text:  • Phishing  • Malware  Individual  • Information leakage Stable  • Data theft

text:  • Web application attacks

text:  • Web application attacks  Financial/Banking/ • Insider threat (unintentional abuse) 

text:  Insurance • Malware Stable  • Data theft

text:  • Malware • Insider threat (unintentional  Health/Medical  abuse/error) Increasing  • Web application attacks

text:  Education • Ransomware Stable slightly  • Web based attacks decreasing

text:  • Web application attacks Information and • Insider threat (unintentional 

text:  Communication abuse/error) Stable  • Malware

text:  • Web application attack Professional/Digit • Insider threat (unintentional 

text:  al Services abuse/error) Stable  • Malware

text:  Arts, • Web application attacks

text:  • Malware  • Web application attacks 

text: “April 2020 Cyber Attacks Statistics”. June 3, 2019. HACKMAGEDDON.

text: “Data Breach Investigation Report” 2019. Verizon.

text: “CIRCL - Operational Statistics” 2019. CIRCL. https://www.circl.lu/opendata/statistics/

text: “Survey: The Third Annual Study on the State of Endpoint Security Risk”. 2020.

text: “Good Practices for Security of IoT - Secure Software Development Lifecycle”. November 19,

text: 2019. ENISA. https://www.enisa.europa.eu/publications/good-practices-for-security-of-iot-1

text: “ENISA good practices for security of Smart Cars”. November 25, 2019.

text: The selected order of sectors has been performed by consolidating statistics from various

text: incident-based reports. It provides medial values for the reporting period (2019-Q1 2020) and may slightly deviate from values presented in monthly or quarterly reports.

text: “Player vs. Hacker: Cyberthreats to Gaming Companies and Gamers’. March 16, 2020. Security

text: Intelligence. https://securityintelligence.com/posts/player-vs-hacker-cyberthreats-to-gamingcompanies-and-gamers/

text: It is worth mentioning that the threat exposure has been assessed via detailed threat

text: categories that have been developed by ENISA (see https://www.enisa.europa.eu/topics/threatrisk-management/threats-and-trends/enisa-threat-landscape/threat-taxonomy/view) and is used for various sectorial assessments. Due to the absence of incident data for emerging sectors, the threat assessment goes at a greater detail to obtain a more exhaustive approach.

identifier: ENISA Threat Landscape 2020 - Sectoral/thematic threat analysis

nummer: sectoral-thematic-threat-analysis

title: ENISA Threat Landscape 2020 - Sectoral/thematic threat analysis

text: ENEN From January 2019 to April 2020

text: Sectoral/ thematic threat analysis

text: ENISA Threat Landscape

text: Overview

text: Apart from indicating adversaries’ motivations, it provides evidence about the most common attack techniques and threat exposure applying to a particular sector, thus indicate protection requirements and priorities. With respect to themes, the analysis of threats and challenges associated with specific emerging technologies contributes to the process of assessing, evaluating and mitigating future risks. Contextualised cyber threat intelligence (CTI) for sectors is an important preparedness tool for drawing conclusions on expected cyberattacks within a specific sector. _Sector incident statistics vs. assessed exposure of emerging sectors Contextualisation of sectoral CTI is mainly based on cybersecurity incidents encountered in a sector. Although this is a standard method for existing and established IT components and digital services, it does not cover emerging technologies. This is mainly because no incident information exists for technologies that are only at a pilot or experimental phase. CTI for emerging technologies is contextualised through threat assessments of asset categories pertinent to a specific sector. ENISA performs such 5 6 assessments for emerging sectors such as 5G, IoT and smart cars . Sectorial and thematic threat landscapes and assessments of baseline protection are the methods used by ENISA to contextualise CTI. In this report, besides sectorial CTI relying on incident-based statistics, we present a summary of assessed CTI for emerging technology sectors based on ENISA work.

text: “During the next decade, cybersecurity risks will become harder to assess and interpret due to the growing complexity of the threat landscape, adversarial ecosystem and expansion of the attack surface.”

