text: Reference to the report page:

identifier: Foresight Cybersecurity Threats For 2030 - Update 2024

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Foresight Cybersecurity Threats For 2030 - Update 2024

serie: rapporter

text: FORESIGHT 2030 THREATS

type: rubrik

text: THREATS 2030 7 MARCH 2024 FORESIGHT 2030 THREATS EXECUTIVE DIRECTOR FOREWORD

text: In today’s world, the growing reliance on digital technologies, such as AI, across all sectors has introduced both opportunities and threats in the cybersecurity ecosystem. Amidst worldwide geopolitics and natural disasters, cyberattacks have become more sophisticated and hybrid threats have gained prominence.

type: stycke

text: We are currently faced with a rapidly changing cyber threat landscape. To successfully address what the future might bring, we have to continuously adapt our posture, tools and strategies.

text: The EU Agency for Cybersecurity remains committed to its mission to increase the common level of cybersecurity across the EU, by building resilience against the emerging cybersecurity risks and threats. In order to be able to remodel our approach and shield our critical infrastructure, we need to be vigilant to the upcoming cybersecurity trends.

text: The second edition of the Foresight Cybersecurity Threats for 2030 is a result of the applied foresight methodology along with the valuable contributions from cybersecurity experts. This booklet provides a comprehensive overview of the top emerging cybersecurity threats and identified trends that lie ahead and eventually aims to improve preparedness and enable better informed actions

text: Juhan Lepassaar

text: Executive Director

text: SUPPLY CHAIN COMPROMISE OF SOFTWARE

text: DEPENDENCIES

text: WHAT IF… State-sponsored actors insert a backdoor in a well-known and popular open-source library on online code repository. They use this to infiltrate information from most major European corporations and

text: use the information to blackmail leaders, espionage, or otherwise initiate disruptions across the EU.

text: More integrated components and services from third party suppliers and partners could lead to novel and unforeseen vulnerabilities with compromises on the supplier and customer side.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, criminal organisations

text: POTENTIAL METHODS

text: Sabotage, theft, network reconnaissance, malicious code, abuse of information leakage

text: POTENTIAL IMPACTS

text: Disruption, malfunction, data loss, data leakage

text: FORESIGHT 2030 THREATS SKILL SHORTAGES

text: WHAT IF… The skill shortage leads to an increase of online job advertisements that tell attackers the technologies that each organisation is using and the approximate number of empty positions. A state-sponsored

text: actor may use this to their advantage as a part of a larger campaign to tamper with critical infrastructure in another country.

text: Lack of capacities and competencies could see cybercriminal groups target organisations with the largest skills gap and the least maturity.

text: POTENTIAL THREAT ACTORS

text: Cybercrime actors, hackers-for-hire, state-sponsored actors

text: POTENTIAL METHODS

text: Spear phishing attacks, social engineering

text: POTENTIAL IMPACTS

text: Financial damage, outages

text: HUMAN ERROR AND EXPLOITED LEGACY SYSTEMS WITHIN CYBER-

text: PHYSICAL ECOSYSTEMS

text: WHAT IF… Manuals for all legacy OT equipment are available online and studied primarily by state-sponsored groups. Once a vulnerability is found, they target user devices or other IoT products used at the plant.

text: Cyber criminals begin a new form of ransomware in which they bring ?

text: down important infrastructure and demand payment, given that the operator likely lacks the resources to solve the issue themselves.

text: The fast adoption of IoT, the need to retrofit legacy systems and the ongoing skill shortage could lead to a lack of knowledge, training and understanding of the cyberphysical ecosystem, which can lead to security issues.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, cyber criminals, hacktivists

text: POTENTIAL METHODS

text: Tampering, failure of communication links, denial of service, malicious activity, manipulation of information, targeted attacks, brute force, unauthorised physical access

text: POTENTIAL IMPACTS

text: Malfunction, failures and outages, physical damage

text: FORESIGHT 2030 THREATS EXPLOITATION OF UNPATCHED AND OUT-OF-DATE SYSTEMS

text: WHAT IF… Criminals exploit a vulnerability in an unpatched component of critical infrastructure owned by a private company currently going bankrupt which cannot afford the few subject matter experts or the support contract that can respond to the attack. On the other side attackers launch

text: a ransomware attack towards out of date hospital systems that cannot be patched because the manufacturer doesn't provide updates anymore.

text: Everything-as-a-service leads to a multitude of tools and services that require frequent and synchronised updates as well as orchestrated maintenance. This fact along with the skill shortage, results in an extended and unmanageable surface of vulnerabilities that threat actors can exploit.

text: POTENTIAL THREAT ACTORS

text: State-sponsored groups, criminal organisations, hacktivists

text: POTENTIAL METHODS

text: Tampering, failure of communication links, denial of service, malicious activity, manipulation of information, targeted attacks, brute force, malicious code

text: POTENTIAL IMPACTS

text: Malfunction, failures and outages, physical damage, damage/loss, unavailable critical infrastructure 5

text: RISE OF DIGITAL SURVEILLANCE AUTHORITARIANISM /

text: LOSS OF PRIVACY

text: WHAT IF… An authoritarian regime uses their power to retrieve databases of information about individuals who have visited their country, from both public and private entities. They track all those who participated in anti-government protests, put them on a watch list,

text: and subsequently are able to manipulate those individuals’ access to national services like voting, visits to their healthcare providers, or access to other online services.

text: Facial recognition, digital surveillance on internet platforms or digital identities data stores may become a target for criminal groups.

text: POTENTIAL THREAT ACTORS

text: POTENTIAL METHODS

text: Man in the middle, malicious software, use of rogue certificates, abuse of personal data

text: POTENTIAL IMPACTS

text: Privacy breaches, human rights abuses

text: FORESIGHT 2030 THREATS CROSS-BORDER ICT SERVICE PROVIDERS AS A SINGLE POINT OF FAILURE

text: WHAT IF… A state-sponsored actor aims to temporarily cripple a region during an active conflict by installing malware that disrupts all critical functions of the ICT

text: provider. Without operational cities, roadways, and communication channels, ?

text: the region is essentially crippled without the ability for civilians to go about their daily lives and the responsible parties limited in their ability to maintain defense monitoring systems and to collaborate to develop response options and methods for bringing the necessary systems back online.

