text: In this report we use the terms ‘Cyber’ and ‘Critical Information Infrastructures’ synonymously and interchangeably, based on the definition of the former as: ‘ “cyber’’ refers to the interdependent network of information technology infrastructures, and includes technologies such as the Internet, telecommunications networks, computer systems, and embedded processors and controllers in critical industries.’ (Source: WEF, Partnering for Cyber Resilience, World Economic Forum Report, 2012 available at: http://www.weforum.org/issues/partnering-cyber-resilience-pcr)

text: An evaluation report from the exercise and a video are available online: http://www.enisa.europa.eu/act/res/ce2010

text: The Cyber Europe 2012 Key findings report will be available (after Nov 2012) at: https://www.enisa.europa.eu/activities/Resilience-and-CIIP/cyber-crisis-cooperation/cyber-europe

text: Restricted access though the ENISA Resilience portal

text: Figure 1: The cyber exercises collected by year Figure 2 displays the duration of the cyber exercises we examined. We found that that 43% of the exercises were one-day events, 32% of the exercises continued for two to three days and 19% of the exercises took more than three days. We can see that approximately 75% (based on 81% of overall

text: Please note that the findings presented in this report are based on the exercises gathered in this stocktaking. Although the survey was open to all for a long period, scientifically we cannot claim this is an exhaustive research. It does, though represent a large sample.

text: Figure 2: Duration of the cyber exercises examined As Figure 3 shows, around 84% of the exercises (based on 82% of overall data gathered) are part of a series; around two-thirds of them take place on a yearly basis and a quarter on a biannual basis.

text: Figure 3: Proportion of exercises carried out as part of a series

text: Figure 4: Cyber exercises in Europe for the period 2002–2012 (numbers indicate exercises per country) Compared to data ENISA gathered in 2010, we observe a slight increase in the number of national and international cyber exercises in Europe (see Figure 5). Two years ago, 20 countries organised a national exercise. This current stocktaking reveals that some countries have organised two or even three cyber exercises, while others have just completed one. In addition, almost all EU and EFTA countries have participated in multinational cyber exercises.

text: Figure 5: EU and EFTA countries involved in national cyber exercises; data from ENISA surveys of 2010 and 2012

text: Figure 6: National vs. multinational exercises In total, 64% (based on 94% of overall data gathered) of the multinational exercises involved more than 10 countries, 13% involved 6–10 countries and 13% involved 3–5 countries. Another interesting aspect of cyber exercises is the participation of sectors, and more specifically the participation of the public and private sectors. As Figure 7 shows, we found that 57% of the exercises (based on 88% of overall data gathered) combined the public and private sector, while 41% involved only the public sector. We found that only one exercise in this stocktaking took place with only the private sector involved. This is an interesting finding that demonstrates that the private sector could be more proactive with testing security and contingency plans, as they are the owners of the

text: Figure 7: Sectors involved in the exercise The number of participants in the exercises ranged from 20 to more than 75 people; this of course depends on the sectors and number of countries involved in the exercise.

text: Figure 8: Types of cyber exercise

text: Figure 9: Focus of the exercise Using the collected data, we see that most of the time a (distributed) table-top exercise was carried out. A (distributed) table-top is suitable for both beginners and experienced participants, and addresses the operational, tactical and strategic level.

text: Operational exercises focus mainly on checking technical issues; tactical exercises are mostly procedural tests; while strategic exercises refer mainly to high-level decision-making and policy exercises. A good reference for these terms is the ENISA Good Practice Guide on National Cyber Contingency Plans (NCPs). Please contact resilience@enisa.europa.eu

text: Figure 10: Type of monitoring methods used during or after the exercise As demonstrated in Figure 11, we found that 16% of the exercises (based on 54% of overall data gathered) had a debriefing workshop, 31% made a report after the exercise, 17% had a hot wash session and 12% asked participants to carry out self-evaluation (with evaluation forms). Again in this case a combination of these evaluation methods is quite common policy.

text: Figure 11: Cyber exercises evaluation Using the collected data, we can see that a report of the exercise is made for most of the cyber exercises we have examined. This may be because exercise organisers need to report to their management about the exercise and the results.

text: Given in no particular order.

text: The ENISA Good Practice Guide on National Cyber Contingency Plans is available upon request.

identifier: National and International Cyber Security Exercises: Survey, Analysis & Recommendations

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: National and International Cyber Security Exercises: Survey, Analysis & Recommendations

serie: rapporter

text: On National and International Cyber Security Exercises

type: rubrik

text: Survey, Analysis and Recommendations

text: October 2012

text: On National and International Cyber Exercises I Survey, Analysis and Recommendations

text: Acknowledgements

text: ENISA wishes to thank all persons and organisations which have contributed to this stocktaking exercise. In particular, our gratitude goes to the following contributors:  The cyber exercise community who filled in the online survey published on the ENISA website and provided additional information about the exercises;  Speakers and participants who attended ENISA’s 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises, 27 June 2012, in Paris.

type: stycke

text: About ENISA

text: The European Network and Information Security Agency (ENISA) is a centre of network and information security expertise for the EU, its Member States, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU Member States in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU Member States by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu. Follow us on Facebook Twitter LinkedIn Youtube & RSS feeds

text: ENISA project team

text: Panagiotis TRIMINTZIOS, Resilience and CIIP Unit, ENISA Razvan GAVRILA, Resilience and CIIP Unit, ENISA

text: Contact details

text: For questions related to this report or any other general inquiries about the resilience program please use the following contact address: resilience at enisa.europa.eu

text: Legal notice

text: Please note that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the ENISA

text: Regulation (EC) No 460/2004

text: as lastly amended by

text: Regulation (EU) No 580/2011

text: . This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. Reproduction is authorised provided the source is acknowledged. © European Network and Information Security Agency (ENISA), 2012

text: II On National and International Cyber Exercises Survey, Analysis and Recommendations Executive Summary

text: Cyber exercises are an important tool to assess the preparedness of a community against cyber crises, technology failures and critical information infrastructure incidents. ENISA supports the stakeholders involved in EU cyber exercises. This report aims to support European and international bodies involved in cyber exercises with lessons learned about cyber exercises and recommendations for the future. The report presents the results of the ENISA 2012 research and analysis by ENISA in 2012 of national and international cyber exercises carried out. ENISA examined 85 exercises covering the period between 2002 and 2012. In total, 84 countries worldwide participated in the multinational exercises analysed in this report. A total of 22 European countries conducted in national cyber-exercises. The main findings in this research include:

text: 1. The number of cyber exercises has increased in recent years (71% took place in between 2010- 2012). The reasons for this increase are the overall policy context that supports and boosts cyber exercises, the increased emphasis given by the EU Member States to cyber exercises, and the increasing threat of (cross-border) cyber incidents and attacks.

text: 2. Cyber crisis cross border cooperation efforts are continuously developing. Cyber security is an urgent matter which receives increasingly more attention in European countries.