text: in ETL 2020

text: Overview

text: _The urgent need for accurate and up-to-date sectoral incident statistics Sectoral incident statistics are an essential tool to understand the dynamics of threat evolution, adversaries’ motives, exposure of assets, and actions on objectives. Because of the complexity of attacks, dependencies among the assets targeted and the cross-sector nature of the abused vulnerabilities exploited, incidents statistics have some inherent uncertainties that emanate from the following facts.  In various sector statistics, we see a number of incidents classified as 1,2 ‘unknown’ . This percentage varies from 1,5% to 5%. If these incidents could be associated with some of the known sectors, this percentage could influence the order of targets. Moreover, the significant amount of unknown attack techniques (approximately 15%), add some uncertainty to the assessment of threat agents’ motives.  Most attacks take more than one-step (average three) to reach their objectives of the final target. In many cases, multiple targets from various sectors are involved in a single attack. Hence, an incident recorded within a sector may result from several incidents in other sectors that are intermediate steps in the attack. Such dependencies among incidents may affect the accuracy of incident statistics.  Apart from the number of incidents per sector, an important element for the statistical analysis is the nature of attack techniques used. This information may provide useful evidence about the most frequently used attack vector and can help contribute to prioritise necessary protective measures necessary for a particular sector.  The materialization of threats depends heavily on existing opportunities that are explored by adversaries. Because of the COVID-19 pandemic, for example, IT environments have become decentralized. This weakens the corporate security controls applied within a company’s network, which explains the shift in attacks from corporate targets to individual targets. This example is indicative of the need to ‘translate’ observed changes in statistics in the light of emerging opportunities.  Current statistics are developed with various criteria in mind. Variations in the criteria of statistics impede comparisons between incident statistics. For example:  Depending on the information collector’s stakeholders/contributors data base of the data about statistic may not cover all sectors evenly;  Classification of incidents may be based on their frequency of occurrence, irrespectively of the magnitude of the damage (e.g. size of breached information) or its impact.  An essential element of sectoral statistics is the frequency of occurrence of individual cyberthreats. This gives an impression of the most common attack method used in a sector. Such statistics may provide guidance on the required level of preparedness or maturity of individual security controls that reduce exposure to the relevant cyber threats.  Given the above facts pertinent to incident statistics, this report provides an approximate ranking of sectors in terms of observed incidents, together with a trend drawn from the emerging dynamics of the potential exposure of each sector. Moreover, some information on the most popular attack vectors per sector is also given. For this purpose, 1,2,3,4 information from various publications has been consolidated.

text: Trends in incidents

text: INCIDENTS SECTOR MOST POPULAR THREATS/ATTACKS TRENDS

text: Multiple industries • Phishing  Increasing • Malware

text: Public  • Malware Administration,   • Phishing Defence, Social Stable slightly  • Web based attack Services decreasing

text: Entertainment • Malware 8  Stable and gaming • Phishing

text: Manufacturing

text: • Insider threat (unintentional Stable  abuse/error)

text: SECTOR INFLUENCING FACTORS

text: Self-isolation due to COVID-19 lockdown measures has led to dispersed/ decentralized IT environments and isolation of users

text: Individual

text: who are easier to fool and have fewer security controls in place, than was the case in centralized environments.

text: Remote users due to COVID-19 lockdown measures have

text: Multiple

text: facilitated attacks via phishing and leakage of sensitive

text: industries

text: information (i.e. credentials).

text: Public Use of cloud services may have influenced the security of public Administration, offerings. Nonetheless, social services have received significant Defence, Social amount of attacks due to financial aids offered to citizens during Services COVID-19 pandemic.

text: The complexity of the financial sector makes it hard to interpret

text: Financial/

text: the threat landscape, as different domains within financial

text: Banking/

text: services and banking may face entirely different cyber risks and

text: Insurance

text: threats.

text: The attention paid by cybercriminals to health targets has Health/Medical increased considerable due to financial motives and the importance of the sector during COVID-19 pandemic.

text: Although stable, this sector has been targeted in 2020 by Education cyberespionage campaigns due to interest in COVID-19 research results.

text: This sector is constantly under pressure due to the difficulties in Information and protecting a huge attack surface, introduced by digital media Communication platforms. For online media organizations, attacks that cause reputational damage are one of the biggest threats.

text: Although stable, this sector has been targeted in 2020 by various

text: Professional/

text: campaigns in an attempt to leak information from users of digital

text: Digital Services

text: services teleworking from home during COVID-19 pandemic.

text: Arts, The change from a licensed to subscription business model Entertainment adopted by the gaming industry made this sector more attractive and gaming to cyber criminals.

text: Supply chain attacks and attacks to industrial control systems are the main threat to manufacturing companies since these are able

text: Manufacturing

text: to shut down a complete production line. The theft of intellectual property data is another serious threat to this sector.

