text: www.enisa.europa.eu European Union Agency For Network and Information Security

text: Reference Incident Classification Taxonomy

text: January 2018

text: January 2018

text: January 2018

text: https://www.europol.europa.eu/sites/default/files/documents/common_taxonomy_for_the_national_network_of_ csirts.pdf http://www.ecsirt.net/cec/service/documents/wp4-clearinghouse-policy-v12.html#HEAD6 https://www.trusted-introducer.org/Incident-Classification-Taxonomy.pdf https://www.cncs.gov.pt/certpt/ https://github.com/MISP/misp-taxonomies https://tf-csirt.org/tf-csirt/meetings/51st-meeting/

text: January 2018

text: January 2018

text: MISP – Malware Information Sharing Platform - Open Source Threat Intelligence Platform & Open Standards for Threat Information Sharing

text: January 2018

text: st As mentioned in the 51 TF-CSIRT meeting, “there is the need for a taxonomy list and name everyone could rely on and refer to”. As the need for information exchange, and incident reporting increases, not to mention an increase in the use of automation in incident response, it is becoming evident that there is need for some common ground. This common ground would assist incident handlers dealing with technical incidents on a daily basis to deal with the abovementioned needs. The aim of this task force is to enable the CSIRT community in reaching a consensus on a reference taxonomy. It should be noted that details such as identifying suitable sharing mechanisms are outside of the current scope. The objectives of the task force are the following:  Develop Reference Document (Classifications, incident types or examples, and definition) using eCSIRT.net as a starting point.  Define and develop an Update and Versioning Mechanism  Host reference document  Organise regular physical meetings with the stakeholders nd  In the 2 phase broader working group with non-European teams (FIRST) to achieve global consensus on incident reference taxonomy

text: January 2018

text: FIRST - the global Forum of Incident Response and Security Teams

text: January 2018

text: INCIDENT INCIDENT EXAMPLES DESCRIPTION CLASSIFICATION

text: or "Unsolicited Bulk Email", this means that the recipient has not granted verifiable permission for the message to be sent and that the message is Spam sent as part of a larger collection of messages, all having a functionally comparable content

text: Abusive Content

text: Discreditation or discrimination of somebody (e.g. cyber stalking, racism Harmful Speech and threats against one or more individuals)

text: Child/Sexual/Violence/ Child pornography, glorification of violence, ... ...

text: Worm Software that is intentionally included or inserted in a system for a Trojan Malicious Code harmful purpose. A user interaction is normally necessary to activate the Spyware code.

text: Attacks that send requests to a system to discover weak points. This Scanning includes also some kind of testing processes to gather information about hosts, services and accounts. Examples: fingerd, DNS querying, ICMP, SMTP (EXPN, RCPT, …), port scanning.

text: Information Gathering

text: Sniffing Observing and recording of network traffic (wiretapping).

text: Gathering information from a human being in a non‐technical way (e.g. Social engineering lies, tricks, bribes, or threats).

text: An attempt to compromise a system or to disrupt any service by exploiting Exploiting known vulnerabilities with a standardised identifier such as CVE name (e.g. buffer vulnerabilities overflow, backdoor, cross site scripting, etc.).

text: Intrusion Attempts

text: Login attempts Multiple login attempts (Guessing / cracking of passwords, brute force).

text: New attack signature An attempt using an unknown exploit.

text: Privileged account compromise A successful compromise of a system or application (service). This can Intrusions have been caused remotely by a known or new vulnerability, but also by Unprivileged account an unauthorized local access. Also includes being part of a botnet. compromise

text: January 2018

text: Application compromise

text: DoS By this kind of an attack a system is bombarded with so many packets that the operations are delayed or the system crashes. DoS examples are ICMP DDoS and SYN floods, Teardrop attacks and mail-bombing. DDoS often is based Sabotage on DoS attacks originating from botnets, but also other scenarios exist like

text: DNS Amplification attacks. However, the availability also can be affected by local actions (destruction, disruption of power supply, etc.) – or by Act Outage (no malice) of God, spontaneous failures or human error, without malice or gross neglect being involved.

text: Unauthorised access Besides a local abuse of data and systems the information security can be to information endangered by a successful account or application compromise.

text: Information Content

text: Furthermore, attacks are possible that intercept and access information Security Unauthorised during transmission (wiretapping, spoofing or hijacking). modification of Human/configuration/software error can also be the cause. information

text: Using resources for unauthorized purposes including profit-making Unauthorized use of ventures (E.g. the use of e-mail to participate in illegal profit chain letters resources or pyramid schemes).

text: Offering or Installing copies of unlicensed commercial software or other Copyright Fraud copyright protected materials (Warez).

text: Type of attacks in which one entity illegitimately assumes the identity of Masquerade another in order to benefit from it.

text: Masquerading as another entity in order to persuade the user to reveal a Phishing private credential.

text: Open resolvers, world readable printers, vulnerability apparent from Vulnerable Open for abuse Nessus etc scans, virus signatures not up-to-date, etc

text: All incidents which do not fit in one of the If the number of incidents in this category increases, it is an indicator that Other given categories the classification scheme must be revised. should be put into this class.

text: Test Meant for testing Meant for testing

text: Table 1: eCSIRT.net mkVI

text: January 2018

text: January 2018

text: COMMON TAXONOMY FOR LE AND REFERENCE TAXONOMY (ECSIRT.NET) NOTE CSIRTS

text: Abusive Content Abusive Content

text: Malicious Code Malware

text: Information Gathering Information Gathering

text: Intrusion Attempts Intrusion Attempts

text: Intrusion Intrusion

text: Availability Availability

text: Information Content Security Information Security

text: Fraud Fraud

text: Vulnerable Not relevant to LEA

text: Other Other

text: Test Not relevant to LEA

text: Table 2: Reference taxonomy vs Common Taxonomy for LE and CSIRTs

text: The term ‘Reference taxonomy’ will be used to refer to the eCSIRT.net

text: January 2018

text: REFERENCE TAXONOMY ND COMMON TAXONOMY FOR LE ND INCIDENT TYPE (2 INCIDENT CLASSIFICATION INCIDENT EXAMPLES (2 COLUMN) AND CSIRTSINCIDENT ST COLUMN) ST (1 COLUMN) CLASSIFICATION (1 COLUMN)

text: Spam SPAM

text: Abusive Content Harmful Speech Copyright

text: Abusive Content

text: Child/Sexual/Violence/... Child Sexual Exploitation, racism and incitement to Virus violence

text: Worm Infection

text: Trojan Distribution

text: Malicious Code

text: Spyware C&C Malware

text: Dialler Undetermined

text: Rootkit Malicious Connection

text: Scanning Scanning Information Gathering Sniffing Sniffing Information Gathering Social engineering Phishing Exploiting known vulnerabilities Exploitation of vulnerability Intrusion Attempts Login attempts Intrusion Attempts Login attempt New attack signature (Successful) Exploitation of Privileged account compromise vulnerability