text: ICT sector connecting critical services such as transport, electric grids and industry that provide services across borders are likely be to targeted by techniques such as backdoors, physical manipulation, and denials of service and weaponised during a future potential conflict.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, hackers-for-hire

text: POTENTIAL METHODS

text: Fraud, theft, corruption, terrorist attack, network traffic manipulation, manipulation of hardware or software, abuse of authorisations

text: POTENTIAL IMPACTS

text: Outages, damage/loss, unavailable critical infrastructure

text: ADVANCED DISINFORMATION CAMPAIGNS

text: WHAT IF… A state-sponsored actor may impersonate a political rival by using deepfakes and spoofing the candidate’s digital identity, significantly

text: impacting election results.

text: Deepfake attacks can manipulate communities for (geo) political reasons and for monetary gain.

text: POTENTIAL THREAT ACTORS

text: POTENTIAL METHODS

text: Fraud, unauthorised access, session hijacking, identity theft, abuse of personal data

text: POTENTIAL IMPACTS

text: Distrust, disinformation, financial damage, foreign information manipulation and interference (FIMI)

text: FORESIGHT 2030 THREATS RISE OF ADVANCED HYBRID THREATS

text: WHAT IF… Hackers are hired by a corporation to investigate the new technology being developed by a competitor. In their quest, they are able to retrieve metadata, view code, and set up a machine learning algorithm that continuously collects changes to the code and then continuously

text: accesses user account to prevent monitoring systems from recognising ?

text: that the attacker is in the network. In parallel they obfuscate the activity by spreading fake news about insider trading and industrial espionage from a third competitor by dropping fake evidence of physical intrusion.

text: Physical or offline attacks are evolving and becoming often combined with cyberattacks due to the increase of smart devices, cloud usage, online identities and social platforms.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, hackers-for-hire, cyber criminals

text: POTENTIAL METHODS

text: Unauthorised access, social engineering, abuse of personal data, remote command execution, malicious activity

text: POTENTIAL IMPACTS

text: Privacy breaches, outages, failures/malfunctions

text: ARTIFICIAL INTELLIGENCE ABUSE

text: WHAT IF… A state-sponsored actor wants to sow discord in a population before an election and manipulates the learning data of a law enforcement algorithm to target specific populations, causing widespread protests and violence. They are also able to deduct information about the political opponents themselves by using an AI analysis of the individuals’

text: whereabouts, health history, and voting history – the correlation of such personal data will likely only be feasible with the use of AI tools.

text: Manipulation of AI algorithms and training data can be used to enhance nefarious activities such as the creation of disinformation and fake content, bias exploitation, collecting biometrics and other sensitive data, military robots and data poisoning.

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, cyber criminals, hackers-for-hire

text: POTENTIAL METHODS

text: Spoofing, denial of service, malicious code, unauthorised access, targeted attacks, misuse of information, man in the middle attack

text: POTENTIAL IMPACTS

text: Biased decision-making, privacy violations, foreign information manipulation and interference (FIMI)

text: FORESIGHT 2030 THREATS PHYSICAL IMPACT OF NATURAL/ ENVIRONMENTAL

text: DISRUPTIONS ON CRITICAL DIGITAL INFRASTRUCTURE

text: WHAT IF… The increasingly common occurrences of fires and flooding result in more frequent power outages, leading to disruptions in connectivity services.

text: Techno luddites weaponise this and perform physical attacks to back up sites.

text: The increased severity and frequency of environmental disasters following climate change may cause several unforeseen regional outages. Redundant back-up sites that maintain the availability of critical infrastructure are also impacted by the massive and extreme weather phenomena

text: POTENTIAL THREAT ACTORS

text: State-sponsored actors, hacktivists

text: POTENTIAL METHODS

text: Tampering, terrorist attack, sabotage, theft, manipulation of hardware

text: POTENTIAL IMPACTS

text: Outages, damage/loss, unavailable critical infrastructure, disruption, malfunction, data loss 11

text: 2030 TOP THREATS CONTINUED

text: 11 12

text: LACK OF ANALYSIS AND TARGETED ATTACKS (E.G. CONTROL OF SPACE-BASED RANSOMWARE) ENHANCED INFRASTRUCTURE AND BY SMART DEVICE DATA OBJECTS

text: Cybercriminals may use the increased amount State-sponsored attackers access space of available data from smart devices and analyse infrastructure, build up their capabilities and it with AI to create behavioral models of their knowledge of the technology, and secure their victims for spear phishing campaigns or stalking. presence to execute attacks. Their aim may Through data obtained from internet-connected be to create infrastructure malfunctions as smart devices, attackers can access information a statecraft tool to sabotage other governments for tailored and more sophisticated attacks. or commercial space operations and systems during geopolitical conflicts. Due to the intersections between private and public infrastructure in space, the security of these new infrastructures and technologies need to be investigated as a lack of understanding, analysis and control of space-based infrastructure can make it vulnerable to attacks and outages.

text: FORESIGHT 2030 THREATS

text: 13 14

text: INCREASED DIGITAL MANIPULATION OF SYSTEMS CURRENCY-ENABLED NECESSARY FOR EMERGENCY CYBERCRIME RESPONSE

text: By 2030, digital currency-enabled cybercrime Manipulation of sensors with connections to will increase rapidly. Cryptocurrencies, and the emergency services may overload services like broad market adoption of them, already have ambulances, police, firefighters, etc. For example, enabled organised crime to expand their reach. call centres may be overloaded with inauthentic Because digital currencies will be very commonly calls or fire alarms may be manipulated to injure used as an investment asset and means of specific individuals or to obscure emergency payment in European markets, organised crime response teams' ability to locate the issue. may be able to expand their targets. This means Similarly, mass panics that overload emergency that cybercrime groups offering professional systems may also be provoked through the use services (cyber-attacks) will be better funded of social media. because of an increase in the efficiency and effectiveness of their efforts.

text: 15 16

text: TAMPERING WITH DEEPFAKE AI DISRUPTING / ENHANCING VERIFICATION SOFTWARE CYBER ATTACKS SUPPLY CHAIN

text: Escalation as a result of AI-based tools. Attackers By 2030, deepfake technology will be widely will use AI-based technologies to launch attacks. used. It may be used as a form of harassment, In order to defend against those attacks and evidence tampering, and provoking social even to launch counter measures, there must unrest. Although there will likely be a rapid influx also be defensive AI-based weapons. Behaviour of verification software that analyses videos and of the AI in these cases is difficult to test, voice to verify the identity of individuals , the measure and control – if speed of response is urgent market demand leads to programmers valued. cutting corners. This software will be highly targeted by anyone wishing to use deepfakes for illegal or unethical purposes.