text: 3. Public–private partnerships during cyber exercises are essential due to private sector ownership of most critical information infrastructures. There is a need to intensify public–private cooperation in cyber exercises.

text: 4. More attention should be paid to developing exercise management tools which can support exercise execution and preparation.

text: 5. The use of methodological planning, monitoring and evaluation is crucial for effective exercises.

text: 6. There is broad consensus that cyber exercises help to enhance the preparedness, responsiveness and knowledge of stakeholders in responding to cyber incidents. The report concludes with seven recommendations for stakeholders in the global cyber exercises area, which aim to increase the number and quality of cyber exercises. The main recommendations are: 1. Establish a more integrated global cyber exercise community; 2. Ensure the exchange of good practices on cyber exercises, including public–private cooperation; 3. Support the development of exercise management tools to support exercise planning, execution and evaluation; 4. Aim for more complex cyber exercises on an inter-sectoral, international and European level; 5. Enhance preparedness by including exercises in the lifecycle of Cyber Crisis Contingency Plans; 6. Update the good practices for national exercises and initiate a good practice guide for multinational exercises;

text: 7. Develop feedback mechanisms for ensuring that lessons learned from cyber exercises are implemented resulting in enhanced cyber crisis preparation.

text: On National and International Cyber Exercises V Survey, Analysis and Recommendations On National and International Cyber Exercises 1 Survey, Analysis and Recommendations

text: 1 Introduction

text: Cyber exercises are an important tool to assess the preparedness of a community against cyber crises, technology failures and critical information infrastructure incidents. Exercises enable the competent authorities to target specific weaknesses, increase cooperation across the critical information infrastructure sector, identify interdependencies, stimulate improvements in continuity planning, and generate a culture of cooperative effort to boost resilience in the cyber crisis cooperation area. In 2009 ENISA issued a recommendation about the importance of cyber exercises. Since then ENISA has continued to support the stakeholders involved in cyber exercises in Europe. This stocktaking report is one of ENISA’s efforts to enhance this area in Europe. This report aims to support the European and international cyber exercises community with lessons about cyber exercises and recommendations for the future. The report presents the results of the stocktaking of national and international cyber exercises carried out by ENISA in 2012. More information about this report, the stocktaking activities and supporting material can be found on the report’s companion website at ENISA’s Resilience and CIIP public web pages.

text: 1.1 Policy context

text: In its 2009 Communication on Critical Information Infrastructure Protection COM(2009)-149 , the European Commission invited Member States to ‘organise regular exercises for large scale network security incident response and disaster recovery’. The Tallinn Ministerial Conference, which took place in 2009, subsequently built on the five pillars of the CIIP Action Plan, stressing that ‘A joint EU exercise on Critical Information Infrastructure Protection should be organised and staged by 2010, in line with the Commission’s action plan’. As an ultimate confirmation of the importance of exercising at both the national and pan-European level, the Council Resolution published in December 2009 stated that ‘Member States should organise national exercises and/or participate in regular European exercises in the area of Network and Information Security’. ENISA fulfils a significant role in this by supporting Member States in providing appropriate responses to emergencies. Supporting EU-wide cyber security preparedness exercises is one of the main items on the Digital Agenda for Europe COM(2010), the new policy plan of the European Commission which emphasises the need for Member States to carry out large-scale attack simulations and test mitigation strategies in cooperation with the Commission. Here, ENISA’s newly proposed mandate again highlights the significance of cyber security preparedness exercises in enhancing trust and confidence in online services across Europe, as well as the exchange of good practices in this area.

text: 2 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: In this policy context the first pan-European exercise on Critical Information Infrastructure Protection (CIIP), Cyber Europe 2010, was conducted on 4 November 2010. The exercise was organised by EU Member States and facilitated by ENISA. Built on a scenario concerning internet resilience, the exercise helped to increase trust and test the communication efficiency between the participating Member States of the European Union and the European Free Trade Association (EFTA), hence illustrating the value of conducting such exercises. A COM Communication of March 2011, COM(2011)-163 , on CIIP again stressed the importance of cyber exercises for a coherent strategy for cyber incident contingency planning and recovery at both national and European level. There is therefore an increasing appreciation of exercises as a means of validating CIIP resilience and improving stakeholder communication. As such, the cycle, which began with the Good Practice Guide on National Cyber Exercises, is now in full motion after the completion of the first joint EU–US CIIP Exercise, Cyber Atlantic 2011, and of the second pan-European cyber exercise Cyber Europe 2012 .

text: 1.2 Scope and audience

text: This report aims to provide a global overview of cyber exercises, analyse their commonalities and differences and finally draw a number of recommendations that could help improve their impact and quality. In this research we explore the field of cyber exercises, focusing on the way exercises are executed. Our research included information about cyber exercises conducted since 2002 (and about those planned in the near future). Such exercises took place at different levels, such as the national or multinational level and in the private, public or combined sectors. The target audience for this report consists of stakeholders, policymakers and experts in the field of national, European and global cyber crisis cooperation, and especially those with a responsibility for organising cyber exercises.

text: 1.3 Methodology

text: As a first step to prepare this research, we conducted a bibliographical search over six months (February–July 2012) in order to gather information on cyber exercises from online sources and available relevant literature. The second step was to develop a survey about cyber exercises. We opened the survey at ENISA’s website from April 2012 until July 2012, and invited stakeholders in the global cyber exercise community to respond. The survey was filled in on a voluntary basis; therefore we cannot claim that we have covered all cyber-exercises.

text: On National and International Cyber Exercises 3 Survey, Analysis and Recommendations

text: The final step in the process was the organisation of the 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises on 27 June 2012 in Paris. In total, 17 speakers and approximately 65 participants, all involved in the field of cyber exercises, attended and contributed to the conference. The objectives of the conference were to: a) Exchange good practices in the field of international cyber crisis cooperation, specifically focusing on cyber exercises. b) Bring together the stakeholders that organise and have experience in cyber exercises in order to explore cooperation between them. c) Identify gaps and challenges in the field of international cyber crisis cooperation and in particular cyber exercises. This report takes into account the results and recommendations of the 2012 Paris conference. The full details about the Conference, including the individual presentations, are available at ENISA’s resilience and CIIP web pages. The data gathered from all three steps were analysed in order to draw valid conclusions about the nature of national and international cyber exercises. This report includes the results of this analysis. In addition, ENISA has created a database with the results of the open survey on the stocktaking of cyber exercises. Subsequently, we analysed the results of the stocktaking of cyber exercises. In this report we present the analysis of the results, the conclusions and recommendations.

text: Note that the data gathered in the three steps of our methodology were given to us on a voluntary basis. Therefore we cannot guarantee that these data correspond to a full mapping of all cyber exercises; i.e., we cannot claim we have an exhaustive list of all cyber exercises. We do believe, though, that we have the critical mass, covering a broad scope in terms of cyber exercise types.

