities - Energy and Air Transport

serie: rapporter

text: SECTORAL CSIRT CAPABILITIES December 2020

type: rubrik

text: SECTORAL CSIRT CAPABILITIES

text: Status and Development in the Energy and the Air Transport sector DECEMBER 2020 0 SECTORAL CSIRT CAPABILITIES

text: ABOUT ENISA

type: stycke

text: CONTACT

text: For queries in relation to this study, please use: csirt-relations@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Edgars Taurins, ENISA. Activities supporting this study were conducted under contract with CEIS-Avisa Partners.

text: ACKNOWLEDGEMENTS

text: Study was performed with the input from Informal Expert Group on EU Member States Incident Response Development.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-444-2 - DOI 10.2824/123795

text: SECTORAL CSIRT CAPABILITIES

text: TABLE OF CONTENTS

text: EXECUTIVE SUMMARY 4 1. OVERVIEW AND SCOPE OF THE STUDY 6

text: 1.1 CONTEXT 6

text: 1.2 OBJECTIVE OF THE STUDY 6

text: 1.3 SCOPE OF THE WORK AND DEFINITIONS 7

text: 2. METHODOLOGY AND DATA COLLECTION 11

text: 2.1 OVERVIEW OF THE METHODOLOGY 11

text: 2.2 A SEVEN-STEP APPROACH 11

text: 2.2.1 Step 1 – Definition of the research focus for the data collection 11 2.2.2 Step 2 – Desktop research in open source on air transport and energy Sectors IRC 11 2.2.3 Step 3 – Designing and validating the survey 11 2.2.4 Step 4 – Conducting the survey and complementary interviews 12 2.2.5 Step 5 – Collation of raw data 12 2.2.6 Step 6 – Analysis and identification of trends 12 2.2.7 Step 7 – Final report 13

text: 2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY 13

text: 2.3.1 Desktop research – Data collection assessment 13 2.3.2 Survey – data collection assessment 14 2.3.3 Interviews – data collection assessment 14

text: 3. KEY FINDINGS 15

text: 3.1 KEY FINDING #1- IRC SET-UP AND LANDSCAPE 15

text: 3.2 KEY FINDING #2 – CREATION OF SECTORAL CSIRTS 20

text: 3.3 KEY FINDING #3 – SECTORAL CSIRTS SERVICES 23

text: 3.4 KEY FINDING #4 – SECTORAL IR PROCESSES AND TOOLS 26

text: 3.5 KEY FINDING #5 – SECTORAL IR MATURITY DEVELOPMENT 31

text: 3.6 KEY FINDING #6 – SECTORAL CSIRTS CHALLENGES AND GAPS 1/2 35

text: 3.7 KEY FINDING #7 – SECTORAL CSIRTS CHALLENGES AND GAPS 2/2 37

text: 3.8 KEY FINDING #8 – SECTORAL CSIRTS LESSONS LEARNT 38

text: SECTORAL CSIRT CAPABILITIES December 2020 4. RECOMMENDATIONS 40 5. BIBLIOGRAPHY 41 A ANNEX: PRESENTATION OF THE RAW DATA 44 B ANNEX: SURVEY – QUESTIONNAIRE 48 C ANNEX: FIGURES AND TABLES 60 SECTORAL CSIRT CAPABILITIES

text: EXECUTIVE SUMMARY

text: Digital infrastructure, Information and Communication Technologies are critical to our societies

text: Cyberattacks

text: and economies. The global Covid-19 pandemic witnessed in 2020 sent all these technologies

text: have risen

text: into the limelight like never before and forced millions around the world to work from home and

text: sharply since the

text: rely on remote connections to professional networks during the lockdown.

text: beginning of the

text: Vital sectors had to ensure continuity of service during this lasting global crisis despite COVID-19 increased exposure to cyber threats over this long-lasting global crisis. The growing use of pandemic, in remote IT networks by a large part of the population working remotely opened new digital attack

text: particular in

text: surfaces to criminals who were quick to exploit such vulnerabilities. Cyberattacks rose sharply

text: critical sectors

text: since March 2020, as confirmed by a number of cybersecurity experts and law enforcement

text: such as

text: agencies such as Interpol. They specifically noted a rise in malware, phishing and Trojan horse

text: 1 transport, health

text: attacks worldwide .

text: or finance.

text: Both the Energy and the Air Transport sectors face considerable threats with potentially disastrous financial and societal consequences, requiring solid Incident Response Capabilities (IRC).

text: Both sectors come with large supply chains and a multiplicity of stakeholders (Public authorities, Regulators, Professional associations, large industries, SMEs, etc.). They have, in recent years, taken steps to structure and strengthen their ability to face cyber threats and to respond to cyber incidents. The creation of ISACs to foster information-sharing at sectoral level is an excellent illustration of this evolution.

text: This study provides a continuation of work on Sectoral IRC at European level following the publication of the 2019 “EU Member States incident response development status report” . The report focuses on trends in Energy and Air Transport Incident Response (IR) Capabilities, procedures, processes and tools. It also offers insights on current challenges and gaps facing IR communities.

text: The analysis aimed to focus on:

text:  Current IRC of Air Transport and Energy sectors,  The recent changes in the context of the Covid-19 pandemic,  The upcoming revision of the NIS Directive,  To draw practical recommendations for the IR community.

text: SECTORAL CSIRT CAPABILITIES KEY FINDINGS

text: The research highlighted the following eight key findings:

text: Key Finding #1 A large majority of EU countries tend to have dedicated sectoral specialists and experts within their National/governmental CSIRTs rather than one dedicated sectoral entity at national level. Sectoral CSIRTs are not yet the norm in the EU.

text: Key Finding #2 The EU countries which decided to create a dedicated sectoral CSIRT for the Energy or Air Transport sector were driven by organisational and functional needs rather than technical ones.

text: Key Finding #3 Energy and air transport sectoral CSIRTs tend to provide their constituency with sector-specific expertise in addition to the generic services provided by national CSIRTs.

text: Key Finding #4 The tools and processes used by sectoral CSIRTs to deliver their services are similar to those used by national CSIRTs.

text: Key Finding #5 Although IR stakeholders did not request specific guidance when developing their capabilities, they tended to use dedicated tools made available by EU authorities, regulators and national CSIRTs.

text: Key Finding #6 Sectoral CSIRTs in both air transport and energy sectors are facing similar challenges, such as legislations overlapping, or the growing time spent on compliance issues.

text: Key Finding #7 Sectoral CSIRTs in both the air transport and energy sectors face the common challenge of formally and rapidly sharing ex-ante information in a particularly tense context.

text: Key Finding #8 On-going programmes and information sharing initiatives successfully supported IRC developments in both sectors. However, a strong demand remains for more framework, guidance and know-how in relation to the impact of the Covid-19 pandemic.

text: SECTORAL CSIRT CAPABILITIES

text: 1. OVERVIEW AND SCOPE OF THE STUDY

text: 1.1 CONTEXT Incident

text: Since its creation, ENISA has been actively working to assist the European Commission,

text: Response

text: European Union Member States (EU MS) and the overall cybersecurity community to enhance their capabilities and expertise. The Agency engaged in an in-depth research on Capabilities have Incident Response Capabilities (IRC) to that end. As a result ENISA was able to produce a never been so state-of-the-art overview of the CSIRT landscape and of its development in Europe. This crucial for study aims to complement this work by continuing to update ENISA’s recommendations for

text: sectoral

text: the CSIRT capability development and to disseminate the latest trends and evolutions in this

text: stakeholders

text: domain.

text: who rely heavily on digital tools.

text: ENISA’s public website features a European CSIRT inventory. The interactive map it includes gives an overview of the current CSIRT teams active in Europe. A study on the CSIRT landscape and an overview of the IR capabilities in 2025 Europe are also available. These features serve the purpose to present a comprehensive picture of existing CSIRTs’ incident handling and response capabilities (IRC), with initial facts and figures about sectoral CSIRTs.

text: 2020 has been impacted by the global COVID-19 pandemic in many ways but in addition to an unprecedented financial impact, it has resulted in a massive increase in the use of digital tools and services. As a result, cybersecurity and Incident Response Capabilities in particular have become more crucial than ever. It is therefore fundamental that ENISA continues to closely monitor capability development, particularly in light of the upcoming revision of the NIS Directive.

text: This revision is a great opportunity to take stock of the recent evolutions of the Incident Response Landscape across the EU. The revision will be an occasion to build on the lessons learnt by the IR community across the EU Member States (MS) in addressing the challenges the implementation of the NISD has given rise to.

text: Following the publication of the 2019 “EU Member States incident response development status report” , ENISA is eager to take a closer look at the IRC development of sectoral CSIRTs, more specifically in the energy and air transport sectors.

text: 1.2 OBJECTIVE OF THE STUDY

text: This study aims to further ENISA’s understanding and knowledge of IRC development and draw conclusions about the development of IR capabilities particularly in the energy and air transport sectors.