text: FORESIGHT 2030 THREATS

text: 17 18

text: MALWARE INSERTION TO EXPLOITATION OF E-HEALTH DISRUPT FOOD PRODUCTION (AND GENETIC) DATA SUPPLY CHAINE

text: The amount of genetic and health data Due to increased automatisation and increases tremendously by 2030 and is in digitalization of food production, food supply the hands of many stakeholders in the public chains can be disrupted by a range of threat and private sectors. Vulnerabilities in e-health actors with medium-high resources. Denial of devices and databases containing very sensitive service attacks on packaging plants, for example, and/or genetic information may be exploited can prevent continued food operations; or used by criminals to target individuals or by processed food manufacturing tools may be governments to control populations, e.g., using manipulated to change the compounds in the diseases and genetic diversity as a reason for food itself. Attacks like these can lead to a food discriminating against individuals. Genetic data shortage, economic disruptions, and in the may further be abused to aid law enforcement worst case, poisoning. activities like predictive policing or to support a more regimented social credit system.

text: 19 19 21

text: ATTACKS USING DISRUPTIONS TECHNOLOGICAL QUANTUM IN PUBLIC INCOMPATIBILITY COMPUTING BLOCKCHAINS OF BLOCKCHAIN TECHNOLOGIES

text: In 2030 quantum computing Blockchain has been resources will be made more implemented in nearly all Until 2030, several regionally based widely available, allowing aspects of society in 2030. blockchain technologies are created threat actors to use quantum Unfortunately, security by different groups of governments computing to attack existing expertise in the area of to create an international "gold deployments of public key blockchain did not advance standard". This is driven by a cryptography. Likewise, there significantly, creating a slew societal lack of trust in blockchain is a risk that threat actors of vulnerabilities that may that has accumulated over the last collect sensitive encrypted be exploited in the future. years. Each technology group aims data now, aiming to decrypt it Locally unavailable blockchain to gain a competitive advantage. once quantum computing is technology will, for example, This gives rise to a period of accessible. This is especially prevent access to voting, technological incompatibility of relevant for current digital legal transactions, and even blockchain technology which IDs that use asymmetric security systems. Another leads to failures, malfunctions, cryptography to authenticate. possible attack vector is data loss and the exploitation of exploited by partitioning the vulnerabilities at the interfaces bitcoin network by hijacking of the different blockchains. This IP address prefixes. This creates challenges for ecosystem can cause, for example, management and data protection, duplicated spending and thus furthers distrust, and negatively economic damage. affects trade and GDP growth.

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certifi cation schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

text: ENISA

text: European Union Agency for Cybersecurity

text: Athens Oﬃ ce

text: Agamemnonos 14 Chalandri 15231, Attiki, Greece

text: Heraklion Oﬃ ce

text: 95 Nikolaou Plastira 700 13 Vassilika Vouton, Heraklion, Greece

text: Brussels Oﬃ ce

text: Rue de la Loi 107 1049 Brussels, Belgium

text: enisa.europa.eu https://www.enisa.europa.eu/topics/foresight


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Figure 1: Visualisation of the relationship of NIS Directive to Cyber-security

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: 3GPP CCRA ETSI ISI IIC OAA Platform Industrie 4.0 3GPP SA2 CEN ETSI LI InfluxDB OASIS RIOT 3GPP SA3 CENELEC ETSI MTS-SIG IO-Link OASIS CTI ROS 3GPP SA5 CEPOL ETSI NFV IoT Security ODVA SAE International Foundation 3GPP CT CERT-EU ETSI NTECH IoTivity OGC SensiNact ACDC CIA ETSI SAGE IPEN OIC-CERT SGIP ACEA: CIIAII FIDO Alliance IPSO OM2M Sofia2 AEF CIS FIRST ISA OMA TCG AIOTI CLEPA Fi-ware ISF OMG The KNX Association AllJoyn Contiki GlobalPlatform ISO OneM2M The Open Group Allseen Continua: Health GSMA ISO JTC1/SC27 ONOS The ULE Alliance Alliance Alliance Apache CSA GSMA FASG ISO JTC1/SC6 OPC Foundation The ZigBee Spark Alliance APCERT CSC H2020 ISO JTC1/SC7 Open Connectivity ThingSpeak Forum Arduino: CSCG HGI ITU ITU-D OpenDaylight Thread group ASHRAE DICOM HL7 International ITU ITU-R openHAB TMForum Automation easyway HYPER/CAT ITU ITU-T OpenIoT UDG Alliance ML AVNU eCl@ss ICANN ITU OpenRemote UniverSaal BEREC EclipseIoT IEC LinuxIoTDM OpenStack UPnP Bluetooth ECRG IEEE LoRa Alliance OpenWSN W3C Broadband ENISA IEEE 802 LAN/MAN MITRE OPFNV Weightless Forum Standards Committee C2C-CC Enocean Alliance IEEE P2413 Mosquitto OSCE Wi-Fi Alliance CA/B Forum ERTICO - ITS Europe IETF NATO OSGi Alliance WWRF Cable Labs ETSI IETF IRTF NATO CCDCOE OWASP Calypso ETSI CYBER IETF MILE NATO LIBGUIDE Paho CCC ETSI E2NA IETF SACM NIST Particle CC-Link ETSI ESI IHE Node-RED PI International

text: Table 1: Significant Cyber Security Standards fora

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Figure 2: Interfaces of NIS Directive

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Figure 3: Stakeholders of NIS Directive

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

text: Gaps in NIS standardisation

text: v. 1.0 | November 2016

identifier: Gaps in NIS standardisation - Recommendations for improving NIS in EU standardisation policy

nummer: gaps-eu-standardisation

title: Gaps in NIS standardisation - Recommendations for improving NIS in EU standardisation policy

text: Recommendations for improving NIS in EU standardisation policy

text: V. 1.0 NOVEMBER 2016 About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact

text: For contacting the authors please use isdp@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: We would like to thank all those who contributed to this study and reviewed it, specifically the members of various Standard Developing Organisations.

