text: COM(2011) 777 final VOL. 1/2 http://ec.europa.eu/atwork/programmes/docs/cwp2012_en.pdf

text: General public 23% 27% LEAs

text: Industry and security companies 14% CERTs 18% Web monitoring 18%

text: N Source Volume of information Relevance and trust Automation Needs General public (emails, contact forms, phone Hardly available calls…) Low ls o Large Collecting: basic To Web monitoring Processing: widely manual Industry and n Medium o

text: Exchange formats exist but lati u security companies are not widely used eg R CERTs LEAs case-by-case Figure 2 - Sources, showing volumes, relevance and trust, level of automation and improvements needed

text: 17% 26% ISPs roles Evidence collection Intelligence gathering 14% Take down and sinkholing Arrests 15% Curative actions (incl. Patches) 14% 14%

identifier: Report on 7th ENISA CERT Workshop

title: Report on 7th ENISA CERT Workshop

text: Part II: Addressing NIS aspects of cybercrime [Deliverable – 2012-11-15]

text: ENISA 7th CERT Workshop Part II Report

text: Acknowledgements

text: We would like to thank Europol for co-organising this event, especially to Jaap van Oss, Tom Robson and Alexander Schol for their support in organising this event. Our special thanks go to the moderators of the workshop sessions, namely Luc Beirens Federal Computer Crime Unit (Belgium), Dr. Serge Droz (SWITCH) and Vincent Danjean (INTERPOL), the presenters Steve Purser (ENISA), Monika Josi (Microsoft EMEA) and Olivier Burgersdijk (Europol) and to all participants. Further acknowledgement should be given to the ENISA colleagues Jo De Muynck and Andrea Dufkova.

text: ENISA 7th CERT Workshop Part II Report

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Contact details

text: To contact ENISA for this report please use the following details:  Email: opsec@enisa.europa.eu  Internet: http://www.enisa.europa.eu

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

text: ENISA 7th CERT Workshop Part II Report

text: Introduction

text: ENISA and Europol organised jointly the 7th annual CERT Workshop, Part II, as a follow up event to the very successful 6th Annual CERT workshop held last year in Prague, Czech Republic. This year the workshop was held at the Europol premises in The Hague on 16-17 October 2012. The focus remained on cooperation between national/governmental CERTs (n/g CERTs) in Europe and their national Law Enforcement counterparts (LEAs). Out of a total number of 44 participants, 15 represented the national/governmental CERT, 12 the national Law Enforcement Agency (usually the high tech crime units). The other participants were experts from Industry as well as from international organisations. Belgium, Czech Republic, France, Germany, Greece, Hungary, Ireland, Luxembourg, Netherlands, Slovenia, Spain, United Kingdom were the EU Member States that participated as well as Norway and Switzerland. The emphasis was on how to increase an exchange of information on cybercrime threats and the cooperation and collaboration on a practical working level between n/g CERT and LEA communities, both on a national and cross-border level. There is an urgent need for these two communities to collaborate because of their complementary responsibilities. A mutual cooperation can mean a win-win situation for both communities, because both CERTs and LEAs can learn from and support each other in the fight against cybercrime. Currently, in many cases this collaboration is very limited and sometimes even non-existent. The workshop aimed to identify synergies and gaps and practically address these obstacles for cooperation. It was also intended to discuss next steps which need to be taken in order to improve this collaboration in short term. The format of this workshop was very similar to the approach chosen last year and was in essence composed of four keynote presentations followed by three interactive working sessions. Sessions were on the following topics: - Botnet mitigation - Capacity building - Workflows and incident response This report should be seen as a summary of the content presented and discussions which took place during one and a half day lasting workshop. It should be noted that this report represents the views of moderators, presenters and participants that emerged from the debate. It is not exhaustive and only points out the main thoughts and ideas. This is the public version of the report. A similar non public version was sent out to all participants including a participants list and the presentations.

text: ENISA 7th CERT Workshop Part II Report

text: 1 Methodology

text: The goal of sessions was to enable both communities to debate together and address questions such as how the collaboration can be achieved and improved. Each session was moderated by a specialist in the cyber security field. The moderators were suggested by ENISA and Europol and volunteered to lead the groups. The moderators had different methods to approach their sessions and in all three cases there was an intensive debate and discussion taking place. It should be noted that participants were split in three groups and each session was ran three times. This model enabled more room for discussion as the groups were small in size.

text: ENISA 7th CERT Workshop Part II Report

text: 2 Agenda

text: 2.1.1 1st half day (16.10.2012):

text: 13:00- Registration 13:50

text: 13:50- 1st day opening (ENISA and Europol) 14:00

text: 14:00- 1st keynote ENISA, Steve Purser Head of Technical Competence Department 14:30

text: 14:30- 2nd keynote Europol, Olivier Burgersdijk Assistant Director and Designated Head

text: 15:00 of the European Cybercrime Centre (EC3)

text: 15:00- Coffee break 15:30

text: 15:30- 3rd keynote Microsoft, Monika Josi Chief Security Advisor EMEA 16:15

text: 16:15- 4th keynote FCCU, Luc Beirens Head Federal Computer Crime Unit (Belgium) 17:00

text: 17:00- Tour of Europol facilities incl. the new EC3 17:30

text: 19:00- Dinner 21:00

text: ENISA 7th CERT Workshop Part II Report

text: 2.1.2 2nd full day (17.10.2012):

text: 09:00- 2nd day opening (Europol and ENISA) and introduction to the working sessions 09:30 by each moderator

text: 09:30- Working sessions (1st round) 11:00 Session 1: Botnet mitigation Presentation/Moderation: Luc Beirens, FCCU Session 2: Capacity building Presentation/Moderation: Serge Droz, SWITCH Session 3: Workflows and incident response Presentation/Moderation: Vincent Danjean, Interpol

text: 11:00- Coffee break 11:30

text: Working sessions (2nd round) 11:30- Session 1: Botnet mitigation 13:00 Session 2: Capacity building Session 3: Workflows and incident response

text: 13:00- Lunch break 14:00

text: Working sessions (3rd round) Session 1: Botnet mitigation 14:00- 15:30 Session 2: Capacity building Session 3: Workflows and incident response

text: 15:30- Coffee break 16:00

text: Working sessions’ conclusion – presenting the outcomes: 16:00- 16:00 – 16:15 Session 1: Botnet mitigation 16:45 16:15 – 16:30 Session 2: Capacity building 16:30 – 16:45 Session 3: Workflows and incident response

text: 16:45- Q&A 17:15

text: 17:15- Closing notes (ENISA and Europol) 17:30

text: ENISA 7th CERT Workshop Part II Report

text: 3 1st Keynote: Moving Towards a European Cyber Security Strategy Steve Purser, ENISA

text: The first keynote was given by Dr. Steve Purser, Head of Technical Competence Department, ENISA on the topic of ‘Moving Towards a European Cyber Security Strategy’. The presentation started with a brief introduction of ENISA’s history, scope and tasks. As a Centre of Expertise the Agency supports the Commission and the EU Member States in the area of information security. ENISA facilitates the exchange of information between EU institutions, the public sector and the private sector. After the introduction, the speaker elaborated on the topic of cyber security. From a technological perspective, there is little that separates classical information security from cyber security. Cyber security is about securing data and systems in the global environment. It is just the perspective and scope that change. Adopting this point of view, cyber security is by definition a global concern. Due to the nature of this problem, advances in cyber security are most likely to be achieved through political (cross-border) cooperation. Dr. Steve Purser gave an overview of European Member States with a National Cyber Security Strategy (NCSS) in place and noted that there is quite some difference in these strategies. He also briefly mentioned the Cyber Security Strategies of Canada, Japan and USA. There is no uniform way to approach such a strategy and it is clear that many countries have a different focus and scope in such strategies. Towards the end of 2012 the EU Cyber Security Strategy is expected. The main elements of this strategy are likely to be: - Fostering close cooperation and early warning between Member States’ competent authorities and the private sector; - Ensuring adequate capacities and structures for prevention, detection, mitigation and response at national and EU level; - Stimulating efforts to improve security of products, networks and services; - Ensuring a strong EU response to cybercrime; - Supporting R&D investments and strengthening the competitiveness of the EU’s security industry; - Reinforcing cooperation with international partners.

text: ENISA 7th CERT Workshop Part II Report

text: 4 2nd Keynote: The European Cybercrime Centre Olivier Burgersdijk, Europol

text: The next presenter was Olivier Burgersdijk, Head of Strategy and Outreach for the European Cybercrime Centre (EC3). He gave an insight in the new EC3, its role and responsibilities and its place within Europol structure. The EC3 is a part of Europol and its governance. EC3 is governed by a Programme Board consisting of external partners including international organisations such as ENISA and Interpol. The implementation phase has started in 2012 and is expected to be finished in 2014. EC3 has multiple roles. It should function as a Fusion Centre, namely an information hub on cybercrime. The EC3 should: - provide support on cyber operations and forensics; - assist with capacity building (Law Enforcement, Prosecutors, Judges); - reach out to the public and private partners; - have a global view in order to define a strategic response; - provide a collective ‘voice’ for European cybercrime investigators. To achieve these roles, the EC3 has built relations with different partners. The key partners of EC3 are: - Institutional partners (Including Eurojust, ENISA, EU CERTs, CEPOL, EUCTF, Interpol) ; - Law enforcement (Member States, Cooperation partners); - Judicial authorities; - Private Sector; - Universities; - Non-governmental organisations. EC3 defined specific priority crime areas where the centre will focus on. Among others this includes intrusion incidents, cyber-attacks, malware, internet based trade in counterfeit products, payment card fraud and child sexual exploitation.