text: Threats on emerging technologies

text: _ Next generation of mobile communications or 5G

text: RELATED COMPONENTS – THREAT EXPOSURE ASSET GROUPS

text: Abuse from remote access, Authentication traffic spikes, Abuse of user authentication/authorization data, Abuse of third party hosted network functions, Abuse of lawful interception function, Application programming interface (API) exploitation, Exploitation of poorly designed architecture and planning, Exploitation of misconfigured or poorly configured systems/networks, Erroneous use or administration of the network, systems and devices, Fraud scenarios related to Core Network roaming interconnections, Lateral movement, Memory scraping, Manipulation of network traffic, network reconnaissance and information gathering, Manipulation of network configuration data, Malicious flooding of core network components, Malicious diversion of traffic, Manipulation of the network resources orchestrator, Misuse of audit tools, Opportunistic and fraudulent usages of shared resources, Registration of malicious network functions, Traffic sniffing, Side-channel attacks

text: Abuse of spectrum resources, Address Resolution Protocol (ARP) poisoning, Fake access network node, Flooding attack, IMSI catching attacks, Jamming the radio frequency, MAC

text: Access Network

text: spoofing, Manipulation of access network configuration data, Radio interference, Radio traffic manipulation, Session hijacking, Signalling fraud, Signalling storms

text: False or rogue MEC gateway, Edge node overload, Abuse of

text: Multi Edge Computing

text: edge open application programming interfaces (APIs)

text: Virtualisation of

text: Abuse on Data Centres Interconnect (DCI) protocol, Abuse of

text: Network Functions

text: cloud computational resources, Network virtualisation

text: and Software Defined

text: bypassing, Virtualised host abuse

text: Networks

text: Manipulation of hardware equipment, Natural disasters affecting the network infrastructure, Physical Physical sabotage/vandalism of the network infrastructure, Threat Infrastructure from third parties’ personnel accessing MNO’s facilities, Universal Integrated Circuit Card (UICC) format exploitation, User equipment compromising

text: Denial of Service (DoS), Data breach, leak, theft destruction and manipulation of information, Eavesdropping, Exploitation of software and hardware vulnerabilities, Malicious code or

text: All above 5G asset

text: software, Compromised supply chain, vendor and service

text: groups

text: providers, Targeted threats/attacks, Exploiting flaws in security, management and operational procedures, Abuse of authentication, Identity theft or spoofing

text: Threats on emerging technologies

text: _ Internet-of-things (IoT)

text: Insider threat, Teamwork issues, Internal limitations, Hacktivism, Loss of support services, Utility outage, Network outage, Unintentional modifications, Sabotage, Violation of Human factor rules and regulations, Breach of legislation, Contract Requirements, Failure to meet contractual requirements (e.g. software maintenance), Software exploitation, Social engineering, Identity theft. Insider threat, Hacktivism, Unintentional modifications, Erroneous use or administration of devices and systems, Sabotage, SDLC process failures, Third party failures, Failure

text: Software design

text: to meet contractual requirements (e.g. software maintenance), Software exploitation, Loss/leakage of information. Insider threat, Hacktivism, Loss of support services, Unintentional modifications, Erroneous use or administration of devices and systems, Sabotage, Vandalism and theft,

text: Software

text: Software vulnerabilities, SDLC process failures, Maintenance

text: development

text: failures, Abuse of authorisation, Software exploitation, Manipulation of SDLC infrastructure, Loss/leakage of information. Insider threat, Hacktivism, Loss of support services, Unintentional modifications, Erroneous use or administration of devices and systems, Sabotage, Vandalism and theft, Software Software vulnerabilities, SDLC process failures, Third party deployment failures, Abuse of authorisation, Software exploitation, Manipulation of SDLC infrastructure, Denial of Service, Manipulation of information, Disclosure, Loss/leakage of information.

text: Insider threat, Hacktivism, Loss of support services, Unintentional modifications, Erroneous use or administration of devices and systems, Sabotage, Vandalism and theft, Software Data vulnerabilities, SDLC process failures, Third party failures, Abuse of authorisation, Software exploitation, Manipulation of SDLC infrastructure, Denial of Service, Manipulation of information, Disclosure, Loss/leakage of information.