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2016 Reproduction is authorised provided the source is acknowledged.

text: ISBN: 978-92-9204-186-1 doi: 10.2824/975760 Catalogue number: TP-06-16-337-EN-N

text: Table of Contents

text: Executive Summary 4

text: 1. Landscape of the European NIS-related standardisation 5

text: The context for NIS 5

text: European and global efforts in NIS standardisation 6

text: 1.2.1 Critical Infrastructure Protection initiative support to NIS 7

text: Work of Cybersecurity Focus Group (CSCG) 7

text: New context – NIS Directive 7

text: 2. Analysis of the NIS Directive against standards requirements 9

text: 3. NIS Directive requirements 10

text: Overview 10

text: Risk management for networks and information systems 10

text: Impact prevention and minimisation 10

text: Computer Security Incident Response Teams (CSIRTs), Competent Authorities, and Single Points of Contact 11

text: Identification of Operators 11

text: 4. Recommendations 12

text: Annex A: Definitions and abbreviations 13

text: Definitions 13

text: Abbreviations 13

text: Annex B: Summary of NIS Directive technical requirements 14

text: Overview 14

text: Executive Summary

text: This report recommends that the European Commission, with the support of the Member States, pursuant to the NIS Directive, adopt a standards based framework for the exchange of threat and defensive measure information that impacts the functioning of Network Information Infrastructure (NII). The capabilities from this framework underscore NII as Critical Infrastructure of the EU and its Member States.

text: This report recognizes the work already addressed by a number of European bodies including the designated European Standardization Organisations (CEN, CENELEC and ETSI) and the Cyber Security Focus Group (CSCG), the European Reference Network for Critical Infrastructure Protection (ERNCIP), and individual Member States who have already taken steps to facilitate information sharing between Computer Security Incident Response Teams (CSIRTs). The recommendations of this report include extending the technical basis for information sharing in the following ways:

text:  Adopting open standards in threat exchange based on the globally accepted STIX/TAXII/CyBOX platform to be prepared as an European Norm (EN) defining the syntax and semantics of the data and the necessary transfer protocol, and an accompanying guide to the implementation of the standard  Extending the risk analysis and defensive measures capabilities defined in current standards to allow Member States to address the NII and NIS provisions necessary to mitigate risk both at national and regional level. This should be prepared as an EN extending the capabilities already described in ETSI TS 102 165-1, ETSI TR 103 305, ISO/IEC 15408 and in relevant ISO/IEC JTC1 2700x series standards.

text: In making the recommendations above, it is noted that it is not possible to separate provisions for NIS from general provisions for cyber security which have been developed by a broad array of ICT standards bodies and implemented to varying extents by the entities subject to the NIS Directive. A significant concern consists in the fact that EU Regulation No 1025/2012 referenced by the NIS Directive only defines a small handful of organisations as constituting standardization bodies. This is not an accurate reflection of the current state of the market, nor those used within the highly specialized sectors to which the Directive applies.

text: Furthermore, NII, NIS and Cyber security cannot be geographically isolated and applied only to the European Union. This distributed complexity should be considered in implementing of the necessary information sharing required for effective NIS. Thus many of the capabilities of the NII, of commercial necessity, will be implemented using software and hardware from a global market and not a market restricted to the EU.

text: 1. Landscape of the European NIS-related standardisation The context for NIS

text: The Network Information Security (NIS) domain is one of the many dimensions of the multi-dimensional cyber-security landscape that can be visualised as a set of linked questions:

text: 1. What is cyber security? 2. Who or what is affected? i.e. What is the cyber environment? 3. What measures enable protection? 4. What measures enable threat detection?

text: 5. What measures enable thwarting and other remedies?

text: 6. What legal remedies exist?

text: The NIS scope and the scope of what is cyber-security have considerable overlap and whilst the focus of the NIS Directive may be considered as relating to questions 3, 4 and 5 the reality is that the entire set of 6 questions needs to be considered in giving an assurance of NIS as required through the detail to be found in the articles of the NIS Directive. The visual model of the scope of the NIS Directive within Cyber-Security

text: Focus of the Directive

text: is shown in Figure 1.

text: Defense against attack of Network Information Systems shares the same set of fundamental building blocks as any other system. The well-known CIA paradigm (Confidentiality, Integrity, Availability) leads to well-known and understood triples of {threat, security-dimension, countermeasure} such as {interception, confidentiality, encryption}. The role of the CIA paradigm is most often seen in 2 areas: Risk analysis; and, Countermeasure deployment. The CIA paradigm applies equally to NIS as to any other domain in cybersecurity.

text: European and global efforts in NIS standardisation

text: Standards are developed for global markets, and whilst there are some regional localisations that are addressed by the European Standardisation Organisations (ESOs) designated in

text: Regulation (EU) No 1025/2012

text: , the state of the global standards market in the NIS and Cyber-security domain is complex and highly specialized within ICT sectors. Practically the formal recognition processes for technical standardisation has been progressively side-lined by the rapid growth over the past twenty years of what may be termed alternative standards development bodies.

text: The following list enumerates the bodies involved in global cyber security standards whilst a more complete list of bodies is maintained by ETSI in ETSI TR 103 306 and a similar list has been captured in report number 3 of the Cyber Security Focus Group (CSCG).

text: The actual global cyber security standards ecosystem today used by the ICT industry is depicted in Table 1. This ecosystem is, however, so complex and rapidly evolving that it is probably incomplete. The Table

text: reflects the recognition in Recital (32) of the NIS Directive that “standardisation of security requirements is a market-driven process.”

text: Unfortunately, the definition of what constitutes a standard or a specification in the Directive is fundamentally at odds with this recognition by referencing

text: Regulation (EU) No 1025/2012

text: which excludes almost all the bodies cited in Table 1. (Only CEN, CENELEC, ETSI, ISO/IEC and ITU are recognized as standards bodies).

text: An immediate consequence of the diversity of the current standardisation ecosystem, and because of the extremely rapid pace of change, is that it is increasingly difficult to authoritatively determine if gaps in standardization or in capability exist. Any failure to recognize the reality of the ecosystem and the constituent members will gravely harm the aims of the NIS Directive and the harmonization of NII/NIS.

text: 1.2.1 Critical Infrastructure Protection initiative support to NIS

text: The ERNCIP (European Reference Network for Critical Infrastructure Protection) initiative has identified a set of Cyber Security and Network protection standards. However, the ERNCIP work has not addressed NII as a domain in its own right and this needs to be revised. The NII is increasingly a component of all other Critical Infrastructures and this trend is expected to continue to the point that all CI shall have an NII component.