text: ENISA 7th CERT Workshop Part II Report

text: 5 3rd Keynote: Cybersecurity & cybercrime Monika Josi, Microsoft EMEA

text: The 3rd keynote was presented by Monika Josi, Chief Security Advisor EMEA, Microsoft, on the topic of cyber security and cybercrime. She opened her talk by mentioning some cybercrime ‘realities’ mentioning some specific recent cases such as recent attacks on governments and private sector companies as well as ZBOT . She referred to specific organisational cyber security challenges, namely: - Organizational fragmentation - Lack of communication - Unclear roles and responsibilities - Lack of expertise Cyber security is mostly seen as a national security topic. Reality and recent cases, however, show that the implications of cybercrime and hence cyber security reach all aspects of society. Currently, a lot of governments are looking into establishing a cyber-security strategy as a way to address this issue. There is no one definition of cyber security or cybercrime. Nevertheless, the descriptions and definitions provided by the Council of Europe of cybercrime and cyber security are used frequently. When using this definition, offenses involving Information Communication and Technology (ICT) are related to cybercrime and non-intentional incidents could be considered as purely cyber security related. However, there are also two big areas of overlap, namely offenses by means of ICT and intentional incidents. Very often it is a case that different stakeholders are involved in cyber security, than in cybercrime and cooperation between those stakeholders is in many cases not optimal. From the perspective of Microsoft (and more specifically their Chief Security Advisors and Digital Crimes Unit) cyber security and cybercrime are seen as closely interlinked. This has not always been the case and only very recently have they realised from both sides that they could not be successful without listening and learning from each other. Today, there is hardly a day without communication between Security Advisors and their colleagues from the Digital Crimes Unit. This communication could be on national botnet projects, information sharing and capacity building initiatives. A good way to approach this is to adopt a cyber-security/cybercrime agenda. The speaker referred to some influencing factors for such a comprehensive agenda, namely: - A country’s threat landscape including threat actors and available threat intelligence data

text: ENISA 7th CERT Workshop Part II Report

text: - A country’s IT environment - General technological trends such as Cloud, Consumerization of IT, social media - The local market, e.g. the opportunity to turn cyber security into a competitive advantage to enable economic growth Taking this broader view will help to address all aspects of the ‘cyber-cycle’ taking both cyber security and cybercrime aspects into consideration - Protect information systems (typically the domain of cyber security) - Detect anomalies (combined cyber security/cybercrime approach) - Respond to incidents (combined cyber security/cybercrime approach) - Recover from incidents (typically the domain of cyber security) Important aspects are to see these as a ‘cyber-cycle’ rather than a bullet list and to make sure that there is a close collaboration between cyber security actors, cybercrime fighters, academia and the private sector. The involvement of all the aforementioned parties is important to be able to come to an accurate threat assessment, which will allow a pro-active response to the current threat landscape. Ideally, this collaboration is also fostered by the establishment of a common threat information sharing platform so this assessment and the corresponding response can be made based on a coherent information base.

text: ENISA 7th CERT Workshop Part II Report

text: 6 4th Keynote: Botnet Mitigation Luc Beirens, FCCU (Belgium)

text: The next presenter was Luc Beirens, Head of the Federal Computer Crime Unit (FCCU) of the Belgian Federal Judicial Police and Chairman of the EU Cybercrime Task Force . His speech was about a botnet mitigation issue. The aim of the presentation was an introduction to his moderated session the next day. First the presenter showed some general trends applicable to today. He mentioned an evolution towards the e-society, where persons are replaced by e-applications, where all systems are interconnected, where there is a rise in the amount of mobile devices and where social networks are used increasingly. Throughout these trends, Internet Protocol (IP) is the common platform offered by many Internet Service Providers (ISPs) integrating telephone, data, Virtual Private Networks (VPS), etc. Furthermore Mr Beirens stated that identity fraud is an easy thing to carry out as currently there is a poor security in legacy applications and protocols, and because the end-user is not yet educated to act properly. Cybercriminals mainly want to become rich and powerful in a rapid and easy way. Some of them want to destabilize society. But what is cybercrime exactly? It is a collective noun for many criminal activities. However, a big part of it can be linked to botnets, networks of systems being compromised by malware. Botnets are used for spamming, click generation, dialer installation, spyware/malware/ransomware installation, espionage, etc. They are also frequently used for Distributed Denial of Service attacks in order to disturb the functioning of an internet device. The fight against botnets is hence an important part of the fight against cybercrime. New evolutions that could be seen in the field of cybercrime are: - Political motivated attacks, namely hacktivism; - Apple is no longer out of range and also starts to be targeted; - Mobile device and smartphones are botnets of the future, as they’re always online; - P2P botnets, which are more difficult to fight, as there are no Command & Control servers (C&C) that could be taken down. But do we have accurate statistics for cybercrime? No, we don’t. Victims are sometimes unaware of the incident or the fact that their systems have been compromised. They also try to solve it themselves and rarely file a complaint. This lack statistics is according to the presenter one of the reasons why hackers go on with developing botnets. So what are currently the barriers for an effective combat of cybercrime? The presenter mentioned the following issues: - Lack of awareness and negligence of the victims/end users - Lack of an overall/global view

text: ENISA 7th CERT Workshop Part II Report

text: - Everyone is working on his own - Lack of specialized investigators - Jurisdiction is limited by national borders - Mobility of criminal services To overcome these barriers, everyone has to play a role in cyber security and they have to do it as partners and in an integrated way. The presenter gave insight into the Belgian situation and elaborated further on the topic to introduce his session the next day. The goal of his session is to see where good results in cooperation can be achieved.

text: ENISA 7th CERT Workshop Part II Report

text: 7 Session 1: Botnet mitigation

text: The moderator of this session was Mr Luc Beirens from Federal Computer Crime Unit (FCCU) of the Belgian Federal Judicial Police. The session format was structured in an interactive discussion. Several questions were presented to the participants and various topics were addressed.

text: 7.1 Is botnet mitigation a business case for CERTs?

text: In all sessions it was unanimously stated that botnet mitigation clearly is a business case for the CERT community. However, it became obvious that in various countries the roles of and workflow/approach between LEA and CERTs diverge (e.g. inform victim about infection and advise to report to the police vs. taking down C&C).

text: 7.2 Ongoing and planned projects

text: To the surprise of the moderator hardly any ongoing or planned projects regarding botnet mitigation were known to the participants. This underlines the fact that there is a need for a broader awareness about what all stakeholders in the fight against botnets are actually doing. Communication between the CERT community and LEA can be improved and that projects 6 7 should be made more known. Some of the projects mentioned were botfrei.de , OPTA , etc.

text: 7.3 Prioritization

text: But somewhere in this fight we also have to prioritize. Generally it was acknowledged that work needs to focus on victims, internet infrastructure, end-user, botnet servers and hackers. During discussions the views on this question differ between CERTs and LEA. While LEA clearly argued for a prioritization - amongst others due to limited resources – some CERTs considered all C&C found on national territory worth action, whereas others argued that this was a question of criticality. An interesting opinion was that the responsibility of the ISP regarding bots should be enhanced – if needed through a change of legislation. Also, it became clear that additional progress needs to be made regarding the cooperation between CERTs and LEAs. One remark was to consider cooperation based upon contracts which clearly state roles and tasks for each partner (e.g. cooperation agreements). It has to be noted that this potential approach was not at all shared by all participants.

text: ENISA 7th CERT Workshop Part II Report

text: 7.4 Partners in this fight

text: Groups identified the following partners in the fight against cybercrime. This list should however not been seen as a ranking and complete. The following stakeholders were recognized: - CERTs - LEAs - Internet Service Providers, telecom services, telecom regulators - Antivirus industry - Political decision makers - Judiciary - Intelligence services - Software producers - Hosting industry - National Cyber Security Centers - Financial institutions - Operators of Critical Infrastructure - Academia - ICANN and other registrars - Non-profit organisations e.g. Shadowserver - End-users

text: 7.5 Gaps

text: There also seemed to be a knowledge gap about roles, responsibilities and tasks of each stakeholder and this needs to be overcome in order to build up trust. Mechanisms on how to inform the others should be identified and implemented. It became clear that actions and measures could be taken; however, legal dispositions on who can take down a botnet (legally and practically) remain an obstacle. In various countries the status of CERTs diverges and different CERTs (governmental, private, academia, etc.) are given different powers. Another unanimously acknowledged problem identified was a lack of communication between CERTs and LEA. As a conclusion, it was established that clear roles and responsibilities, a clear vision of who needs which information in which format, could enhance trust which forms a basis for a fruitful cooperation. Some additional problems and questions from a rather practical point of view were also identified and debated on: - Can a botnet be used to send a patch? - Since operators often work with virtual providers, they do not know who their customers really are (problem whom to inform).