text: Insider threat, Hacktivism, Utility outage, Network outage, Unintentional modifications, Erroneous use or administration of devices and systems, Damage caused by a 3rd party, Sabotage, Vandalism and theft, Attacks with physical access, Forced Access, Contract Requirements, Software vulnerabilities, SDLC Maintenance process failures, Third party failures, Failure to meet contractual requirements (e.g. software maintenance), Maintenance failures, Abuse of authorisation, Software exploitation, Manipulation of SDLC infrastructure, Denial of Service, Manipulation of information, Disclosure, Loss/leakage of information

text: Insider threat, Hacktivism, Loss of support services, Unintentional modifications, Erroneous use or administration of devices and systems, Damage caused by a 3rd party, Information leakage, Sabotage, Vandalism and theft, Attacks with physical access, Forced Access, Contract Requirements,

text: Software

text: Software vulnerabilities, SDLC process failures, Third party

text: components

text: Threats on emerging technologies

text: _ Smart cars

text: Denial of Service,Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, , Threats targeting autonomous sensors, Threats against AI and ML, Sabotage, Vandalism, Theft, Side-channel attacks, Fault injection, Theft, Failure or malfunction of a sensor/actuator, Car sensors and Software vulnerabilities exploitation, Communication protocol actuators hijacking, Man-in-the-middle attack / Session hijacking, Unintentional change of data or car components configuration, Using information and/or devices from an unreliable source, Erroneous use of configuration of car components, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data.

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, , Manipulation of information, Threats Decision Making against AI and ML, Sabotage, Vandalism, Theft, Theft, Failure or

text: Algorithms

text: malfunction of a sensor/actuator, Software vulnerabilities Car ECUs, processing exploitation, Failure or disruption of service, Communication and decision making protocol hijacking, Data replay, Man-in-the-middle attack /

text: components

text: Session hijacking, Unintentional change of data or car

text: Smart cars

text: components configuration, Using information and/or devices

text: Infrastructure and

text: Backend systems from an unreliable source, Erroneous use of configuration of car components, Loss of GNSS signal, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Threats targeting autonomous sensors, Threats against AI and ML, Sabotage, Side- Vehicle Functions channel attacks, Fault injection, Theft, Failure or malfunction of a Car sensors and sensor/actuator, Software vulnerabilities exploitation, Failure or

text: actuators

text: disruption of service, Communication protocol hijacking, Data

text: Car ECUs,

text: replay, Man-in-the-middle attack / Session hijacking,

text: processing and

text: decision making Unintentional change of data or car components configuration, components Using information and/or devices from an unreliable source, Erroneous use of configuration of car components, Car depleted battery, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data

text: Software

text: authorisations, Sabotage, Side-channel attacks, Fault injection,

text: management

text: Theft, Failure or malfunction of a sensor/actuator, Software

text: Car ECUs,

text: processing and vulnerabilities exploitation, Failure or disruption of service, decision making Communication protocol hijacking, Man-in-the-middle attack / components Session hijacking, Unintentional change of data or car

text: In-vehicle

text: communication

text: from an unreliable source, Network outage, Failure to meet

text: components

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Sabotage, Sidechannel attacks, Fault injection, Theft, Failure or malfunction of a sensor/actuator, Software vulnerabilities exploitation,

text: Inside vehicle

text: Communication protocol hijacking, Data replay, Man-in-the-

text: Communication

text: middle attack / Session hijacking, Unintentional change of data

text: Components

text: Threats on emerging technologies

text: _ Smart cars

text: Communication

text: of authorisations, Sabotage, Theft, Failure or malfunction of a

text: Networks and

text: sensor/actuator, Software vulnerabilities exploitation,

text: Protocols.

text: Car ECUs, processing Communication protocol hijacking, Data replay, Man-in-theand decision making middle attack / Session hijacking, Unintentional change of components data or car components configuration, Using information

text: In-vehicle

text: and/or devices from an unreliable source, Erroneous use of

text: communication

text: configuration of car components, Network outage, Failure to

text: components

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Sabotage, Nearby External Vandalism, Theft, Software vulnerabilities exploitation, Failure

text: Components

text: or disruption of service, Communication protocol hijacking, Man-in-the-middle attack / Session hijacking, Unintentional

text: Smart cars

text: change of data or car components configuration, Using

text: Infrastructure and

text: Backend systems information and/or devices from an unreliable source, Loss of GNSS signal, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Sabotage, Software

text: Servers, Systems

text: vulnerabilities exploitation, Failure or disruption of service,

text: and Cloud

text: Computing Communication protocol hijacking, Data replay, Man-in-the- Smart cars middle attack / Session hijacking, Unintentional change of data or

text: Infrastructure and

text: car components configuration, Using information and/or devices

text: Backend systems

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Threats targeting autonomous sensors, Threats against AI and ML, Sabotage, Vandalism, Theft, Side-channel attacks, Fault injection, Theft, Failure or malfunction of a sensor/actuator, Software vulnerabilities exploitation, Failure or disruption of service, Information Communication protocol hijacking, Data replay, Man-in-themiddle attack / Session hijacking, Unintentional change of data or car components configuration, Information leakage, Using information and/or devices from an unreliable source, Erroneous use of configuration of car components, Loss of GNSS signal, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data