text: Unprivileged account compromise Intrusions Compromising an account Application compromise DoS/DDoS Bot Availability Sabotage DoS Unauthorised access DDoS

text: Availability Information Security

text: Unauthorised Sabotage modification/deletion Outage (no malice) Misuse or unauthorised use Unauthorised access to information Information Content of resources

text: Fraud Security

text: Unauthorised modification of info False representation Unauthorized use of resources Unlisted incident Copyright Other Fraud Undetermined incident Masquerade

text: Phishing LEGEND The same Vulnerable Open for abuse Similar but with some differences Other Other The same but in a different category Not mentioned in the other taxonomy Test Meant for testing

text: Table 3: Detailed Reference taxonomy vs Common Taxonomy for LE and CSIRTs

text: January 2018

text: REFERENCE COMMON TAXONOMY TAXONOMY ND ND FOR LEA AND CSIRT INCIDENT EXAMPLES (2 INCIDENT TYPE (2 INCIDENT INCIDENT COLUMN) COLUMN) ST CLASSIFICATION CLASSIFICATION (1

text: (1 COLUMN) COLUMN)

text: Virus Infection Worm Distribution Trojan C&C Malware

text: Malicious Code

text: Spyware Undetermined Dialler Malicious Connection Rootkit

text: https://cert.lv/en/incidents https://github.com/MISP/misp-taxonomies/blob/master/circl/machinetag.json

text: January 2018

text: REFERENCE TAXONOMY CERT.LV TAXONOMY

text: Abusive Content Abusive Content Malicious Code Malicious Code Information Gathering Information Gathering Intrusion Attempts Intrusion Attempts Intrusion Intrusion Availability Availability Information Content Security Information Content Security Fraud Fraud Vulnerable Vulnerable Other Other Test

text: Table 4: Reference Taxonomy vs CERT.LV taxonomy

text: CIRCL TAXONOMY REFERENCE TAXONOMY

text: Spam Abusive Content malware Malicious Code Information Gathering Scan Intrusion Attempts system-compromise XSS Intrusions sql-injection denial-of-service Availability information-leak Information Content Security copyright-issue phishing, Fraud Scam vulnerability Vulnerable Fastflux Other Test

text: Table 5: CIRCL taxonomy vs Reference Taxonomy

text: January 2018

text: Figure 1: Pivot Mapping

text: January 2018

text: Figure 2: JSON values of MISP mapping taxonomy

text: January 2018

text: January 2018

identifier: Reference Incident Classification Taxonomy

amnesord: EU incident response and cyber crisis management

title: Reference Incident Classification Taxonomy

text: Reference Incident Classification Taxonomy Task Force Status and Way Forward JANUARY 2018

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and EU citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact

text: For queries in relation to this paper, please use CSIRT-Relations@enisa.europa.eu For media enquires about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text:  Members of Reference incident classification taxonomy task force (See Annex A)

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: 1 Introduction 4

text: 2 Background 5

text: 2.1 Past work on Taxonomies 5

text: 2.2 Trigger for Task Force 6

text: 3 Task Force 7

text: 3.1 Aim and Objectives 7

text: 3.1.1 Upcoming Tasks 7

text: 3.2 First Task Force Meeting 7

text: 3.3 Current Members 8

text: 4 Reference Incident Classification Taxonomy 9

text: 4.1 Starting Point – ecsirt.net taxonomy 9

text: 4.2 Sources 11

text: 4.3 Correlation between Reference Taxonomy and Common Taxonomy for LE and CSIRTs 12

text: 4.4 Mapping other Taxonomies 14

text: 4.5 Pivot Mapping 15

text: 4.6 MISP mapping 16

text: 5. Conclusion 18

text: Annex A: Reference Incident Classification Taxonomy Member List 19

text: 1 Introduction

text: Over the past years there have been several discussions around the topic of security incident classification taxonomies. A number of initiatives even resulted in new or modified taxonomies, such as the ‘Common Taxonomy for (LE) Law Enforcement and CSIRTs, which was set up to simplify CSIRT and LEA cooperation. This taxonomy resulted from collaboration initiatives such as the annual ENISA/EC3 Workshop which involved CSIRTs, LEAs, ENISA, and EC3. Other examples include the eCSIRT.net taxonomy which was developed in 2003, and the eCSIRT.net mkVI taxonomy which is an adaptation of the original eCSIRT.net taxonomy.

text: Creating a taxonomy is not a simple task. When dealing with topics like security incidents, there can be different ways in which to classify incidents, and it is not always easy or possible to determine which the best or correct classification is. Organisations defining a taxonomy are usually driven by different needs, and since different CSIRTs have different expectations, teams often end up developing their own incident classifications for internal use. In fact, the ‘Common Taxonomy for LE and CSIRTs’ is itself an adaptation of the CERT.PT taxonomy , which is itself an adaptation of the eCSIRT.net mkVI taxonomy. One main advantage of the Common Taxonomy for LE and CSIRTs for its use in the context of law enforcement is that it has been extended to also include a mapping of the incident classifications with a legal framework. Similarly, there have been a number of taxonomies that are in essence a branch or modification of another .

text: As the need for information exchange, and incident reporting increases, not to mention an increase in the use of automation in incident response, it is becoming evident that there is a need for common ground. This common ground would assist incident handlers dealing with technical incidents on a daily basis to deal with the abovementioned needs. Moreover, it could assist policy decision makers by offering a single reference point for discussing and drafting relevant policies such as the EU cyber security strategy and The Directive on security of network and information systems (NIS Directive). Following a discussion amongst the CSIRT community during the 51st TF-CSIRT meeting (15 May 2017 in The Hague, Netherlands), it was concluded that there is an urgent need for a taxonomy list and name everyone could rely on and refer to. This is where the Reference Incident Classification Taxonomy Task Force comes into play.

text: 2 Background

text: 2.1 Past work on Taxonomies

text: ENISA has recently published two reports related to Incident Taxonomies:

text:  ENISA Report: Information sharing and common taxonomies between CSIRTs and Law Enforcement (Dec 2015) https://www.enisa.europa.eu/publications/information-sharing-and-common-taxonomiesbetween-csirts-and-law-enforcement/at_download/fullReport  ENISA Report: A good practice guide of using taxonomies in incident prevention and detection (Dec 2016) https://www.enisa.europa.eu/publications/using-taxonomies-in-incident-preventiondetection/at_download/fullReport

text: In the first report, the main objective was to enhance cooperation both between the Member States (MS) of the EU and between related Network and Information Security (NIS) communities. It aimed at collecting and presenting information on projects facilitating information sharing between Member States CSIRTs and Law Enforcement. It also aimed at investigating which information can be shared between CSIRTs and Law Enforcement and how this can be achieved technically and organisationally. The following are some of the relevant proposals provided in this report:

text:  (to select) A taxonomy for the exchange of information based on desk research and based on the approval of the majority of the community.  (to define) An update model for the taxonomy, to answer new requirements that could arise from the CSIRTs and the LEAs.  (to develop) A roadmap for the implementation of the taxonomy in the exchange of information across CSIRTs and LEAs and the potential use of a sharing mechanism.