text: ENISA 7th CERT Workshop Part II Report

text: - “Take downs” and giving image samples of infected PCs to the Anti-Virus industry may cause civil damage resulting in civil suits. - An analysis of an infected victim PC would require asking consent of the victim. - How do I know (as LEA or CERT) that my counterpart (LEA or CERT) is not focusing on the same target? There is a clear need for common communication procedures. This is an important for example for CERTs to know that they should not disturb an ongoing investigation and evidence gathering. - PPP is essential but requires clear goals and roles for every partner. - Often lack of voluntary cooperation between ISP and hoster to take down C&C indicates a need to start judicial or regulatory procedure. - In some cases LEA is informed; however, the information provided does not fulfill requirements regarding the legality of the chain of custody and is not actionable by police.

text: ENISA 7th CERT Workshop Part II Report

text: 8 Session 2: Capacity building

text: The moderator of the second session was Dr. Serge Droz from SWITCH (Switzerland). The goal was to collect ideas how an improved collaboration between LEAs and CERTs could be achieved. During the discussion, a number of suggestions and recommendations were formulated.

text: Meetings

text: Regular meetings should be held. In the beginning at least, the focus probably should not be on concrete incidents, but on common issues. One CERT reported to offer “Workshops as a service” to facilitate contacts to LEAs. In this context it seems important to manage expectations.

text: 8.1 Liaison officers

text: LEA liaison officer in CERTs could help CERTs focus on the right issues and avoid process/policy errors that might degrade the value of the information provided. Having a CERT member joining a LEA was considered less effective.

text: 8.2 Case studies

text: The availability of a number of successful case studies would help shaping and guiding the start-up of a collaboration. Inexperienced teams could thus learn from existing success stories.

text: 8.3 Data Protection

text: CERTs and LEAs handle data of varying degrees of sensitivities. Try sharing in the obviously simple cases and work your way up to the more sensitive cases, thereby establishing best practices. Sensitive date is already exchanged with financial institutions. Maybe we could learn from there?

text: 8.4 Exercises

text: The CERT – LEA collaboration should be trained in a next exercise. Obviously this implies an already existing collaboration to begin with.

text: 8.5 Prosecutors

text: In many cases prosecutors do not understand the role of CERTs. There is a need to educate and train them to point out the value of CERTs as another actor on the stage.

text: 8.6 Member States’ capabilities

text: A matrix, containing the possible capabilities in each Member State could be useful.

text: ENISA 7th CERT Workshop Part II Report

text: 8.7 Best Practices for management

text: It was felt, that a best practice document for the management (“higher levels”) would be useful. No need was seen for such a document for the operational staff.

text: 8.8 Summary

text: The issue is longstanding and not easily tackled. While all attendees agreed that collaboration must improve and that there are clear benefits from such collaboration, there is a little consent on how this should be achieved. Most participants agreed that regular meetings are essential to improving collaboration. The meetings should not initially focus on specific incidents, but rather on common issues and problems. At a later stage these meetings could be used to discuss specific cases. It seems that a trust model, which is considered to be a key ingredient in successful CERT collaboration, is required for success. Another suggestion that was made was deploying a Liaison Police Officer to a CERT (and possibly also vice versa). While this could potentially be a very effective approach it already requires an existing and good relationship between the two organisations. It could be seen as a possible next step after having built up trust between them. In some countries such liaison officers are already in place at CERT. These countries acknowledged that there is an improved collaboration and understanding of the other organisation’s work a lot since that. Somewhat surprisingly, data protection issues where not considered an issue by some representatives from LEA and prosecutors. However, there are huge differences between Member States on how data can be used in a prosecution.

text: ENISA 7th CERT Workshop Part II Report

text: 9 Session 3: Cooperation/practical aspects of the fight against cybercrime

text: The moderator for this session was Vincent Danjean from INTERPOL. He triggered a discussion on ‘cooperation and the practical aspects of the fight against cybercrime’. Focusing on the incident management workflow, the session concentrated its work on identifying what processes, tools, and synergies are efficient and which need improving. There was no pre-defined set of processes, tools or possible synergies to be discussed. On the contrary, the participants were encouraged and guided to achieve a comprehensive list of all matters to be discussed collectively. All listed items were then regrouped in families and prioritized by the participants. This was achieved using a formal process of recursive brainstorming.

text: 9.1 Inventory of information sources and how they are managed

text: The incident workflow starts with information flows, either for threat evaluation or for actual incident reporting and handling. According to the working group answers, the monitoring of the web and the general public combined, are the source for half of the information collected. The professional world (CERTs, LEAs, and security companies) account for the other half of information sources, each, in almost identical proportions.

text: Most quoted information sources grouped by categories

text: Figure 1 - Information sources by categories Comparing the relevance of the information collected from each source provided a view on which sources are efficient, can be trusted or just create noise.

text: ENISA 7th CERT Workshop Part II Report

text: The Information shared from CERTs is for instance less prone to reveal false positives and consequently, the level of trust and efficiency is high. Generally we could conclude that the volume of information received from a source is inversely proportional to the level of trust the group has from this same source. Automation is found to be a key in the management of information to avoid undue and inappropriate use of the limited resources. Public sources of information are found to be less structured and the management of it is still widely manual. ‘Professional’ information sources are increasingly structured. Information exchange formats exist but they are not yet sufficiently recognized. It was no surprise that only very few of the workshop participants actively use information exchange formatting and automation. Web monitoring for information sources is an interesting case as well. Automated web monitoring tools are emerging and are rapidly adopted by the incident response community (marketing tools are derived from their initial purpose: brand monitoring, Google alerts, etc.). However, the offer not only lacks maturity when it comes to incident response matters but the volumes collected can be overwhelming. We can conclude that collection is increasingly automated but the processing (analysis, correlation, etc.) is far behind in terms of availability of automation. The incident response community currently only handles information when it relates to an already identified issue. This was found mostly due to 4 factors: limited resources, overwhelming volumes, lack of automation, lack of source qualification.

text: Medium

text: ENISA 7th CERT Workshop Part II Report

text: 9.2 Improving triage and alerting processes

text: The participants also concentrated on reasons why triage and alerting sometimes fails or is delayed.

text: 9.3 Need for a global directory

text: Whilst the group recognized the efficiency of face-to-face meetings to build a network of trusted interlocutors, the group also acknowledges a strong need for a global directory. As people change, face-to-face networking shows its limits. The trust established at a personal level now has to be elevated to unit or department level trusts. A pyramidal overview needs to be established to break the silos. The recommendation expressed by the group as a strong consensus was for the establishment of a structured directory; repository of specialized units and their expertise or domains of activity. This global directory shall be designed and maintained by an international body (Europol or INTERPOL are proposed) and follow a structure established under the management of this body, based on the inputs from the community.

text: 9.4 Exchange Format

text: When alerting and time is paramount, translation and misunderstanding will cause undue delays. The information exchanged amongst the different actionable communities need to be shared in a common format AND based on the same understanding of confidentiality and handling rules. This common framework therefore needs to address: o the language barriers o the criteria and accreditation required for the collecting and preserving of what is to be considered valid evidences (or else the information is to be considered as “actionable intelligence”) o the set of possible items to be exchanged and their definitions o the common rules for confidentiality and secure handling. TLP (Traffic Light Protocol) is becoming a fairly accepted and understood set of levels within CERTS, Industry and some Government bodies. But this needs to be balanced with other schemes derived (more or less accurately) from National or military grade confidentiality regimes.

text: 9.5 Lack of human resources or budgets

text: The incident workflow is often failing due to lack of expertise or lack of human resource designed under the current priorities. The group identified several reasons or potential avenues for improvement.

text: ENISA 7th CERT Workshop Part II Report

text: Because all participants reported failures of processing due to lack of resources, automation came to mind as a potential improvement. Automation could indeed free precious human resources and offers the advantage to concentrate on the more rewarding and expert intensive tasks of the incident response workflow. Automation should therefore come concurrent with the delivery of training to optimize reallocation of the human resources freed. Another avenue that clearly stood out of the group reflections is to provide higher authorities with the decision making proofs that incident workflow is key and currently vastly under prioritized. This can be addressed via awareness and reporting. An additional advantage of reporting to and raising awareness to the highest authorities is that the lack of legal framework often quoted as another reason for failure, can also be acted upon by them.

text: 9.6 CERT statuses

text: The statuses of National CERTs widely differ from one country to another. In the light of countries where digital forensics can be delegated to private entities by Law Enforcement, the group found it was urgent to address the legal status and bindings for CERTs (National or not). Some consideration should be given to a legal framework: when working for Law Enforcement or with a view to civil or penal prosecution, the question is asked: would CERTs be legally empowered to collect evidences, should CERTs be the de-facto experts called to testify in court?

text: 9.7 Incompatible priorities

text: Another identified reason for failure or undue delay in processing triage or alerting, is conflicting priorities amongst the actors. Some examples: o While a CERT’s main priority would be to takedown a domain name in order to temporarily disrupt an attack, LEA’s priority would probably be to delay the takedown in order to avoid collateral damage to other ongoing investigations or to gain sufficient time to collect substantial evidences. o While industries main concerns could be related to financial aspects, the general public could be primarily concerned with its safety. National laws and regulations are usually very clear in what is expected of LEAs or what a priority is when it comes to the protection of critical infrastructures. However for the other actors, the regulators have a role to play in order to establish what the obligations are for each party, regardless of their own prime interests. The lack of harmonization of these priorities through the different legal or regulatory systems at international levels compounds this.

text: ENISA 7th CERT Workshop Part II Report

text: 9.8 Way forward, next generation incident response workflow

text: The group created a large matrix of actors versus actions required in incident handling. Each individual in the group was given five ‘priority points’ to be posted on actors, actions or interactions that they believed called for the most urgent improvements or attention.

text: Votes

text: Figure 3 - Votes for top actors, actions or interactions. As is clearly seen in the above graph, Internet Service Providers come first. This is not a big surprise as they have a major role to play in almost all the steps in incident management. The other priorities selected as the top ones have received approximately the same number of votes.

text: 9.9 Internet Service Providers’ role

text: With the strong take on Cloud computing, one should think of ISPs not only as carrying data but also as hosting, content or value-added service providers. Security around these services is such that investigations will be even more of a challenge if the ISP does not cooperate. The role of the ISPs is amplified by the fact that some actions are required from them in the very first steps of the mitigation phase and are therefore urgent. Additionally, lack of cooperation from the ISPs in the evidence collection process will strongly impact the investigations. LEA investigations demonstrate that malicious people choose their service providers (VPNs, servers, proxy services…) based on the ISP’s policies towards logging and cooperation with Law Enforcement.

text: ENISA 7th CERT Workshop Part II Report

text: Several reasons were quoted by the group: - Lack of resources (ISP staff and price of storage space for logging) - Privacy laws used as a shield to evade logging obligations (IP address as personally identifiable information…) - Fear of negative publicity

text: However, we have examples, including in Europe, where ISPs were not given choices as to whether they want to cooperate: civil law suit, Microsoft vs. servers of the Bredolab botnet or criminal law suits were LEA seized several servers and strongly disrupted the services of an ISP who refused to act upon a court order to help extract the relevant logs.

text: 9.10 Intelligence and evidence collection

text: Intelligence and evidence handling were treated as one since up to now; they were mostly performed by the same experts. The concerns encountered by the group could be addressed in a common Standard Operating Procedure. This SOP would have to describe: - The obligations towards monitoring, sharing and knowledge building - The formats for exchange - The legal frameworks - The data quality insurance criterion

text: The judicial system was found by the group to be lacking expertise. CERTs have this expertise and could either train or are empowered to act on behalf of the judicial system (see “CERT statuses”, above).

text: 9.11 Takedown and sinkholing

text: Takedowns and sinkholing are techniques used to heavily disrupt a botnet, fraud, phishing scam etc.. Whilst terminating resources in the chain of the fraud may deter or discourage criminals, in effect it merely just displaces the issues elsewhere. Victims are left unaware of the issues and collateral damages are to be expected (other licit services may suffer from the termination). The international legal framework needs to address how incident management communities can legally contact potential victims (see below “curative actions”). This legal framework shall also document how botnets’ Command and Controls distributed over servers in several jurisdictions can be taken down. Big private institutions may have resources to coordinate civil law actions in each jurisdiction, but how does this compare to the capacities of the penal (criminal law) system or the CERT communities?

text: 9.12 Curative actions

text: By curative actions the group discusses the means we have to fix a known issue. For this, botnets are a classical example. The botnet servers may be killed and criminals convicted but victims’ machines remain infected with malware long after this.

text: ENISA 7th CERT Workshop Part II Report

text: Product vulnerabilities are disclosed every day and exploits are soon freely available. What are the responsibilities of the company creating the products, of the company using these products and of the end users using these products sometimes unwittingly? The incident management community can help alerting the victims but are often not legally authorized to do so. As mentioned previously, the legal system shall define whose responsibility this is and the legal framework applicable to it. When it comes to internet, the end user has a contract with its Internet Service Provider. This could be the only way to legally contact the end user and help enforce curative actions on their machines. These simple rules exist when we want to use the motorway, why not for the internet?

text: 9.13 Arrests

text: When discussing arrests, international aspects are soon on the agenda. Legally, to define what a crime is and to define how international cooperation is carried out may assist prosecution. Logistically, both the restraining on how criminals can move before they are localized by LEA and a greater mobility of the investigators and response teams will be of assistance. The group repeated the need for an International instrument to tackle cyber issues.

text: ENISA 7th CERT Workshop Part II Report

text: 10 Evaluation

text: After the workshop we have received a 27 written evaluation forms as well as some oral feedback. The results are described below.

text: 10.1 Presentations

text: On the question ‘Were the presentations of interest?’ we received an average score of 4.3 out of 5 where 1 means ‘not at all’ and 5 means ‘absolutely so’.

text: 10.2 Time

text: The second question asked ‘Was there sufficient time to discuss topics with others?’. The average score was 4.0 out of 5 where 1 means ‘not at all’ and 5 means ‘absolutely so’. This means that generally speaking most participants were satisfied with this one and a half day approach. However, it must be noted that we received orally the feedback that some participants preferred to have a meeting lasting a little longer.

text: 10.3 Sharing knowledge

text: Next to that we asked the participants ‘Was it possible to share knowledge with others?’. The average score was 4.2 out of 5 where 1 means ‘not at all’ and 5 means ‘absolutely so’. As this was one of the main objectives of this workshop we are pleased with this high score.

text: 10.4 Expert knowledge

text: We also asked the participants if they learned from the experts and presenters at this workshop. We formulated it ‘Did you benefit from the presenters’ expert knowledge?’. Here we received a 4.1 out of 5 where 1 means ‘not at all’ and 5 means ‘absolutely so’.

text: 10.5 Networking

text: For both questions ‘Was there sufficient opportunity to network?’ and ‘Did you identify new partners for your activities’ we received 4.2 of 5 where 1 means ‘not at all’ and 5 means ‘absolutely so’. Networking and finding new partners to connect with is key to the success of this workshop.

text: 10.6 Venue

text: The average opinion of the venue and the catering was 4.7 out of 5 where 1 means ‘didn’t like’ and 5 means ‘liked very much’. We were extremely content that this year this workshop could be hosted at the Europol premises.

text: 10.7 Future

text: Participants scored on average 4.6 out of 5 where 1 means ‘didn’t like’ and 5 means ‘liked very much’ on the question ‘I would like to participate in other workshops the following years’.

text: ENISA 7th CERT Workshop Part II Report

text: 10.8 Topics

text: We also queried the participants on which topics they would like to see covered. These are the main topics that came out of this: - Best Practices - Elaboration on proposals for cyber legislation/legal framework of information sharing - Roadmap to a shared future - Public-Private cooperation (i.e. ISPs) - Mobile/BYOD and other recent threats - Automated data exchange between CERTs and LEA - Use of sensors - Presentation of the various botnet initiatives and the status of the botnet project ACDC Others comments we received: - Add prosecutors to this workshop and explain them what CERTs do and vice versa. - Limit the representation of the private sector to encourage information sharing.

text: ENISA 7th CERT Workshop Part II Report

text: 11 Conclusions

text: The workshop mainly aimed to identify synergies and gaps and how to practically address these obstacles for cooperation. As the feedback and evaluations suggest, it is desirable to repeat this event. This workshop should be seen as one step in the process of creating a smoother CERT-LEA cooperation. As the workshop sessions revealed, there are already a lot of good practices going on, but more can still be done. Participants called for a stronger ENISA-Europol cooperation in addressing these problems. The workshop was a clear success based on the feedback from the participants both during the workshop and through the evaluation forms afterwards.

text: 11.1 Highlights of the workshop sessions and conclusions

text: - When sharing information and cooperating and collaborating on a cross-border level, several legal aspects should be taken into account. - Trust is key to proper cooperation between CERTs and LEA. Good ways of doing this is by integrating someone from one team into the other team. This can be done through internships, but also a variety of other ways, for example by establishing a cybercrime coordination body. This is referred to as ‘embedded LEA’. - Collaboration should be bilateral. Information should flow in both directions in order to stimulate the CERT community to keep on cooperating. General feedback was that CERTs tend to stop sharing information when communication is only one way. LEAs should try to acknowledge the CERTs. - When handling computer incidents, cooperation with other actors, e.g. ISPs, is particularly relevant. - In general, if a request for information comes from CERTs from other country, the local CERTs can accommodate it and pass the information; on the contrary, if the request comes from the LEA from another country, this request in order to be accommodated must pass via the local LEA.

text: 11.2 Remaining gaps and open gaps

text: - There are still a lot of differences between the Member States when it comes to information sharing and more specifically the Data Protection issues. This is possibly a good topic for a next workshop. - Also the cooperation with ISPs seems to be an open issue. - Automated data exchange between CERTs and LEA is also an open gap. This is also related to the Data Protection issues.

text: ENISA 7th CERT Workshop Part II Report

text: 12 Studies/reports mentioned during this workshop

text: We list here some studies and reports mentioned during this event: - ENISA, Cooperation between CERTs and Law Enforcement Agencies in the fight against cybercrime - A first collection of practices http://www.enisa.europa.eu/activities/cert/support/supporting-fight-againstcybercrime - ENISA, Botnets: 10 Tough Questions http://www.enisa.europa.eu/activities/Resilience-and-CIIP/criticalapplications/botnets/botnets-10-tough-questions - ENISA, A flair for sharing - encouraging information exchange between CERTs http://www.enisa.europa.eu/activities/cert/support/legal-informationsharing/legal-information-sharing-1 - De Natris Consult, National Cyber Crime and Online Threat Analyses Centres: A study into national and international cooperation https://woutdenatris.files.wordpress.com/2012/09/online-threats-report-17-09- 2012.pdf

text: ENISA 7th CERT Workshop Part II Report 2

text: P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu


text: Annual Privacy Forum website: www.privacyforum.eu 2 ENISA webpage: http://www.enisa.europa.eu/ [accessed November 2012] 3 DG CONNECT website: http://ec.europa.eu/dgs/connect/index_en.htm [accessed November 2012]

text: Report on Annual Privacy Forum 2012Report on Annual Privacy Forum 2012

text: Report on Annual Privacy Forum 2012

text: A number of these papers originated from research projects that are conducted in the context of the 7th Framework Programme of EU-funded R&D (FP7).