text: Denial of Service, Malware, Manipulation of Information, OEM targeted attacks, Unauthorised activities, Identity theft, Abuse of authorisations, Manipulation of information, Sabotage, Vandalism, Theft, Failure or malfunction of a sensor/actuator, Software vulnerabilities exploitation, Failure or disruption of service, Communication protocol hijacking, Data replay, Man-in- Humans the-middle attack / Session hijacking, Unintentional change of data or car components configuration, Information leakage, Using information and/or devices from an unreliable source, Erroneous use of configuration of car components, Loss of GNSS signal, Car depleted battery, Network outage, Failure to meet contractual requirements, Violation of rules and regulation/Breach of legislation/Abuse of personal data

text: References

text: “Contextualised cyber threat intelligence (CTI) for sectors is an important preparedness tool for drawing conclusions on expected cyberattacks within a specific sector. “

text: in ETL 2020

text: Related

text: ENISA Threat Landscape Report The year in review

text: Contextualised threat analysis between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report List of Top 15 Threats

text: ENISAs’ list of the top 15 threats of the period between January 2019 and April READ THE REPORT 2020.

text: ENISA Threat Landscape Report Research topics

text: Recommendations on research topics from various quadrants in cybersecurity and cyberthreat intelligence.

text: READ THE REPORT

text: ENISA Threat Landscape Report Main incidents in the EU and Worldwide

text: Main cybersecurity incidents happening between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report Emerging trends

text: Main trends in Cybersecurity observed between January 2019 and April 2020.

text: READ THE REPORT

text: ENISA Threat Landscape Report Cyber Threat Intelligence overview

text: The current state of play of cyberthreat intelligence in the EU.

text: READ THE REPORT

text: About

text: _ The agency The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu. Contributors Christos Douligeris, Omid Raghimi, Marco Barros Lourenço (ENISA), Louis Marinos (ENISA) and all members of the ENISA CTI Stakeholders Group: Andreas Sfakianakis, Christian Doerr, Jart Armin, Marco Riccardi, Mees Wim, Neil Thaker, Pasquale Stirparo, Paul Samwel, Pierluigi Paganini, Shin Adachi, Stavros Lingris (CERT EU) and Thomas Hemker. Editors Marco Barros Lourenço (ENISA) and Louis Marinos (ENISA). Contact For queries on this paper, please use enisa.threat.information@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu. Legal notice Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Copyright Notice © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover: © Wedia. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN: 978-92-9204-354-4 DOI: 10.2824/552242

text: Vasilissis Sofias Str 1, Maroussi 151 24, Attiki, Greece Tel: +30 28 14 40 9711 info@enisa.europa.eu www.enisa.europa.eu

text: All rights reserved. Copyright ENISA 2020. https://www.enisa.europa.eu


text:  Project definition: This will be the initial stage of the project, prior to the start of fostering activities and platform analysis, to review, approve and gain the commitment of the workgroup with the key project foundation. Several workgroup meetings would be held, where the members will have to agree on the following topics: o Convenience and viability of the implementation of a secure communications platform. o Existing tools and technologies analysis. Review of present project deliverables and proposal for secure communications platform  Platform development: This task refers to the implementation of a common secure communications platform. Depending on the chosen implementation model and the resources assigned to the project, the duration of the tasks may vary. It includes the following activities: o Requirements analysis: in this phase the platform requirements must be specified. Possible topics would be the channels to implement, identity management, etc. The input for this activity would be this deliverable, but deep analysis should be carried out to complete and detail it. o Design: once the requirements are defined, how they will be met is determined in the design phase. Topics to deal with in this phase would be the architecture of the solution, interaction between components, etc. Again, this deliverable would be an input for this activity, but more comprehensive detail will be performed before going into implementation. o Implementation. This is the coding phase, following the requirements and design specifications.