text: Work of Cybersecurity Focus Group (CSCG)

text: Within the EU the core standards bodies (CEN, CENELEC and ETSI) have set up the Cybersecurity Coordination Group (CSCG), transformed into Cybersecurity Focus Group (keeping the same acronym) after withdrawal of ETSI, which main goals include giving strategic advice to the technical committees of European standards developing organisations and EU Institution. In this frame, the CSCG has undertaken extended work emanating from the White Paper "Recommendations for a Strategy on European Cyber Security Standardisation" resulting in a further set of documents aimed at defining the term Cyber Security and the stakeholders involved. As noted above, it is not possible to distinguish capabilities for NII/NIS from the provisions for the general ICT/Cybersecurity domains and thus many of the recommendations of the CSCG apply equally to NIS.

text: New context – NIS Directive

text: Whilst it may be suggested that the NIS Directive imposes new requirements, it is probably more correct to state that the NIS Directive imposes essential requirements for harmonization and interoperability of the attack and defense context. The illustration in Figure 2 identifies the interfaces and operations to be made common for NIS Directive conformance.

text:  NOTE 1: Each Member State will designate one or more CSIRTs. If multiple, the Competent Authority will coordinate  NOTE 2: Processing of personal data pursuant to this Directive shall be carried out in accordance with Directive

text: ; processing of personal data by Union institutions and bodies pursuant to this Directive shall be carried out in accordance with

text: Regulation (EC) No 45/2001

text: Article 1

text: a]

text: As indicated in Table 1, above, there are many bodies proposing standardisation in these areas. The key aspects identified in the NIS Directive are those dealing, as shown in Figure 2, with reporting between a service provider and the CSIRT (variously named as ESP-CSIRT, DSP-CSIRT, PECN-CSIRT, and other-CSIRT) and between the CSIRTs and the Competent Authorities. Internally to the service provider domain are two key sets of actions to be undertaken:  Monitor and defence of the information system  Privacy compliance processing

text: 2. Analysis of the NIS Directive against standards requirements

text: This document provides an analysis of gaps in the standards landscape for Network and Information Security and provides recommendations for further standards development to allow the NIS Directive to be fulfilled and for the wider domain of NII to give assurances of security. An article by article summary of the analysis is given in "Annex B: Summary of NIS Directive technical requirements".

text: The analysis of gaps and subsequent recommendations are derived from an analysis of the NIS Directive to identify where standards are explicitly called for or are mentioned as requirements.

text: The research, however extends beyond the core standardisation requirements of the NIS Directive, but takes into account other areas mentioned in the directive, where standards might be considered helpful, but also reviews where requirements from other areas may potentially overlap or even contradict requirements exposed by the NIS Directive.

text: The analysis of requirements has been mapped against existing standards to identify if such existing standards may form the basis of a NIS framework.

text: Where possible, draft standards and projects at earlier stages have been considered. This is particularly important as the NII and general networking world are continuously evolving and the role of network virtualization, of the greater use of cryptography, and of the evolution in the role of virtual operators of networks and services, has been taken into account in identifying the broad set of requirements for NIS.

text: In line with the objectives of the NIS Directive, a strong focus was given to generic process-oriented standards for cyber security in organizations (risk management, information sharing, etc.). Conversely, cybersecurity standards in NIS Directive Art. 14 essential services sectors (energy, transport, banking, financial markets, etc) were not significantly examined. In other cases, such as NIS Directive Art. 15 Digital Services (cloud computing, IoT, embedded systems, big data, etc.), dedicated cyber security standards (e.g. public key infrastructure) were taken into account. The highly disparate sectors made it infeasible to take into account all the standards in a comprehensive fashion within a single focused analysis.

text: Within the recommendations, attention was given to the existing initiatives that could benefit from synergies with work in standards, especially involving contractual Public-Private Partnerships (cPPPs) and Horizon 2020 (H2020).

text: 3. NIS Directive requirements Overview

text: As a result of performed deconstruction of NIS Directive, several distinct areas have been identified, where specific requirements can be reflected in standards. A more in depth review is given below that expands upon the article-by-article review of Annex B.

text: Risk management for networks and information systems

text: Articles 14 and 15 of the NISD require “appropriate and proportionate technical and organizational measures to manage the risks posed to the security of networks and information systems” for operators of essential services and digital service providers respectively. With regards to the latter, the NISD specifically requires to take into account:

text:  security of systems and facilities,  incident management,  business continuity management,  monitoring, auditing and testing,  compliance with international standards.

text: Recent activity in ETSI has led to the publication of ETSI TR 103 305 addressing the role of ICT in Critical Infrastructure. It contains detailed consideration of the role of business continuity management, risk analysis and incident management. Whilst ETSI, in its Technical Committee CYBER, has committed to the extension of this work, there is still no formal plan in place to accomplish this task. Some work has also been done in ISO/IEC JTC1 SC27, which addresses risk and security management in the ISO 27000 series of management documents.

text: Furthermore, ETSI has published a modified set of controls for cyber security. In a similar fashion to the ICT for CI work, they will be further refined in normative specifications in due course. Additional work that addresses event detection within the context of risk analysis and incident management can be found in the following specifications:  ETSI GS ISI 004 V1.1.1 (2013-12): Information Security Indicators (ISI); Guidelines for event detection implementation  ETSI GS ISI 002 V1.2.1 (2015-11): Information Security Indicators (ISI); Event Model A security event classification model and taxonomy

text: As part of the rapid evolution and extension of the existing specifications for Structured Threat Information Expression (STIX), Trusted Automated eXchange of Indicator Information (TAXII) and Cyber Observable eXpression (CybOX) within the OASIS (standardisation body with which ETSI cooperates closely), additional risk and event categorizations are being added.

text: Impact prevention and minimisation

text: As noted, Articles 14 and 15 of the NISD require appropriate technical and operational measures "to prevent and minimise the impact of incidents affecting the security of the networks and information systems" for operators of essential services and digital service providers respectively. The Critical Security Controls specified in TR 103 305 are especially relevant, and efforts are underway to adjust the controls very quickly in response to threat conditions. The topic of risk management is also addressed by ETSI in TS

text: 102 165-1 and ISO/IEC 15408 in the context of security assurance, as well as by some of the ISO/IEC JTC1 27000 series of specifications.

text: There is a significant issue arising from impact prevention, surrounding recovery to an equivalent stable state. This has been addressed in ETSI TR 103 303 with a summary of the concern stated as follows: "If an attacker has exploited systems using "strategy A" which have been successfully immunised against, it is essential that all connected and stakeholder systems that are vulnerable to the same "strategy A" have to be similarly immunised in order to defend against future attacks where "strategy A" is used as a sidechannel attack at a related stakeholder". The reporting of an attack and the means used to immunize the system thus have to be shared, in order to prevent the form of side channel attack indicated.