text: As an outcome of the report, a taxonomy was chosen as the best fitted to act as the nexus between LEAs and CSIRTs communities.

text: In the second report, the main objective was to provide relevant good practices in terms of taxonomies for incident detection and prevention for the CSIRT community. Additionally, it also provides conclusions and recommendations based on the qualitative assessment of taxonomies within the current taxonomy landscape on improvements that can be made on current taxonomies, such as what fields can be extended or added to existing taxonomies. Among the conclusions were the following:

text:  A centralised repository for hosting all relevant taxonomies along with their versions should be

text: set up by ENISA.

text:  A small set of common taxonomies for specific use cases should be agreed upon by CSIRTs at the

text: EU level.

text:  An “Other” or “Unknown”, “Tag” field should be used by the owners of taxonomies as an indicator to revise taxonomies, if there is an increase in that category with incidents or events of the same type.  A roadmap towards standardised exchange formats in the CSIRTs community should be established at the EU level by the CSIRTs Network.

text: 2.2 Trigger for Task Force

text: During the “51st TF-CSIRT meeting” (15 May 2017 in The Hague, Netherlands), members of the CSIRT community discussed the following points (amongst others):  There are two prominent taxonomies in the CSIRT community: “Common Taxonomy for Law

text: Enforcement and CSIRTs”, and “eCSIRT.net mkVI”.

text:  MISP caters for “Common Taxonomy for Law Enforcement and CSIRTs”, while IntelMQ caters for the general categories.  11 categories are fixed, whilst the incident types (2nd column) is usually customised differently by teams.  This topic cannot be decided by TF-CSIRT alone, it has to be coordinated with EC3, standardization would be a solution.  The general conclusion – There is the need for a taxonomy list and name everyone could rely on

text: and refer to.

text:  ENISA will set up a Task Force in this regard.

text: 3 Task Force

text: 3.1 Aim and Objectives 3.1.1 Upcoming Tasks

text: The next meeting will be during the “53rd TF-CSIRT meeting” (5-7 February 2018 co-located with FIRST in Hamburg, Germany). Below are some of the tasks that need to be addressed by the task force.  Decide on two elemental points o Use eCSIRT.net as starting point o Decide whether to focus on Incident Type or incident Example in the second column  Review and consolidate Incident Classifications and definitions in the reference taxonomy (starting with eCSIRT.net)  Define update workflow and Versioning Mechanism  Decide about who will be Hosting online reference taxonomy (ENISA/Dedicated site, etc.)  Propose way forward, e.g.: to meet periodically  Decide on name (reference taxonomy/eCSIRT.net/other…)

text: 3.2 First Task Force Meeting

text: Following the 51st TF-CSIRT meeting, a call for expression of interest for participation in the Reference Incident Classification Taxonomy Task Force was sent out via the TF-CSIRT mailing list, and the first task force meeting was set up back to back with the 52nd TF-CSIRT meeting (See Current Members below). Below are some of the discussion points and conclusions from this meeting:

text:  Different CSIRTs use their own taxonomy, or modified version of an existing eCSIRT.net taxonomy. A reference taxonomy will help us find a middle ground, even though CSIRTs will have their own implementation.

text:  Reference Document (Classifications, types (and decision on their importance), and definition))  Update and Versioning Mechanism.  We need to decide on the hosting of the reference document.  Following the upcoming meeting during TF-CSIRT in Hamburg, the reference taxonomy should be presented to other organisations such as FIRST and ITF.  There are differences in incident classification between CSIRTs and LEAs. However, they do go hand in hand and it is important to proceed accordingly.  Fortunately, there are members that are both in the Reference Taxonomy task force, and the Taxonomy Governance Group of the CSIRT-LEA taxonomy which can ensure a harmonious evolution of the “Reference CSIRT incident Taxonomy” and the “Common Taxonomy for Law Enforcement and CSIRTs” o Mapping between the reference taxonomy and “Common Taxonomy for Law Enforcement and CSIRTs” is important o Consider including “Common Taxonomy for Law Enforcement and CSIRTs” with link to legal framework as an annex.  It is important to define the objectives and outputs for the reference taxonomy (eg: statistics, information sharing and automation).  Scope and Motivation o Taxonomy for CSIRT technical incidents o To ensure that CSIRTs are speaking the same language. o To facilitate sharing across CSIRTs. o To facilitate the harmonization of statistics between the CSIRT community. o To facilitate translation between different taxonomies, without disruption or need for major overhaul. o Could be useful mapping within the context of NIS directive  The eCSIRT.net taxonomy seems to be a good starting point as a reference taxonomy.  To discuss formal name of the new reference incident classification taxonomy.

text: 3.3 Current Members

text: It is important that amongst the members of the task force are members of CSIRT teams, the Common Taxonomy Governance Group (including representatives from ENISA and EC3), tool developers (MISP/IntelMQ…), and taxonomy owners (owner of eCSIRT.net). A mailing list has been set up in order to facilitate communication between the task force members.

text: See Annex A for the current list of participants.

text: 4 Reference Incident Classification Taxonomy

text: To give a better understanding of how a reference taxonomy can benefit the community, we demonstrate a high level mapping of 4 taxonomies: eCSIRT.net (reference taxonomy), Common Taxonomy for LE and CSIRTs, and two CSIRT provided taxonomies (CIRCL.LU and CERT.LV).

text: 4.1 Starting Point – ecsirt.net taxonomy

text: The main action item following the first task force meeting was to determine whether the eCSIRT.net taxonomy was a suitable candidate as a starting point for the reference taxonomy. The official latest version is the eCSIRT.net mkVI:

text: This is not necessarily an ideal taxonomy. However, it has many factors which make it very useful. In particular, the main categories seem to be very practical and universal. Even though the taxonomy was developed many years ago (and has gone over a number of adaptations), the main categories are still current and can easily be used today. The same cannot be said about the subcategories which can sometimes lead to problems with how to classify an incident. For example, it is not particularly useful any more to make a distinction between DoS attacks and DDoS attacks or to determine what is a ’privileged account compromise’, ’unprivileged account compromise’ or ’application compromise’. In practice, subcategories became a part of the description rather than a concrete schema for classification. Nowadays it is really difficult to determine if a particular malware is a virus, worm, Trojan, spyware or a dialler. The functionality of malware changes and the honest approach is to classify it all as ‘malicious code’.

text: The eCSIRT.net classification is highly recommended. Despite some defects, it is still quite useful and good. Many European CSIRTs use it, which will give teams the opportunity to team up with others later and be able to compare and merge statistics.