text: Report on Annual Privacy Forum 2012

text: Visitors, visits and pages viewed

text: www.privacyforum.eu analytics

text: Figure 2:

text: Feedback received (0 is the minimum and 5 points the maximum value)

text: 4 3 2 1 0 Information provided Academic Academic benefit Your overall on the conference program gained out of experience of webpage the conference the conference Feedback from participants

text: Figure 3:

text: Media channels feedback

text: Every Digital Agenda @DigitalAgendaEU European Don’t miss the Annual Privacy Forum 2012 in Limassol, Cyprus, 10 Digital & 11 October ow.ly/dCo2g @PrivacyForum_EU

text: Report on Annual Privacy Forum 2012

text: Report on Annual Privacy Forum 2012

text: Report on Annual Privacy Forum 2012

identifier: Report on Annual Privacy Forum 2012

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: Report on Annual Privacy Forum 2012

serie: rapporter

text: About ENISA

type: rubrik

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of crossborder communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu

type: stycke

text: Follow ENISA on

text: Facebook Twitter LinkedIn YouTube and RSS feeds

text: Contact details

text: For contacting ENISA or for general enquiries on Privacy please use the following details: Email: sta@enisa.europa.eu Internet: http://www.enisa.europa.eu

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be an action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as amended by

text: Regulation (EC) No 1007/2008

text: . This publication does not necessarily represent state-of-the-art and it might be updated from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. Member States are not responsible for the outcomes of the study. This publication is intended for educational and information purposes only. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

text: ENISA project management team:

text: Daria CĂTĂLUI, Demosthenes IKONOMOU, Rodica TIRTEA.

text: Acknowledgements

text: ENISA would like to thank the members of the Programme Committee, chairpersons, panellists, speakers and participants for their contributions to the 1st Annual Privacy Forum. Thanks are also due to: Caspar Bowden, Scott Cadzow, Ioannis Krontiris, Aljosa Pasic and Claire Vishik for their feedback.

text: 1. Executive Summary

text: The first Annual Privacy Forum (APF’12) was held in Limassol, Cyprus from 10–11 October 2012. The Forum was co-organised by the European Network and Information Security Agency (ENISA) and the European Commission Directorate General for Communications Networks, Content and Technology (DG CONNECT), with the support of the Department of Computer Science of the University of Cyprus. APF’12 was endorsed as an official event of the Cyprus Presidency of the Council of the European Union.

text: As ICT technologies develop, they put a rapidly growing number of services and tools in the hands of users, companies and governments. This trend started accelerating with the widespread use of the Internet, developed with the Web 2.0 concept and is currently evolving towards the Internet of Things (also known as ambient intelligence, pervasive computing, or ubiquitous computing). The hot topic today in business events is ‘big data’; this refers to the massive availability of data on all aspects of society. There is no doubt that these developments will transform society, with many beneficial effects on the quality of our lives. However, one of the main concerns is that these developments have a tendency to systematically erode our privacy. Addressing this challenge requires a deep understanding of the political, legal, sociological, psychological and technical aspects of these problems.

text: While there are many scientific events dedicated to privacy and privacy technologies, there is a need for an event at European level that brings together key decision-makers and scientists to discuss the latest developments. In order to achieve this mix, the programme of APF’12 had an unusual combination: it consisted of invited speakers and panels interleaved with a set of contributed papers that had undergone a scientific review process. But in contrast with most scientific events, researchers were encouraged to submit positions papers or overview papers that offered a broader perspective on their research.

text: As a result of the Call for Papers (CfP) and the thorough review by the members of the scientific programme committee, 20 papers were accepted for presentation at APF’12. Following the completion of the forum, the accepted papers are being revised by their authors. This involves a second round of reviewing before publication by Springer Verlag’s Lecture Notes in Computer Science series.

text: Among the recommendations of the Forum are the need for more privacy-respecting tools, that research should seek innovative tools to empower users by enhancing transparency, that empirical understanding of data flows should be the starting point for actors’ agendas and also that data protection agencies should analyse market failures in privacy technology, and intervene with scientific

text: and economic precision.

text: A number of people contributed to the success of APF’12. First we would like to thank all the presenters, as well as the authors who submitted their work as a response to the CfP. We sincerely thank all the Programme Committee (PC) members (Annex II), who volunteered to review the papers and discuss the comments. APF’12 would not have been such a success without the tireless contribution of the staff of

text: ENISA. We would also like to thank the colleagues at the European Commission DG CONNECT as well as the Computer Science department of the University of Cyprus and in particular Prof. Marios Dikaiakos and Mrs Maria Poveda for their continuous support and collaboration throughout the organisation of this event.

text: Our gratitude is also extended to the Cyprus Presidency of the EU Council, which endorsed APF’12 as one of the official events of the Presidency.

text: Finally we want to express our gratitude to the Business Software Alliance (BSA), Austrian Airlines and the Cyprus Telecommunication Authority (CYTA) for their support. We would also like to thank our partners NESSOS, CEPIS, the Cyprus Computer Society and EGI.

text: We hope that this forum can play a stimulating role in the European and international privacy community – offering a forum for the exchange of views and ideas between policymakers, research communities and industry.

text: November 2012

text: Bart Preneel, Demosthenes Ikonomou,

text: PC chair APF 2012, professor KU Leuven General Co-chair APF 2012, Head of Secure Services & Project Support Activities Unit – ENISA

text: 2. Introduction

text: In January 2012, the European Commission (EC) put forward its proposal on a reform of the EU’s data protection rules with the aim of strengthening the online privacy rights of European citizens. Although it is widely acknowledged that privacy is a fundamental need and a basic human right, it is often the case that the use of online service comes at the cost of privacy. At the same time the EC, through the framework of the programmes of EU-funded R&D and in collaboration with industry, is investing in the investigation and development of a number of privacy-enhancing technologies. This demonstrates that citizens and industry can benefit from advances in electronic communications and online services without compromising citizens’ privacy.

text: In light of the above, the former Unit ‘Trust and Security’ (F5) of the European Commission’s Directorate General Information Society and Media (DG INFSO) and ENISA decided to organise the Annual Privacy Forum 2012 (APF’12), a two-day event designed to provide a forum for academia, industry and policymakers in the field. The first Annual Privacy Forum was held at Limassol on 10–11 October 2012, hosted by the Department of Computer Science of the University of Cyprus under the auspices of the Cyprus Presidency of the EU Council.

text: The EC and ENISA hope that the Forum will evolve into an annual event that will foster dialogue between the policy, research and industrial communities, with the aim of ‘closing the loop from

text: research to policy’.

text: We are very pleased that our initiative has already attracted the support of well-known experts in the field of privacy and trust. This is also reflected by the fact that the conference was organised under the auspices of the Cyprus Presidency of the Council of the EU during the second half of 2012. APF’12 was attended by 71 participants representing researchers and academia, industry representatives and policymakers from 12 countries.

text: 3. About the event

text: 3.1 The organisation of the event

text: APF’12 consisted of the following three main elements:

text: ● Four technical sessions. The papers selected for presentation in these sessions resulted from a published Call for Papers (CfP). The papers submitted as a response to this CfP were reviewed by the members of the PC representing the research and academic communities. The CfP was not restricted to submissions relating to research and technology, but also invited contributions on policy and standardisation. As a result of the review, 20 papers were selected for presentation at the technical sessions. The majority of the papers originated from research and academia although there were also some contributions by policymakers as well as international standardisation organisations (ISOs).

text: ● Three panel sessions. Two of the panel sessions addressed the main theme of the conference: ‘closing the loop from research to policy’, through a combination of panellists representing all the different sectors addressed by APF’12. The third panel session focused on the R&D perspective, with well-known researchers in the field of privacy discussing the main challenges and advances in the area and their impact on the relevant policy initiatives. Finally, a workshop was organised by the FP7 NESSoS (Network of Excellence on Engineering Secure Future Internet Software Services and Systems).

text: ● A number of keynote speakers were invited, representing the Presidency, the EC, industry and research.

text: Below we briefly present the main conclusions and key messages of APF’12. These are largely based on feedback received during and after the conference from a number of the participants.

text: The consensus on APF’12 was that the conference was successful, with the majority of the participants particularly appreciating its success in bringing together the research, industry and policymaking communities.

text: 3.2 Visibility of the conference & feedback

text: APF’12 was attended by 71 participants representing researchers, academia, industry representatives and policymakers from 12 countries (from outside as well as within the EU), exceeding the objectives set. The website statistics of the Forum show that it had more than 1,000 visitors, with 1,700+ visits and 5,500+ pages viewed. Figure 1:

text: Visits: 1,761 Unique Visitors: 1,027 Pageviews: 5,564

text: The positive feedback received from most conference participants is depicted in Figure 2. (Participant were asked to rate various aspects of the conference according to a scale from 0 (minimum) to 5 (maximum).)

text: An example of the interest expressed on the social media channels used (e.g. Twitter) is provided by the following tweet.

text: 3.3 The message of the conference

text: The overriding message of the conference was that privacy is complex and easily manipulated in favour of the privacy invader – a message that was never really challenged throughout the event. Understanding of privacy is transient and can be manipulated by subtle modification of the content of the questions asked to initiate private data transfer, and further manipulated by asking for data outside the scope of the agreed consent after the consent has been given. The power of data linking and data farming to reveal detailed private data (even if all of that data is on ‘open’ resources) raises concerns. A number of presentations and invited talks indicated that privacy violation is simple, does not require any sophisticated tools or knowledge, and that any protection model that looks at single instances of private data will be inadequate.

text: A number of technical approaches to solving the privacy problem were proposed, targeting different parts of the privacy architecture. Nevertheless, the lack of flagship initiatives in the area of privacy (e.g. an ‘Airbus’-scale project), where industry will set the requirements and initiatives synthesising a complete model, was once again highlighted.

text: Existing research has already addressed languages for privacy policy, but ensuring that this policy is actually enforced is still a problem. We need some form of confidence that the ICT system managing

text: data actually enforces privacy policies, and it is sensible to divide this assurance problem into areas of early (requirements, design phases) and late assurance (implementation and monitoring of operational environment).

text: We are witnessing the emergence of Future Internet services and applications, which in terms of privacy are characterised by the correlation of traces coming from different devices that reveal new patterns with sensitive information. Examples presented at APF include obfuscation of location privacy or patterns from energy consumption. In addition, Future Internet services are composed of several more simple services (created and hosted by a variety of providers), each with its own security and privacy characteristics. Languages are used for inclusion of security parameters in service description and explicit description of security services. The service compositions are very dynamic in nature, and span multiple trust domains, resulting in a fragmentation of ownership of both services and content, and a complexity of implicit and explicit relations among the participants. This can be extended to privacy parameters and this is

text: why compositional features should be investigated. This would also enable accountability in and for clouds.

text: There are a few success stories of deploying privacy technologies in practice, for example the use of anonymisation techniques in the communication layer of internet. However, in general, we are still far from large-scale deployments of privacy solutions that are also adopted by a large user base.

text: One reason for this is the lack of user awareness with respect to privacy problems, which can be partly attributed to a lack of transparency of data acquisition and the related information processing. The techniques for the latter are progressing very fast, while the progress in user awareness and even in developing corresponding protection tools has been very slow. A second reason lies in the complicated and laborious nature of control imposed on persons, as no legal standards or general consumer protection rules exist.

text: Besides issues related to user awareness, there is a lack of clear incentives for enterprises to manage personal data in a privacy-respecting manner, to design privacy-preserving products, or to make the use of personal data transparent to the data subjects. One of the reasons discussed at the conference was that when building applications, engineers often lack practical knowledge on incorporating PETs to achieve security and privacy protection. Another reason mentioned was that there are not enough

text: privacy-respecting tools offered in the form of software packages that are mature and easy to integrate.

text: Where regulation is concerned, it was pointed out that, unfortunately, neither the current European legal framework nor the approach followed in the USA of industry self-regulation has been effective in protecting privacy online. One of the main problems affecting the current framework is the blurred distinction between personal and non-personal data. A meaningful advance in privacy regulation in Europe is being hindered by the global nature of the market for information and ubiquity of cross-border data flows. Further future refinements on the definition of personal data in the EU should not focus on maximising the profitability potential of personal data.

text: Several research challenges for the future were identified. To address the current mind-set that trust establishment requires full identification, it comes as an interesting challenge to establish trust without transferring too much personal data. Making the question of trust easier to understand is another challenge in front of us. Trusting the client device is a relevant issue that requires attention in making

text: clients stronger (i.e. more secure).

text: Overall, research challenges should always try to improve the level of control that users have over their personal data. Anonymous-based credentials are one of the most advanced technologies we have to achieve this purpose and a lot of progress has already been made in making them efficient, even in the context of smartcards. But a crucial element of individual protection and autonomy is also the individuals’ ability to understand and act on their context, assisted by appropriate and intuitive tools.

text: In order to achieve this, research should seek creative, innovative tools to empower users by

text: enhancing transparency. This will require addressing how the implications of massive-scale data collection and processing can be made comprehensible and practically manageable for individuals. For example, new tools could help users before they engage in privacy-relevant activities online, but also as they act online. Finally, they should help users reconcile breaches of their expectations afterwards.

text: It becomes important to broaden the boundaries of research in order to include new types of data flows. This would include data processed or stored by cloud-based applications, sensors that interact with the physical environment, data communicated in smart grids or car2car applications, etc. Regulatory and

text: technical agendas need to be driven by empirical understanding of these data flows.

text: Data protection agencies should analyse market failures in privacy technology, and intervene with scientific and economic precision.

text: Standardisation initiatives in the domain of privacy should take into account the specific nature of

text: this field. The standardisation process involves multi-party negotiations between industry representatives with deep awareness of the strategic implications of technical alternatives. The negotiation reflects a common interest in an outcome which will suit their mutual commercial interest (IPRs, etc.). In the case of privacy standardisation civil society also needs to be represented with resources for analysing the implications of technical proposals. The EC and ISO should take this particular aspect in the area of privacy into consideration.

text: 4. Conclusions and recommendations

text: 4.1 Recommendations related to the structure of the event

text: Without any doubt the APF’12 was a success. This is evidenced by the following factors:

text: ● The large number of participants at the first edition of a conference addressing an area where a considerable number of events are already established. In this light, the aim of organising a conference that will foster the dialogue between the policy, research and industrial communities has been well addressed by APF’12.

text: ● The participants represented all the different sector actors that are active in this diverse field of work, namely the European Commission, the European Data Protection Supervisor, data protection agencies, international standardisation organisations, research (not only ICT but also social and economic sciences), industry, etc. At the same time the participants of APF’12 represented 12 countries from outside as well as within the EU.

text: ● The positive feedback received from most conference participants both during and after the conference.

text: ● The interest expressed on social media channels (e.g. Twitter).

text: ● The interest expressed by key partners (i.e. DG CONNECT, EDPS) to start the discussions and planning for future editions of the APF (in the event that a decision is made to continue with the conference). This is complemented by the high interest expressed by industry representatives in getting involved in the organisation and planning of future events.

text: ● The interest in getting involved in an e-community: ‘Privacy@ENISA’.

text: ● The high quality of the PC that supported the organisation event.

text: Some first (preliminary) exchanges of ideas for possible future editions of APF have been put forward. In this context, new ideas for improving the conference are being discussed, as well as ways to improve on shortcomings observed at APF’12.

text: ● Improve the interaction in the panel sessions between the policymakers and industry. Ensure a better balance in order to increase the interest on the panels.

text: ● Increase the industry involvement in the conference.

text: ● Promote the CfP to the DPAs and ISO communities in order to increase their involvement in the technical session.

text: ● Consider bi-annual vs. periodicity for the organisation of the conference.

text: ● Creation of a demo area dedicated to demonstrators/test beds by research projects. A part of the demo area can be dedicated to a posters session.

text: ● Continue the ‘Student team’ involvement in the conference and improve the interactions with peers by creating ‘tutoring meetings’.

text: ● Invite representatives of the EP to contribute to the discussions of panel sessions. ● Consider the organisation of thematic workshops on topics such standardisation, international cooperation, etc. ● Considering that there is still diversity of opinion on many aspects of privacy, a debate may be suggested, to make the next APF even livelier and more interactive.

text: 4.2 Recommendations related to the content of the Forum

text: The key messages are mentioned below in order to set the agenda for future discussions: ● Empirical understanding of data flows should be the starting point for actors’ agendas. ● Research should seek creative, innovative tools to empower users by enhancing transparency. ● Data protection agencies should analyse market failures in privacy technology, and intervene with scientific and economic precision. ● Standardisation initiatives in the domain of privacy should take into account the specific nature of this field. ● The need for more privacy-respecting tools offered in the form of software packages. ● Establishing confidence that the ICT system managing data actually enforces privacy policies; the desirability of dividing the assurance problem into areas of early and late assurance. ● Accountability in and for clouds should be enabled. ● Establishing a trust relationship between client devices and the provider.

text: Privacy is an area that is multidisciplinary by nature. Regulations, legal frameworks, technology, user adoption, and economic considerations are all necessary components in elevating privacy to a norm generally observed in a society. In this regard, gatherings that include multiple stakeholders in privacy assembled for a candid dialogue are clearly important and valuable. The 1st Annual Privacy Forum in Cyprus was one of these events.