text: Computer Security Incident Response Teams (CSIRTs), Competent Authorities, and Single Points of Contact

text: In

text: Article 7

text: , the NISD requires Member States to designate one or more Computer Security Incident Response Teams (CSIRTs) "for handling incidents and risks according to a well-defined process, which shall comply with the requirements set out in point (1) of Annex I." Where there are multiple CSIRTs, a Competent Authority within the Member State and a designated Single Point of Contact are also key entities that are part of the structured exchange of information. Annex I further provides an extensive list of required capabilities, such as:

text:  high availability of communications services by avoiding single points of failure and providing several means for being contacted and for contacting others at all times  communication channels clearly specified and well known to the constituency and cooperative partners.  appropriate system for managing and routing requests, in order to facilitate handovers  infrastructure whose continuity of operation is ensured

text: The complete set of entities and associated information exchange architecture resulting from Art. 7 is very complex – as depicted in Figure 2, above. Not only can there be multiple entities within each Member State, among whom information must be exchanged, but there are also equivalent entities in every other Member and Non-Member State that have to be accommodated. It is also foreseeable that some Member States for highly specialized Essential Services will designate third party entities collectively representing the operators (e.g., Information Sharing and Analysis Centres). In addition, foreign providers of digital services must designate domestic representatives for purpose of the NISD requirements.

text: Identification of Operators

text: Article 3

text: a (5) of the NISD requires the Cooperation Group to support a consistent approach among Member States to identify (cf. lit. a-d ) operators of essential services.

text: In identifying NII as a component of CI, the guidance of ETSI TR 103 303 and succeeding work should be considered as the base for future standardization. In particular, ETSI TR 103 303 recommends that organisations should be familiar with the definition(s) of CI in their sector(s) and the government body acting as a point of contact in this area. Any organisation believing that they either meet the relevant definition of CI or will do so in the near future should notify the relevant government body. In the context of NISD, the Competent Authority for NIS may also be considered as the Competent Authority for CI.

text: 4. Recommendations

text: The NISD analysis given in Annex B has identified a small number of gaps in standardisation and some areas of overlap where there is no clear best practice to be adopted. The standardisation analysis has considered a very much wider spectrum of Standards Development Organisations (SDOs) than is implied by the text of Article 16 of the NSID which refers to "internationally accepted standards". The interpretation of this Article for the purpose of presented analysis has been to include standards that have acceptance in the industry from a wide set of bodies. This includes those established under

text: Regulation (EU) No 1025/2012

text: , but should be also extended to the recognised de-facto and industrial groups, thus including groups such as IETF, W3C, OASIS, and established national bodies with international recognition, like FIPS, NIST, BSI and others. A list of such standards bodies with particular roles in Cyber Security, and by inference in Network Information Security, has been published recently as ETSI TR 103 306. It is strongly recommended that this source is adopted as a list of bodies preparing "internationally accepted standards". It is further noted that this list has been summarised in the Cybersecurity Focus Group (CSCG) report number 3 and is presented in Table 1 of this document.

text: The immediate priority is to simplify the standards for NIS that enable interoperability of event reporting and information sharing. The controls for cyber security have been transposed for the EU context in ETSI TR 103 305. Specific recommendations include:

text:  Reach consensus among Member States and major partners on o Architectures, interfaces, and information exchange expressions o Standards and specifications  Given the strong similarities of the NIS Directive and USA Cybersecurity Act, the two implementations should be harmonized to the extent possible, including common architectures, interfaces, structured information expressions and privacy filters  Develop a means for Information Sharing and Analysis Centers (ISACs) and Information Sharing and Analysis Organizations (ISAOs) to fit into the NIS Directive model and architecture  Develop means for Public Electronic Communication Networks or Publicly Available Electronic Communication Service Providers under EU Directive

text: and Trust Providers to fit into the NIS Directive model and architecture  Develop additional border gateway defence and threat exchange standards for one Essential Service (Digital Infrastructure Internet Exchange Points)  Develop a means for NFV, SDN, MEC and other virtualised infrastructures and services to fit into the NIS Directive model and architecture

text: Annex A: Definitions and abbreviations Definitions

text: The following definitions from the NIS Directive apply in the present document:

text:  Network and information system: (a) an electronic communications network within the meaning of Directive

text: , and (b) any device or group of inter-connected or related devices, one or more of which, pursuant to a program, perform automatic processing of computer data, as well as (c) computer data stored, processed, retrieved or transmitted by elements covered under point (a) and (b) for the purposes of their operation, use, protection and maintenance.  Security: The ability of a network and information system to resist, at a given level of confidence, accident or malicious action that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted data or the related services offered by or accessible via that network and information system;  Risk: any circumstance or event having a potential adverse effect on security;  Incident: any circumstance or event having an actual adverse effect on security;  information society service: service within the meaning of point (2) of

text: Article 1 of Directive 98/34/EC

text: ;  NIS cooperation plan: a plan establishing the framework for organisational roles, responsibilities and procedures to maintain or restore the operation of networks and information systems, in the event of a risk or an incident affecting them;  incident handling: all procedures supporting the analysis, containment and response to an incident;  market operator: (a) provider of information society services which enable the provision of other information society services, a non-exhaustive list of which is set out in Annex II of the NIS Directive; (b) operator of critical infrastructure that are essential for the maintenance of vital economic and societal activities in the fields of energy, transport, banking, stock exchanges and health, a non-exhaustive list of which is set out in Annex II of the NIS directive.  Standard: a standard referred to in

text: Regulation (EU) No 1025/2012

text: ;  Specification: a specification referred to in

text: Regulation (EU) No 1025/2012

text: ;  Trust service provider: a natural or legal person who provides any electronic service consisting in the creation, verification, validation, handling and preservation of electronic signatures, electronic seals, electronic time stamps, electronic documents, electronic delivery services, website authentication, and electronic certificates, including certificates for electronic signature and for electronic seals.