text: 4.2 Sources

text: During the 51st TF-CSIRT meeting, one of the main conclusions was that there is the need for a taxonomy list and name everyone could rely on and refer to. When one considers the eCSIRT.net taxonomy, there currently exist different sources where the taxonomy is hosted:

text: Trusted Introducer (Official document):

text:  https://www.trusted-introducer.org/Incident-Classification-Taxonomy.pdf

text: ENISA’s page:

text:  https://www.enisa.europa.eu/topics/csirt-cert-services/community-projects/existing-taxonomies

text: MISP documentation and Github page:

text:  https://github.com/MISP/misp-taxonomies/blob/master/ecsirt/machinetag.json  http://www.misp-project.org/taxonomies.html#_ecsirt  https://www.misp-project.org/taxonomies.pdf

text: IntelMQ:

text:  http://intelmq.readthedocs.io/en/latest/Data-Harmonization/

text: 4.3 Correlation between Reference Taxonomy and Common Taxonomy for LE and CSIRTs

text: An advantage of the Reference Taxonomy is its tight correlation with the Common Taxonomy for LE and CSIRTs, which is itself an adaptation of the CERT.PT taxonomy, which is an adaptation of the eCSIRT.net mkVI. Here we will see a high level mapping of eCSIRT.net to the Common Taxonomy for Law Enforcement and CSIRTs.

text: LEGEND The same Not mentioned in the other taxonomy Not present

text: Table 3 shows a very close correlation between the Reference Taxonomy, and the Common Taxonomy for LE and CSIRTs with regards to the main categories (first column). In fact, there is almost a one-to-one mapping of the existing categories in both taxonomies. However, this is not the case for the incident type and examples (second column).

text: Consider the side-by-side comparison above. It outlines the differences in the “Incident Example” in the Reference Taxonomy, and “Incident Type” in the Common Taxonomy for LE and CSIRTs. Moreover, the Common Taxonomy for LE and CSIRTs also includes a third column which includes the link to the legal framework. This is not always directly relevant to the CSIRT community, however, it could very be useful especially when cooperating with law enforcement. The mapping between these two taxonomies could

text: help to identify factors that could lead to the update or inclusion of new incident types. Consider for example the incident types for the malware category of both the Reference Taxonomy, and Common taxonomy for LE and CSIRTs. There are significant differences between the two, where the Reference Taxonomy focuses more on the technical specification of the malware type, and the Common taxonomy for LE and CSIRTs distinguishes between infection and distribution. This does not seem to be considered in the Reference Taxonomy. The task force could use these kinds of differences to determine whether or not such incident types should be added to the reference taxonomy.

text: 4.4 Mapping other Taxonomies

text: As mentioned earlier, the Reference taxonomy contains a very practical and universal high level

text: categorisation. Below are examples of existing taxonomies (CERT.LV , and CIRCL.LU ), demonstrating how most of their high level categories map into one or more categories from the Reference Taxonomy. In the case of CERT.LV, there is a clear one-to-one mapping with all (except testing) of the high level categories. However, the mapping between CIRCL.LU and Reference Taxonomy is not as direct.

text: 4.5 Pivot Mapping

text: Given the tight correlation between the Reference Taxonomy and a number of other taxonomies such as the Common Taxonomy for LE and CSIRTs, a mapping from a particular taxonomy to the Reference Taxonomy, automatically generates a mapping between that taxonomy and other previously mapped taxonomies. Consider the following example of how CIRCL.LU taxonomy can be mapped to the Common Taxonomy for LE and CSIRTs and the CERT.LV taxonomy by pivoting from one taxonomy to another.

text: Notice that since both the Common Taxonomy for LE and CSIRTs, and CERT.LV Taxonomy have been mapped onto the Reference Taxonomy, this provides a clear mapping between the Common Taxonomy for LE and CSIRTs and the CERT.LV taxonomy, as well as any other taxonomy that would have already been mapped to the Reference Taxonomy. This mapping can be extremely useful for cross-CSIRT collaboration, as well as CSIRT-LEA collaboration by enabling CSIRTs to use the Common Taxonomy for LE and CSIRTs.

text: 4.6 MISP mapping

text: MISP developers have provided a mapping of existing taxonomies.  https://github.com/MISP/misp-taxonomies/blob/master/mapping/mapping.json  http://www.misp-project.org/taxonomies.html#_mapping_of_taxonomies The MISP mapping taxonomy allows for the mapping of a single classification into a series of machine-tag synonyms. The implemented approach for mapping is similar to the one described above, whereby a

text: number of categories are used as a central reference point and each of these points are mapped to categories in other known taxonomies.

text: Figure 2 shows how the taxonomies are mapped in the MISP taxonomy document.

text: 5. Conclusion

text: While still in its infancy, the reference taxonomy task force is off to a good start. The members seem eager and willing to contribute, and make use of the resulting reference taxonomy. The outcome of the upcoming meetings will determine the success of this initiative. In these meetings, the task force plans to:

text:  Decide on two elemental points o Confirm eCSIRT.net as starting point o Decide whether to focus on Incident Type or incident Example in the second column  Review and consolidate Incident Classifications and definitions in the reference taxonomy (starting with eCSIRT.net)  Define update workflow and Versioning Mechanism  Decide about who will be hosting online reference taxonomy (ENISA/Dedicated site,etc.)  Propose way forward, e.g.: to meet periodically  Decide on name (reference taxonomy/eCSIRT.net/other…)

text: Annex A: Reference Incident Classification Taxonomy Member List

text:  Sebastien Schmitt (Gemalto)  Jan Kopriva (ALEF-CSIRT)  Toomas Lepik (Tallinn University)  Sven Gabriel (EGI-CSIRT)  Kris Caron (KBC Group CERT)  Silvio Oertli (SWITCH CERT)  Vladimir Bobor (Telia CERT)  Bilgehan Turan (EATM-CERT)  Vasileios Friligkos (EATM-CERT)  David Alfós (CaixaBank)  Marcolla, Sara Veronica (EC3)  Azofra Martínez, Álvaro (EC3)  Baiba Kaskina (CERT.LV/TF-CSIRT)  Pavel Kácha (CESNET)  Thomas Schreck (Siemens)  L. Aaron Kaplan (CERT.AT)  Michael Hamm (CIRCL.lu)  Jean Paul Weber (GOVCERT.LU)  MANA Patrick (Eurocontrol)  Johannes Clos (BSI/CERT-Bund)  Jonsson Robert (CERT-SE)  Gorazd Božič (SI-CERT)  Francisco Jesus Monserrat Coll. (IRIS-CERT)  Klaus-Peter Kossakowski (DFN-CERT)  Francesco Canestrelli (Open Systems)  Rossella Mattioli (ENISA)  Yonas Leguesse (ENISA)  Andrea Dufkova (ENISA)  Theodoros Nikolakopoulos (ENISA)  Don Stikvoort (S-CURE)  Alexandre Dulaunoy (CIRCL.lu)  Lionel Ferette (CERT.be)  Otmar Lendl (CERT.AT)  Thomas Hungenberg (CERT-Bund)  Sebastian Wagner (CERT.AT)  Ian Bryant (UK MOD / University of Warwick)  N/A (CCN-CERT)