text: Annex I: Organising Committee of APF’12

text: General Co-chairs:

text: Giuseppe Abbamonte, European Commission (DG CONNECT Unit H4 Trust and Security) Dr. Demosthenes Ikonomou, European Network and Information Security Agency (ENISA) Prof. Marios Dikaiakos, University of Cyprus

text: Organising Committee

text: Santiago ALVAREZ, ENISA Daria CATALUI, ENISA Slawomir GORNIAK, ENISA Martin MUHLECK, DG CONNECT Maria POVEDA, University of Cyprus Rodica TIRTEA, ENISA

text: Annex II: The Programme Committee of APF’12

text: Programme Committee chair:

text: Prof. Bart Preneel , Katholieke Universiteit Leuven

text: Programme Committee:

text: Dr. Alessandro ACQUISTI, Carnegie Mellon Dr. Ioanna DIONYSIOU, University of Nicosia University Dr. Jacques BUS, University of Luxembourg Aljosa PASIC, Atos Research Dr. Jan CAMENISCH, IBM Zurich Research Dr. Alma WHITTEN, Google USA Laboratory

text: Dr. Andreas ALBERS, University of Frankfurt Prof. Kai RANNENBERG, University of Frankfurt

text: Prof. Bart PRENEEL, KU Leuven Dr. Nick PAPANIKOLAOU, HP Labs Bristol

text: Dr. Carmela TRONCOSO, COSIC KU Leuven Nick WAINWRIGHT, HP Labs

text: Caspar BOWDEN, independent expert Dr. Nicola JENTZSCH, DIW Berlin

text: Dr. Claire VISHIK, INTEL Paul FRANCIS, Max Planck Institute for Software Systems Dr. Claude CASTELLUCCIA, INRIA Dr. Paul de HERT, University of Tilburg Prof. Claudia DIAZ, KU Leuven Dr. Periklis PAPAKONSTANTINOU, Tsinghua University Dr. Daniel LE-METAYER, INRIA Dr. Rainer BOEHME, University of Münster, Germany Prof. Elena FERRARI, University of Insubria Dr. Rodica TIRTEA, ENISA Dr. Eleni KOSTA, KU Leuven Prof. Simone FISCHER-HUEBNER, University of Prof. Elisa BERTINO, University of Purdue Karlstad Prof. Evangelos MARKATOS, FORTH Prof. Sokratis KATSIKAS, University of Piraeus Dr. Florian KERSCHBAUM, TU Dresden Dr. Sotiris IOANNIDIS, FORTH Dr. George DANEZIS, Microsoft Research Dr. Stefan SCHIFFNER, TU Darmstadt – CASED Cambridge Prof. Tassos DIMITRIOU, Athens Information Dr. Giannis MARIAS, Athens University Economy Technology – AIT & Business

text: Annex III: Final Programme

text: 7.1 Wednesday 10/10/2012

text: 08:00 – 08:50 Registration

text: 08:50 – 09:45 Opening notes & keynotes

text: Welcome note: Polys Michaelides, Commissioner for the Regulation of Electronic Communications and Postal Services of Cyprus Chair & opening note from the local organiser: Marios Dikaiakos, General Co chair APF 2012, Professor University of Cyprus ● Udo Helmbrecht, Executive Director, European Network and Information Security Agency – ENISA ● Rosa Barcelo, Policy Coordinator Trust & Security Unit, European Comission – DG CONNECT ● Stelios D. Himonas, Permanent Secretary of the Cyprus Ministry of Justice and Public Order, representative of Cyprus Presidency of the Council of the EU

text: 09:45 – 09:50 Break

text: 09:50 – 11:15 Keynotes

text: Chair: Bart Preneel, PC chair APF 2012, professor KU Leuven ● Nicolas Dubois, Data Protection Unit, Directorate General Justice, European Commission ● Marisa Jimenez, European Privacy Policy Senior Counsel, Google. ‘Embracing Privacy Reform for Economic Growth: The Role of the Internet’

text: ● Alessandro Acquisti, professor, Heinz College – Carnegie Mellon University. ‘Would “Privacy in the Age of Augmented Reality” work?’

text: 11:15 – 11:30 Coffee break

text: 11:30 – 13:00 Session 1

text: Chair: Rodica Tirtea, PC member APF 2012, expert ENISA ● ‘Integrating Anonymous Credentials with eIDs for Privacy-respecting Online Authentication’, Ronny Bjones, Ioannis Krontiris, Pascal Paillier and Kai Rannenberg ● ‘Privacy-preserving Identity Management in SEMIRAMIS’, Charles Bastos Rodriguez, Ruben Torres Dieguez, Silvio Soracce, Tiago Batista, Ricardo Azevedo, Juan Manuel Marin Perez, Jorge Bernal Bernabé, Gregorio Martinez and Dominik Lamp; Aljosa Pasic ● ‘A Method for Analysing Traceability between Privacy Policies and Privacy Controls of Online Social Networks’, Pauline Anthonysamy, Phil Greenwood and Awais Rashid ● ‘Collection and storage of personal data: a critical view on current practices in the transportation sector’, Eleni Kosta, Hans Graux and

text: Jos Dumortier

text: NOTE: presenter’s name in bold.

text: 13:00 – 14:00 Lunch

text: 14:00 – 15:30 Session 2

text: Chair: Claire Vishik, Security, privacy standards and policy manager, Intel ● ‘Privacy-Preserving Computation (Position Paper)’, Florian Kerschbaum ● ‘A Problem-based Approach for Computer Aided Privacy Threat Identification’, Kristian Beckers, Stephan Faßbender, Maritta Heisel and

text: Rene Meis

text: ● ‘Privacy Concerns and Actions: Evidence from a Large-scale Hybrid Experiment’, Nicola Jentzsch ● ‘Electronic Footprints in the Sand: Technologies for Assisting Domestic Violence Survivors’, Martin Emms, Budi Arief and Aad Van Moorsel

text: 15:30 – 15:45 Coffee break

text: 15:45 – 17:15 Panel Session 1 ‘The economic dimension of data protection’

text: Chair: Giorgos Rossides, Special Advisor – Data Protection Reform, Cyprus Presidency of the Council of the EU ● Alessandro Acquisti, Associate Professor of Information Technology and Public Policy at the Heinz College at Carnegie Mellon University (CMU), co-director of CMU Center for Behavioral Decision Research (CBDR) ● Melina Violari, Policy and Privacy Manager, Facebook Europe ● Andreas Krisch, president EDRi (European Digital Rights), VIBE!AT

text: 17:15 – 17:20 Break

text: 17:20 – 18:20 Workshop organised by NESSoS (Network of Excellence on Engineering Secure Future Internet Software Services and Systems) – ‘Privacy By Design and Secure Software Engineering’ Chair: Aljosa Pasic, Chair of the Industrial advisory board of NESSoS

text: Workshop speakers:

text: ● Jorge Cuellar, Siemens: ‘The need to standardise location privacy protection policies – A look at the IETF’ ● Claire Vishik, Intel: ‘Principles of Privacy by Design in Smart metering: issues of importance to privacy engineers and technologists’ ● Slim Trabelsi, SAP: ‘Use of USDL-SEC for privacy goals’ ● Aljosa Pasic, Atos: ‘Model Driven Privacy: Does it exist?’ ● Nick Wainwright, HP Lab: ‘Accountability for the Cloud.’

text: 20:00 Conference Dinner

text: ● Sponsor’s Brief note ‘Innovation Forecast: A Data Protection Framework for the Cloud’, Thomas Boué, Director of Government Affairs, EMEA

text: 7.2 Thursday 11/10/2012

text: 08:30 – 10:00 Second day opening notes and keynotes

text: Chair and welcome note: Steve Purser, Head of Technical Department, ENISA ● Stephen Deadman, Privacy Officer, Vodafone Group ● Andreas Krisch, President EDRi (European Digital Rights), VIBE!AT, ‘Data Protection: the Enabler for Innovative Information Technologies’

text: 10:00 – 10:10 Coffee break

text: 10:10 – 11:20 Session 3

text: Chair: Ioannis Krontiris, Senior Researcher, Mobile Business and Multilateral Security group at Johann Wolfgang Goethe University in Frankfurt ● ‘Conceptual Framework and Architecture for Privacy Audit’, Alan Hartman, Ksenya Kveler, Kirsten Bock, Pietro Colombo, Tamar Domany and Elena Ferrari ● ‘A solution, but not a panacea for defending privacy: The challenges, criticism and limitations of Privacy by Design’, Demetrius Klitou ● ‘Current Status and Prospect of Acts on Privacy in Korea’, Jae Suk Yun and

text: Yong-Jun Jeong

text: ● ‘ICT and Privacy: Barriers’, Antonio Kung

text: 11:20 – 11:30 Break

text: 11:30 – 13:10 Session 4 Short Talks

text: Chair: Sławomir Górniak, expert ENISA ● ‘Privacy in ETSI Security Standardisation’, ETSI, Carmine Rizzo ● ‘The role of standards in privacy protection’, Scott Cadzow ● ‘Federated Identity as Capabilities’, Harry Halpin and Blaine Cook ● ‘FutureID- Shaping the Future of Electronic Identity’, Heiko Roßnagel, Jan Camenisch, Lothar Fritsch, Thomas Gross, Detlef Houdeau, Detlef Hühnlein, Anja Lehmann, Jon Shamah ● ‘Designing Privacy by Design’, Jeroen van Rest, Daniel Boonstra, Maarten Everts, Martin van Rijn and Ron van Paassen, Sander van Oort ● ‘Enhancing Privacy by Design From a Developer’s Perspective’, Christoph Bier, Pascal Birnstill, Erik Krempel, Hauke Vagts and Jürgen Beyerer ● ‘GINI Position Paper’, Lefteris Leontaridis ● ‘Privacy preserving course evaluations in Greek higher education institutes: an e-Participation case study with the empowerment of Attribute Based Credentials’, Vasiliki Liagkou, George Metakides, Apostolis Pyrgelis, Christoforos Raptopoulos and Yannis Stamatiou