text: o Testing. Testing phase, to assess the quality and security of the solution. This phase also includes the resolution of problems detected in the testing process. o Platform publishing. When the testing phase has finished, the platform software would be distributed among the participants (published in a web portal, sent by email,...). o Maintenance of the platform. This phase would not have end date, since the platform will require at least a minimal maintenance while it is in use.  Fostering: Within the task "Fostering" we can have any number of subtasks and milestones that would mainly consist of providing publications and attending events: o Attend relevant events/conferences organized by CERTs and/or stakeholders to promote the use of secure communications. o Activities at events could include presentations, publications delivery (see below), workgroup meetings (see below) or key signing parties. o Some examples of events to attend are the TERENA’s TF-CSIRTs meetings organised by ENISA, FIRST meetings, APWG events, e-Crime congresses, MAAWG events or other European institutions events. o Releasing publications about secure communications, procedures and best practices for CERTs and Stakeholders. These publications could be delivered in events, as well as published through ENISA’s portal. o Promoting the platform implementation and utilization. o Workgroup: creation of a workgroup with the participation of CERTs and stakeholders, to monitor and support the implementation and adoption secure communication. o The workgroup could hold meetings at events already scheduled (e.g. TF-CSIRT). o ENISA could support the use secure communication by using it in their own communications and media (signing/encrypting emails, web pages, documents, etc.) or for online registration in events organised by ENISA.  The web of trust. Key management and directory creation, with the identities and certificates of CERTs and Stakeholders. This would take place simultaneously with other "Fostering" activities. The workgroup could provide support on these activities as well.

text: o Key management infrastructure: This phase will follow the necessary steps to create the key management infrastructure. The size of the platform will directly depend on the focus adopted for the key management, having two options:  Creation of a single root, housing the public keys of all CERTs and stakeholders wishing to become part of this community.  Creation of a main root and several secondary platforms, being part of the main root the CERTs and also the European level stakeholders (e.g. Europol), and the rest of platforms, being one per country, containing the public keys of the various CERTs and stakeholders in that country. This seems to be the most recommendable option. o Key management platform publishing: when the initially defined group of members of a particular the key platform is complete, the key platform access point can be published. The web directory with the identities could also be published. o Key management platform maintenance & monitoring: to develop and maintain the PKI.  Monitoring of the adoption level of secure communication, to check the implementation level in CERTs and stakeholders’ environment, and the different promotion activities held during the implantation execution. The workgroup could provide support on these activities too.

identifier: Secure Communication with the CERTs & Other Stakeholders

nummer: secure-communication

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

text: PRACTICAL GUIDE / ROADMAP FOR A SUITABLE CHANNEL FOR SECURE COMMUNICATION Concise version

type: rubrik

text: Secure Communication with the CERTs & other stakeholders Report, December 2011

text: Secure Communication with the CERTs & other stakeholders I

type: stycke

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact details

text: For contacting ENISA or for general enquiries on CERT related activities please use the following details:  E-mail: cert-relations@enisa.europa.eu  Internet: http://www.enisa.europa.eu

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2011

text: 1 Executive Summary

text: This deliverable aims to give an overview of the work that was done in WPK 1.3 of ENISA’s Work Programme 2011. The goal of this work was to identify ways to improve communication with the CERTs and other stakeholders (institutions in the Member States, European Commission, etc.), especially when it comes to sharing information in a secure way. Secure‖ in this respect means transportation of information and assuring some combination of confidentiality, integrity and authenticity of the data. ENISA wanted to identify the most suitable security technology and the channel to start with and to analyse a future secure communications platform, providing additional secure communication channels. Both a stocktaking of existing solutions, developments and research in that area and an analysis of the requirements were performed in order to offer guidance on a suitable channel in this respect. The stocktaking and the analysis have been used as inputs to preselect the technologies, solutions and products which are suitable, and to define the assessment criteria to select the suitable channels and security technologies. The assessment criteria applied to the evaluation has been grouped into four categories: - Criteria regarding the suitable communication channel. - Criteria regarding the security requirements. - Criteria regarding CERT and stakeholders requirements. - Criteria regarding CERT and stakeholders preferences.

text: 2 Introduction 2.1 Scope

text: In its Work Programme for 2011 (WP2011) ENISA included an activity related to reinforcing CERTs in the Member States. One of the tasks defined in this work package was an analysis concerning ways to improve communication with the CERTs and other stakeholders (institutions in the Member States, European Commission, etc.), especially when it comes to sharing information, for example about incidents, in a secure way. “Secure” in this context means information transfer ensuring some combination of confidentiality, integrity and authenticity of the data, possibly with non-repudiation. The work, briefly described in this concise report has been extracted from a full detailed report ‘Proposal for secure communication channel(s) and roadmap’ which was developed for the CERT-EU pre-configuration team for future exploitation, together with the reports on the stocktaking and the analysis of the requirements of the stakeholders. INTECO was commissioned by ENISA to undertake this study. The aim of this project is to analyse the requirements of a secure channel for secure communication within the CERTs community and between them and other stakeholders, and to develop a practical guide and a roadmap for the implementation of the solution that best fits the requirements of this community.

text: 2.2 Objectives

text: The main objective of the project “Secure Communications with the CERTs and other Stakeholders”, which as mentioned above is one of the ENISA activities related to reinforcing communications between CERTs in the Member States, is the preparation work for a report on secure communication channel(s) with the CERTs and other stakeholders and a roadmap for implementation and future development. The detailed objectives for this project were: - To perform an assessment and solution selection: the different criteria for evaluating the possible solutions are defined by considering the security constraints, and the CERT and stakeholder requirements and preferences obtained during this project. - To provide a description of the selected solution, in accordance with the identified requirements. - To draft an implementation guide for the solution. - To provide a solution implementation roadmap. - To shed a light on possible future developments, detailing possible future initiatives and evolution as, for instance, the addition of new channels.

text: Secure Communication with the CERTs & other stakeholders 3 This concise report aims at providing an outline of the results of this project.

text: 4 Secure Communication with the CERTs & other stakeholders

text: 3 Methodology

text: The work in this project consisted of three parts: 1) A stocktaking of existing solutions, developments and research in the area of interest; 2) An analysis of the requirements; and finally 3) The preparation of a practical guide and roadmap. Both the stocktaking and the analysis activities had a similar approach and resulted both in a report which will be sent to the CERT-EU preconfiguration team for further exploitation together with the practical guide and roadmap report. During the execution of both the stocktaking and the analysis part, CERT members, stakeholders and a number of experts in this field have been asked to comment on tools and methods used to secure communications in CERT community, with the purpose of having an in-depth analysis of the pros and cons of the existing situation and also collecting information and requirements for the optimal future solution. The execution of these tasks has combined different kinds of methods with the purpose of achieving the project objectives in a sequential way and has aimed to identify as many synergies as possible between both parts. Three main methods were used:

text: 1) Desktop research aimed to achieve a complete vision of the state of the art in secure communications solutions. 2) Expert Interviews (think tank, expert list defined in collaboration between InTeCo and ENISA). 3) A survey of requirements amongst CERTs/CSIRTs, stakeholders and experts, belonging to the European framework defined by ENISA.

text: Secure Communication with the CERTs & other stakeholders 5

text: 4 Stocktaking of existing solutions, developments and research

text: The stocktaking report represents the results obtained from the different research activities performed (desktop research, interviews, interaction and surveys) with CERTs and other stakeholders and experts in the area of secure communications. When security in communications is required, it is possible to take two different approaches to provide the security guarantees: - Securing the data prior to being exchanged through an unsecure communications channel. In this approach, cryptographic technologies have been analysed: symmetric cryptography, asymmetric cryptography and hybrid cryptosystems (like PGP/GPG and PKI). - Securing the communication channel as a whole, so any data being exchanged through that channel is secure. Technologies that secure the channel are SSH, SSL/TLS and VPNs. Information regarding the current state of secure communications in the CERTs and stakeholders environment has been gathered during the data collection process, and this information is also presented in this report. To align the research with the scope of this project, the application of the different technologies considered to the channels used in communications with CERTs and other stakeholders has been analysed. Channels considered are: email, instant messaging, file exchange / storage, VoIP, IRC and web. The research and analysis activities carried in preparation of this report show that the most complete and widespread technologies are hybrid cryptosystems. This involves the integration of symmetric cryptography, asymmetric cryptography and hash algorithms in a unique communications technology. In this context, PGP/GPG is commonly used in email (and less used in other channels), while SSL/TLS is used in most of the channels analysed but barely in email in order to ensure the confidentiality of the communications. Both technologies are implemented by many existing solutions in the market. The full stocktaking report will be provided to the CERT-EU pre-configuration team.

text: 6 Secure Communication with the CERTs & other stakeholders

text: 5 Analysis of the requirements

text: This analysis report is dedicated to the presentation and analysis of the results indicating which requirements were selected by participants as important or necessary. Different categories of requirements were analysed. Below are listed the requirements used in this analysis taking into consideration the inputs and feedback obtained from the qualitative and quantitative research. The detailed report will be provided to the CERT-EU pre-configuration team.

text: 5.1 Security requirements

text: Security must be an integral part of any mechanism for exchanging information between CERTs and other stakeholders, since we are analyzing secure communications due to the sensitive nature or classification level of some information being transmitted. - Confidentiality: a message is confidential when it can only be understood by the person or system authorized. - Integrity: this is the quality by which a message or document can’t be modified without the change being detected. - Authenticity: means that a message or a document belongs to the person who claims it. Applied to the verification of the identity of a user, authentication occurs when the user can provide any evidence to verify that indeed s/he is who claims to be. - Non-repudiation: in information security, non-repudiation implies that none of the participants of an information exchange can deny having sent or received a message. - Auditability: is the quality by which a system can be examined or evaluated, in order to verify that it works how it is said that works. Auditability is also related to the ability of a system of having evidence of all operations made within that system, for example with access and operations traceability. - Restricted access: means that the access to a system is not free or public; to achieve this usually is necessary to implement some mechanism to verify that the user accessing the system is an authorized user.