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vasilissis Sofias Marousi 151 24, Attiki, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu


identifier: Reference source for threats, vulnerabilities, impacts and controls in IT risk assessment and risk management

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

serie: rapporter

type: rubrik

text: Deliverable 3 Version 1.0 Date: 26/04/2007 Deliverable 3

text: Contents

text: ENISA ad hoc working group on risk assessment and risk management 2 / 15 Deliverable 3

text: 1 Introduction

text: Effective IT risk assessment and management, using the process described on the ENISA website (www.enisa.europa.eu/rmra/rm_process.html), requires the input of information about IT security assets, about threats to these and about their vulnerabilities, about potential impacts on assets, and about controls that can be put in place. Such information is essential to all of the tools, good practices or methodologies for risk assessment and risk management that are catalogued in the inventory on the ENISA Website (http://www.enisa.europa.eu/rmra/rm_ra_methods.html). Inventoried here are therefore a number of sources of information concerning: • Assets • Threats • Vulnerabilities • Impacts • Controls. The preliminary inventory has been compiled by members of the ENISA ad-hoc working group on risk assessment and management. ENISA intend to extend and improve this inventory and regularly review entries. Suggestions for additional entries, or changes to existing entries, are welcomed – please contact: riskmngt@enisa.europa.eu. Each entry in the inventory contains a short description of the information source referenced and the following data: Location: Where the referenced information can be found in the source document. Version and Date: Version and date of the referenced source document. Last updated: Date when ENISA last updated the entry. FoC: Although all referenced documents are publicly available, some may incur an access charge or fee. Where no such charge is made, this is indicated by use of the abbreviation FoC (Free of Charge). The inventory can be used to provide input to support the use of individual tools, good practices or methodologies for risk assessment and risk management. Or it can be used to support individual processes selected from a number of such tools, good practices or methodologies, as chosen according to the system described in the ENISA methodology for evaluating usage and comparison of risk assessment and management items. The table below indicates where inputs and outputs into the 15 processes referenced in the benchmark used by that methodology will benefit from the information presented in this inventory. Asset Threat Vulnerability Impact Control I.2.3 I.2.1 I.5.1 I.4.1 I.6.4 I.4.1 I.5.1 I.5.2 I.5.1 Inputs I.4.2 I.5.2 I.5.2 I.6.2 I.5.3 O.2.3 O.5.1 O.5.2 O.5.3 O.6.3 O.4.2 O.5.7 O.5.7 O.6.4 O.9.1 O.5.2 O.6.2 O.6.2 O.6.6 O.5.4 O.6.1 Outputs O.6.2 O.6.3 O.6.4 O.6.5 O.6.6 O.9.1 ENISA ad hoc working group on risk assessment and risk management 3 / 15 Deliverable 3

text: 2 Table of reference sources

text: Nr Source Assets Threats Vulnerabilities Impacts Controls

type: stycke

text: title : location : (e.g. chapter, location : (e.g. chapter, location : (e.g. location : (e.g. location : (e.g. chapter, page version & date : page etc.) page etc.) chapter, page etc.) chapter, page etc.) etc.) description : description : description : description : description : description : hyperlink : hyperlink : hyperlink : hyperlink : hyperlink : hyperlink : free of charge (yes or not) : language : last update :

text: 1 title : Austrian IT Security Handbook location : part 2 "Security ("Österreichisches IT-Sicherheitshandbuch") Measures" version & date : Version 2.2, November 2004 description : description : While part 1 of the handbook gives comprehensive summary of guidelines for the establishment of an IT security technical and organizational management process in on organization, part 2 security controls, comprising: "Security Measures" gives a comprehensive physical and infrastructure summary of technical and organizational security security, human resources controls. security, security management, hyperlink : security in system development, http://www.cio.gv.at/securenetworks/sihb/ technical controls, security in free of charge : yes operation, business continuity. language : German hyperlink : last update : 16.04.2007 http://www.cio.gv.at/securenetw orks/sihb

text: 2 title : C.E.R.T. location version & date : continuous description : gives description : web site on vulnerabilities support on hyperlink : remediation on the http://www.cert.org/nav/index_red.html vulnerabilities free of charge : yes hyperlink : language : English http://www.cert.org/ last update : 16.04.2007 nav/index_red.html

text: 3 title : CobiT 4.0 location : refer to the location : refer to the ISACA version & date : Version 4.0, 2005 ISACA brochure "COBIT brochure "COBIT Mapping: description : CobiT is an IT governance Mapping: Mapping of Mapping of ISO/IEC 17799: framework supporting business alignment of IT ISO/IEC 17799: 2005 With 2005 With COBIT 4.0" and IT auditing. It defines 34 IT processes and COBIT 4.0" description : several parts of about 215 detailed control objectives, providing description : several parts the Cobit framework must be generic information on security controls, as well of the Cobit framework considered as efficiency and compliance. must be considered hyperlink : www.isaca.org

text: ENISA ad hoc working group on risk assessment and risk management 5 / 15 Deliverable 3

text: hyperlink : www.isaca.org hyperlink : www.isaca.org free of charge : yes language : English, French, German, Italian, Japanese, Portuguese, Spanish last update : 29.03.2007

text: 4 title : Common Criteria for Information location location : location : Part 2 Technology Security Evaluation Description : Due Description : Due to Description : Are widely version & date : Version 3.1, revision 1, to its non-RARM its non-RARM covered (grouped in an September 2006 methodology methodology nature, exhaustive number of functional description : Common Criteria for Information nature, CC have CC have very little if classes) Technology Security Evaluation (shortly CC) is very little if none none consideration of hyperlink : not a Risk Analysis and Management consideration of impact. www.commoncriteriaportal.org methodology: it is primarily intended as a guide to vulnerability, hyperlink assist the user in individuating and formally considered only at :www.commoncriteria defining security requirements for a given TOE glossary level portal.org (Target Of Evaluation). It provides the users with hyperlink : a guidance suitable to describe with different www.commoncriter degrees of formality how security requirements iaportal.org are individuated (may be using a RARM method), how they are fulfilled and how related countermeasures are set-up. The deliverables of such a standard are the typical ones able to enter a certification process, which is the ultimate goal of CC usage. Keep in mind that a security certification scheme like the CC one doesn’t certify the capability of a product or a process or an organisation to contrast all possible attacks, but merely certifies that declared countermeasures free of charge : yes language :English, German last update : 16.04.2007

text: 5 title : CSI/FBI survey location : can vary each location : can vary location : can vary version & date : published each year year each year each year description : The Computer Crime and Security description : result on a description : result description : result on Survey is conducted by the Computer Security survey in the United States on a survey in the a survey in the United

text: ENISA ad hoc working group on risk assessment and risk management 6 / 15 Deliverable 3