text: It constitutes an extensive analysis of IRC in the energy and air transport sectors and presents potential gaps, overlaps and challenges in the services offered as well as in the procedures, processes and tools used by sectoral IRCs.

text: SECTORAL CSIRT CAPABILITIES

text: The specific objectives of this study are:

text:  To collect and aggregate comprehensive data on the current IRC in the air transport and energy sectors;  To analyse and measure the evolution and development in sectoral CSIRTs services, capabilities, processes, tools and cooperation mechanisms;  To identify potential gaps, overlaps and challenges in national IR procedures, processes and tools.

text: To this end, research was divided into three parallel activities, namely:

text:  A desktop research of open sources,  A survey of EU national and sectoral CSIRTs (responses received from 13 Member States and a European sectoral CSIRTs),  Complementary interviews with sectoral IRC experts and national CSIRTs.

text: An overview of the methodology and an assessment and presentation of the data collected can be found in chapters 3 and 4.

text: 1.3 SCOPE OF THE WORK AND DEFINITIONS

text: This study provides data and analysis on the recent changes and evolutions of IR capabilities (IRC) within Air Transport and Energy sectors in Member States.

text: The study focuses on:

text:  Capabilities of sectoral CSIRTs;  Operational preparedness of sectoral CSIRTs or other IR entities;  IR services actually provided to constituency;  IR processes and procedures;  IR tools (used by sectoral CSIRTs or other IR entities) standalone and/or in contrast with national CSIRT(s);  Awareness of ENISA maturity assessment and/or (Self) assessment framework for CSIRTs;  Examples and/or lessons learnt of sectoral incidents;  Cooperation mechanisms used nationally and internationally;  Current levels of maturity and requirements for development.

text: It was therefore important to agree on the definition of the key structuring concepts and elements of the study.

text: The scope and key concepts of the research were defined as follows:

text: Incident response (IR): The protection of an organisation's information by developing and implementing an IR process (e.g. plans, defined roles, training, communications, management oversight) in order to quickly discover an attack and effectively contain the damage, eradicate the attacker's presence, and restore the integrity of the network and systems.

text: SECTORAL CSIRT CAPABILITIES

text: Incident response capabilities (IRC): The processes (e.g. plans, defined roles, training, communications, management oversight), procedures and tools (log analysis, Intrusion Detection Systems, Vulnerability scanners, Data Capture & Incident Response Forensics Tools, Patch management systems, etc.) used to identify, respond to and mitigate the impact of an attack, and to restore continuity of service.

text: Incident response models: the survey used a typology of four Incident Response models:

text:  Centralised: the national CSIRT is in charge of handling incidents across the different sectors; it provides a centralised point for incident reporting and analysis, decision-making, response coordination, and dissemination of information.  Distributed: the national CSIRT has core responsibilities to handle incidents and works with a competent authority for each sector (e.g. national ministries or public agencies); the role of these actors may be to facilitate incident notification and dissemination of information.  Hybrid: a national CSIRT and the sectoral CSIRTs share the IR responsibilities and operations, which may depend on the sector(s) impacted or the scale of the incident for instance.  Decentralised: a sectoral CSIRT is in charge of handling incidents in a given sector from incident detection to response coordination and decision-making, including coordinating with other stakeholders.

text: National/Government (N/g) CSIRTs: Teams that serve a country’s government by helping to protect its critical information infrastructure. N/g CSIRTs play a key role in coordinating incident management with the relevant stakeholders at national level. They also bear responsibility for cooperation with other countries’ national and governmental teams.

text: National Sectoral CSIRTs: Entities responding to computer security or cybersecurity incidents affecting a specific sector at national level. N/ Sectoral CSIRTs are usually established in NISD sectors such as Healthcare, Energy, and the Transport Sector. Unlike the N/G CSIRT who serves the public sector, the national Sectoral CSIRTs provides services to constituents from a single sector in one country (in the context of this study, the national Sectoral CSIRTs and sectors mentioned are mainly Air Transport and Energy sectors).

text: Sectoral CSIRT of international organisation: Entities or teams within an international organisation or company responding to computer security or cybersecurity incidents affecting the organisation and providing services to constituents from a single sector at regional (EU) or international level.

text: OES CSIRT/IRTs: Entities or teams responding to computer security or cybersecurity incidents affecting an Operator of Essential Services within a sector.

text: Operators of Essential Services (OES): Operators of essential services are private or public sector entities who play an important role in providing healthcare, transport, energy, banking and financial market infrastructure, digital infrastructure and water supply. According to the NIS Directive, Member States should be responsible for determining which entities meet the criteria of the definition of operator of essential services .

text: SECTORAL CSIRT CAPABILITIES

text: Digital Service Provider (DSP): A digital service provider is an entity providing one or more of the three types of digital service, such as:

text:  Cloud computing services: digital services enabling access to a scalable and elastic pool of shareable computing resources.  Online marketplaces: digital services allowing consumers to conclude online sales or service contracts with traders online using computing services provided by the online marketplace.  Online search engines: means a digital service that allows users to perform searches of, in principle, all websites or websites in a particular language on the basis of a query on any subject in the form of a keyword, phrase or other input, and returns links in which information related to the requested content can be found.

text: NIS Directive: The Directive on Security of Network and Information Systems (NISD) was adopted by the European Parliament on 6 July 2016 and entered into force in August 2016. The NISD provides legal measures to boost the overall level of cybersecurity in the EU.

text: NISD sectors: Critical sectors for the European Union’s society and economy are heavily dependent on ICT. Member States have been requested to identify operators of essential services (OES) for the seven sectors listed in the NIS Directive (NISD sectors). These seven sectors – and related subsectors – listed in the Directive are:

text:  Energy (electricity, oil, gas);  Transport (air, rail, water, road);  Banking;  Financial market infrastructures;  Health sector;  Drinking water supply and distribution;  Digital Infrastructures.

text: SECTORAL CSIRT CAPABILITIES

text: Figure 1: NISD sectors

text: SECTORAL CSIRT CAPABILITIES

text: 2. METHODOLOGY AND DATA COLLECTION

text: 2.1 OVERVIEW OF THE METHODOLOGY

text: The methodology to identify, collect and analyse data on Incident Response set-up and capabilities within the air transport and energy sector is illustrated below. The series of steps the methodology consists of is presented in this chapter.

text: Figure 2: Overview of the methodology

text: 2.2 A SEVEN-STEP APPROACH 2.2.1 Step 1 – Definition of the research focus for the data collection

text: The research focus of the study was defined in close cooperation with the ENISA team. To that purpose an analysis grid setting criteria and theme was created to classify the information collected on energy and air transport Sectoral IRC

text: The list of criteria was defined pertaining to the specific data sought in the context of this study (e.g. cooperation aspects, recently created entities, etc.).

text: 2.2.2 Step 2 – Desktop research in open source on air transport and energy Sectors IRC

text: This step consisted in conducting a literature review and open source research in order to collect data on sectoral IRC and recent trends in the field of air transport and energy IRC. This research was performed within the 27 Member States and a selection of 13 neighbouring countries .

text: During a preliminary data collection phase, a first team of analysts gathered the relevant data in the data classification grid. A second team of analysts validated and further enriched the preliminary data. An overview of the collected data is detailed in chapter 5.1.

text: 2.2.3 Step 3 – Designing and validating the survey

text: Publicly available information on air transport and energy Sectoral IRC procedures and tools was, as anticipated, not detailed enough to provide insightful input (see chapter 5.1).

text: SECTORAL CSIRT CAPABILITIES

text: Therefore, a survey to collect comprehensive data from relevant parties had been planned early on.

text: Once the objective of the survey was defined, two categories of organisations were identified to participate in the survey:

text:  27 Member States’ national CSIRTs;  Additional public, private (IRC of Operator of essential services (OES)) and European sectoral CSIRTs from the 27 MS.

text: Further information on data collected can be found in A Annex – Presentation of the raw data (p. 44).

text: Together with ENISA, the project team then drafted the survey to be sent to both audiences considering aspects such as data protection, privacy and legal aspects, language, size and format, and structure.

text: The final version of the survey validated by ENISA is available in B Annex: Survey – questionnaire (p. 48)

text: 2.2.4 Step 4 – Conducting the survey and complementary interviews

text: The survey was sent by ENISA to the 27 national CSIRTs and additional sectoral CSIRTs through the CSIRTs Network . To maximise participation the survey included a presentation of the study and its context.

text: Targeted e-mails were sent to relevant contacts and followed up on, to ensure a high response rate from Member States and sectors.

text: Following the survey, additional interviews took place to complement and further enrich the data collected with the survey and desktop research with both:

text:  Sectoral Cybersecurity experts;  Members of the Informal Expert Group on Incident response Capabilities;

text: A list of entities was drafted for each group with an interview rationale validated by ENISA. Once agreed, participants were able to fill-in the survey, using the EU survey tool, or scheduling a phone interview to provide their answers.