text: 1.4 Structure of the report

text: The rest of this report is structured as follows. Chapter 2 presents a general overview of the exercises in our research as well as the results from the open survey. It also contains a part focusing specifically on national cyber exercises in Europe. Chapter 3 presents the main findings, while the following chapter describes the main conclusions and sets out recommendations for future cyber exercises. The Annexes of the report contain the necessary supporting information and evidence.

text: 4 On National and International Cyber Exercises Survey, Analysis and Recommendations On National and International Cyber Exercises 5 Survey, Analysis and Recommendations

text: 2 Overview of cyber exercises

text: In this stocktaking we have collected information on a number of cyber exercises of national and international cyber exercises. The exercises studied display a mixture of different exercise types. In this section we present a general overview of our findings. Annex 1 and 2 provide more details on the results of the stocktaking.

text: 2.1 Basic facts

text: The number of exercises examined during this stocktaking was 85 (see the list of exercises in Annex 2), covering the period between 2002 and 2012. The data for these exercises were mainly taken from the open survey that ENISA had conducted over two months, as well as the related research we carried out. In our analysis we have included all the cyber exercises we found; in other words, there were no inclusion or exclusion criteria, as long as the event could qualify as a cyber exercise. The number of European countries that participated in and organised national cyber exercises is 22. In total, 84 countries worldwide participated in the multinational exercises that we analysed.

text: 2.2 General exercise information

text: Figure 1 shows the number of cyber exercises per year. We see that the majority of the exercises, around 71%, in this stocktaking were conducted in the last three years (2010–2012). This figure shows that governments and private organisations take cyber threats seriously. Based on the trend observed, we can expect the number of cyber exercises to increase in the coming years.

text: 6 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: data gathered) of the exercises lasted for one to three days, which indicates that even a short period of time can be sufficient to execute a cyber exercise.

text: 2.3 Cyber exercises in Europe

text: More specifically, we looked at the situation of cyber exercises in Europe. Figure 4 shows the map of Europe and the number of national exercises organised by European countries. For this stocktaking, we included both EU and EFTA countries (31 countries in total). According to our findings, between 2002 and 2012 six countries (indicated with on the map) organised a national exercise three times. In the same period four countries (indicated with on the map) organised two national cyber exercises. The countries indicated with on the map conducted one national exercise. We thus see that 22 European countries have already organised one or more

text: On National and International Cyber Exercises 7 Survey, Analysis and Recommendations

text: national cyber exercise. Cyprus, Malta, Luxembourg and the Czech Republic have not yet conducted such an exercise. However, these countries were involved in international exercises.

text: 8 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: 2.4 Participation in cyber exercises

text: Figure 6 shows that approximately two-thirds of the exercises (based on 97% of overall data gathered) were national exercises and approximately one-third were multinational exercises. This indicates a tendency towards cooperation at the international level, even though matters of national security are usually domestic concerns. The cross border nature of cyber threats gives rise to the need for international cooperation. Based on these results, we anticipate that the trend of a growing number of multinational exercises will continue.

text: On National and International Cyber Exercises 9 Survey, Analysis and Recommendations

text: infrastructure and the actual experts in the subject. Public–private cooperation occurs in more than half of the exercises, which is attributed to the fact that private stakeholders play a critical role in the area of cyber crisis cooperation. As such, public–private cooperation in cyber exercises is likely to increase in the coming years.

text: 2.5 Type of exercise

text: Many kinds of exercises exist, each with different formats, benefits, challenges and costs. There is no international standard taxonomy of exercise types, although there are many commonly used terms and categories (see table below). The simplest forms of exercise are the ‘desk check’ and ‘walk through’ exercises which use a simple scenario to validate a plan or procedures to ensure that the participants are able to meet the requirements of the organisation. The most complex are ‘full simulation exercises’ where players experience the pressure of working in real time responding to an unfolding scenario.

text: What Why How

text: Desk check Early stage validation of a new plan One to one discussion with the author of or amendments to a plan. the planned procedures against a simple scenario to demonstrate the stages that are in place and how they operate. Comms check To validate systems or A different form of initial activity used to infrastructures. validate the communications methodologies or notification systems. Walk through The first time the response team The response team is convened in one convenes to consider the planned room and a simple scenario is used to procedures and their roles. demonstrate the progression of the planned responses and what each responder should do.

text: 10 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: Workshop A scenario-based rehearsal of A developmental step in the building of responses and actions in open capability, using a scenario to rehearse forum, to allow discussion of in an open forum the responses of teams activities. and actions without any time pressure. Table-top To validate plans and integration of Scenario-based, open forum discussions procedures prior to moving on to with no external pressures. Responses more complex, team-based are stepped through in a measured activities. fashion and each aspect is discussed if needed before moving on. Distributed table-top To test plans and procedures. Scenario-based, players act according to routine. Command post To enable a team to rehearse using Response centre based but with role their own response facilities. Usually play of the external environment and only management level involvement. players. Full simulation To stress test the responses with a Players respond in real time as real time environment, as close to information is received, interacting with reality in every aspect as possible. other teams and role players as the response requires.

text: As shown in Figure 8, 43% of the exercises (based on 61% of overall data gathered; the relevant data were not available for the remaining 39%) were executed as distributed table-top exercises (i.e. players remain in their usual place of work within their organisation/country); 19% were full simulation exercises; and 5% took the form of a workshop.

text: On National and International Cyber Exercises 11 Survey, Analysis and Recommendations

text: Figure 9 demonstrates that in total 48% of the exercises (based on 45% of overall data gathered) had an operational focus, while 17% were mainly tactical and 24% mainly strategic. Most of the cyber exercises examined had a combined focus.

text: 2.6 Exercise execution

text: The following list shows which objectives were mentioned most often in the stocktaking survey: - Build awareness about cyber threats; - Examine the capabilities of participating organisations to prepare for, and respond to the effects of cyber-attacks; - Identify and highlight roles, responsibilities and authorities for responding, as well as to test decision-making and procedures between public and private actors; - Assess cyber security emergency readiness (prepare, test and evaluate (national) procedures and processes); - Raise awareness of infrastructure interdependency issues with a particular focus on cyber security; - Build trust among states; enhancing interstate and interagency cooperation. As this list shows, raising awareness and building trust are important objectives of cyber exercises. In addition to the objectives, we found that procedures, plans, protocols, capabilities and players are all tested during the exercises. Around half of the exercises (based on 25% of overall data gathered) made use of exercise management tools (i.e. tools and software to support preparation, execution and evaluation of an

text: 12 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: exercise). However, three-quarters of all exercises gathered did not provide data about the exercise management tools. This could be either because they do not use tools, or because the information about them could be made public.

text: 2.7 Monitoring and evaluation

text: Research shows there is a need for structured evaluation in order to improve the learning of participants in exercises. Looking only at outcomes of an exercise tends to undermine the aims of the exercise, is generally unfair to participants and encourages risk-avoiding behaviour. The focus should be on process characteristics that enhance the effectiveness of crisis management. Monitoring and evaluation tools help to structure feedback and formulate lessons learned. The results of our stocktaking (illustrated in Figure 10) show that 31% of the exercises (based on 24% of overall data gathered) conducted real-time monitoring, 22% worked with status reports, and 27% employed experts to monitor the exercise. Most of these approaches are not used exclusively, and there are many exercises that use a combination of the different methods.