text: Abbreviations

text:  ENISA: European Union Agency for Network and Information Security  ETSI: European Telecommunications Standards Institute  NISD: Network and Information Security Directive

text: Annex B: Summary of NIS Directive technical requirements Overview

text: Below is the set of stakeholders identified in the NIS Directive:

text: Basing on the Figure 3, we can identify sets of responsibilities of each stakeholder in the NIS Directive (by article):

text: e ed ssue ssue m Th at s i s i

text: h f le. t o assu vices. ard ard ab e d d

text: vel ser an an s ar tified le efin st st h d m en

text: s ig id ical ical n h ste sential " is un se " sy o es chn chn atio d rt te te th o term rity a a u p t t be o o

text: Observ The sec affecte to sup N N

text: ry C o

text: ard ex lat n u

text: n

text: stand al reg ce e in A n o es

text: ren e tabl e

text: n nati n o n easur o

text: Refe N See o m N

text: f ] e h n o . a t t gh a e e to ty n and h el n atio t o rk p oi a hi g t cret res lev p rm r th this o d in n u h ecuri rity o re wo ei wi ig s o et l a co eas h n ll ap inf n ce d o d e m a defin sha l ensu h s in th an shal an ati an gy ry f t rd te o tain rk te es rm tes ent auth o em o o a iv lat s shal y st Sta ra ain et wo it gu st p y acc st inf sy er ject m m ate n in b b ilit cur IS re o f net St o d sib e em o er f se atio ries al N e and rk and ember al c s n gic an n b tiv n o m o to rity rm iev w u el licy em fo rri irec atio ste atio o et Respo M lev in te D Each M n strate p ach n [The m N sec sy

text: er

text: ld

text: s s s eho

text: ate ate ate

text: stak St St St

text: ed er er er b b b

text: fect em em em

text: Af M M M

text: er b

text: m u n

text: ticle

text: Ar 4 5 6

text: . f n s f o no s r h tio c best reed S ic d ard at n er o ei p f d h io ag te o wit to is b gle M o t cifi o U ared an . It m ed in es ed ctice sin be no ecifica ely tial act s t ed th ers and spe fin y E as b ail e to eral t m lik leads e nu h an prep t m ed st et ini pra es h it le ly t u d re verlap t o CERT entifi as b h an tifi ent M bu n practic ised sp est t r f c re ig o t all m are de s. id e n d s fo A h ge o h a b r specific o pro cut cu n the gen rg m pictu ver IS er o is an o ate erm n s and b is s fo o res la lf a n d er eady o rall ed tha s is S. atio m g a se at p xchan sio n that iden n M alr s. EN ard u tse in ard h rts cite n e cedu ro e f i fu gest t gle harm alysis it n id d ro te av ata e end ractice y all

text: Observ P in general t h CERT repo d they stand sin The is o p an the ove co sug respo gu stand an citatio p b

text: ad r to as n cept ro o fo h ls n b is ard s and n X rt ati o co o o o ard n t e rm d o h . The ati yBO o le C . stand t n an ati ent A rep to ab end wards ain ce inf t n XII/ IS 3 rm em atio o m g st m o an t TA ren EN 5 ag tio m d rin rm ve inf s do 6 an f ac fo o

text: Refe The cite sha 1 m relev o in reco m STIX/ thi

text: g l t e r u b am in o Te rd shal ay a le fo o set m ent se up n sib ts et o n s acc RT p et which en sp m l s s, m o

text: risk Re respo d ire ces I. A CE e c shal cy ") o h an ex t te requ n

text: Sta CERT ed pr e ergen ents h y d f An er m : " o within ilit b efin ) r E -d with t (1 y sib em te after g inci t n u ell ly rit lin in lished p p d w m m ab tho a po an Respo Each M Co (herein h to co in est au

text: er

text: ld

text: s eho

text: ate

text: stak St

text: ed er b

text: fect em

text: Af M

text: er b

text: m u n

text: ticle

text: Ar 7

text: e h red

text: by t ay

text: ts, rities ed to se h er

text: to rr ef m ac be The lish, tho r o be

text: . Tho ll be

text: : " tion efe re t ay tab lities a au r 3 ce wit d ting n d m es d sha which

text: er a

text: ts edu ts lat ll es sion rd )" ite op oc s nee c

text: a 2 an (2 h moda ac co 9

text: mis s pr g ac s s ry h ard n stipu ac

text: mplemen a ompetent p ting e 1

text: e the co ra n tion ed and sion ess entin atio of i g p e Com rticl stand s een c h ted in o m ra eme ired articl litate t a sulta ly el le

text: is ci d op n p p etw n p d ev

text: Observ Th Commis mean the nec fa b a in impl a co to in A im d Im requ

text: X X rk s in rk s in be g a o be g a o ard ed yBO ed yBO ld sfer ld sfer u C (w thi u C (w thi the a n ). the a n ). 7 o usin efin n O 7 o usin efin n O ran o ran o w t d XII/ D w t d XII/ D stand ata ata d ithi ay d ithi ay ticle ce d TA YBER ticle ce d TA YBER ce as as n e an n n e an n ar X/ ean S erw C C X/ ean S erw C C ren r at ed w p d r ar at ed w p d T T ctio o ctio o shar rm n r STI SI shar rm n r STI SI refere refere Refe As fo p to fo fu fo ratifi Eur is un ET As fo p to fo fu fo ratifi Eur is un ET

text: e

text: erat p e o m b

text: rk o o

text: o c affecting yste t

text: w to s n rk" et ") o o n ents rk d tw o ati

text: ent w ne inci rm et o n d o man n y n an inf er secure

text: ilit p tio erati ly p sib a risks o n era rk and o rm p st o sical o o "c o w f ain et trin

text: Respo To ("c ag n The in

text: er

text: ld

text: eho

text: t , n t , n

text: stak en sio en sio

text: ed ean is ean is et rities et rities p p m p p m o o fect m tho m m tho m

text: Af Co au Eur Co Co au Eur Co

text: er b

text: m u n

text: ticle

text: Ar 8 9

text: d ired

text: ate el in d requ e at ent. rd o

text: o m be ad m p o n . m c o ay o e el ical m ev ts and erati s d chn n will b p ac vel o te