text: An overview of the raw data collected through the survey is detailed in A Annex – Presentation of the raw data (p. 44).

text: 2.2.5 Step 5 – Collation of raw data

text: The raw data collected from the desktop research, the survey and the interviews, was aggregated in structured tables in a collaborative tool.

text: The collaborative tool allowed the aggregation of all raw data, the generation of statistics and the identification of key input.

text: 2.2.6 Step 6 – Analysis and identification of trends

text: The methodology used in this step was a qualitative use of the Delphi Method. This method ensures that the data collection team and the data analysis team benefit from and build on

text: SECTORAL CSIRT CAPABILITIES

text: each other’s expertise, and that the final analysis addresses all aspects of the request presented in a concise, coherent and comprehensive way.

text: The data collection team and the data analysis team performed a first analysis of the raw data to develop a draft set of key findings. With analysis methods applied, the teams drafted a first version of the key findings of the study and submitted it to ENISA for validation and further discussion.

text: At a later stage, a virtual workshop held via videoconference was organised with members of the ENISA Informal Expert Group on Sectoral Incident Response Capabilities .

text: After the virtual workshop and once all final comments were received, a preliminary version of the final report was drafted and submitted to ENISA for validation and further discussion.

text: 2.2.7 Step 7 – Final report

text: This final step consisted in further developing findings and in drafting the final report of the study in collaboration with the member of the IEG.

text: Close interactions and exchanges with ENISA ensured that the final recommendations of the study were in line with the Agency’s needs and expectations.

text: 2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY

text: The identification of reliable and qualitative data was crucial throughout the study. For each of the three activities conducted during the study, namely the desktop research phase, the survey and the complementary interviews, an overall assessment the data and information availability was conducted, and several assumptions were made. A detailed overview of the raw data is presented in A Annex – Presentation of the raw data (p. 44).

text: For both the desktop research and survey data collection phases, research identified all CSIRTs relevant to the energy and transport sectors about which information was publicly available, regardless of size or maturity. As described in the key findings, whether these two sectors are covered by sectoral or by national CSIRTs varies from country to country. The information is summarised p. 16.

text: 2.3.1 Desktop research – Data collection assessment

text: During the open-source desktop research phase, information on IR layout and set-up was collected for 19 out of 27 Member States and a few elements were collected for the remaining 8 MS.

text:  The clarity and level of information available on national IR approach in NISD sectors was very different from one Member States to another;  Information on procedures, processes and tools used by Sectoral IR teams were rarely, if ever, detailed in publicly available documents;  Publicly available information about cooperation models or cross-border procedures was not detailed;  Qualitative information on information exchange communities and fora were rarely, if ever, detailed in publicly available documents.

text: SECTORAL CSIRT CAPABILITIES 2.3.2 Survey – data collection assessment

text: The survey collected answers from 20 respondents from 13 Member States and 1 regional air transport organisation:

text:  10 National CSIRTs;  4 Regulatory organisation, body or Ministry;  2 Sectoral CSIRT (1 national and 1 European);  4 Energy and Air Transport OES IRT.

text: Further information is presented in A Annex – Presentation of the raw data (p. 44). Specific information about the breakdown of respondents by type and sector can be found p.46.

text: 2.3.3 Interviews – data collection assessment

text: And additional two interviews were conducted with sectoral experts in each of the two targeted sectors (Air Transport and Energy) along with extra interviews conducted with members of the Informal Expert Group on Incident Response Capabilities.

text: SECTORAL CSIRT CAPABILITIES

text: 3. KEY FINDINGS

text: 3.1 KEY FINDING #1- IRC SET-UP AND LANDSCAPE

text: A large majority of EU countries tend to have dedicated sectoral specialists and experts within their National/governmental CSIRTs rather than a dedicated sectoral entity at national level. Sectoral CSIRTs are not yet the norm in the EU.

text: Our research, which covered the 27 EU Member States, identified National sectoral CSIRT capabilities in 19 Member States :

text:  65% (12 out 19 MS) have no Sectoral CSIRTs, 9 haven’t planned to create one in the near

text: future, but 3 are discussing the possibility of creating one some at national level in the future, should the need arise;  1 MS is currently setting up both an Energy and Air Transport CSIRT at national level;  4 MS have no Energy or Air transport CSIRT at national level yet but do have other

text: Sectoral CSIRTs (Finance, Health or Water, etc.);  1 MS has an Energy Sectoral CSIRT at national level and 1 MS has an Air Transport

text: Sectoral CSIRT at national level;

text: To this date, the general approach towards IR set-up in both the Energy and Air Transport sectors in the EU is to have the National CSIRT acting as the competent authority for IR and OES in charge of conducting incident response at operational level, with a dedicated unit or sectoral expert to that purpose.

text: Table 1: Overview of all MS’ basic IR set-up in sectors (with available data collected)

text: Countries Summary of national approach toward IR in the Energy & Air Transport sectors

text: SECTORAL CSIRT CAPABILITIES

text: SECTORAL CSIRT CAPABILITIES

text: SECTORAL CSIRT CAPABILITIES

text: SECTORAL CSIRT CAPABILITIES

text: As illustrated in the table above, the sectoral Incident Response layout and set-up at European level in both the Air Transport and Energy sector is still recent and evolving. The ecosystem is organised around the following elements:

text: At national level, Incident response set-up is structured around:

text:  Generic IR services provided by the national/governmental CSIRT in each EU Member State for all sectors, including Energy and Air Transport. This is particularly relevant in countries with a centralised IR model; These national/governmental CSIRTs either have specific experts and specialists within their organisation for these two sectors or a dedicated unit. In these Member States, Energy and Air Transport OES are also developing their own internal CSIRTs or are externalising this activity to certified Digital Service Providers (DSPs);

text:  For two Member States, dedicated Sectoral CSIRTs coordinate incident

text: response at national level, supervised by the national CSIRT.

text: At European level, the landscape also includes international organisations’ sectoral CSIRTs intended to develop requirements and regulations and to provide a forum for sector stakeholders.

text: Both sectoral IRC/OES IRT at national level and Sectoral CSIRT of international organisations tend to be recent (less than 5 years old) and are still in the development phase of their capabilities.

text:  Summary: All Member States recognise the need for specific IR expertise for NISD sectors at national level to support OES and sectoral actors. This specific IR expertise can either be mutualised within the National CSIRT or organised as a separate and dedicated sectoral entity. This expertise is essential as IR capabilities must be aligned with the risk management process specific to each sector.

text: SECTORAL CSIRT CAPABILITIES 3.2 KEY FINDING #2 – CREATION OF SECTORAL CSIRTS

text: The EU countries which decided to create a dedicated sectoral CSIRT for the Energy or Air Transport sector were driven by organisational and functional needs rather than technical ones.

text: A closer look reveals that for those two Member States who decided to create a dedicated sectoral CSIRT for Energy or Air Transport at national level, the main drivers were organisational and functional needs rather than technical ones.

text: Both the Energy Sectoral CSIRT and the Air Transport Sectoral CSIRT created at national level responded to a need and a specific demand from sector stakeholders to organise Incident Response nationally.

text: “[there is a] need for facilitating oversight and compliance” (Air Transport Sectoral CSIRT)

text: Table 2: Case Study – Creation of the Austrian Energy CERT

text: Case study

text: Although not a member of the European Union, Norway is also an interesting case to mention among the European Free Trade Association (EFTA) countries. KraftCERT (Norwegian energy sector CSIRT) is the result of a joint initiative from NorCERT and the Norwegian Water Resources and Energy Directorate (NVE). The Sectoral CSIRT aims to support the entire power industry at national level in the prevention and handling of security incidents .

text: As illustrated below, the creation of sector-specific IR Capacities was not the result of the lack of sector-specific knowledge of the National CSIRT, nor the inability to manage cybersecurity incidents in the sectors at national level.

text: SECTORAL CSIRT CAPABILITIES

text: Figure 3: Drivers to create sector-specific IR Capacities

text: NB: Five respondents decided not to answer this question as they do not have a national sectoral CSIRT and for the moment do not intend to create one in the near future.

text: According to 50% of respondents, the need to facilitate the implementation of the NIS Directive is one of the most important drivers behind the creation of such sector specific IR capacities. It shows that European legislation has an important and positive impact in pushing actors to develop sectoral capacities .

text: The need to be prepared and to facilitate the implementation of the requirements of the NIS Directive is shared by those two Member States currently preparing or discussing the creation of sectoral CSIRTs and by sectoral private operators who decided to create an internal IR capacity.

text: Both Denmark and Belgium are currently discussing the creation of an energy CSIRT at national level. According to Denmark’s sectoral strategy , « it is considered that such a sector CERT with sector-specific competences is relevant to the energy sector to act on the cyber threats ». Danish authorities will explore how a sectoral CSIRT could be established and whether there is a basis for establishing a common CSIRT with specialist competence in cybersecurity in the energy sector. Depending on its structure, a sectoral CSIRT will be able to contribute specific knowledge and experience-based competencies such as advising and training. In Belgium, the creation of an oil-sector CSIRT is currently under discussion .