text: Institute (CSI) with the participation of the San hyperlink : United States States Francisco Federal Bureau http://www.gocsi.com/ hyperlink : hyperlink : of Investigation’s (FBI) Computer Intrusion http://www.gocsi.co http://www.gocsi.com/ Squad. It is based on the responses of computer m/ security practitioners in U.S. corporations, government agencies, financial institutions, medical institutions and universities. hyperlink : http://www.gocsi.com/ free of charge : yes language : English last update : 29/03/2007

text: 6 title : DTI Information Security Breaches Survey location : Part location : Part “Security – Technical report (PricewaterhouseCoopers) “Security Breaches“ Controls” version & date : April 2006, carried out every description : description : two years hyperlink : hyperlink : description : Survey of UK businesses, provides www.dti.gov.uk/sector www.dti.gov.uk/sectors/infosec/ information on security incidents suffered by s/infosec/index.html index.html businesses, both large and small. hyperlink : www.dti.gov.uk/sectors/infosec/index.html free of charge : yes language : English last update : 29.03.2007

text: 7 title : ISO/IEC 17799:2005 "Information location : chapters 5 to 15 refer technology –Security techniques - Code of also to the ISACA brochure practice for information security management" "COBIT Mapping: Mapping of version & date : 2005 ISO/IEC 17799: 2005 With description : This international standard gives COBIT 4.0" guidelines and general principles for establishing description : Implementing and maintaining information security management ISO/IEC 17799 (27002) will in an organization. It provides a list of 133 generic give the guidance of security controls. implementing controls to be able hyperlink : http://www.iso.org and national to provide certification against standardization bodies the ISO/IEC 27001 (http://www.nia.din.de/sixcms/detail.php?id=5195 hyperlink : http://www.iso.org

text: ENISA ad hoc working group on risk assessment and risk management 7 / 15 Deliverable 3

text: ) and national standardization free of charge : no bodies language : English, French, Russian, German last update : 29.03.2007

text: 8 title : ISO/IEC 27005 "Information technology – location : Annexes B1 and location : Annex C location : Annex D location : Section 7.2 location : Section 9 Information Security techniques - Information security risk B2 description : Annex C description : Annex (Basic criteria) p11. security risk treatment. management (draft)" description : In Annex B1 contains a list of about 40 D gives examples of Annex B3 (Impact description : version & date : draft (Asset identification) sorts typical threats and their vulnerabilities and assessment) p47. This section sorts risk controls description : This international standard provides assets are sorted into: possible origin (accidental, corresponding description : into: guidelines for information security risk 1. Primary assets - environmental or threats and some Section 7.2 p11 "Basic 1. Risk avoidance management in an organization. 1.1Business process & deliberate). For deliberate methods for criteria" proposes a list 2. Risk transfer hyperlink : http://www.iso.org and national activities, threats a description of vulnerability of 6 impact criteria. 3. Risk reduction standardization bodies -1.2. Information possible threat sources assessment Annex B3 (Impact (refers to ISO 27002), (http://www.nia.din.de/sixcms/detail.php?id=5195 2. Supporting assets (hackers, insiders, hyperlink: assessment) p47 4. Risk retention (referring to ) -2.1 Hardware terrorists,...) and threat proposes a ISO27001-4.2.1 free of charge : not yet published (restricted to -2.2 Software actions is given. hyperlink: characterization of an hyperlink ISO experts), -2.3 Network operational impact: published standard will not be free of charge -2.4 Personnel direct (4 items) or language : English -2.5 Site indirect (5 items) last update : 29.03.2007 -2.6 Organization. Annex B2 (Asset valuation) Hyperlink: gives a list of criteria. hyperlink:

text: 9 title : IT-Grundschutz location : Chapter location : Chapter location : IT- location : Chapter "Catalogues version & date : December 2006 "Catalogues of Modules" "Catalogues of threats" Grundschutz of Safeguards" description : The IT-Grundschutz Catalogues description : In IT- description : IT- Methodology, BSI- description : IT-Grundschutz provide lists of typical relevant threats and the Grundschutz the assets Grundschutz provides a list Standard 100-2, Page provides a list of thesafeguards respective standard security measures for standard addressed are handled in of the threats that are 39 that are considered to be asset-types. Technical, organisational, personnel "modules". Each module considered to be relevant description : The IT- relevant for the addressed assets and infrastructural issues are encountered. The describes a standard use of for the addressed assets Grundschutz (modules). The version 2006 of information is publicly available and free of costs. the asset and the relevant (modules). The version Methodology provides the IT-Grundschutz Catalogues hyperlink : threats and security 2006 of the IT-Grundschutz a list of high-level contains more than 1000 http://www.bsi.de/gshb/deutsch/index.htm measures. The modules are Catalogues contains more impacts as a basis for safeguards. Each safeguard is (German), grouped into the layers: than 400 threats. For each the definition of the provided with a detailed http://www.bsi.de/english/gshb/index.htm generic aspects, threat a detailed description protection description, the responsible roles

text: ENISA ad hoc working group on risk assessment and risk management 8 / 15 Deliverable 3

text: (English) infrastructure, IT systems, is given. requirements of the for initiation and free of charge (yes or not) : yes network, applications. hyperlink : assets. implementation and a set of language : German, English Version 2006 of IT- http://www.bsi.de/gshb/deu hyperlink : check questions. last update : 29.03.2007 Grundschutz Catalogues tsch/g/g01.htm http://www.bsi.de/liter hyperlink : contains 70 modules. at/bsi_standard/index. http://www.bsi.de/gshb/deutsch/ hyperlink : htm m/m01.htm http://www.bsi.de/gshb/deu tsch/baust/b01.htm

text: 10 title : kes/Microsoft-Sicherheitsstudie 2006 - location : Part 1 location : Part 2 Lagebericht zur Informations-Sicherheitsicherheit description : The first description : The second part of version & date : October 2006 part of the survey the survey contains statistical description : The magazine “kes” carries out a contains statistical information on the IT security survey on the IT security status in Germany every information on kind, measures already implemented. 2 years. The last study provides information on IT extend and costs of IT Hyperlink : http://www.kes.info risks, IT security attacks and IT security status in security damages Access requires password Germany. The survey can be purchased from during the last 3 years. SecuMedia Publishing House Hyperlink : hyperlink : http://www.kes.info/ http://www.kes.info free of charge (yes or not) : no Access requires language : German password last update : 16.04.2007

text: 11 Title : Location : Location Location Location : Location : EBIOS EBIOS-Guide Section 4 EBIOS-Guide Section 4 EBIOS-Guide EBIOS-Guide EBIOS-Guide Section 5 Version & Date : "Tools for assessing ISS "Tools for assessing ISS Section 4 "Tools Section 3 "Tools for treating ISS risks" version 2, 2004-02-05 risks" pp 7-23. risks" pp 24-53. for assessing ISS "Techniques" pp 21- pp 1-198. Description : Description: Description : risks" pp 54-188. 22. Description EBIOS-Guide : In EBIOS, an asset is Classification of 42 generic Description : Description 1. Knowledge bases of generic -Section 4 "Tools for assessing ISS risks". composed of an essential attack methods, according Classification of Table of 22 (proposed) security objective, arranged -Section 5 "Tools for treating ISS risks" element (ie. immaterial part to 8 types: generic relevant impacts. according to entity types. These 2 sections contain the following EBIOS that carries the asset value) 1. Compromise of vulnerabilities These impacts on 2. Knowledge base of knowledge bases: and entities (ie. concrete information, according to 42 business processes are functional security requirements, 1. A classification of entities according to types parts that support the asset). 2. Compromise of attack methods that used to assess the integrating: and sub-types, The essential elements are functions, can exploit them, security needs of each -ISO-IEC-15408 (11 types), 2. A classification of 42 generic attack methods, of 2 types: 3. Technical failures, and with cross- asset with respect to -ISO-IEC-17799 (10 types), with a detailed description (corresponding threat 1. Function (ie. business 4. Unauthorised actions, references to type or security criteria and -DCSSI-PSSI (Information-

text: ENISA ad hoc working group on risk assessment and risk management 9 / 15 Deliverable 3

text: agent profiles and impacts, …), process) 5. Physical damage, sub-type of entities the corresponding System-Security Policy) (16 3. A classification of generic vulnerabilities, 2. Information 6. Natural events, (Entity sub-types scales of security types) cross-referenced to attack methods and entities (inputs/outputs of 7. Loss of essential services inherit of needs. -Other sources (15 types). knowledge bases. functions). 8. Disturbance due to vulnerabilities of These proposed These requirements cover a wide 3. A classification of security objectives and radiation. their entity type). impacts are also spectrum of controls ranging security requirements for risk treatment, with EBIOS provides with a (classification compliant to hyperlink : referred to as from technical to organizational cross-references to attack methods base and classification of entities ISO/IEC27005) http://www.ssi.gouv "consequences" in and training/awareness controls. vulnerabilities base, together with coverage into types and subtypes All attack methods are .fr/en/confidence/do each attack method 3. Coverage table of tables. Theses security objectives and with detailed description described with the cuments/methods/eb description given in vulnerabilities by security requirements are recompiled and rearranged from and examples. following details: iosv2-section4- EBIOS Guide section objectives according to attack major ISO standards, DCSSI-PSSI and EBIOS- The 7 entities types are : 1. Affected security needs outillageappreciatio 4 §3 (pages 26-53). methods. Club-Best-practices. 3. Hardware, criteria, n-2004-02- hyperlink : 4. Coverage table of security All these knowledge bases are implemented and 4. Software, 2. Threat agent profiles 05_en.pdf http://www.ssi.gouv.fr objectives by security intertwined in EBIOS software. Cross-references 5. Network, with type of intentionality /en/confidence/docum requirements according to types are then automatically carried out by the software 6. Personnel, (natural, human, ents/methods/ebiosv2- and subtypes of entities. tool, giving real added value to consultant when 7. Site, environmental), section3-techniques- Coverage tables are useful to filling up an EBIOS study. 8. Organization 3. Resources needed for 2004-02-05_en.pdf ensure security controls are Those knowledge bases result from experience 9. System him to act (time, money, necessary and sufficient. They feedback of DCSSI experts or EBIOS club These classifications are skills,…), are also needed when dealing members, and from various ISO standards. They compliant to (draft) 4. Feared consequences, with defence in depth are constantly maintained for relevance and ISO/IEC27005. 5. Examples. (resilience). exhaustiveness. hyperlink : hyperlink : hyperlink : Consultants may also use a base of 13 best http://www.ssi.gouv.fr/en/c http://www.ssi.gouv.fr/en/c http://www.ssi.gouv.fr/en/confid practices guides, convenient when producing onfidence/documents/meth onfidence/documents/meth ence/documents/methods/ebiosv deliverables in accordance with a specific ods/ebiosv2-section4- ods/ebiosv2-section4- 2-section5-outillagetraitementtemplate: NATO (CSRS, SSRS, SISRS, outillageappreciation-2004- outillageappreciation-2004- 2004-02-05_en.pdf SECOPS…), ISO- 15408 (Protection Profile, 02-05_en.pdf 02-05_en.pdf Security Target), ISO-17799 (Security Policy) ISO-27001 (Risk Treatment Plan, Statement of Applicability).

text: nyperlink :

text: http://www.ssi.gouv.fr/en/confidence/ebiospresent ation.html

text: Free of charge: yes

text: Language : French, English, German, Spanish. Last update : 29.03.2007

text: ENISA ad hoc working group on risk assessment and risk management 10 / 15 Deliverable 3

text: 12 title : Mac Afee location : version & date : continuous description : description : hyperlink : hyperlink : http://us.mcafee.com/virusInfo/d http://us.mcafee.com/virusInfo/default.asp?WW efault.asp?WWW_URL=www. W_URL=www.mcafee.com/anti-virus/default.asp mcafee.com/antifree of charge: virus/default.asp language : English, French last update : 29.03.2007

text: 13 title : MAGERIT – versión 2. Metodología de location : Magerit methods, location : Magerit methods, location : Magerit location : Magerit location : Magerit methods, Análisis y Gestión de Riesgos de los Sistemas de chapter 2 chapter 2 (page 20) and methods, chapter 2 methods, chapter 2, chapter 2, page 23. Chapter 6 of Información description : Relevant chapter 5 of the “Elements description : In page 21 the “Elements catalogue” gives a version & date :version 2, 2005 assets are identified and catalogue” that gives a list comparasing with description : Direct list of suitable safeguards for description : The first version of MAGERIT is defined in respect to of typical threats. Magerit v1.0, the derivation of impact is each type of asset. dated in 1997. In 2005 Electronic Government relation and operations they description : The valuation “vulnerability” explained, as well as description : Procedures or Council (Consejo Superior de Administración perform on data. Chapter 2 of threats is described with concept is now accumulated and technological mechanisms that Electrónica, CSAE) has prepared version 2 of the of the “Elements two aspects: degradation incorporated using deflected impact. reduce the risk are called Risk Analysis and Management Methodology for catalogue” gives a list of and frequency. the degradation These determine the safeguards or counter-measures the information systems of Public types of assets.The threats hyperlink : measurements of impact of a threat on in Magerit 2, although term Administrations, MAGERIT (the Spanish and safeguards are different http://www.csae.map.es/csi the asset and the an asset in a certain security controls is also used for acronym) and recently this version has been according to the type of /pg5m20.htm frequency with dimension. This measuring effectiveness of these translated to English. assets. The concept of which the threat chapter also explaines safeguards. These are described hyperlink : “dependencies between occurs. how single impacts and classified in different terms http://www.csae.map.es/csi/pg5m20.htm assets” is introduced and Hyperlink : none may be aggregated (preventive, degradation free of charge : yes explained.Value and under certain limitation, according to their language : Spanish, English dimensions of assets are conditions. effectiveness...). In Appendix 1 last update : 29.03.2007 also discussed. Furthemore, hyperlink : (Glossary), page 99, several quantitative and qualitative http://www.csae.map.e definitions for terms safeguard, valuations are explained s/csi/pg5m20.htm countermeasures and controls with the pointers to are given. chapters 8.1 and 8.2 that hyperlink : give analysis model based http://www.csae.map.es/csi/pg5 on these valuations.Finally, m20.htm one exception (the valuation of the

text: ENISA ad hoc working group on risk assessment and risk management 11 / 15 Deliverable 3

text: interruption of the availability) is described with a use of a more complex structure.