text: On National and International Cyber Exercises 13 Survey, Analysis and Recommendations

text: 2.8 Cyber exercises in the media

text: In 74% of the exercises (based on 67% of overall data gathered), the media reported about the exercises. Most media reports about these exercises are still available online. The following list shows which type of information was mentioned most often in the media reports: - The exercise was an excellent opportunity to enhance our nation’s cyber security; - The exercise organisers wanted to show they are working on their preparedness regarding cyber incidents; - The outcomes of the exercise showed the need for further improvement of plans, and procedures; - Several countries and organisations cooperated within the exercises; - The exercise was a first examination of IT security; - This exercise was a first step in organising regular exercises on critical information infrastructure protection as preparation against similar attacks. As the list above shows, organising exercises attracts publicity for organisations and helps to raise awareness within a country about cyber security. In addition, media reporting about the exercise proved to have a positive impact on the reputation of organisations involved (e.g. that citizens learn about the work done by their government).

text: 14 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: 3 Summary of the main findings

text: This survey of national and international cyber exercises shows that countries engage in a variety of cyber exercises. The research presented in this report is not exhaustive as the results capture only 85 exercises of 84 countries (national or multinational, European or global) from 2002 to 2012. However, we do think our stocktaking presents a good overview of the status quo and in this section we draw the main conclusions from the findings during our research. Below we have listed (in no particular order) the main findings.

text: 1. The number of cyber exercises has increased in the past few years Cyber exercises are becoming increasingly more common, with the number of exercises rising sharply since 2010. This may have been caused by the overall policy context that supports and boosts cyber exercises, cyber exercise and by the increasing threat of cyber incidents and attacks. Many exercises are part of an exercise series and take place on a yearly basis. This shows that interest and activity in the field of cyber exercises persists and that this trend will most likely continue in the coming years. We observed that many countries actively engage in this field and are preparing to carry out cyber exercises in the (near) future, both domestically and in international cooperation. In addition, the media seem to report more frequently on the cyber exercises.

text: 2. Cyber crisis cooperation efforts are in constant development Not only are cyber exercises more frequent and widespread, but there is also a constant development of cyber crisis cooperation initiatives. Cyber security is an urgent matter which receives increasingly more attention in European countries. The growing attention is spurred by the fact that societies face ever more complex and potentially devastating cyber-related contingencies and challenges. The participants in the 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises stressed the need for more exchange of good practices in the area of cyber crisis cooperation (e.g. regarding exercises and conferences) in order to learn from each other’s experiences, lessons and solutions.

text: 3. Most European countries participate in national and multinational cyber exercises Most EU and EFTA countries participate in both national and multinational exercises. This implies that efforts on a national level can be combined and complemented with efforts on a multinational level and that (inter)national cyber crisis cooperation expands during these exercises. For countries with limited national capacity (for instance to organise a national exercise), it is very helpful to participate in multinational exercises in order to ensure that their national preparedness meets the required standards. The fact that cyber crises do not stop at the border of a country also provides a strong incentive for larger countries to help neighbours with more limited capacity, and emphasises the need to jointly organise multinational exercises. ENISA supports these efforts by arranging seminars on 13 14 cyber exercises and pan-European regional exercises.

text: 4. Public–private liaison is essential due to private sector ownership of most critical information infrastructures

text: On National and International Cyber Exercises 15 Survey, Analysis and Recommendations

text: Since many private sector stakeholders are involved in the protecting, managing and employing of critical information infrastructure, we consider it promising that private and public sector actors cooperate in many cyber exercises (about half of the exercises involve both public and private sector participants). However, the trend that critical information infrastructure is increasingly more owned by private stakeholders, shows the need to intensify public–private cooperation in cyber exercises in the future. 5. More attention must be paid to exercise management tools The cyber exercise field seems to show an under-appreciation of exercise management tools. Exercise management tools can assist in exercise execution and preparation (e.g. when inexperienced people prepare to organise an exercise). During the 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises several exercise management tools were presented and good practices were exchanged. However, the work in this area is still progressing and many exercises do not yet employ any exercise management tools. We believe the use of these tools will grow significantly and become more relevant in the years to come. 6. Advance the use of planning, monitoring and evaluation methods Planning, monitoring and evaluation are crucial for exercise pay off, e.g. improvement of plans and procedures, policy changes, and planning and enhancement of new exercises. Planning is essential to guarantee an effective and successful exercise. It is crucial that organisers have enough time to plan, execute and evaluate exercises. The global cyber exercise community should exchange good practices regarding the planning process in order to help organisers prepare better for an exercise. The monitoring and evaluation process is made more efficient when good practices are shared among several exercise organisers. As this stocktaking yielded limited evidence of the use of monitoring and evaluation methods, we stress the fact that it is essential to gain ground in this respect. Monitoring and evaluation methods can further help exercise organisers to structure feedback and generate lessons learned.

text: 16 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: 4 Recommendations

text: Building on the findings from research on cyber exercises we have produced a number of recommendations that could increase the number and quality of cyber exercises, and thus contribute to the enhanced resilience of the critical cyber infrastructures and services. The recommendations below are mainly targeted at cyber exercise organisers, political leadership and policymakers, the various public agencies, national and international, behind the organisation and support of cyber exercises, the private sector owners of the cyber infrastructures, and the research and development community that can support the tools and methodologies for cyber exercises. 1. Establish a more integrated cyber exercise community As we observe the continuous expansion of the cyber exercise area and the constant development of the field of cyber crisis cooperation, there is a need for a more integrated cyber exercise community in which good practices, challenges and lessons learned are exchanged and discussed among stakeholders in the global field of cyber exercises. Most of the current efforts, such as national cyber exercises and multinational, civilian and cyber defence, are quite segregated. A big challenge for the cyber community is to coordinate the exercise schedules, and synchronise wherever possible, in order to be able to learn from each other. In addition, we recommend continuing with the organisation of international conferences in the field of cyber crisis cooperation in order to build a more integrated cyber exercise community.

text: 2. Exchange of good practices on cyber exercises – public–private cooperation The 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises provided a number of ideas about how to share good practices in the field of cyber exercises. The most important recommendation is the need for cooperation between the private and public sector. Private– public partnerships for the protection of critical information infrastructures are very important, and in that context joint exercises and sharing of best practices are essential. Other suggestions for exchanging good practices include: the establishment of (virtual) databases for sharing good practice in conducting cyber crisis exercises and observing each other’s exercises in order to learn from them and exchange ideas. We recommend that all stakeholders in the global field of cyber exercises engage in the exchange of good practices and that private–public partnerships are established and utilised for cyber exercising. ENISA will aim to facilitate this in the future.

text: 3. Further development of the area of exercise management tools to support exercise organisation The planning, execution and evaluation processes of cyber exercises can be more efficient if they use well defined methodologies and automated tools to support them. Exercise management tools, including simulators and emulators, can help advance these processes and improve exercise quality and outcome. We urge the global cyber exercise community to support the development, adoption and sharing of exercise management tools.

text: On National and International Cyber Exercises 17 Survey, Analysis and Recommendations

text: 4. Aim for more complex cyber exercises on an inter-sectoral, international and European level One of the main challenges we found during our research on cyber exercises is the cross-border nature of most of the cyber incidents/crises. These types of crises cross the boundaries of countries, and sectors. The challenge is to organise cyber exercises that can test all different complexities of a cross-border crisis, specifically testing different levels (operational, tactical and strategic) together. We recommend the global cyber exercise community, together with ENISA, aims for more complex exercises.

text: 5. Enhance preparedness by including exercises in the lifecycle of Cyber Crisis Contingency Plans Countries need to develop, maintain and update their crisis contingency plans and standard operational procedures for cooperation. The continuous improvement of the response structure (as described in the crisis contingency plans) is refined and fuelled by performing exercises. We recommend that policymakers in the EU Member States include exercises in cyber crisis contingency plans and standard cooperation procedures, since this enhances their preparedness for cyber crises. ENISA prepared a Good Practice Guide on National Cyber Contingency Plans. We recommend the use of this guide in the development of a coordinated response and crisis management of large-scale cyber incidents.

text: 6. Update the good practices for national exercises and promote good practices for multinational exercises In 2009, ENISA developed a Good Practice Guide on National Exercises as is a first step towards a more formal methodology for planning and conducting cyber exercises. Another related effort is the HERMESOEx method. We recommend these methods are merged and updated by ENISA based on developments in recent years in the European policy area, the results gathered in this research and the forums such as the 1st International Conference on Cyber Crisis Cooperation: Cyber Exercises, and create a formal method, with the relevant tools, for planning and organising cyber exercises.

text: 7. Develop feedback mechanisms for ensuring that lessons learned from cyber exercises are implemented resulting in enhanced cyber crisis preparation Any cyber exercise (an exercise in general) is not a target in itself. A cyber exercise is considered part of the preparedness and response procedures development and maintenance lifecycle. Therefore it is vital to have the necessary feedback mechanisms to implement any changes needed as a result of the lessons learned from the exercise. These mechanisms include both the appropriate feedback tools analytical evaluation reports on preparedness, cooperation and response improvement, but also political and strategic empowerment of the owners of processes and procedures to allow them to proceed with the implementation of changes with the appropriate resources. Both aspects are considered essential for the success of an exercise.

text: 18 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: ANNEX 1: Full results of the survey

text: On National and International Cyber Exercises 19 Survey, Analysis and Recommendations 20 On National and International Cyber Exercises Survey, Analysis and Recommendations 22 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: ANNEX 2: List of the cyber exercises from the survey

text: YEAR EXERCISE LOCATION

text: 1 2002 Blue Cascades I Welches, OR, USA 2 2004 Blue Cascades II Seattle, WA, USA 3 2006 ASEAN CERT Incident Drills (ACID 2006) 4 2006 Cyberstorm I USA 5 2006 FY 2006 Japan 6 2006 NICTer Project 2006 Japan 7 2007 ASEAN CERT Incident Drills 2007 (ACID 2007) 8 2007 APCERT Drill 2007 9 2007 FY 2007 Japan 10 2007 Shift Control The Netherlands 11 2008 APCERT Drill 2008 12 2008 Cyber Coalition 2008 13 2008 Cyberstorm II USA 14 2008 FiCom 2008 Finland 15 2008 FY 2008 Japan 16 2008 IKT 08 (ICT 08) Norway 17 2009 APCERT Drill 2009 18 2009 Cyber Coalition 2009 19 2009 FiCom 2009 Finland 20 2009 FY 2009 Japan 21 2009 White Noise UK 22 2010 10th Annual Cyber Defense Exercise Greenbelt, ML, USA 23 2010 APCERT Drill 2010 24 2010 Baltic Cyber Shield 2010 25 2010 COM 10-1 Germany 26 2010 Cyber Coalition 2010 Mons, Belgium 27 2010 Cyber Europe 2010 28 2010 Cyber Hedgehog 2010 Estonia

text: On National and International Cyber Exercises 23 Survey, Analysis and Recommendations

text: 29 2010 Cyberstorm III USA 30 2012 Cyberstorm III-NL pact The Hague, Netherlands 31 2010 ECD – Ejercicio de Cyberdefensa 2010 Spain 32 2010 FY 2010 Japan 33 2010 Gaillean Exercise Ireland 34 2010 Nationell informationssäkerhetsövning (NISÖ) Sweden 35 2010 Panoptis 2010 Greece 36 2010 PHOENIX 2010 Sofia, Bulgaria 37 2010 Piranet 2010 France 38 2010 Tallinn CIIP 2010 Tallinn, Estonia 39 2011 APCERT Drill 2011 40 2011 CERT.LV Technical IT Security Exercise 2011 Latvia 41 2011 COMEX Hungary 42 2011 Copy…Paste The Hague, Netherlands 43 2011 Cyber Atlantic 2011 Lisbon, Portugal 44 2011 Cyber Coalition 2011 45 2011 CYBER DEFENCE 2011 Germany 46 2011 Cyber Endeavor Grafenwöhr, Germany 47 2011 Cyber Italy 2011 Italy 48 2011 CYBER WINTER 2011 Bulgaria 49 2011 ECD – Ejercicio de Cyberdefensa 2011 Spain 50 2011 EuroCybex 2011 51 2011 FY 2011 Japan 52 2011 HACKCERT 2011 Italy 53 2011 Information Security Exercise 2011 Slovakia 54 2011 ITU IMPACT ALERT 2011 55 2011 KRISESTYRINGSØVELSE 2011 Denmark 56 2011 LÜKEX 2011 Germany 57 2011 (Malaysia) National Cyber Security Exercise Malaysia 58 2011 Panoptis 2011 Greece

text: 24 On National and International Cyber Exercises Survey, Analysis and Recommendations

text: 59 2011 Slovak Information Security Exercise (SISE) Slovakia 60 2011 Telö 11 Sweden 61 2011 Turkish National Cyber Security Exercise 2011 Turkey 62 2011 Operation Kill Switch USA 63 2012 APCERT Drill 2012 64 2012 BelgoCybex Belgium 65 2012 COMPOR 2012 Portugal 66 2012 Cyber Defense Exercise 2012 (CDX 2012) USA 67 2012 Cyber Europe 2012 68 2012 Cyber Fever 2012 Estonia 69 2012 Cyber Italy 2012 Italy 70 2012 Cyber Phalanx 71 2012 Cyber Planspiel Austria 72 2012 Cyberstorm IV USA 73 2012 EuroSOPEx 74 2012 Eventide Los Alamos, NM, USA 75 2012 ITU-IMPACT 2012 Amman, Jordan 76 2012 Jornadas PSCIC Spain 77 2012 Lights Out 2012 Israel 78 2012 Locked Shields 2012 79 2012 National Crisis Management Exercises 80 2012 Netútlaginn 2012 Iceland 81 2012 NLE 2012 USA 82 2012 Piranet 2012 France 83 2012 Switzerland Cyber Exercise Switzerland 84 Every half TIETO Finland year 85 No date PTS Trainings Sweden provided

text: On National and International Cyber Exercises 25 Survey, Analysis and Recommendations P.O. Box 1309, 71001 Heraklion, Greece P.O. Box 1309, 71001 Heraklion, Greece www.enisa.europa.eu www.enisa.europa.eu


text: Exploring Cloud Incidents TLP GREEN | JUNE 2016

text: Figure 1 Cloud forensics stages

text: ENISA; Cloud Security Incident Reporting, Framework for reporting about major cloud security incidents

text: Exploring Cloud Incidents

text: TLP GREEN | JUNE 2016

text: SERVICE MODEL CUSTOMER PROVIDER

text:  Logging tools should run on the provider  Client does not have a deep view of the infrastructure system and its underlying infrastructure  Providers may not give access to the IP logs  Single sign-on (SSO) access control should be SaaS of clients accessing content or to the requested metadata of all devices  The client has to contribute to the forensic

text: process, e.g. by implementing Proofs of

text: Retrievability (POR)  Some CSPs provide diagnostic features that  Core application is under the control of the offer the ability to collect and store a variety customer of diagnostics data in a highly configurable PaaS  The customer has no direct control of the way. underlying runtime environment  Logging mechanisms and additional

text: encryption can be implemented  Virtual IaaS instances, in many cases do not  IaaS instances provide much more have any persistent Storage (Persistent data information that could be used as forensic has to be stored in long time storage) and evidence than the PaaS and SaaS models. volatile data might be lost.  Some examples are: the ability of the  Providers may be reluctant to provide customer to install and set up the image for forensic data such as recent disk images forensic purposes, to execute the snapshot of IaaS because of privacy issues that arise. virtual machine; RFC 3227 contains several  Some problems may arise from the unclear best practices applicable to a IaaS useful for situation regarding how the provider responding to a security incident especially in handles the termination of client contracts the case of live investigating systems. and from the inability of the client to verify

text: that the sensitive data stored on a virtual

text: machine has been deleted exhaustively.

text: Table 1 Investigation in the different service models

text: Technical Challenges of Forensic Investigations in Cloud Computing Environments, D. Birk

text: Cloud forensics: An overview, Keyun Ruan, Prof. Joe Carthy, Prof. Tahar Kechadi, Mark Crosbie

text: Forensic Investigation in Cloud Computing Environment, Agreeka Saxena, Gulshan Shrivastava, Kavita Sharma

text: Cybercrime and Cloud Forensics: Applications for Investigation Processes, K. Ruan 6 Technical Challenges of Forensic Investigations in Cloud Computing Environments, D. Birk

text: TECHNICAL ORGANISATIONAL LEGAL Organisational structure for each cloud Multi-jurisdiction and multi-tenancy Forensic data collection organisation Chain of Dependencies of CSPs and Service Level Agreement Elastic, static and live forensics cloud applications Evident segregation of resource pooling environment Investigations in virtualized environments Proactive preparations of measures for forensic investigations

text: Table 2 Characterization of the three dimensions identified in the forensics of cloud incidents in the EU

text: Cloud forensics: An overview, Keyun Ruan, Prof. Joe Carthy, Prof. Tahar Kechadi, Mark Crosbie.

text: Directive on privacy and electronic communications (Directive

text: of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector, OJ 2002 L 201). 10 Acquiring Forensic Evidence from Infrastructure-as-a-Service Cloud Computing: Exploring and Evaluating Tools, Trust, and Techniques, J. Dykstra, A. Sherman 11 Cloud Computing: Pros and Cons for Computer Forensic Investigations Denis Reilly, Chris Wren, Tom Berry

text: The interviews have been conducted online after the consent of the participants.

identifier: Exploring Cloud Incidents

nummer: exploring-cloud-incidents

title: Exploring Cloud Incidents

text: 1 Introduction

text: The use of cloud computing technologies is gaining increased popularity and quickly becoming the norm. At the same time, the cloud service providers (CSP) are not always able to keep up the pace with new technologies. This also affects forensic analysis of incidents in these systems. Nowadays, events caused by malicious activities are becoming more and more frequent and, therefore, digital forensics activities are becoming a necessity. Even though this necessity is identified as a challenge, digital forensics on cloud remains a complex topic.

text: The specific characteristics of a cloud-based environment can raise a number of technological, organizational and legal challenges (the definition of these dimensions of analysis for the cloud forensics is explained below) that digital forensics investigators usually don’t face while obtaining digital evidence in traditional IT environments.

text: Scope and objectives

text: With this paper, ENISA aims to give an overview of the current status of the forensic analysis techniques and processes of cloud incidents.

text: Specifically, the objectives of this paper are:

text:  To identify and analyse the current technical, legislative, organisational challenges or any other kind of limitations that could hamper a sufficient and seamless investigation of cloud incidents.  To present an overview of the techniques, approaches and good practices for the forensic analysis of incidents in the Cloud, based on a desktop research.  To provide advice and good practices (in particular related to SLAs and security measures) on how to make cloud forensic analysis more effective.

text: Target Audience

text: This document is addressed to:

text:  cloud providers and cloud customers, to enhance their knowledge on existing approaches and techniques;  law enforcement agencies and governmental authorities, to improve their expertise on the matter;  cloud security professionals to make them aware of the challenges they might face when conducting forensic analysis in cloud environments.

text: Specifically, the document aims at informing both cloud providers and cloud customers on cloud forensics challenges; it also provides insight on the current approaches to cloud security professionals and law enforcement agencies. Additionally, the document addresses some of the key challenges and concludes on how cloud service providers, law enforcement agencies and cloud security experts could invest on cloud forensics within the EU Member States.

text: 2. Approaches for Cloud forensics

text: The term “Cloud Forensics” refers to the ability of reconstructing and analysing past cloud computing events (cloud based cybercrimes or incidents) by applying suitable practices, techniques and methods. This process can be divided into the stages depicted in the Figure 1:

text: A cloud incident is a breach of security in the cloud environment that has an impact on the operation of network and information system core services, which public administrations and market operators provide.

text: Literature review

text: Based on the literature review, the main factors that render forensic investigation on cloud harder than traditional investigations are the following:  Legal issues including multiple ownership, multiple jurisdictions, and multiple tenancies;  Limited access to remote and distributed physical infrastructure and storage;  Lack of physical control and physical location of data;  Lack of collaboration from the cloud provider(s);  Segregation of duties among cloud actors;  Difficulties in accessing and analysing the log data / lack of transparency of log data to the consumer;  Proliferation of mobile devices and endpoints.

text: The complexity of cloud forensics depends on:

text: a. The cloud service models: in the IaaS model, customers may easily have access to data, while in the SaaS model customers may have little to no access to data required for cloud forensics; b. The deployment model: in private clouds, provider-side artefacts should not be segregated among multiple tenants, while in public clouds, the segregation is mandatory.

text: The following table tabulates some of the key elements that affect investigations between different service

text: models, based on the relevant literature

text: Procedures for cloud forensics

text: There are three potential types of forensics in the cloud environment: before incident, live, and post incident .

text: Before incident: In the cloud environment, it is important for the customer and the CSP to have prior agreement on the actions they have to take for forensics in case of an incident. Before incident is considered the most valuable type of forensics because such provisioning activities tackle most of the technical issues. This type of analysis falls under the responsibility of the CSP who has to carry out some preliminary actions: examples include tracking of the activity records, regular and detection of suspicious of abnormal behaviour, collection of activity logs, collection of support machinery (hypervisor) logs and collection of logs from other tenants (the latter implies careful planning for information sharing and anonymization). A common practice, well documented and detailed in all stages, is to monitor the network (before incident - provisioning) and try to turn each case into a traditional network forensics procedure when an incident occurs. CISOs can handle many incidents more efficiently and effectively if these provisional actions and controls have been adopted into the procedures of the CSP in order to support forensics activities. These preventive controls can be included in the contract between customers and providers to support the forensic analysis of incidents.

text: Live: Live forensic acquisition aims at capturing forensic data from a live and running system before switching off the power. In general live forensic acquisition is usually carried out to acquire volatile data (memory, process, network information acquired in order of volatility) that will be lost with traditional forensic acquisition (dead forensics). Due to the nature of cloud systems (cloud system cannot be easily ‘switched off’, networking for the remote access of the infrastructure, etc.), live forensic acquisition capability is essential but also very expensive.

text: Post incident: After an incident, the investigators acquire a logical and physical image of each artefact. In such cases it is recommended to have the mapping of the entire environment used by the victim, both the dedicated and the shared environment, if any and if allowed.

text: Traditional approaches

text: The main features of forensic approaches used in cloud based environments are remote acquisition and triage capabilities, applied on the target virtual machine deployed in the IaaS model. In both SaaS and PaaS models, the ability to access the virtual instance for gathering evidential information is highly limited or almost impossible: the investigator will have to rely on the evidence provided by the CSP and the device.

text: The tools currently available are actually the ones used in traditional investigations. In particular, network forensic tools are used to capture data (information, logs, etc.) on IaaS, as IaaS instances provide more information for forensic evidence in case of an incident than the PaaS and SaaS models do .

text: In the SaaS model, the customer does not have any control of the underlying operating infrastructure or even the application that is provided. For the support of forensics analysis, the customer has to buy specific services from the providers (for example logging and trace activities application, access control toolkit) to create useful information for the analysis.

text: In the PaaS model, it might be possible to implement logging mechanisms at the application layer to help the forensic investigation. However, the customer has not direct control of the underlying environment and the data acquisition for collecting evidence depends strongly on the prior agreement with the CSPs.

text: 3. Challenges in forensics for cloud incidents

text: In this paper, we have followed a specific approach to identify the challenges of cloud forensics in the EU. In order to contextualize the specific European landscape we report briefly some essential pointers that are specific in the EU policy context:

text:  The EU data protection Directive

text: imposes stringent dispositions with regards to the processing of personal data and on the free movement of such data. At the same time, not all member states have adopted the EU data protection directive, resulting in the fragmentation of national data protection legislation. With the General Data Protection Regulation, which includes new data protection requirements that should be implemented by MS, this becomes even more complex.  In case of forensic analysis that requires cross-border data access and exchange, the lack of collaboration mechanisms between the EU law enforcement agencies and the fragmentations in a multitude of national regulations, make the coordination between the law enforcement agencies problematic and the roles and responsibilities of the actors involved in this type of investigations unclear.  There is a lack of specific guidelines or references in cross-European level for forensics investigations tailored to the characteristics of cloud computing infrastructure.  The big cloud services providers are mainly based outside the EU where the laws regulating privacy and data protection are different from the EU, as are the regulations regarding multi-jurisdictions’ and cross border investigations.  No certification exists for tools, practices and training related to cloud forensic investigations.

text: Therefore, to depict the cloud forensics status in the EU landscape we have defined these three dimensions:

text:  The technical dimension refers to the specific features of the cloud computing model that are to be considered in the forensic investigations in the cloud computing environment.  The organizational dimension refers to the aspects related to the coordination of parties involved in the forensic investigations in the cloud computing environment.  The legal dimension regards the legal aspects and issues between the parties involved in the forensic investigations in the cloud computing environment, the legislative frameworks as well as the legal issues of the acquisition of digital evidence in the cloud computing environment. The table below outlines the three dimensions as well as the challenges of forensic analysis per dimension.

text: Due to the multi-tenant nature of Cloud, a number of additional horizontal challenges that might affect the cloud forensics have been identified in this analysis. Specifically, these challenges are not directly linked to the dimensions identified above, but they might belong to one or more of the dimensions or be related to more generic/high-level issues.

text: Technical challenges

text: Forensic data collection in a cloud environment is defined as the process of identifying, labelling, recording, and acquiring forensic data from the possible sources of data in the Cloud and is actually the first critical stage of the post -incident analysis. In particular, the experts consulted within the context of this study, highlighted that forensic data collection in the case of cloud based environments is usually more complex than in traditional investigations, particularly given

text: a. the remote nature of the evidence, b. the lack of physical access and c. the distributed and dynamic nature of the cloud model that makes it difficult to demonstrate the integrity and authenticity of the evidence acquired.

text: It is important to stress that seizure and acquisition of digital artefacts is a critical step in the forensic process, on which the other steps are highly dependent. The issues encountered in this initial phase of the process can affect its next phases by preventing and/or interrupting the execution of the investigations. Most of the interviewees, based on their experience in specific investigation practices and forensics activities, have agreed that technical challenges have been almost always less relevant than legal and organizational ones, which are considered as the most difficult to overcome. Some of the technical characteristics of cloud computing, such as the resource pooling using multitenancy model and virtualization of resources, are well known in traditional investigations. However, in a cloud environment such features are actually enhanced and they might prevent the practices of forensics in some cases. Given the specific characteristics of the cloud, the post incident investigation activities become more complex. In particular the following features can be translated to some cloud-specific challenges for forensic analysis:

text: Multi-tenancy. Multi-tenancy of systems is not a new challenge in the forensic investigations but, in the case of Cloud, it is exacerbated by the rapid elasticity of the cloud resources that increases the complexity of the data acquisition. Most forensics procedures and tools developed over the years focus on physical acquisition and extraction of images. However, in cloud environments, if the CSP is not providing the specific feature then the forensic process is almost impossible. Additionally, physical acquisition might be a challenge even for the CSP if the tenant has released the resources which are then reused by other tenant in a different fragmentation scheme.

text: Dynamic nature. In cloud, the resources are allocated dynamically. This attribute of cloud hampers the accurate segregation of the resources under investigation. This is a significant challenge for the investigators and the Law Enforcement Agencies (LEA) as confidentiality of other tenants sharing the infrastructure must be taken into account.