text: SECTORAL CSIRT CAPABILITIES

text: Table 3: Case Study - Bulgarian Cybersecurity Strategy

text: Case study

text: The response of a private electricity provider from a large member state, which decided to create its own CSIRT in January 2019 is an illustration of this trend.

text: “There was a growing awareness of the need to create an internal capacity to handle incident

text: response in the organisation. The Chief Information Officer was aware of the lack of preparedness and had the will to invest to be prepared for the upcoming changes (GDPR, NIS Directive implementation, upcoming status of OES). We wanted to anticipate the future taking into account the growing number of attacks targeting other actors.”

text: Another point to reflect on is that both Energy and Air Transport Sector deal with crossborder aspects. There is, therefore, a need for cross-border communication between entities, which could be facilitated by the creation of sectoral CSIRTs.

text:  Summary: The creation of sectoral entities tends to facilitate the functioning of IR at national level, the implementation of cybersecurity regulations and cross-border cooperation for sectoral actors.

text: SECTORAL CSIRT CAPABILITIES 3.3 KEY FINDING #3 – SECTORAL CSIRTS SERVICES

text: National energy and air transport sectoral CSIRTs tend to provide their constituency with very sector-specific expertise in addition to the generic services provided by national CSIRTs.

text: As illustrated in chapter 3.1, a majority of EU countries tends to either rely on the generic services of their national CSIRT or to support the development of Incident Response capabilities of operators of essential services in the energy and air transport sectors. The focus of the study was therefore to analyse the differences between specific services provided by National Sectoral CSIRTs as opposed to those provided by National CSIRTs.

text: According to survey responses, and as confirmed by additional desktop research, Sectoral CSIRTs at national level tend to provide very sector-specific expertise and maintain closer relationships with their constituents.

text: Additional services provided by Sectoral CSIRTs at national level differing from those of

text: “A Sectoral

text: National CSIRTs include:

text: CSIRT at national

text:  Specific information and in-depth knowledge in their sector; level could  Sector-specific network of contacts; provide a more  Closer relationships with vendors of the sector;

text: in-depth

text:  Expertise on sector-specific hardware and systems;

text: knowledge of the

text:  Sector-specific conferences, workshops, and training;

text: sector’s

text:  The creation of uniform frameworks for audit documentation at sectoral level;  Faster sectoral communication channel, as their constituency base is smaller than the one specificities & of a National CSIRT; challenges.”  Sector-specific recommendations. (National CSIRT)

text: “It [the Sectoral CSIRT] could provide more in-depth knowledge of the sector’s specificities &

text: challenges” (National CSIRT)

text: In addition to those services, Sectoral CSIRTs would be an important player to organise sectoral exercises as they have good communication channels and closer relationships with the main sectoral stakeholders at national level.

text: In Romania, the creation of a dedicated sectoral CSIRT for Air Transport at national level was driven by the following key needs:

text:  The need for a real-time and integrated response capability;  The need for a continuous and up-to-date situational awareness;  The need to facilitate oversight and compliance;

text: CERT-AV-RO was created as a consequence within the Romanian Civil Aviation Authority to facilitate the monitoring, detection and coordination of the response to correlated incidents, as well as cooperation and hierarchical reporting. The services provided by CERT-AV-RO compared with those of the National CSIRT are presented below.

text: SECTORAL CSIRT CAPABILITIES

text: Table 4: Case Study - CERT-AV-RO - Specific mandate and services compared with those the National CSIRT

text: Case study

text: SECTORAL CSIRT CAPABILITIES

text: Table 5: Case Study - Future Belgian Sectoral CSIRTs - Specific tasks compared with those of the National CSIRT

text: In addition to their sector-specific service offer, both Sectoral and OES CSIRTs provide generic services in the four main services areas identified by the FIRST CSIRT Services

text: 19 FIRST CSIRT

text: framework :

text: SERVICES FRAMEWORK

text:  Information Security Event Management; The FIRST CSIRT  Information Security Incident Management; Services Framework  Vulnerability Management; seeks to assist  Knowledge Transfer. CSIRT teams by identifying and According to survey responses, both National and Sectoral CSIRTs’ main services and defining core functions relate to Information Security Incident Management and Vulnerability Management, categories of services among others. and their subcomponents. Sectoral CSIRTs tend to be recent and therefore dedicate their resources to these two services and focus less on knowledge transfer activities.

text:  Summary: Sectoral CSIRTs play an important role in facilitating operational collaboration and information sharing at Sectoral level.

text: SECTORAL CSIRT CAPABILITIES 3.4 KEY FINDING #4 – SECTORAL IR PROCESSES AND TOOLS

text: The tools and processes used by sectoral CSIRTs to deliver their services are similar to of national CSIRTs.

text: The main IR tools in service in both National and Sectoral CSIRTs are a combination of open-source, commercial and internally developed tools which are mostly in service in mature CSIRTs. Recently created entities, in particular recently created OES CSIRTs, are still testing open-source or commercial tools.

text: Table 6: Case Study - Commonly-used tools in service in both National and Sectoral CSIRTs, categorised by service area

text: CSIRTs key Commercial tools Others (data sources, Tool Family Free tools in service service areas in service methodologies, etc.)

text: SECTORAL CSIRT CAPABILITIES

text: Most IR teams have Standard Operating Procedures (SOPs) and procedures in place except for the most recent CSIRTs. Those teams are still testing or selecting tools and therefore are still preparing associated procedures and SOPs.

text: Despite varying maturity levels, most CSIRTs tend to have very organised procedures in place to handle incidents.

text: According to ENISA CSIRT Maturity assessment Model, CSIRTs can self-assess their team’s maturity based on a list of 44 parameters over 4 categories: O (Organisational), H (Human), T (Tools) and P (Processes). Each main category includes a diverse range of parameters such as those defined for Organisational parameters, which analyse the mandate, constituency, authority, responsibility, or services of the CSIRT.

text: The ENISA CSIRT Assessment model defines a list of key parameters to analyse a CSIRT Tool maturity including the following:

text:  An IT Resource List;  An Information Sources List;  A Consolidated E-mail System;  An Incident Tracking System;  A resilient Phone, email and Internet Access;  An Incident Prevention, Detection and Resolution Toolset.

text: SECTORAL CSIRT CAPABILITIES

text: The evaluation of the presence, existence of guidelines/procedures and effective use of the elements listed above are an excellent method to assess the maturity of CSIRT tools. There are several methods available for maturity assessment in addition to the one proposed by ENISA.

text: The analysis of the CSIRTs through the survey (National CSIRTs in charge of IR in energy and Air Transport Sectors; Sectoral CSIRTs at national level, OES IRTs), gave the following results:

text:  70% of respondents have formal SOPs that OES teams should follow in case of an incident. Among the remaining 30%, some are in the process of developing such guidelines and two participants did not provide an answer to this question.

text:  82% of respondents use a formal incident notification template and those who do not have an SOP yet are in the process of establishing one.

text: Figure 4: Specific information exchange tools for notification of incidents

text:  100% of respondents have specific information exchange tools (commercial or dedicated) to enable the notification of incidents. Among these tools, the most commonly used is secure e-mail.

text: France is an interesting case study in terms of good practices. The Member State has various procedures in place at national level according to the nature of the actor targeted by a cyberattack.

text: SECTORAL CSIRT CAPABILITIES

text: Table 7: Case Study - French National Cybersecurity Agency Notification Portal

text: Case study

text: SECTORAL CSIRT CAPABILITIES

text: These IR tools and procedures tend to be included in CSIRT constituents’ codes of conduct or are directly promoted by the National CSIRT.

text:  Summary: Sectoral IR stakeholders are constantly fostering their capabilities and benefit

text: greatly from open-source tools and free commercial tools.

text: SECTORAL CSIRT CAPABILITIES 3.5 KEY FINDING #5 – SECTORAL IR MATURITY DEVELOPMENT

text: Though IR stakeholders did not request specific guidance when developing their capabilities, they tended to use dedicated tools made available by EU authorities, regulators and national CSIRTs.

text: According to the survey, a majority of CSIRTs, whether national CSIRTs, national sectoral CSIRTs or OES CSIRTs, did not seek any specific support or guidance from external stakeholders to design and implement sectoral IR capacities.

text: Figure 5: Specific information exchange tools used for notification

text: Even if they don’t directly ask for support, they all tend to leverage the guidelines, tools and know-how made available by EU authorities, regulators or other national CSIRTs.

text: As an example, 60% of respondents use specific CSIRT maturity assessment methodologies to support the development of IR Capabilities in their sector. 70% out of these use both the 22 23 ENISA CSIRT Maturity assessment and SIM3 . Both methodologies are seen as valuable tools to enhance the maturation of CSIRTs.