text: 13:10 – 14:30 Lunch

text: 14:30 – 15:30 Panel Session 2 ’Research Challenges in Privacy’

text: Chair: Bart Preneel, PC chair APF 2012, professor KU Leuven ● Caspar Bowden, independent expert ● Kai Rannenberg, professor University of Frankfurt ● Florian Kerschbaum, professor University of Dresden ● Antonio Kung, TRiALOG

text: 15:30 – 15:45 Coffee break

text: 15:45 – 17:30 Panel Session 3 ‘European Policies and Technological Innovation in Privacy

text: and Data Protection’

text: Chair: Rosa Barcelo, Policy Coordinator Trust & Security Unit, European Comission – DG CONNECT ● Nicolas Dubois, Data Protection Unit, Directorate General Justice, European Commission ● Michael Waidner, SIT Research Group, Chair Fraunhofer SIT, Director CASED and EC-SPRIDE ● Peter Schaar, the Federal Commissioner for Data Protection and Freedom of Information (BFDI) ● Gwendal Le Grand, Commission Nationale de l’Informatique et des Libertés (CNIL), Head of IT experts group ● Caspar Bowden, independent expert ● Giovanni Buttarelli, Assistant Supervisor, European Data Protection Supervisor (EDPS)

text: 17:30 – 17:40 Closing remarks

text: Demosthenes Ikonomou, General Co chair APF 2012, Head of Secure Services & Project Support Activities Unit – ENISA

text: Annex IV: Description of Panel Sessions and Workshops

text: 8.1 Panel 1: The economic dimension of data protection

text: Chair: Giorgos Rossides, Special Advisor – Data Protection Reform | Cyprus Presidency of the Council of the EU

text: This panel examined the interaction of the fundamental right to the protection of personal data with the economic imperatives of the 21st-century digital internal market. The innovative business models of this market have, in recent years, come to depend increasingly on the utilisation of personal data. While this fact may carry significant advantages in terms of the personalisation and customisation of web-based services, it also brings with it considerable risks for the protection of personal data and calls into question the regulatory regimes that are in place to ensure this protection.

text: Key questions explored:

text: ● What are the changes that have happened since the adoption of the EU data protection regulatory framework in 1995? How do these changes challenge our existing legal framework for the protection of personal data? ● What are the economic trade-offs between the provision of ‘free’ digital services and the uptakes of these services by individuals? Is personal data the currency with which these services are paid for? ● Have technological advances rendered privacy and data protection irrelevant? Do people care? ● What would be the best solutions to ensuring the protection of personal data without stifling innovation and entrepreneurship on the internet? ● Will the proposed EU data protection reform help foster the economic growth, innovation, job creation it envisages, particularly for micro and medium-sized enterprises, in the currently negative economic environment?

text: Panel Composition:

text: ● Alessandro Acquisti, Carnegie Mellon University ● Melina Violari, Policy and Privacy Manager, Facebook Europe ● Andreas Krisch, president EDRi (European Digital Rights), VIBE!AT

text: 8.2 Panel 2: Research Challenges in Privacy

text: Chair: Bart Preneel, PC chair APF 2012, professor KU Leuven

text: The developments at EU level in the policy framework related to privacy represents one of the most interesting and fast evolving sectors in EU policy. At the same time, for a number of years the EU has been making a significant investment in collaborative EU-funded R&D in the areas of NIS and privacy.

text: The main purpose of ENISA is to enhance the capability of the Community, the Member States and, as a consequence, the business community to prevent, address and respond to Network and Information Security (NIS) problems. To this end, ENISA has observed that many of the innovations occurring in the programmes of EU-funded R&D are not feeding into the relevant policy initiatives in the areas of NIS and privacy. In a similar way the strategic priorities of EU policy in the area of privacy are not feeding to research priorities.

text: The Agency therefore proposed a panel where experts working in the area of privacy discussed and addressed these gaps. With this panel we covered topics such as ‘privacy by design’ between objective and practice, technical implementation issues for the ‘right to be forgotten’, etc. Furthermore the goal was to identify with key experts topics that should receive priorities for funding in the near future in order to address the policy agenda of the EU.

text: Panel composition:

text: ● Caspar Bowden, independent expert

text: ● Kai Rannenberg, professor University of Frankfurt

text: ● Florian Kerschbaum, professor University of Dresden

text: ● Antonio Kung, TRiALOG

text: 8.3 Panel 3: European Policies and Technological Innovation in Privacy and Data Protection

text: Chair: Rosa Barcelo, Policy Coordinator Trust & Security Unit, European Commission – DG CONNECT

text: Privacy is a fundamental need and a basic right in Europe. New information and communication technologies have given it a completely new dimension, for instance in terms of accessibility of personal information online, transparency of the use of data and the availability of personal data in the future. The dynamic uptake of new communication devices and forums online often comes with new challenges and costs for preserving one’s individual needs for privacy protection. European policies and research efforts address these challenges, most recently with this year’s Commission proposal of a major reform in the protection of personal data. At the same time, R&D results from the scientific communities in Europe outline new approaches for privacy in the digital age.

text: This panel discussed how Europe can deliver a regulatory environment for the privacy needs of its citizens that keeps pace with technological developments and stimulates growth and innovation. A question raised was how regulatory efforts and technological innovation for online privacy can complement each other to ensure the effective protection of citizens’ rights. Another point for discussion was how policies and research can support a fundamental change from a reactive mode of adapting privacy rules to new online forms of communication to privacy rules applicable for any emerging online environment. European decision-makers of privacy policies discussed with research and industry representatives as well as the participants of the Forum their views and approaches on these questions.

text: Panel composition:

text: ● Nicolas Dubois, Data Protection Unit, Directorate General Justice, European Commission

text: ● Michael Waidner, SIT Research Group, Chair Fraunhofer SIT, Director CASED and EC-SPRIDE

text: ● Peter Schaar, the Federal Commissioner for Data Protection and Freedom of Information (BFDI)

text: ● Gwendal Le Grand, Commission Nationale de l’Informatique et des Libertés (CNIL), Head of IT experts group

text: ● Caspar Bowden, independent expert

text: ● Giovanni Buttarelli, Assistant Supervisor, European Data Protection Supervisor (EDPS)

text: 8.4 Workshop organised by NESSoS – Privacy By Design and Secure Software Engineering

text: Chair: Aljosa Pasic, the Chair of Industrial advisory board of the Network of Excellence on Engineering Secure Future Internet Software Services and Systems (NESSoS)

text: ‘Privacy by Design’ is a hot topic. Virtually all stakeholders agree that it is better to build in than to bolt it on later, but the European security industry has expressed concerns about vagueness and ambiguity of this concept. In order to come with a structured process, industry might need to take a look at requirements engineering, formal languages, programming environments and the other areas of engineering secure software-based services. The engineering of secure software services is based on the principle of addressing security concerns from the very beginning in system analysis and design, thus helping to reduce the amount of system and service vulnerabilities and enabling the systematic treatment of security needs through the engineering process.

text: This panel aimed to examine the interaction of privacy by design and secure software and service engineering. For example, most current requirements engineering approaches consider security only at the technological level, failing to capture the high-level requirements of trust or privacy. In parallel we are witnessing the emergence of Future Internet services and applications. They are composed of several services (created and hosted by various organisations and providers), each with its own security and privacy characteristics. The service compositions are very dynamic in nature, and span multiple trust domains, resulting in a fragmentation of ownership of both services and content, and a complexity of implicit and explicit relations among the participants.

text: Key questions explored:

text: ● What are the best practices for Privacy by Design in practice?

text: ● What impact has service-orientation on privacy by design and on secure software and service engineering?

text: ● How do we combine the software engineering and data management sides of the (compositional) privacy by design principle?

text: ● What does location privacy mean for secure software engineering?

text: ● What solutions or approaches do you foresee to solve the challenges and fill the gaps?

text: Workshop speakers:

text: ● Jorge Cuellar, Siemens: ‘The need to standardise location privacy protection policies – A look at the IETF’

text: ● Claire Vishik, Intel: ‘Principles of Privacy by Design in Smartmetering: issues of importance to privacy engineers and technologists’

text: ● Slim Trabelsi, SAP: ‘Use of USDL-SEC for privacy goals’

text: ● Aljosa Pasic, Atos: ‘Model Driven Privacy: does it exist?’

text: Annex V: Visual material

text: The materials below were used for the 1st Annual Privacy Forum and third parties can use them in order to make reference to the Forum.

text: PO Box 1309 71001 Heraklion Greece Tel: +30 2810 391 280 Fax: +30 2810 391 410 Email: info@enisa.europa.eu

text: Follow ENISA on

text: Contact details


text: December 2019 (Update – November 2020)

text: -N N -E 1 2 -9 -1 1 -0 P T

text: and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu .

text: ISBN 978-92-9204-321-6 DOI 10.2824/83374

identifier: ENISA Report - Request to ENISA 2019

title: ENISA Report - Request to ENISA 2019

text: STANDARDS SUPPORTING CERTIFICATION

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For media enquiries about this paper please use press@enisa.europa.eu.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

text: Copyright for the image on the cover and internal pages: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-321-6, DOI 10.2824/83374, ISSN 2600-0571

text: ABOUT ENISA

type: vagledning

utgivare: enisa