text: hyperlink :

text: http://www.csae.map.es/csi /pg5m20.htm

text: 14 title : NIST SP 800-30 : Risk Management guide location : chapter 3.2 location : chapter location : chapter 4.4 for Information technology systems description : It contains a 3.3 description : a list of security version & date : July 2002 list of typical human threats description : gives control categories description : The document provides a (threat source, motivation some examples for hyperlink : foundation for the development of a risk and threat actions) vulnerability/threat http://csrc.nist.gov/publications/ management and gives definitions and practical hyperlink : pairs nistpubs/ guidance. http://csrc.nist.gov/publicati hyperlink : hyperlink : ons/nistpubs/ http://csrc.nist.gov/p http://csrc.nist.gov/publications/nistpubs/ ublications/nistpubs free of charge : yes / language : English last update : 29.03.2007

text: 15 title : OCTAVE ("Operationally Critical Threat, location : OCTAVE SM location : White Paper location : OCTAVE location : OCTAVE Catalog of Asset, and Vulnerability Evaluation") Method Implementation “OCTAVE Threat Profiles” SM Method Practices, Version 2.0 version & date : Version 2.0, Guide Version 2.0, Volume description : A list of Implementation Guide description :This document description : OCTAVE is a comprehensive RA 7: Process 5 – Identify Key generic security controls is Version 2.0 Volume 9: outlines the set of practices method and is supported by a number of papers Components given to build asset-based Process 7 – Conduct against which organizations can outlining different aspects of RA, eg the White description : Within Threat Profiles Risk Analysis §10.1 compare their own practices paper on "OCTAVE threat profiles" and the Process 5 the key hyperlink : Risk Impact during OCTAVE. "Catalogue of practices", which can be regarded components of the http://www.cert.org/octave/ Descriptions and hyperlink : as list of generic security controls. infrastructure for each pubs.html Values for Critical http://www.cert.org/archive/pdf/ hyperlink : critical asset are identified Assets 01tr020.pdf http://www.cert.org/octave/methods.html . description : Contains free of charge: a table with language : English descriptions of last update : 29.03.2007 impacts to the organization. hyperlink :

text: ENISA ad hoc working group on risk assessment and risk management 12 / 15 Deliverable 3

text: http://www.cert.org/oc tave/pubs.html

text: 16 title : OWASP web site location : specific web location : specific version & date : continuous page web page description : The Open Web Application Security description : give general description : give Project (OWASP) is dedicated to finding and information on threat general information fighting the causes of insecure software. hyperlink : on vulnerability Everything here is free and open source. The http://www.owasp.org/inde hyperlink : OWASP Foundation is a 501c3 not-for-profit x.php/Category:Threat_Ag http://www.owasp.o charitable organization that ensures the ongoing ent rg/index.php/Catego availability and support for our work. ry:Vulnerability hyperlink : http://www.owasp.org/index.php/Main_Page free of charge: yes language : English last update : 16.04.2007

text: 17 title : Secunia web site location : website location n : website version & date continuous description : advisories on description : description : this website is a portal that gives viruses advisories on information on virusses and also news related to hyperlink : system information security.It is not related to a specific http://secunia.com/ imperfections supplier hyperlink : hyperlink : http://secunia.com/ http://secunia.com/ free of charge (yes or not) : yes language : English last update : 16.04.2007

text: 18 title : Securityfocus portal location : website version & date : continuous description : allow description : portal related to information search on several security criteria for hyperlink : http://www.securityfocus.com vulnerabilities free of charge: yes hyperlink : language : English http://www.security last update : 16.04.2007 focus.com/vulnerabi

text: ENISA ad hoc working group on risk assessment and risk management 13 / 15 Deliverable 3

text: lities

text: 19 title : Sophos location :specific web pages version & date : continuous description : give description : Vendor website with relevant informationon control to put in information places hyperlink : http://www.sophos.com/security/ hyperlink : free of charge: yes http://www.sophos.com/security language : English / last update : 16.04.2007

text: 20 title : Symantec Internet Security Threat Report location : website location : website (ISTR) description : descriptions description : version & date : continuous of threats description and description : Vendor website with relevant hyperlink : resolution of information http://www.symantec.com/ vulnerabilities hyperlink : enterprise/threatreport/inde hyperlink : http://www.symantec.com/enterprise/threatreport/ x.jsp http://www.symante index.jsp c.com/enterprise/thr free of charge : yes eatreport/index.jsp language : English last update : 16.04.2007

text: 21 title : Systems Security Engineering — Capability location : several Maturity Model (SSE-CMM) / ISO/IEC description : descriptions 21827:2002 of threats version & date : 2002 hyperlink : description : The SSE-CMM describes the http://www.symantec.com/ essential characteristics of an organization's enterprise/threatreport/inde security engineering process that must exist to x.jsp ensure good security engineering. hyperlink : www.sse-cmm.org/index.html free of charge: yes language : English last update : 16.04.2007

text: 22 title : The IT-Security Situation in Germany in location : Chapter 4, location : Chapter 3 IT-

text: ENISA ad hoc working group on risk assessment and risk management 14 / 15 Deliverable 3

text: 2005 Vulnerabilities of and Security Awareness and ITversion & date : 2005 Threats to IT Systems, security Competence in description : This report presents the current IT- Page 14 Society, Page 9 security situation in Germany, provides lists of description : The report description : List o threats threats priorised according to their importance and contains statistics on and statistics on their their damage as well as statistics on IT security vulnerabilities and on the importance today and in the attacks. The report makes also a categorisation respective exploits. future and evaluation of trends in IT security. The hyperlink : hyperlink : information is publicly available and free of costs. http://www.bsi.de/english/p http://www.bsi.de/english/p hyperlink : ublications/securitysituatio ublications/securitysituatio http://www.bsi.de/english/publications/securitysit n/lagebericht2005_englisch n/lagebericht2005_englisch uation/lagebericht2005_englisch.pdf .pdf .pdf free of charge: yes language : German, English last update : 16.04.2007

text: ENISA ad hoc working group on risk assessment and risk management 15 / 15

type: vagledning

utgivare: enisa