text: SECTORAL CSIRT CAPABILITIES

text: Figure 6: CSIRT maturity Assessment methodology used

text: Together with National CSIRTs, regulators and professional associations are key enablers for capability development for the Energy and Air Transport Sectoral CSIRTs as well as OES CSIRTs. Several initiatives were recently implemented at sectoral level to foster these capacities, some by sectoral operators themselves.

text: A noteworthy initiative in the energy sector is the 2019 launch of a cyber range dedicated to electricity operators. The German energy company Innogy opened its “CyberRange-e” training centre. The cyber range “allows up to 12 network and IT specialists at a time to practice how to manage cyberattacks under real-life electricity grid conditions, including wargame methods, pitching the participants against real hackers” . According to Professor Andreas Pinkwart, Minister for Economic Affairs, Digitisation, Innovation and Energy of the State of North Rhine-Westphalia, this facility addresses the need to better protect and safeguard data, procedures and processes in the energy industry.

text: At European level, sectoral regulators are also developing initiatives to enhance sectoral stakeholders’ incident response capabilities. As an example, the Council of European Energy Regulators offered a dedicated training on cybersecurity and the protection of the European energy sector back in 2016.

text: At national level, many ministries, National Cybersecurity Agencies or National CSIRTs provide different support tools and initiatives to sectoral actors.

text: SECTORAL CSIRT CAPABILITIES

text: Figure 7: Resources in place to support IRC development

text: The NIS Cooperation Group identified multiple examples in their “Sectorial implementation of the NIS Directive in the Energy sector” report as illustrated below:

text: Table 8: Case Study - 9 Member States initiatives to support Energy Sector operators with their cybersecurity capacity-building

text: Member State Initiative

text: SECTORAL CSIRT CAPABILITIES

text: Member State Initiative

text: Some sectoral CSIRTs also look for support from non-EU actors and tend to reach out to national cybersecurity and sectoral authorities from third countries. As an example, the Romanian Civil Aeronautical Authority (RO CAA) CSIRT (CERT-AV-RO) used:

text:  MITRE Corporation ;  The NIST Cybersecurity Framework ;  The Australian Cyber Security Centre;  The United Kingdom Civil Aviation Authority and the UK National Cyber Security Centre (NCSC);  The Centre for Internet Security (CIS) Best Practices based on “CIS Controls” and “CIS Benchmarks” .

text:  Summary: ENISA and other EU institutions and stakeholders should continue their efforts to support capacity development across the European IR community by facilitating open access to resources and tools for operational stakeholders.

text: SECTORAL CSIRT CAPABILITIES 3.6 KEY FINDING #6 – SECTORAL CSIRTS CHALLENGES AND GAPS 1/2

text: Sectoral CSIRTs in both air transport and energy sectors face a similar challenge, i.e. the overlap of multiple legislations and increasing time spent on compliance issues.

text: Both Air Transport and Energy operators share common specificities and similar challenges when it comes to incident response. Both sectors are considered to be the backbones of societies to such extent that any disruption could have a major impact on populations and economies. Shared specificities are:

text:  Complex ecosystems with large supply chains: both sectors count a wide variety of public and private-sector actors, ranging from government, regulators and professional associations to large industries, critical SMEs and digital service providers;

text:  Infrastructure interdependencies: both sectors have infrastructures strongly interconnected to others across the European Union and beyond. This can potentially lead to a cascading effect, and could result, in case of one system targeted, in all others being compromised. As an example, a gas pipeline can run through several countries, and an airport infrastructure is a commercial hub for essential products in a country.

text:  Legacy systems and lack of security-by-design: both sectors are composed of basic infrastructure elements (e.g.: transformers and generators in the Energy sector), all designed and built much before cybersecurity became an issue, and of more recent equipment used for automation and control, and increasingly dependent on ICT.

text:  Real-time requirements and 24h coverage: In both the Energy sector and Air Transport, several cybersecurity measures would be challenging to implement in real-time such as 24/7 monitoring coverage or systems shut down. This is particularly true for infrastructures that cannot be easily shut down given the prohibitive operational costs (financial and for users) associated with such a measure.

text: Because of these specificities, sectoral incident response stakeholders in both the Air transport and Energy sectors face common challenges.

text: One of the most common challenges raised by sectoral stakeholders, and common to all sectors and impacting the entire cybersecurity community, is how to deal and comply with the multiplication of requirements from national/EU authorities and sectoral actors (professional association and regulators).

text: “There is a high need for sync[hronisation] between EU regulatory bodies, regarding the harmonisation between the general cybersecurity regulation (i.e. NIS Directive) and the special/ specific cybersecurity requirements of each of the industries. Some of the industrial entities (which are defined specifically as under the NIS Directive jurisdiction, e.g. OES) refuse to respect the NIS Directive and the transposed national legislation, motivating that they are only under the jurisdiction of the special legislation. NIS Directive and special legislation shall complement each other, creating a framework of common base [and] complementary regulatory provisions.” (Air Transport Sectoral CSIRT)

text: SECTORAL CSIRT CAPABILITIES

text: The European Banking Federation points to an interesting example of competing cyberincident reporting schemes to be applied in the European Union.

text: Figure 8: Main Incident Reporting Schemes in the EU (Source: EBF)

text: As illustrated, for specific cyber-incidents involving a data breach, both Energy and Air Transport stakeholders could apply at least three common EU cross-industry regulations (namely the NIS Directive, the GDPR, the e-IDAS Regulation) along with the National reporting regulation in place in their countries.

text: In Air Transport sector, several actors lead different activities related to cybersecurity. EUROCONTROL is currently the only one receiving direct information on incidents in ATM systems, leaving other activities focusing more in collaboration. An effort towards a coordinated common vision is required.

text: The multiplication of security and reporting requirements pushes operational actors to spend time updating their procedures to stay compliant. While costly for all, this can be particularly tough for smaller entities with less resources available to ensure compliance.

text: “The efforts that we consume for the justification of the cybersecurity realities in front of the financial control authorities’ overpass, often, the efforts for the actual development and implementation of the domain. This is a critical issue, keeping the entire development process to the ground.” (Sectoral CSIRT).

text: Sectoral stakeholders have called for a harmonisation of security regulation as a mitigation action meant to leverage revision processes. DG ENER, for instance, created a stream for private actors in the NIS revision process. At the same time, Air Transport stakeholders are continuously exchanging with regulators to share their operational requirements and input.

text:  Summary: The upcoming revisions of the NIS Directive and GDPR could be an opportunity to harmonise legislation by considering sectoral stakeholders’ feedback.

text: SECTORAL CSIRT CAPABILITIES 3.7 KEY FINDING #7 – SECTORAL CSIRTS CHALLENGES AND GAPS 2/2

text: Sectoral CSIRTs in both the air transport and energy sectors face a common challenge in formally and rapidly share ex-ante information in a particularly tense context

text: Energy and Air Transport stakeholders are well aware of the need to enhance informationsharing at sectoral level, yet they share a common difficulty in rapidly sharing ex-ante information. According to sectoral stakeholders, incident response community fora are useful to promote discussion among stakeholders but are rarely used to exchange real-time technical information about vulnerabilities and threats.

text: “There should be a wider dissemination of both technical and non-technical information

text: related to incidents across the EU.” (OES CSIRT)

text: All survey respondents use various international, European, national and sectoral groups and fora (ENISA CSIRTs Network, the FIRST Community, National inter-CSIRTs Network, etc.) to exchange information and best practices. Yet they tend to rely on mastered tools, such as private MISP instances, or mass communication tools tweaked for a specific use, such as WhatsApp, to exchange operational or real-time information with peers in an informal way.

text: Both Energy and Air transport sectors include a multiplicity of actors and have a very wide surface of exposure to attacks. Incident response is therefore even more challenging and requires in-depth expertise and important capabilities to successfully ensure 24/7 coverage and rapidly share information about cyber threats.

text: “[There is a need for] setting up fast channels of information exchange on cybersecurity

text: “There is a need

text: threats” (Sectoral Ministry)

text: for setting up fast channels of

text: A recurrent explanation is that stakeholders prefer to share ex-post rather than ex-ante information to avoid reputational and commercial damages. information

text: exchange on

text: To mitigate this, stakeholders confirm that dedicated sectoral fora are beneficial for cybersecurity information-sharing. Within those fora, information is sector-focused, up-to-date and

text: threats.”

text: exchanges are often made real time. Participants are more encouraged to share information

text: (Sectoral Ministry)

text: with peers from the same sector as they use the same tools. They also rely on similar infrastructure and face similar threats.

text: Several sectoral initiatives can provide interesting good practices and lessons learnt, such as 32 33 34 the Energy ISAC , the Health ISAC , the Aviation ISAC or the Energy Community of Users that the European Cybersecurity Community is currently developing.

text: Sectoral ISACs are seen a “useful mechanism” and a trusted place to share operational information with peers. As such, they should be better recognised. Certain tools such as MISP or automated solutions could be explored to enhance information-sharing.

text:  Summary: Sectoral communities of users constitute a key tool to enhance operational information-sharing. Besides, the use of automation should be explored.

text: SECTORAL CSIRT CAPABILITIES 3.8 KEY FINDING #8 – SECTORAL CSIRTS LESSONS LEARNT

text: Though ongoing programmes and information-sharing initiatives have successfully supported IRC developments in both sectors, there is still a strong demand for more frameworks, guidance and know-how

text: Existing capacity-building initiatives implemented at both national and European level are very useful for Incident Response stakeholders. Such initiatives help IR stakeholders to foster CSIRT development in both the Energy and Air Transport sectors.

text: Stakeholders who participated in the survey pointed to several successful initiatives such as:

text:  the CEF programme,  ENISA guidelines,  the CSIRTs Network,  EU ISACs,  National CSIRTs tools,  Regulators and European Sectoral CSIRTs Guidelines, etc.

text: According to a National CSIRT, its ultimate objective is for sectoral operators “to be autonomous in incident response”. As a result, it focuses on anticipation and prevention on the one hand and building resilience of its constituency on the other, by training personnel, providing robust tools and certifying DSPs. This goal is shared by several National and Sectoral CSIRTs all keen to foster their effort to support capacity-building at sectoral level.

text: A number of these initiatives are public, and therefore highly dependent on public budgets, whether national or European. The ongoing COVID-19 pandemic and the dramatic economic crisis in its wake massively impact public budgets and the resources available for such initiatives.

text: The Air Transport sector continues to suffer from the impact of the pandemic, with air traffic drastically reduced and offices closing all over the world. Contingency planning does not always feature cybersecurity to the extent it should, increasing the threat to millions working remotely, using less secure networks and thus increasing their exposure to cyber threats.

text: For many Air Transport and Energy sectoral operators, the pandemic has led to temporary and permanent job and wage cuts and staff reallocation. This in turn challenges the upkeep of organisations’ security cultures and incident response capabilities. Even if they are critical, cybersecurity teams have also suffered from job cuts and tense environments. This could have severe consequences on cybersecurity in the long run, making the strengthening of IR capabilities even more important than ever.

text: Several measures could be taken by European institutions to keep up their ongoing efforts to enhance Sectoral IR capacity-building:

text:  Measures to foster cross-sector and cross-border cooperation for incident management;  IR sector-specific knowledge for public stakeholders as they face competition with the private sector;  Additional guidelines and reviews on new tools and equipment to assist IR teams in selecting appropriate IR tools;

text: SECTORAL CSIRT CAPABILITIES

text:  More training and drills.  Summary No-one doubts that the support provided by European institutions and professional associations is beneficial to the whole sectoral IR community in a particularly tense context fuelled by the COVID-19 pandemic.

text: SECTORAL CSIRT CAPABILITIES

text: 4. RECOMMENDATIONS

text: This study is intended as a snapshot of the current situation. The data collected indicates that it is still too soon to formulate sector specific recommendations. As a result, the following recommendations are general rather than sector specific.

text: Sectoral actors should encourage the sharing of lessons learnt on the use of openaccess or commercial tools, especially those automated within their sector to better benefit from each other’s experience and accelerate the maturation of newly created IR entities.

text: Sectoral actors should continue to identify overlaps, systematically raise awareness of challenges in cybersecurity regulations and cooperate with policy makers to address these issues by being involved in their revision processes.

text: Sectoral actors should continue their efforts to make use of existing reporting schemes such as NISD repostign and build trusted sectoral communities of users where they could securely exchange both ex-ante and ex-post incident information leveraging existing tools and automated solutions.

text: SECTORAL CSIRT CAPABILITIES

text: 5. BIBLIOGRAPHY

text: Avionics International, Will today’s cybersecurity guidelines and standards become mandates for connected aircraft systems? April 2020 ECSO, Position paper European Sector-Specific ISACs, European Cyber Security Organisation, December 2018 ECSO, Energy network and smart grids. Cyber security for the energy sector, European Cyber Security Organisation, November 2018 ECSO, Transportation sector report - Cyber security for road, rail, air, and sea, European Cyber Security Organisation, March 2020 ECSP, Strategy for Cybersescurity in Aviation, European Strategic Coordination Platform, September 2019 EECSP, Cyber Security in the Energy Sector. Recommendations for the European Commission, Energy Expert Cyber Security Platform, February 2017 ENISA, Maturity Evaluation Methodology for CSIRTs, European Union Agency for Network and Information Security, 2019 ENISA, Power sector dependency on time service, European Union Agency for Network and Information Security, April 2020 ENISA, Strategies for Incident Response and Cyber Crisis Cooperation, European Union Agency for Network and Information Security, 2016 IATA, Aviation Cyber Security Toolkit, Kossena, M., Cyber security in air transportation, May 2019 KPMG, Complying with the European NIS Directive. Cybersecurity for critical infrastructures, KPMG, April 2019 Norton, R. F., Cybersecurity law in the aviation sector, August 2019 PA Consulting, Overcome the silent threat - building cyber resilience in airports,

text: WEBSITES AND ONLINE PUBLICATIONS:

text: ANSSI, “The French CIIP Framework”, 2019. [Online]. Available: https://www.ssi.gouv.fr/en/cybersecurity-in-france/ciip-in-france/ CERT-BE, “Report an incident”, 2019. [Online]. Available: https://www.cert.be/en/report-incident CERT-BE, “Traffic Light Protocol (TLP)”, 2019. [Online]. Available: https://www.cert.be/en/traffic-light-protocol-tlp

text: SECTORAL CSIRT CAPABILITIES

text: CIRCL, “Training and Technical Courses”, 2018. [Online]. Available: https://www.circl.lu/services/training/

text: CNCS, “CERT.PT”, 2019. [Online]. Available: https://www.cncs.gov.pt/en/certpt_en/

text: CSIRT-DSP, “Duty to report incidents for digital service providers”, 2019. [Online]. Available: https://csirtdsp.nl/en/node/1

text: CSIRTs Network, ENISA online directory Available: https://csirtsnetwork.eu

text: EASA, “Krakow Declaration”, November 2016, [Online] Available: https://www.easa.europa.eu/sites/default/files/dfu/DECLARATION-Krakow- Cybersecurity.pdf

text: ECS, Position Paper “European Sector-Specific ISACs”, 2018. [Online]. Available: https://ecs-org.eu/documents/publications/5c0a6a3aac673.pdf

text: ENISA, “History”, 2019. [Online]. Available: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/baselinecapabilities

text: EUR-Lex, “The Directive on security of network and information systems (NIS Directive)”, 2016. [Online]. Available: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: FIRST, “FIRST CSIRT Framework”, 2020. [Online]. Available: https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1

text: GitHub, “CERT Tools”, 2019. [Online]. Available: https://github.com/certtools/

text: GitHub, “Digital Forensics and Incident Response (DFIR) Resources”, 2019. [Online]. Available: https://github.com/The-Art-of-Hacking/h4cker/tree/master/dfir

text: GPPi, New America, “National CSIRTs and Their Role in Computer Security Incident Response”, 2015. [Online]. Available: http://www.digitaldebates.org/fileadmin/media/cyber/National_CSIRTs_and_Their_Role_in_C omputer_Security_Incident_Response__November_2015_-- _Morgus__Skierka__Hohmann__Maurer.pdf

text: IATA, Aviation Cyber Security Toolkit Available: https://www.iata.org/en/publications/store/aviation-cyber-security-toolkit/

text: Industrial Cybersecurity Center, “The center”, 2019. [Online]. Available: https://www.cci-es.org/en/mision

text: ITU/BDT, “Cyber Security Programme: Global Cybersecurity Index (GCI)”, 2018. [Online].

text: SECTORAL CSIRT CAPABILITIES

text: Available: https://www.itu.int/en/ITUD/Cybersecurity/Documents/GCIv3_documents/GCI%20V3%20Ref erence%20model.pdf

text: MISP Threat Sharing, “Features of MISP, the open source threat sharing platform”, Date [Online]. Available: https://www.misp-project.org/features.html

text: NCSC, “CiSP”. https://www.ncsc.gov.uk/section/keep-up-to-date/cisp Available: https://www.ncsc.gov.uk/section/keep-up-to-date/cisp

text: NCSC, “CSIRT Maturity Toolkit”, 2018. [Online]. Available: https://english.ncsc.nl/get-to-work/cooperation/i-would-like-to-strengthen-mycollaboration/csirt-maturity-toolkit

text: Open CSIRT Foundation, “SIM3 and references “. [Online]. Available: https://opencsirt.org

text: SGDSN, “La sécurité des activités d’importance vitale”, 2016. [Online]. Available: http://www.sgdsn.gouv.fr/uploads/2016/10/plaquette-saiv.pdf

text: SECTORAL CSIRT CAPABILITIES

text: A ANNEX: PRESENTATION OF THE RAW DATA

text: DESKTOP RESEARCH – SECTORAL IR SET-UP

text: The objective of the desktop research was to identify those Incident Response (IR) actors and bodies playing a role in NISD sectors across the EU Member States.