text: d o licy t

text: atio ses o te al le n n s po y n the c d t lic elega atio u ee o

text: Observ D Respo n b n P

text: X X s o rk rk s in rk s in e o be g a o be g a o e t t ical ed ed h ard ld sfer yBO ld sfer yBO (w thi (w thi tend ew the u C a ). the u C a ). T no n n 7 o usin efin n O 7 o usin efin n O d s. echn 7 ran o ran o ex w t d XII/ D w t d XII/ D n ram . stand ata ata an f es d ithi ay d ithi ay g practic o 2 ticle ce d TA YBER ticle ce d TA YBER ere the t ce as as 1 n e an n n e an n h licy s licy X/ ean S erw C C X/ ean S erw C C rkin cati r ar r ar ical gh ren at ed w p d at ed w p d articl u T T act po po ctio o ctio o end m shar rm n r STI SI shar rm n r STI SI p wo d chn d refere refere Refe As fo p to fo fu fo ratifi Eur is un ET As fo p to fo fu fo ratifi Eur is un ET im to an te specifi Ext an fro thro

text: g to gs se n n n

text: rk" rm o entin fo pla n n tw e warni o respo lem o h n y o p ne f t ed n m o earl erati at erati o ed p f i p n in o as e o o b h o o t rd erati atio "c o p ce m o eans S c o rm o e g" an m NI y a c co fo in fr y n n f ilit " in b o via th o arn assur t, sib the ge p n atio rk" e n ed o y w ve o a Uni rm iv w us cha arl gi ad fo et

text: Respo To ex "e To in rece n To acts,

text: er

text: ld

text: eho

text: t , n t , n n

text: stak en sio en sio sio

text: ed ean is ean is ean is et rities et rities p p m p p m p m o o o fect m tho m m tho m m

text: Af Co au Eur Co Co au Eur Co Eur Co

text: er b

text: m u n

text: ticle

text: Ar 10 11 12

text: w r n ay t Es o BOX io m ly, al n ey o M is y fo ain r h th at st o the ilit /Cy be o r S t ch er easi litic o o in es ly XII p tners fo o re p t ar is n a c ed f p ar d and o o e be c h ent in entiti m ee ay sponsib sup X/TA al p n ticul has m se g t d xclud e n al ar le m cha h re STI o o in e ay an p t e s e d ly n atio gh SD p at h is g m in p e ak in cl im u p h s in the rn h 1 t g t ed. atio 0 e NI to te e t that tho h su ach titie tin ithstan tiat 70 en to t ires t ly p ro es 2 al n iev y precis p o p tw rd m e o ego O u verall

text: Observ Ad ap with in ach n issu n IS ver b who fro o requ sup all

text: g e n h U e in o ard t rtin m re o n so the ISO o o track f f p al y enti s the E er o m e gram d stand e o all ily ered if erati are n ard ecific ent be m s sup us ro m s. ce st p p al att o n ed by with n sp ay fo rk" o ls un fa em ard atio o ard co o o 0 ren m stand CIP t ag gram w rn lies itio tr 0 m p d n an ro et te entifi aid 70

text: Refe This m easily p stand the " n co in The id ERN ap ad p co 2 m stand

text: e

text: cur e

text: n se ised ctur n tio ed

text: o era ag m p rastru o an

text: o m r har inf y c d

text: fo al ilit n an w y risk

text: sib o n atio rks allo o rn w all depl te et

text: Respo Sh in To n

text: n er o

text: ld rs, n s, o trati

text: eho io is

text: , ate in t erat stak St p m en o ed ean Un er t Ad et rities b p p o lic fect m tho em arke b u Af Eur Co au M M P

text: er b

text: m u n

text: ticle

text: Ar 13 14

text: . d ly f e p al p o n ate ssue n o ssue ssue ssue S tsid ked st 4 a s i u s i s i s i se ati NI o 1 o vo be d ard rn in ard ard ard isatio that m be o te r cl cle d n d o te d d d

text: o o o be t sta an te an an an e m o r in Arti st e to st st st a fil eeds t m d s ro is n arise fr th n o ical ical ical ical n be t o o P what is ld n ay d nee f s fr ires har s. I u chn chn chn chn atio o te n m an ay o te te te te lied t ctio o U m et p ivalent. n a requ a a a te t ctio acks t t t m t ro o u o o o

text: Observ Targ co This sh P equ The N b san att the E laws N N N

text: ly to p e e. f d m e o their f im o em o IEC 00 ld e ts o r s h 8 a that nee u s d P h y o ertak sul ard rs it o sc d t is are o ce ard g ISO/ n eria ST S e cur ed) xisting un e re io in and stand d o h erat This c ran NI se Crit f e f t ysis. p end o s t ce gest n stand clu lysis o o m t the rks. assu in and er g o et o m 8 ted ther ard ren sug m o b anal e e e e ve w o ly 0 rin m rren p m n n n n ark ro et ther 54 u o o o o

text: Refe The m p n Co (rec o Cu ap 1 As n n stand risk ana sha such N N N N

text: g

text: re ce f u

text: ce n o entin ail acts ee ss lian n lia p o r f itt ce

text: p lem o m ted m p m s f m pro o -co m n c n entati f i o

text: o m o S Co n view rce le t delega e p se p NI re y fo u n at im ilit e ed sancti ent o e by ado stig 4 is m lish a lish a sib t 1 n to n rag le ab ab rs o p r u inve we d im we est est o arm o

text: Respo P an Enco article acts H to P To To

text: er

text: ld

text: s s s eho es,

text: ate ate ate n n t stak stat St St St en sio sio ed er er er er is is b et rities b b b ean ean p p m p m o o fect em m tho em em em m m

text: Af M Co au M M M Eur Co Eur Co

text: er b

text: m u n

text: ticle

text: Ar 15 16 17 18 19 20

text: a t e u b ssue ssue. ssue s i s i ay s i tho wi m ard ard ard d d d ce an an an st st lian s basis rce st p fo s ical ical m ard n ical n o d e c an o chn chn chn atio te te ver st lt t te a a d a n icu t t we u t o o o iff o Observ N N H so d N

text: ard

text: stand

text: ce

text: ren e e e n n n o o o Refe N N N

text: s n o f visi o o al law n n o D pr o IS to ati licati D n b al f N o IS rn as pu u ce f N D o IS s of y w al jo ien n ci ilit io al la day ffi lish N 0 sib n n ab 2 ed aud in o d sposit n D natio est te IS Respo Tran in To within N In

text: er ld

text: s s s eho

text: ate ate ate stak St St St

text: ed er er er b b b

text: fect em em em

text: Af M M M

text: er b

text: m u n

text: ticle

text: Ar 21 22 23

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece Catalogue Number TP-06-16-337-EN-N

text: PO Box 1309, 710 01 Heraklion, Greece ISBN: 978-92-9204-186-1 DOI: 10.2824/975760 Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu