identifier: Cyber Europe 2012 - Key Findings Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Cyber Europe 2012 - Key Findings Report

serie: rapporter

text: Key Findings and Recommendations

text: December 2012

type: stycke

text: I

text: S Key Findings and Recommendations

text: Acknowledgements

text: ENISA wishes to thank all persons and organisations which have contributed to this exercise. In particular, our gratitude goes to the exercise planners, national monitors and moderators.

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Follow us on Facebook Twitter LinkedIn Youtube & RSS feeds

text: ENISA Project Team

text: Panagiotis TRIMINTZIOS, ENISA Razvan GAVRILA, ENISA Maj Ritter Klejnstrup, ENISA

text: Contact details

text: For questions related to this report or any other general inquiries about the resilience program please use the following contact address: resilience at enisa.europa.eu

text: Legal notice

text: Please note that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

text: 4 On National and International Cyber Exercises

text: Key Findings and Recommendations

text: About Cyber Europe 2012

text: On 4 October 2012 more than 500 cyber-security professionals across Europe participated in Cyber Europe 2012, the second pan-European Cyber Exercise. The exercise built on extensive activities at both the national and European level to improve the resilience of critical information infrastructures. As such, Cyber Europe 2012 was a milestone in the efforts to strengthen cyber-crisis cooperation, preparedness and response across Europe. In 2009, the European Commission issued a communication on Critical Information Infrastructure Protection (CIIP): ‘Protecting Europe from large-scale cyber-attacks and disruptions: enhancing preparedness, security and resilience’ (COM/2009/149). This communication gave rise to the first pan- European Cyber Exercise, which took place on 4 November 2010. The European Commission moved forward with its Digital Agenda for Europe (2010), and its 2011 communication: ‘Achievements and next steps: towards global cyber-security’ (COM/2011/163). Building on these efforts, Cyber Europe 2012 expanded in scope, scale and complexity. Cyber Europe 2012 had three objectives:

text: 1. Test the effectiveness and scalability of mechanisms, procedures and information flow for public authorities’ cooperation in Europe.

text: 2. Explore the cooperation between public and private stakeholders in Europe.

text: 3. Identify gaps and challenges on how large-scale cyber-incidents could be handled more effectively in Europe. Twenty-nine EU (European Union) and EFTA (European Free Trade Association) Member States were involved in the exercise; 25 of them participated actively in the exercise, while the other four were involved as observers. In addition, several EU Institutions participated. Overall, 339 organisations participated in the exercise, bringing a total of 571 individual players in action. Following up on a key recommendation of Cyber Europe 2010, the private sector actors took part in this exercise. Cooperation between public and private players took place at the national level, while public authorities also cooperated across borders. The majority of the players (88%) were positive about the exercise (see Figure 1).

text: Figure 1: Level of players’ satisfaction

text: Key Findings and Recommendations

text: The planning process

text: Cyber Europe 2012 was facilitated by the European Network and Information Security Agency (ENISA) and supported technically by the Joint Research Centre (JRC) of the European Commission. Representatives of all 25 participating countries and the European Union Institutions were involved in the planning of the exercise. The planning process was organised around several workshops.

text: The scenario

text: The exercise scenario revolved around large-scale cyber-incidents in Europe, which affected all participating countries. Fictional adversaries joined forces in a massive cyber-attack against Europe, mainly through Distributed Denial of Service (DDoS) attacks against public electronic services. The affected services were online e-government and financial (e-banking, etc.) services. Cyber-incidents challenged the public and private sector participants, triggering a need for crosscountry cooperation. Players received information on the scenario (injects) via emails, and had to collaborate using standard procedures and structures in order to assess the situation and agree upon a course of action. Figure 2 depicts the large number of email injects exchanged during the exercise.

text: Figure 2: Email injects send out during the exercise

text: The Players

text: The exercise scenario involved many different players. Overall 571 individuals from 339 organisations around Europe took part in the exercise. There were 25 countries playing in the exercise; the European Union Institutions also played. The organisations involved were from the following groups: the cybersecurity agencies and organisations, the relevant ministries, the e-government service owners, financial institutions and Internet Service Providers (ISPs) and telecommunication service operators. The distribution of players is shown in Figure 3.

text: 6 On National and International Cyber Exercises Key Findings and Recommendations

text: Figure 3: The distribution of the organisations that actively played in CE2012

text: Media attention

text: Cyber Europe 2012 attracted considerable attention in the global media. More than 600 articles were published in 19 languages. Many articles quoted Vice-President of the European Commission responsible for the Digital Agenda, Neelie Kroes, stating that ‘Working together at the European level to keep the Internet and other essential infrastructures running is what today’s exercise is all about.’ In addition, Cyber Europe 2012 was mentioned in social media in over six languages. The compilation of media messages in the picture below displays some of the articles published about Cyber Europe 2012.

text: Key Findings and Recommendations

text: Key Findings

text: Cyber Europe 2012 produced a series of key findings regarding national-level cooperation, international-level cooperation, and cyber exercises, which are summarised below:

text: National-level cooperation

text: • Playing countries, taking cyber security incidents very seriously, responded to the challenges by escalating to their national crisis response cells and/or activating national crisis structures. • Frequent cooperation and information exchange at the national level between public and private players took place during the exercise. • Some countries experienced challenges in crisis management decision making, even though that was not part of the exercise objectives (e.g., some of the decisions at hand have to be taken at more strategic levels during a crisis). • Public–private cooperation structures differ from country to country. Parallel and sometimes overlapping public and private national-level procedures sometimes challenged the public– private cooperation within countries. • The inclusion of private sector organisations as players at the national level provided an excellent improvement on the previous Cyber Europe exercise.

text: International-level cooperation

text: • Cyber Europe 2012 has proven to be an excellent opportunity to explore, understand and evaluate existing European cyber cooperation mechanisms. The exercise has strengthened the European cyber-incident management community.

text: 8 On National and International Cyber Exercises

text: Key Findings and Recommendations

text: • All participating countries were fully engaged in the international cooperation phase of the exercise. During the exercise many bilateral and multilateral interactions at the international level took place. • Having a set of standard operational procedures and communication tools helped to provide structure and situational awareness during the simulated cyber-crisis. • Challenges were identified in the operational procedures, notably in terms of scalability due to the large number of playing countries and institutions. • Familiarity with procedures and information flows proved to be crucial for building a fast and effective response capability across Europe. • Appropriate and up-to-date technical infrastructures and tools proved critical to ensuring effective cooperation. • Cyber Europe 2012 helped to build trust between countries, which is key to successful and timely mitigation activities during real cyber-crises. The exercise has fostered both new and existing relationships.

text: Cyber exercises

text: • The European cyber-incident management community considers pan-European exercises as an important tool for evaluating and improving existing cyber-crisis cooperation frameworks. • Cyber Europe 2012 has proven extremely useful for testing national contingency measures and levels of preparedness. • Cyber exercises are very useful to build trust among different cyber communities. • Efficient planning is crucial for conducting an effective, large-scale, and complex exercise.

text: Recommendations

text: Cyber Europe 2012 resulted in the following recommendations: • Cyber Europe 2012 proved valuable in enhancing pan-European cyber-incident management. It is therefore important to continue the efforts and further develop the European cyber exercise area. EU Member States and EFTA countries should cooperate towards new pan- European and national cyber exercises in order to enhance transnational cyber-incident management. The Good Practice Guide on National Exercises , developed by ENISA, provides additional support in this area. • Future cyber exercises should explore inter-sectoral dependencies and be more focused on specific communities. • Cyber Europe 2012 provided an opportunity for international-level cooperation and strengthening of the European cyber-incident management community. To foster international cooperation it is essential to facilitate exchange of good practices in cyber

text: Key Findings and Recommendations

text: exercises, lessons learned, expertise and the organisation of conferences. This will ensure a stronger community that is able to tackle transnational cyber-crises. • EU Member States and EFTA countries should further improve the effectiveness, scalability of, and familiarity with, existing mechanisms, procedures and information flows for cooperation at national level and with other public authorities in Europe. Lessons learned from Cyber Europe 2012 provide an excellent starting point. • All stakeholders in the area of international cyber-crisis cooperation need to be trained on the use of procedures in order to know how to adequately work with them. • The involvement of private sector organisations as players was of added value to this exercise. Therefore, EU Member States and EFTA countries should consider the involvement of the private sector in future exercises. • The European cyber-incident management community could be strengthened with input from other European critical sectors (e.g. health, transportation) that are relevant to the handling of large-scale crises.

text: Further information on cyber-crisis cooperation and exercises can be found at ENISA’s web pages at: http://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-cooperation

text: 10 On National and International Cyber Exercises Key Findings and Recommendations

text: P.O. Box 1309, 71001 Heraklion, Greece P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu www.enisa.europa.eu

type: vagledning

utgivare: enisa


text: CYBER EUROPE 2018: AFTER ACTION REPORT 5

text: Commission Recommendation (EU) 2017/1584

text: , 13 September 2017, on ‘coordinated response to large-scale cybersecurity incidents and crises’.

text: CYBER EUROPE 2018: AFTER ACTION REPORT 7

text: CYBER EUROPE 2018: AFTER ACTION REPORT 9

text: Strategic goal Objective Metrics/Indicators

text: G1. Test O1. Assess the quality of information sharing Timeliness, usefulness, structured vs EU-level unstructured

text: processes O2. Monitor occurrences of cooperation Number of EU Cyber SOPs cooperation activities activities held, e.g. meetings/teleconferences, during the exercise

text: O3. Evaluate situational awareness Completeness, timeliness, usefulness of EU Cyber Integrated Situation report

text: O4. Assess the ability to develop exit strategies Appropriateness and usefulness of the proposed options (to senior management) to follow in a crisis.

text: G2. Provide O5. Provide opportunities to Participants to test Number of opportunities recognised and used opportunities their intra-organisational procedures, if they by the Participants. for MS to exist (BCPs, Crisis Management Plans, etc.)

text: test their

text: national-level O6. Provide opportunities to Participants to test Number of opportunities recognised and used cooperation cross-organisational cooperation processes, if by Participants processes any

text: O7. Provide opportunities to Participants to Number of opportunities recognised and used test national-level cooperation activities and/or by Participants contingency plans, if they exist

text: G3. Train O8. Provide opportunities to train a wide variety Number of Participants who used the EU- and of cybersecurity-related skills training opportunities, level of satisfaction of national-level Participants in training opportunities

text: O9. Provide learning opportunities Number of learning opportunities recognised by Participants

text: O10. Provide self-assessment opportunities Types of self-assessment opportunities recognised and used by Participants

text: O11. Identify training needs for the future Number of different types of training needs identified

text: Local Planners

text: 120 100 80 60 40 20 0 AT BE CY CZ EE ES FI FR IE IT LT LU LV PL PT SE SL SK BG CH DE DK EU GR HR HU MT NL NO RO UK

text: SECTORIAL ICT PARTICIPATION 20% PARTICIPATION

text: Academia and Research Hardware/ Software Industry Defence/ military Information Security ICT Internet and Digital Services Other Security Companies Public/ Government Telecommunications Transport – Aviation

text: CYBER EUROPE 2018: AFTER ACTION REPORT 11

text: We use the log from the Cyber Exercise Platform as well as the CSIRTs Network cooperation tools, which were used in exercise mode during Cyber Europe 2018.

text: CYBER EUROPE 2018: AFTER ACTION REPORT 13

identifier: Cyber Europe 2018 - After Action Report

title: Cyber Europe 2018 - After Action Report

text: THE EU CYBERSECURITY AGENCY

type: rubrik

text: CYBER EUROPE 2018: AFTER ACTION REPORT

text: Findings from a cyber crisis exercise in Europe DECEMBER 2018 CONTACT For queries in relation to this paper, please email exercises@enisa.europa.eu For media enquiries about this paper, please email press@enisa.europa.eu LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent the current state of affairs and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources, including external websites, referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. COPYRIGHT NOTICE

text: © European Union Agency for Network and Information Security (ENISA), 2018 Reproduction is authorised provided the source is acknowledged. Catalogue number: TP-06-18-410-EN-N ISBN: 978-92-9204-287-5 DOI: 10.2824/369640

text: Copyright for the images on the cover: © Shutterstock. For reproduction or use of these photos, permission must be sought directly with the copyright holder.

text: CYBER EUROPE 2018: AFTER ACTION REPORT

text: Findings from a cyber crisis exercise in Europe EUROPEAN UNION AGENCY FOR NETWORK AND INFORMATION SECURITY 41 TABLE OF CONTENTS

text: Executive summary 6 Key findings and recommendations 7

text: PART I EXERCISE OVERVIEW 9

text: 1.1 GOALS AND OBJECTIVES 9

text: 1.2 TARGET AUDIENCE AND PARTICIPATION 9

text: 1.3 PLANNING AND SET-UP 11

text: 1.4 SCENARIO 12

text: 1.5 EVALUATION 12

text: 1.6 KEY RECOMMENDATIONS 13

text: EXECUTIVE SUMMARY

text: Cyber Europe 2018 was the fifth pan-European cyber crisis exercise organised by the European Union Agency for Network and Information Security (ENISA). The exercise engaged around 900 participants, from the public authorities and private companies, mainly in the Aviation sector, from all 28 EU Member States as well as two European Free

text: Trade Association (EFTA) countries, Norway and Switzerland.

text: The exercise simulated an intense realistic crisis caused by a large-number (over 600

text: hundred) of cybersecurity incidents that occurred during the two-days, 6-7 June 2018. The

text: exercise was built on three main pillars: The sound use of business continuity and crisis management plans within an organisation National-level cooperation and use of contingency plans Cross-country cooperation and information exchange

text: In addition, the exercise gave the opportunity to the technical teams to test their skills

text: in cybersecurity with a vast variety of technical challenges, including malware analysis,

text: forensics, mobile malware, APT attacks, network attacks, IoT device infection, etc.

text: The exercise brought up the importance of cooperation between the different actors (victims and authorities) of simulated cybersecurity incidents, security providers and national authorities. It proved to the participants that only by information exchange and

text: collaboration, it is possible to respond to such extreme situations with a large number of

text: simultaneous incidents. We have witnessed a large number of instances of public–private and private–private cooperation. Participants had to follow existing business processes, agreements, communication protocols and regulations to mitigate effectively the situations presented to them. Nevertheless, the level of preparedness varied significantly between participants, the information flow felt sometimes to be unidirectional and structured private-public cooperation procedures were immature or non-existent. The EU Network and Information Security (NIS) directive identifies many of the associated shortcomings and proposes measures to improve the situation.

text: The EU-level cooperation has been undoubtedly improved over the last years. In particular, the technical-level cooperation has proven mature and effective. The introduction of the CSIRTs Network (CNW) as defined in the NIS directive has provided EU Member States with an effective formal structure to exchange technical information but also to collaborate in order to resolve complex, large-scale incidents. The exercise proved that at this level EU is well equipped to respond. Some minor gaps were identified and have been already tackled by those involved. On the other hand, the operational-level cooperation was exercised to a lesser extent. It is not so obvious how in real-life these levels will interact and furthermore how they will implement the strategic vision of the political leaders. Future exercises shall try to test these aspects as well.

text: Finally, the technical incidents of the exercise provided an excellent opportunity for the cybersecurity teams to enhance their capabilities and expertise to deal with a variety of cybersecurity challenges. The operational capacity as well as the technical skills in all participating organisation proved to be at the highest level. Participating teams from noncybersecurity private companies in the Aviation sector analysed the majority of incidents successfully, and proved that their skillset in certainly very high. The only shortcoming in some cases was not the lack of skills but the actual number of available resources for IT security. This is a challenge that has be tackled by the higher management, since the return

text: on investment (ROI) in cybersecurity expertise is definitely high for such critical sectors.

text: KEY FINDINGS AND RECOMMENDATIONS

text: The information gathered during Cyber Europe 2018 was analysed by ENISA. This resulted in an extensive list of over 90 concrete observations. Based on the observations we analysed the consequent challenges and gaps and proposed 80 detailed recommendations.

text: The list below includes the key findings and recommendations from the exercise.

text: 1. EU Member States cooperation at technical level has been improved and proved to be

text: Including the interaction between operational and technical levels, and the strategic guidance of higher political management. The procedures and tools needed in order to implement the framework defined in the EU-level coordinated response to large-scale cyber crises (known as the Blueprint) shall be defined and tested. Responsible: the actors identified in the Blueprint .

text: including structured cooperation and information exchange between private actors and public authorities. Special care needs to be taken during the development of such procedures and tools in order to provide incentives to cooperate and exchange information avoiding unidirectional information flow. When such national-level standard operational procedures for public-private cooperation are established, they should be tested by exercises on a regular basis. Responsible: National cybersecurity authorities.

text: 4. The private sector shall identify IT security as a priority and invest in resources and

text: expertise. Especially when the services they are providing is essential for the society.

text: Responsible: private sector entities of essential or critical services.

text: 5. Organisations, public and private, must ensure that they have crisis communication

text: protocols in place and that employees in sensitive positions are aware of these protocols. Responsible: all organisations, private and public, that may be subject to cybersecurity incidents.

text: 6. Cyber Europe has been established as the main EU cyber crisis management exercise. The participants unanimously agreed that the exercise has proven to mature. The challenge is to keep the exercise standards at the highest level. Responsible: ENISA and Member State authorities responsible for the planning of the exercise.

text: I

text: PART I EXERCISE OVERVIEW

text: 1.1 GOALS AND OBJECTIVES The main target audience of the exercise was comprised of professionals and organisations Cyber Europe 2018 goals built upon those set in involved in information security activities in the Cyber Europe 2016, following an in-depth assessment Aviation sector. Some participants chose to involve of their relevance performed in the after action report players from other sectors as well, as indicated of the latter exercise . in Figure 3.

text: G1. Test EU-level cooperation processes. In total, 892 participants officially registered for the exercise, representing the 28 EU Member States, G2. Provide opportunities for Member States to test 2 EFTA countries (Norway and Switzerland), several their national-level cooperation processes. EU institutions and agencies and one international organisation in the Aviation sector (Eurocontrol/ G3. Train EU- and national-level capabilities. Network Manager ).

text: The goals of the exercise are high level. These have Out of the total participants, around 60 % were from been analysed into concrete objectives that drove the private sector. Figure 3 — Sectorial representation the exercise design. The following table presents the in CE2018 illustrates the percentage of the different decomposition of the exercise goals into objectives. sectors representation in CE2018.

text: 1.2 TARGET AUDIENCE AND PARTICIPATION

text: Participation in Cyber Europe 2018 was limited to organisations from the European Union

text: institutions, European Union Member States and European Free Trade Association member countries, both the public and the private sectors in

text: these countries. 3 These figures account only for those Participants who registered in the Cyber Exercise Platform. Several organisations chose to use one account and distribute exercise information between multiple participants. As a result, one can assume the actual total number of Participants was effectively significantly higher. 2 https://www.enisa.europa.eu/publications/ce2016-afteraction-report 4 https://www.eurocontrol.int/network-manager

text: Table 1. CE2018 Goals and objectives Figure 1. Overall participation in CE2018 PART I. Exercise overview Figure 1. Level of participation per country Figure 3. Sectorial representation in CE2018

text: 1.3 PLANNING AND SET-UP Nov-Dec 2017: Invitations to Participants;

text: 6-7 Mar 2018: Final Planning Conference (FPC); The key planning dates of exercise and delivery were the following: 3 May 2018: Dry-run meeting;

text: 11 May 2017: Initial Planning Conference (IPC); 6-7 Jun 2018: Exercise Conduct — Distributed/ Exercise Control in Athens; 17-18 Oct 2017: Main Planning Conference (MPC);

text: 28 Nov 2018: Exercise AAR Conference.

text: Cyber Europe 2018 followed the same set-up as the exfiltration, traffic capturing and logging, keylogging, second phase of CE2016: ransomware, hybrid attacks with drones, IoT infectors, worms, etc. It was a 2-day distributed exercise, during normal working hours, though the players were allowed The exercise realism was enhanced with a large to play continuously, as they wished; number of injects being delivered within the Exercise The players were remote, usually at normal place Universe of ENISA’s Cyber Exercise Platform (CEP). of employment or in incident cells; The Universe included a number of emulated realworld platforms: Injects were sent to players based on which they should have reacted appropriately; Mainstream media outlets There was a single Central Exercise Control Social media (ExCon) at ENISA in Athens; Websites of key exercise simulated entities Exercise moderators representing all participating Yellow pages countries supported execution at ExCon; Local monitors supported players at national or The detailed scenario of the exercise consisted of local level; numerous materials including: Injects and support was available during normal Structured and unstructured, useful and working hours, though the players were allowed misleading data scattered in simulated online to play continuously, as they wished. blogs, magazines, forums and file storage

text: infrastructure;

text: The Cyber Europe 2018 was an all-inclusive cybersecurity exercise building upon: Thousands of simulated personal and professional social media profiles on multiple technical cybersecurity incident analysis;

text: simulated platforms; business continuity and crisis management,

text: A simulated news channel, depicting the including media pressure handling; event through filmed news in a realistic fashion, intra- and inter-organisational cooperation at supported by simulated formal news websites national and international levels; containing hundreds of news articles and

text: formal news websites;

text: escalation; Hundreds of tailor-made documents supporting

text: situational awareness.

text: the scenario for Participants to analyse, from technical incident material to legal and public 1.4 SCENARIO affairs documents.

text: The scenario was set around the concept of Finally, during the exercise, live media pressure was the worldwide rise of extremism. This ‘virtually simulated by real journalists who were continually invisible’ phenomenon has turned into an open and contacting players to ask for information. Real-time widespread one with several different facets, from response by the experts was noted, while dynamic religion to political beliefs, engaging thousands of media reactions in simulated social media were followers and millions of supporters. The number of added by the journalists. radical websites has increased exponentially since 2013 and extremists are utilising social media to recruit and organise. 1.5 EVALUATION

text: The increase of the followers of this extremism lead In order to evaluate the exercise against the to their engagement in cyber-attacks. Radical groups objectives and key performance indicators could use advanced or less advanced techniques to presented in Section 1.1, ENISA collected feedback strike at any time as they revealed the internet to from Participants of Cyber Europe 2018, as well as be a hotbed of radicalisation; ‘Now on the internet, statistics from the different exercise platforms. radicalisation can occur instantly and anonymously Evaluation survey results (see Annex C); within significantly larger and more geographically distributed groups’. A new radicalistic movement, Observation and status reports; without a central organisation has a powerful arsenal of cyber-attack techniques with capabilities, such as

text: PART I. Exercise overview

text: Platforms ( ) logs; established, they should be tested by exercises on a regular basis. Responsible: national National and EU integrated situation reports; cybersecurity authorities. Audioconference minutes. 4. Private sector shall management shall identify IT Observations, challenges, recommendations security as a priority and invest in resources and and actions drawn from the analysis of the findings expertise. Especially when the services they are highlighted in the elements mentioned above, are providing is essential for the society. Responsible: analysed on the basis of the exercise goals as follows: private sector entities of essential or critical services. Findings related to EU-level cooperation; 5. Organisations, public and private, must ensure Findings related to national-level cooperation; that they have crisis communication protocols in Findings related to training at national place and that employees in sensitive positions and EU levels; are aware of these protocols. Responsible: all organisations, private and public, that may be Findings related to exercise organisation. subject to cybersecurity incidents. 6. Cyber Europe has been established as the main 1.6 KEY RECOMMENDATIONS EU civilian exercise. The participants unanimously agreed that the exercise has proven to mature. Based on the findings ENISA proposed 80 The challenge is to keep the exercise standards recommendations. The key recommendations are at the highest level. Responsible: ENISA and given below: Member State authorities responsible for the planning of the exercise. 1. EU-level cooperation at technical level has been improved and proved to be efficient. Minor issues with cooperation structures and tools can be easily treated by the CNW. Regular exercises, trainings and communication checks are important in order to keep the knowledge of procedures and usability of cooperation tools at an adequate level. Responsible: CSIRTs Network and ENISA (as the Secretariat). 2. EU-level cooperation at operational-level shall be further developed and tested. Including the interaction between operational and technical levels, and the strategic guidance of higher political management. The procedures and tools needed in order to implement the framework defined in the EU-level coordinated response to large-scale cyber crises (known as the Blueprint) shall be defined and tested. Responsible: the actors identified in the Blueprint. 3. At national-level countries shall develop procedures and tools for coordinated response, including structured cooperation and information exchange between private actors and public authorities. Special care shall be taken during the development of such procedures and use of tools in order to provide incentives to cooperate and exchange avoiding the negative feelings when information flow seems to be unidirectional. When such national-level standard operational procedures for public-private cooperation are

text: ABOUT ENISA The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found online www.enisa.europa.eu. ENISA Athens Office European Union Agency for Network and Information Security 1 Vasilissis Sofias Str 151 24 Marousi, Attiki, Greece ENISA Heraklion Office in Crete European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece Catalogue number: TP-06-18-410-EN-N ISBN: 978-92-9204-287-5 DOI: 10.2824/369640 enisa.europa.eu


text: CYBER EUROPE 2022: AFTER ACTION REPORT 3

text: CYBER EUROPE 2022: AFTER ACTION REPORT 5

text: CYBER EUROPE 2022: AFTER ACTION REPORT 7

text: These figures account only for participants who registered on the Cyber Exercise Platform. Several organisations chose to participate using a generic functional mailbox and distributed exercise information among multiple participants and teams. As a result, it is safe to assume that the actual real number of participants was significantly higher.

text: CYBER EUROPE 2022: AFTER ACTION REPORT 9

text: CYBER EUROPE 2022: AFTER ACTION REPORT 11

identifier: Cyber Europe 2022: After Action Report

title: Cyber Europe 2022: After Action Report

text: EUROPEAN UNION AGENCY FOR CYBERSECURITY Cyber Europe 2022: After Action Report ER EURO B P Y E C 2 0 22

text: CYBER EUROPE 2022: AFTER ACTION REPORT

text: Findings from a PAN-EUROPEAN cyber crisis Exercise DECEMBER 2022 CONTACT To contact the authors, please use exercises@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu. AUTHORS ENISA: Nikolaos Christoforatos, Iﬁ genia Lella, Evangelos Rekleitis, Christian Van Heurck, Alexandros Zacharis LEGAL NOTICE This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to

text: Regulation (EU) No 2019/881

text: . ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources, including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication. COPYRIGHT NOTICE © European Union Agency for Cybersecurity (ENISA), 2022 This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”. Cover image © queezz, shutterstock.com For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. Print ISBN 978-92-9204-606-7 DOI: 10.2824/385167 TP-04-22-224-EN-C PDF ISBN 978-92-9204-603-3 DOI: 10.2824/397622 TP-04-22-224-EN-N

text: CYBER EUROPE 2022: AFTER ACTION REPORT

text: Findings from a PAN-EUROPEAN cyber crisis Exercise EUROPEAN UNION AGENCY FOR CYBERSECURITY 21 TABLE OF CONTENTS PART I EXERCISE OVERVIEW 5

text: 1 INTRODUCTION 5

text: 2 GOALS 5

text: The 2022 edition aimed to achieve the following Goals: 5

text: 3 OBJECTIVES 6

text: 4 SCENARIO 6

text: 5 TAKEAWAYSFROMTHEEXERCISE 11

text: GENERALTAKEAWAYS 11

text: Cyber Europe 2022 Goals and Objectives 11 The future of Cyber Europe 12 Participating entities and sectors 12

text: I

text: PART I EXERCISE OVERVIEW 1 INTRODUCTION 2 GOALS

text: Cyber Europe is a series of EU-level cyber incident Cyber Europe 2022 was designed to fulfil a list and crisis management exercises organised by of Goals (G). These Goals were developed to provide ENISA. It is aimed at both the public and private the organisers and the participants with a clear scope sectors from the EU and EFTA Member States. and a purpose for their participation in the event.

text: The exercises simulate large-scale cybersecurity The 2022 edition aimed to achieve incidents that escalate into cyber crises, offering the following Goals: opportunities to analyse advanced technical cybersecurity incidents but also test participants on G1. Test EU-level technical and operational their capabilities for dealing with complex situations. cooperation during cyber-crises

text: The exercises aim to test the participants’ readiness and capacity to tackle challenging and G2. Provide opportunities to test local-level incident

text: realistic cyber crises. response and resilience plans

text: The exercises are organised by ENISA together with G3. Train EU- and local-level technical capabilities. planners from participating countries and institutions. These Goals were complemented by the following Cyber Europe 2022 aimed to accomplish several Goals secondary (also known as implicit) Goals: and Objectives which are detailed below.

text: Help to build trust

text: Engage the private sector

text: Improve situational awareness

text: Testthepublicaffairsresponse

text: Improve the exercise’s process and capabilities.

text: 3 OBJECTIVES 4 SCENARIO

text: The Goals of Cyber Europe 2022 were designed to Cyber Europe 2022 revolved around the healthcare remain broad and all-encompassing. To further ecosystem and tested the resilience of several assess the relevance and the added value of the relevant stakeholders, including national Computer exercise, specific Objectives (O) were derived Security Incident Response Teams (CSIRTs), from the Goals. Each Objective was assigned cybersecurity authorities, ministries of health, specific metrics for evaluation purposes in order healthcare organisations such as hospitals and clinics, to facilitate assessment of the extent to which they eHealth service providers, and health insurance were achieved. providers. The participants had to address an

text: escalating cyber crisis, tackling multiple incidents

text: The different Objectives targeted by this exercise are simultaneously. described below, categorised per Goal. The scenario aimed at realistically mimicking

text: G1. TestEU-leveltechnicalandoperational technical incidents. These incidents are detailed

text: cooperation during cyber-crises in Figure 1 below, which highlight how they covered O01. Test the quality of information-sharing several elements, with some aimed at gaining a O02. Test incident response capability at EU level foothold and others aimed at tampering with medical O03. Evaluate situational awareness devices. The second figure describes the sectors O04. Test the articulation between the technical and targeted by the attacks and their potential impacts. operational levels O05. Test the operational coordinated handling of The objective of the scenario was to enable the public communication players to react accordingly to each incident in order to minimise the damage incurred, with G2. Provideopportunitiestotestlocal-level the general objective of testing the operational incident response and resilience plans and technical layers. The scenario, which spanned O06. Provide opportunities to participants to test two days, began on the first day by engaging their intra-organisational procedures, if they the participants around a disinformation exist (Business Continuity Plans (BCPs), Crisis campaignof manipulatedlaboratoryresults Management Plans, etc.) and a cyberattack targeting the networks

text: O07. Provide opportunities to participants to test of European hospitals as well as internet

text: cross-organisational cooperation and cloud serviceproviders.

text: O08. Provide opportunities to participants to

text: test local-level cooperation activities and/or contingency plans, if they exist

text: G3. TrainEU-andlocal-leveltechnical capabilities O09. Provide opportunities to train in a wide variety

text: of cybersecurity and crisis management skills

text: O10. Identify training needs for the future

text: The aim was to achieve the Goals and Objectives by means of the main Cyber Europe 2022 scenario presented in the following subsection.

text: PART I. Exercise overview Figure 1. Overviewofthetechnicalscenario

text: Medicaldevicetampering

text: GAIN DATA LOSS DATA EXFILTRATION/ HUMANLIFE FOOTHOLD GDPR VIOLATION/ ATRISK DATA LOSS

text: Spearphishing Tampered medical Medical data Implantable attack laboratory server attacks cardiac device instrument cyber-attack Drive-by infection

text: Infected document

text: Attacks through Ransomware Vulnerable IOTs unsecure wi-fi infection (temperature Legend: control, data leaks) Type Attack through Data loss through fileless malware unrecoverable Multiprotocol data

text: encryption stealer OSINT incident

text: Maliciousinsider

text: Insider threat Non Robocall Technical attacks

text: Figure 2. Targetedsectorsandpotentialimpactoftheattacks

text: Sensitive (medical) Sensitive (medical) Mainstream news outlets or confidential data for sale or confidential data loss covering major attacks/events on the darknet

text: Threats of exposing sensitive Compromised integrity Cyberphysical attack (medical) or confidential data of sensitive medical data (pharmacy storage) via social media

text: Misuse of resources (cryptominer)

text: TARGETS

text: Government Industry Networks Helthcare providers

text: Figure 3. CyberEurope2022planners PART I. Exercise overview Figure 4. ParticipantsperSector

text: Healthcare and Public Health Public/Government Facilities and Services

text: ICT– Information Security

text: ICT – Telecommunications

text: Defence/military

text: ICT – Internet and Digital Services Emergency and Security Services

text: Energy – Electricity

text: Academia and Research ICT – Hardware/ Software industry Entertainment and media

text: Other

text: 0 50 100 150 200 250 300

text: Entities Players

text: In total, 918 participants (planners, players and monitors) officially registered for the exercise, representing the 27 EU Member States, 2 EFTA countries (Norway and Switzerland) and several EU institutions and agencies (including CERT-EU, EAAS, EDPS, EUSPA, EUROPOL and the European Commission). As illustrated in Figure 4, the Healthcare and Public Health sector was the most widely represented sector, but participants came from a wide range of sectors.

text: Figure 5. NumberofEmailsandNumberofAffiliationsperParticipatingSector

text: CountofAffiliation

text: Count of Email

text: 0 0 50 100 150 200

text: Academia and Research Defence/military Emergency and Security Services Energy – Electricity Entertainment and media Healthcare and Public Health ICT – Hardware/Software industry ICT– Information Security ICT – Internet and Digital Services ICT – Telecommunications Other Public/Government Facilities and Services

text: The figure above illustrates the number of emails The programme was an opportunity for (i.e. personal emails) and affiliations (i.e. functional stakeholders to engage in fruitful discussions, mailboxes) per participating sector. exchange lessons learnt and discuss opportunities for future collaboration. An observers programme ran in parallel to the execution of the exercise, with representatives from EUIBAs (EU Institutions, Bodies and agencies) and the international cybersecurity community present in the ENISA offices in Halandri (Athens) during the two days of the exercise.

text: PART I. Exercise overview Figure 6. CyberEurope2022observers 5 TAKEAWAYSFROMTHEEXERCISE GENERALTAKEAWAYS

text: Cyber Europe 2022 Goals and Objectives

text: Following the completion of Cyber Europe 2022, a survey was circulated to collect feedback The Goals and Objectives set by Cyber Europe from the participants. The data collected was 2022 (CE2022) were mainly achieved. In a nutshell, complemented by findings from the planners collected CE2022 provided the testing and training during the exercise, observations from the ENISA opportunities to the participants that were stated exercise team and finally analysed by ENISA. in the main Goal.

text: The detailed findings were compiled in a report

text: shared with the planners. Themoredetailedanalysisconfirmedthatthe

text: exercise also achieved secondary (implicit) goals.

text: One key takeaway is that Cyber Europe 2022 can be Although not every participating entity was able to regarded as having been a success as all parties engage in all secondary areas, the exercise scenario

text: involvedidentifiedareasforimprovement. This offeredtheopportunity to all participating countries

text: proves that Cyber Europe is helpful in identifying and institutions to do so. what works, but also where there are shortcomings

text: Theuptakeofthedetailedfindingsatthe

text: and areas for improvement.

text: Objectives level, which were shared with the

text: planners, should result in the improvement of The lessons learned from the participants in Cyber

text: procedures, communication and coordination

text: Europe were compiled in the following word cloud.

text: processes that are in place at local, sectoral,

text: national, cross-border and EU-wide levels.

text: Figure 7. Wordcloud“Lessonslearnedbytheparticipants” revised guidelines plan good finetune tools communication potential standards procedures stakeholder horizontal streamline clear improved stricter revision better internal inventory improvement

text: The future of Cyber Europe Participating entities and sectors

text: An exercise like Cyber Europe as a training and CyberEurope2022confirmedtheimportance testing ground is needed, as it successfully ofallocatingsufficientbudgetandresources identifiesgapsanddevelopmentpoints to cybersecurity teams in the healthcare across the board in order to improve the sector, given the severity of the challenges linked

text: cybersecurity posture of all participating to cyber-attacks.

text: stakeholders. Cyber Europe 2022 was notably Cyber Europe 2022 provided a training ground

text: able to engage several stakeholders from the for Standard Operating Procedures and Business private and public sectors in collaboration and Continuity Plans. Theexerciseconfirmedthe working together towards achieving a common

text: need for frequent testing at local level in order

text: goal: improving EU-wide coordination during

text: to continuously improve and strengthen the

text: major cyber crises.

text: healthcare sector’s resilience with regard to The ENISA Cyber Exercise Platform (CEP) used cybersecurity threats. for the planning and execution of the exercise couldbenefitfromarefresh in order to be able

text: to be accommodate future expectations and improve the user experience for all involved.

text: CyberEurope2022confirmedtheimportance of preparing optimally for such a large-scale exercise, investing more effort in the preparation

text: of the results in order to produce a more useful output. The preparation helps to better identify gaps and areas for improvement, determines the impact of participating in such an exercise and facilitates recruiting players with different roles.

text: The planners agreed with ENISA’s observations that receiving improved support and training for their crucial role as planners would help them get even more out of future Cyber Europe exercises. It would also help level the playing field

text: for all players. This would ensure the exercise is adequately tailored to local-level specificities.

text: TP-04-22-224-EN-N Cyber Europe 2022: After Action Report ABOUTENISA The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certiﬁ cation schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost the resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu. ENISA European Union Agency for Cybersecurity AthensOffice Agamemnonos 14 Chalandri 15231, Attiki, Greece HeraklionOffice 95 Nikolaou Plastira 700 13 Vassilika Vouton, Heraklion, Greece enisa.europa.euenisa.europa.eu ISBN 978-92-9204-603-3