text: This comprehensive analysis also focused on the distribution of responsibilities to present draft hypotheses on the emergence of new actors following the publication of the NIS Directive.

text: Data structuring and classification criteria

text: The raw data gathered during the study was consolidated in an Excel table. It was first organised by Member States.

text: In addition to Member State classification, it was decided tthat the the scope of the research would be extended to sectoral IR Capabilities in non-EU countries to provide insight into approaches of neighbouring countries, namely Albania, Bosnia-Herzegovina, Georgia, Iceland, Kosovo, Moldova, Montenegro, North Macedonia, Norway, Ukraine, the United Kingdom, Serbia and Switzerland.

text: For each country, the following information was initially provided (where available):

text:  Summary of national approach to IR in the NISD sectors  Incident Response general set-up o NISD Sectors o Competent authorities; o Existing/newly created CSIRT or IR entities; o Role and list of OES; o Role of DSP.  Cooperation set-up & processes o Cross-border IR aspects.  Development of capabilities and other initiatives o Operational preparedness and capacities; o Tools; o Initiatives, communities, etc.

text: Then, the list of existing and newly created CSIRT and IR entities was extracted to build a separate consolidated table.

text: For each entity, the following information was provided (where available):

text:  CSIRT/IR entity name  Sector (energy /air transport / cross-sector national CSIRT)  Country

text: SECTORAL CSIRT CAPABILITIES

text:  Type (public/private)  Description & mandate  Status (existing / to be created)  Cooperation set-up & processes o Cross-border IR aspects.  Development of capabilities and other initiatives o Operational Preparedness and capacities; o Tools; o Initiatives, communities, etc.

text: OVERVIEW OF THE SECTORAL IR SET-UP IN THE 27 MEMBER STATES AND A SELECTION OF NON-EU COUNTRIES

text: Desktop research – key figures

text: Table 9: Desktop research – Data collection overview

text: SURVEY AND INTERVIEWS – IR APPROACH AND SECTORAL CAPABILITIES

text: The objective of the survey and of the complementary interviews was to bridge information gaps in the desktop research and gain deeper insight into IR set-up in the 27 Member States.

text: These activities also focused on the recent changes and evolutions of Sectoral IRC. They were designed to also improve the knowledge on sectoral CSIRTs processes, procedures and tools following the publication of the NIS Directive.

text: SURVEY - DATA STRUCTURING AND CLASSIFICATION CRITERIA

text: The raw data gathered from the survey was consolidated in an Excel table.

text: The table was structured around the answers of each respondent according to the questions of the survey (see B Annex Survey – questionnaire (p. 48)).

text: SECTORAL CSIRT CAPABILITIES OVERVIEW OF THE SECTORAL IR SET-UP IN THE 27 EU MEMBER STATES

text: Survey - Key figures

text: The data collection relies on 20 responses from 13 EU Member States. It also includes the answer from an Air Transport organisation very active in the areaof cybersecurity and IR at EU level.

text: Figure 9: Respondents by countries

text: 20 respondents from 13 EU MS:

text: Half of respondents were national CSIRTs with IR teams ranging from 2 to 25 people (fulltime equivalents).

text: SECTORAL CSIRT CAPABILITIES

text: Figure 10: Respondents by entity

text: Figure 11: Respondents by sectors

text: COMPLEMENTARY INTERVIEWS – RATIONALE AND KEY FIGURES

text: The main objective of the interviews was to collect additional information and insights into IR set-up, along with qualitative assessments of recent changes and considering the impact of the NISD. After reviewing initial survey results, complementary interviews took placewith:  Sectoral cybersecurity experts;  Members of the Informal Expert Group on Incident response Capabilities.

text: SECTORAL CSIRT CAPABILITIES

text: B ANNEX: SURVEY – QUESTIONNAIRE

text: ABOUT YOUR ORGANISATION

text: Name: ……………………………………………………………………. Incident Response Team Full Time Employees: ………………………  What type of organisation are you? National CSIRT Government or Military CSIRT Regulatory organisation, body or Ministry Sectoral CSIRT OES Incident Response Team  Please select relevant sector or sub-sector Energy Electricity Oil Gas Air Transport Air carriers Airport managing bodies Traffic management control operators Other. Please specify: ………………………………………

text: Comments

text: SECTORAL CSIRT CAPABILITIES

text: 1. What are the services and associated functions provided by the sectoral CSIRTs or sector-specific IR capabilities in your sector ?

text: Service Area 1 – Information security event management Service Area 3 - Vulnerability management

text: Monitoring and detection Vulnerability discovery / research

text: o Log and sensor management o IR vulnerability discovery o Detection use case management o Public source vulnerability discovery o Contextual data management o Vulnerability research

text: Event analysis Vulnerability report intake

text: o Correlation o Vulnerability report receipt o Qualification o Vulnerability report triage & processing

text: Service Area 2 - Information security incident management Vulnerability analysis

text: Information security incident report acceptance o Vulnerability triage o Vulnerability root cause analysis o Information security incident report receipt o Vulnerability remediation development o Information security incident triage and processing

text: Vulnerability coordination Information security incident analysis o Vulnerability notification/reporting o Information security incident triage o Vulnerability stakeholder coordination o Information collection o Detailed analysis coordination Vulnerability disclosure o Information security incident root cause analysis o Cross-incident correlation o Vulnerability disclosure policy & infrastructure maintenance Artifact and forensic evidence analysis o Vulnerability announcement / communication o Media or surface analysis o Post-vulnerability disclosure feedback o Reverse engineering o Run Time or dynamic analysis Vulnerability response o Comparative analysis o Vulnerability detection/scanning Mitigation and recovery o Vulnerability remediation

text: o Response plan established o Ad-hoc measures and containment Service area 4 – Situational awereness o System restoration Data acquisition o Other information security entities support

text: o Policy aggregation, distillation, and Information security incident coordination guidance o Asset mapping to functions, roles, o Communication actions and key risks o Notification distribution o Collection o Relevant information distribution o Data processing and preparation o Activities coordination o Reporting Analysis and synthesis o Media communication

text: o Projection and inference Crisis management support o Event detection o Information security incident o Information distribution to constituents management decision support o Information security status reporting o Situational impact o Strategic decisions communication

text: SECTORAL CSIRT CAPABILITIES

text: Communication Exercises

text: o Internal and external communication o Requirements analysis o Reporting and recommendations o Format and environment development o Implementation o Scenario development o Dissemination / integration / information sharing o Exercise execution o Management of information sharing o Exercise outcome review o Feedback Technical and policy advisory

text: Service area 5 – Knowledge transfer

text: o Risk management support Awareness building o Business continuity and disaster recovery planning support o Research & information aggregation o Policy support o Reports and awareness materials developed o Technical advice o Information dissemination o Outreach

text: Training & Education

text: o Knowledge, skill, and ability requirements gathering o Educational and training materials development o Content delivery o Mentoring o CSIRT staff professional development

text: Comments

text: SECTORAL CSIRT CAPABILITIES 1. CREATION OF SECTORAL CSIRT/IR CAPABILITIES

text: 2. Which of the following sectors have (or will have) a dedicated CSIRT in your country? If yes, please specify in the comment box for each sector if the CSIRT status : exists, under creation, creation process is to be launched in 2020 or 2021, plans in the coming years, no plans yet.

text: Energy Electricity Oil Gas Air Transport Other. Please specify: Comments (please specify if the CSIRT is/are listed,

text: accredited, certified.

text: 3. What are the key drivers to create such sector specific IR capacities?

text: The implementation of the NIS Directive The lack of sector-specific knowledge or capacity of the National CSIRT Lessons learnt from past incidents The difficulties in managing the cybersecurity incidents in the NISD sectors The complexity of managing the high number of OES in some of the NISD sectors The need to facilitate incident handling cross-borders Other. Please: specify: ………………………………………………………………………………

text: 4. In your opinion, what are the additional and/or new services, roles or functions of the sectoral CSIRTs in contrast to those supplied but the national, governmental or military CSIRT?

text: Comments

text: 5. In your opinion, what are the specific services, roles or functions of the sectoral CSIRTs in contrast to those supplied but the national, governmental or military CSIRT?

text: Comments

text: SECTORAL CSIRT CAPABILITIES

text: 6. Based on your experience, what are the key factors facilitating the development of sectoral CSIRTs and/or IR capacities?

text: The lessons learnt from past incidents The establishment of sector-specific regulations clarifying the security requirements and responsibilities Recommendations from a previous audit and certification programmes Requests from stakeholders or participating organisations/future members The establishment of cooperation agreements between national and sectoral actors Access to funding and support of IR capability development through the Connecting European Facility (CEF) programme or other fundings The establishment of public-private partnerships. Please specify the nature of these PPPs: ……………………………………………….……………………………………………….……… The dissemination of threat intelligence, exchange of good practices and lessons learnt Other. Please specify: ……………………………….……………………………………………….…………………………

text: Comments

text: 7. What specific resources and tools are in place to support the development of constituents’ incident response capabilities (IRC) in your sector?

text: Appointment of local or sectoral counsellors advising OES on the development of their IRC Training and Education activities A network of IR actors at a national or sectoral level to exchange good practices about information exchange, capabilities, cooperation etc. Methodological baselines and tools to support IR (e.g.: specific software tools, risk assessment methodologies, best practices, frameworks) Shared framework for incident classification and threat modelling Certification by cybersecurity companies providing reliable services and products Other. Please specify

text: Comments

text: SECTORAL CSIRT CAPABILITIES

text: 8. Do you need / have you asked or looked for any specific support or guidance from external stakeholders to design and implement sectoral IR capacities?

text: Yes No

text: If yes, please specify from who:

text: European Union entities Professional associations or industry players International authorities CSIRT communities/peers National authorities Other

text: Comments

text: 9. Do you use to a specific CSIRT maturity assessment methodology to support the development of IR capabilities within your sector(s)?

text: Yes No

text: 10. If yes, which one?

text: SIM3 (Security Incident Management Maturity Model) ENISA CSIRT maturity assessment Your national CSIRT maturity tool A CSIRT maturity assessment methodology from the private sector (please specify in comments) Other (please specify in comments)

text: Comments

text: SECTORAL CSIRT CAPABILITIES 11. IR CAPABILITY DEVELOPMENT IN THE SECTORS

text: 12. Which specific tools does your organisation rely on to conduct the following services?

text: Tools status: Tools used & supporting Service area and Services Tool in service/ planning to implement one/out of procedures/SOPs/ scope or perimeter Playbooks

text: 13. Do you have standard operating procedures (SOPs) that OES’ teams should follow in case of incident?

text: Yes No

text: If yes, please detail for which services or functions?

text: SECTORAL CSIRT CAPABILITIES

text: 14. Do you use an incident notification template?

text: Yes No

text: If Yes, who has (or will have) access to the notification template? constituents, participating

text: organizations, LEA, third-party organizations, CSIRT peers? ……………………………

text: If yes, please indicate the nature of the information reported.

text: Description of the incident and IOCs and TTPs Root cause Services affected Severity Cross border impact Lessons learnt Indicators to measure the nature and impact in addition to those of the NISD. Current situation of the incident (actions taken or needed, investigation status etc.) Other……………

text: Comments

text: 15. Do you have specific information exchange tools to enable the notification of incidents?

text: Secure emails (e.g. PGP encrypted) MISP standard formats and technologies A special government secured network via an ISAC (Information Sharing and Analysis Center) Other. Please specify: …………………………………………………………………

text: 16. How do you ensure the uptake of these tools and procedures by constituents?

text: Obligation stipulated in legislature Code of conduct Promotion by national CSIRT Post-attack measures implemented by national CSIRT Other (specify below)

text: Comments

text: 17. IR COOPERATION AND OPERATIONAL MODELS WITHIN THE SECTORS

text: Cooperation with OES/Critical Infrastructure (in particular from the private sector)

text: 18. In case of incident, do you have:

text: Specific cooperation agreements between the national cybersecurity authorities and the IR teams of OES (in particular for private companies)

text: Specific consultation process involving OES’ incident response capabilities (in particular for private companies)?

text: SECTORAL CSIRT CAPABILITIES

text: Specific process allowing OES to request operational assistance from the national, governmental or military CSIRT

text: Specific process to share lessons learnt among national and sectoral CSIRT after a crisis (e.g.: after incident standard report, meetings etc.)

text: Comments

text: 19. What are the main challenges faced when collaborating with OES in the energy/air transport sectors?

text: Confidentiality issues Cross-border issues Commercial issues Regulatory issues GDPR-related issues Resources or expertise issues No 24/7 coverage / capabilities Supply chain management Lack of security culture among OES The management (and the security) of OES IT infrastructure is often outsourced Lack of established cooperation tools and channels with OES IR teams Cross-sector interdependencies and cooperation Other. Please specify: ……………………………………………………. Comments

text: Incident response in cross-border crisis situations

text: 20. Do you have specific procedures to address cross-border incidents within the sectors?

text: Yes, we have such procedures at a national level Yes, we have such procedures at a sectoral level Yes, indirect (through a trusted third-party Point-of-Contact such as governmental CSIRT, LEA...) No, but these are planned to be implemented No, it is not plan at the moment

text: Comments

text: SECTORAL CSIRT CAPABILITIES

text: 21. What is the nature of these procedures?

text: Bilateral agreement with the other MS. Designation of a Point of Contact at national or sectoral level to facilitate cross-border cooperation in case of incident Participation of representative of the other country in the crisis response process Organisation of cross-border exercises Information sharing platform (existing or about to be implemented) Other. Please specify: ……………………………………………………………….

text: 22. Do you have specific measures in place to inform the relevant actors (national authorities and OES) in neighbouring countries about an incident that may impact them?

text: Yes, direct Yes, indirect (through a PoC, a trusted third-party...) No, but it is planned to establish some No, it is not planned at the moment If yes, please specify

text: 23. What main barriers or difficulties do you face when developing cooperation procedures between national and sectoral IR actors?

text: Identifying and involving the relevant stakeholders The cross-border nature of the services, sectors and companies at stake Exchanging technical information about incident and risks Addressing the commercial issues of asking competitors to collaborate and share information about incidents affecting their business Common terminology, standards and formats Legal issues related to the nature of the information exchanged and different legislation (from one sector to another and/or from one country to another) GDPR-related issues LEA-related issues No 24/7 coverage / capabilities Other. Please specify: ……………………………….……………………………………………….………………………

text: SECTORAL CSIRT CAPABILITIES 24. GDPR COMPLIANCE AND DATA BREACH MANAGEMENT

text: 25. Do you have, in your team, an appointed “privacy champion”? If yes, can you detail his/her functions and tasks (full time/partial time, exclusively/partially dedicated to privacy, …?

text: Comments

text: 26. Did you receive awareness training in GDPR? If yes, can you describe the training policy: frequency, percentage of the team been trained, refresh, … If not, where can you receive guidance related to GDPR matters?

text: Comments

text: 27. Does your Incident Response Policy specify how to identify a Data Breach, as defined by the GDPR (

text: articles 33

text: & 34)?

text: Comments

text: 28. Does your Incident Response Management Process indicates the information of the DPO, or any other person or institution in charge of the privacy/GDPR compliance concerns?

text: Comments

text: 29. Do you have a forensics manual or guidelines to handle evidence related to a Personal Data Breach?

text: Comments

text: 30. LESSONS LEARNT AND RECOMMENDATIONS

text: 31. Do you use groups/forum to exchange with peers IR information, good practices and experience in your sector with peer?

text: Yes No

text: If yes, please specify

text: SECTORAL CSIRT CAPABILITIES

text: 32. What possible measures undertaken by European Union entities, ENISA, international or national authorities or bodies, or private body in a specific sector would help improve the effectiveness of sector IR capacities?

text: Comments

text: 33. What specific tools or processes in place in your organisation would help improve the effectiveness of sector IR capacities?

text: Comments

text: 34. Do you have any other inputs about your work / the IR capacities within the NISD sectors in your country you would like to share with us?

text: Comments

text: END OF QUESTIONNAIRE SECTORAL CSIRT CAPABILITIES

text: C ANNEX: FIGURES AND TABLES

text: LIST OF FIGURES

text: Figure 1: NISD sectors (Source ENISA) Figure 2: Overview of the methodology Figure 3: Drivers to create sector-specific IR Capacities Figure 4: Specific information exchange tools for notification of incidents Figure 5: Specific information exchange tools for notification Figure 6: CSIRT maturity Assessment methodology used Figure 7: Resources in place to support IRC development Figure 8: Main Incident Reporting Schemes in the EU (Source: EBF) Figure 9: Respondents by countries Figure 10: Respondents by entity Figure 11: Respondents by sectors

text: LIST OF TABLES

text: Table 1: Overview of all MS’ basic IR set-up in sectors (with available data collected) Table 2: Case Study – creation of the Austrian Energy CERT Table 3: Case Study - Bulgarian Cybersecurity Strategy Table 4: Case Study - CERT-AV-RO - Specific mandate and services compared with those the National CSIRT Table 5: Case Study - Future Belgian Sectoral CSIRTs - Specific tasks compared with those of the National CSIRT Table 6: Case Study - Commonly-used tools in service in both National and Sectoral CSIRTs, categorised by service area Table 7: Case Study - French National Cybersecurity Agency Notification Portal Table 8: Case Study - 9 Member States initiatives to support Energy Sector operators with their cybersecurity capacity-building Table 9: Desktop research – Data collection overview

text: -N -EN -822 -20 -03 TP ABOUT ENIS A The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. For more information, visit www.enisa.europa.eu.

text: ISBN 978-92-9204-444-2 DOI 10.2824/123795