text: 5.2 Interoperability requirements

text: Interoperability requirements refer to the ability of a system to work or integrate easily with other tools or standards. - Compatibility with information exchange standards/formats: is the quality of a system to operate with established information exchange formats like, for example, IODEF. - Compatibility with existing tools: refers to the ability of a system to integrate with other existing tools being already used such as, for example, incident management tools, CRMs, etc. - Integral communication solution: is the quality by which a system or solution implements more than one communication channel.

text: Secure Communication with the CERTs & other stakeholders 7

text: 5.3 Design requirements

text: Design requirements refer to the architectural characteristics of the solution. - Open source: means that the source code of the solution is freely distributed. If a solution is open source, it implies that it can be audited. - Multiplatform: is the ability of a solution to be run on multiple computer platforms and/or operating systems.

text: 5.4 Performance requirements

text: Performance refers to the throughput performed by a system in relation to the time and resources used. - Performance: in the scope of secure communication channels, information volume to transmit in a secure way per second (throughput). - Scalability: growth capability, in terms of performance, in case of an increase in needs (new channels, more information volume...).

text: 5.5 Functional requirements

text: Functional requirements are those characteristics or operations that should be implemented by a solution for secure information exchange in the CERTs environment. - Usability: refers to the ease of use of a solution. To be usable, a computer software user interface should be intuitive and easy to learn. - Ease of deployment: is related to the difficulty of installing a tool or technology in available infrastructures. It includes among others ease of installation, hardware requirements, etc. - Fault tolerance: is the ability of a system to recover or continue working in the event of failure of some of its components. - Granularity: refers to the possibility of specifying who has access to the information stored or being processed by a solution. It is usually related to access, users, roles and groups management.

text: 5.6 Other requirements

text: In this section are listed those identified requirements that do not fit in any of the previous categories. - Trusted administrator: means that the third party administrator or owner who is the provider of a solution must be trusted by all of the users. In other case, the users are not going to store or transmit sensitive information using a solution provided by a third party they do not rely on. - Not dependant on individuals: this requirement refers to the capacity of a solution to be administered by an organization and not individuals. For example, the solution should keep working if the administrator or any other staff member leaves the company, and the channels used should not be established on personal basis.

text: 8 Secure Communication with the CERTs & other stakeholders

text: - Multiple manufacturers: this requirement considers the possibility of similar solutions being provided by different providers. This could promote the competitiveness and overall quality of the solutions. - Commercial support: refers to the solution having a manufacturer involved in its maintenance (although the solution itself could be open source). - Cost: the cost of acquiring and implementing the solution.

text: Secure Communication with the CERTs & other stakeholders 9

text: 6 Secure communications practical guide and roadmap

text: Based on the two reports ‘Stocktaking of existing solutions, developments and research’ and ‘Analysis of requirements’, a proposal was outlined for the implementation of a secure communication channel. A related roadmap to implement this channel was proposed too.

text: This practical guide and a detailed roadmap will be provided to the CERT-EU pre-configuration team together with the above reports for further exploitation.

text: The practical guide is both a user’s guide for end users of secure communications and an implementation guide for ENISA to foster and support some of the infrastructure required by the secure communications platform required by CERTs and stakeholders.

text: An overview of the related roadmap is given below.

text: 10 Secure Communication with the CERTs & other stakeholders

text: Secure Communication with the CERTs & other stakeholders 11

text: 12 Secure Communication with the CERTs & other stakeholders

text: 7 Conclusions

text: One of the results of the stocktaking of existing solutions, development and research, is that CERTs use a variety of secure communications channels and that most complete and widespread technologies are hybrid cryptosystems. Concerning the requirements, there are several requirements to be considered for secure communication channels, from security requirements to the interoperability ones, from design to performance or functional requirements. A clear conclusion from the stocktaking and the analysis of the requirements is that CERTs currently use within the CERT community a PKI based secure communication solution. It is also a clear requirement of secure communication for most CERTs. A widely used example in the CERT community is PGP. An overview of the proposed secure communications practical guide as well as of the related road map for implementation and future development of secure communication channels with the CERTs and other stakeholders was provided to the CERT-EU pre-configuration team.

text: 2 Secure Communication with the CERTs & other stakeholders P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu

type: vagledning

utgivare: enisa