text: Volatile data. It was always a challenge for digital forensics investigators to acquire the volatile data in memory. The same applies to the data stored in the cloud instances that do not have persistent storage synchronization. Additionally, in cloud instances, volatile data might be lost after attacks that are able to force the shutdown of the

text: cloud instances. Attackers entirely compromising the acquisition of volatile data from virtual IaaS instances could abuse this vulnerability.

text: Data deletion. Data deletion procedures are in place by the CSP for privacy reasons and for the elasticity of the cloud resources. The recovery of deleted data in a shared and distributed virtual environment is more difficult if the CSP has not implemented efficient mechanisms for the retrieval and the limitation of data in terms of backups and data retention.

text: Cumulative trust issues across Cloud layers. Cloud environments are structured in multiple layers (Network, Physical Hardware, Host OS, Virtualization, Guest OS, Guest application) and this introduces more trust issues than in traditional investigation where the target machines are physically controlled/owned by the customers . The data forensic acquisition techniques vary according to the level of trust required for each layer. For example, the acquisition technique that follows a remote forensic software takes place in the layer of the Guest application. This technique requires to trust that the Guest OS, Virtualization, Host OS, Physical Hardware and Network (all the previous layers) to produce accurate and error free evidence data.

text: Cloud and time synchronization dynamics. The collection and analysis of evidence entails the correlation and the event-based reconstruction of information from dispersed sources of the digital environment under investigation and requires the association of timestamps with each event or data item of interest in order to reconstruct a sequence of events. The definition of time-lining of the file creation, access, and modification times over cloud resources is an issue for the rapid dynamics of the cloud environment and for the accurate time synchronization requested. In the cloud environment, the data is distributed across the world, and when reconstruction of the data and the actions is required, the time synchronization is a critical issue as timestamps must be synchronized using protocols (e.g. NTP) that synchronize machines located across different locations.

text: Unification of different data format of the logs. A similar issue to time synchronization is the distribution of logs among different layers of the cloud stack and the different data format of the logs. It is an issue inherited by network forensics that makes accessibility and acquisition of logs more complex. Unification of log formats in cloud forensics requires at least common dictionaries, synchronized clocks and unifying console.

text: Lack of cloud-specific tools. The lack of cloud-specific and certified tools has often been perceived as an obstacle for the development of foundation of mature cloud forensics technology. The development of such tools should evolve together with cloud technology and should provide suitable and standard solutions for the digital evidence collection overcoming the specific technical challenges of the investigations in the cloud environment.

text: Encryption of data. Data encryption may cause some technical challenges because the decryption of large amounts of data is time and resources intensive. This challenge is exacerbated by the fact that in the Cloud in case of investigations that require large volumes of data to be decrypted.

text: Re-usable and shareable resources. Due to the constant re-use of resources (i.e. IP addresses), some of them

text: might be blacklisted due to an abuse case. The next tenant that gets the IP is also considered black listed due to the

text: previous owners’ malicious use. The whitelisting process is more difficult in cloud environments and can lead to whole ranges of IPs being blocked due to slow response of CSP fixing the issue.

text: User Accountability. Cloud resources can be used by many tenants during a short period of time (e.g. over a year).

text: Tracking of the use of each resource by a user is critical in a forensics investigation; for instance a public IP address used in an attack/abuse can be held by many users during a year, therefore, who is responsible for a specific time, which space was allocated to which user at the time in order to extract evidence, and other similar queries might arise.

text: Organisational challenges

text: The complexity of forensics and investigations in a cloud environment is strictly related to the organisational challenges. The experts noted that these types of challenges are actually the most relevant (compared to the technical and legal ones) and that might affect investigations in a very severe manner. The most prominent organisational challenges are the following:

text: Evidence collection. In practice, forensic investigations in the case of cloud computing environments always involve at least two parties, the CSP and the cloud customer. However, the dependency on the CSP for the forensic data collection is strongly dominant since it affects the starting phase to execute the investigation.

text: Limited collaboration. Investigators can collect forensic evidence themselves remotely from the source (time consuming operation), but in most cases investigations require evidence retrieval from physical locations on the premises of the providers. In both cases, without the provider’s cooperation, it is almost impossible to perform the investigation and obtain any information; additionally, in most cases the time needed for the data acquisition may be longer than in traditional investigations. When the investigator is in law enforcement, cloud providers (in some countries) might be obliged to cooperate and facilitate the investigation.

text: Specifically, the factors that make the role of the CSP important are mainly related to the following:

text:  In the distributed architecture of the cloud model, data is stored in different host machines and located in the data centres across the world. Information about machines, credentials, logs and encryption keys is managed on the provider side.  The procedure of evidence acquisition conducted on the target machines has to be fully supported by the CSP: the investigators collect the evidence directly from the target sources together with the providers and are not allowed to “touch” or operate on any of the CSP systems and machines.  Even third parties could be engaged in the forensics investigations if the CSPs have data located on contracted third parties, increasing the complexity on the organization aspects of the forensics activities.  CSPs and investigators do not usually follow any common standard or procedures to acquire image/find traces/get history logs, which increases the complexity of the design and organization of the activities of the forensic investigations.  In the case of cross-border incidents the collaboration between the CSPs and law enforcement becomes even more crucial and complex: in the worst case, if the law enforcement bodies or the CSP of one of the involved countries does not collaborate it is almost impossible to proceed with the investigation. In cross border incidents the legal procedures are slower as they might “hit” in legal obstacles and gaps on legislation between countries.

text: Responsibilities based on the deployment model. Finally, there are still significant differences in the complexity of the forensics investigations depending on the cloud deployment models. In general, the more control the customer has on the cloud environment, the fewer organizational challenges the investigator will face. In the case of IaaS, where the consumer has complete control over a guest operating system running on a virtual machine (VM)

text: and the provider retains control and responsibility for the hypervisor (HV) down to the physical hardware in the data centre, the organizational issues are weaker than in the other deployment models. More challenges arise in the SaaS case, where the owner of the data has no control over the infrastructure and without the full collaboration of the CSP the owner of the data cannot access the needed information (logging, data, metadata, hashes, root hashes etc.).

text: Legal challenges

text: With regards to the legal challenges for cloud forensics the most important ones that were highlighted by the experts are analysed below.

text: Cross-border and multi-jurisdictional issues

text: Cross-border and multi-jurisdictional challenges are common to almost any cloud deployment model. However in cases where the host machines and data centres of the CSPs are located around the world, more legal issues are likely to emerge considering the time constraints that characterise the investigations. Specifically, the experts have underlined the following:

text: a. Cross-national legislations and collaboration mechanisms or channels between law enforcements, CERTs and public authorities that can facilitate the exchange of data for the forensic investigations are not well developed. b. Formal requests issued during cross-border investigations to allow access to data stored remotely are conditional to the local legislation. Access is granted only after preliminary analysis realised by the responsible authorities of the countries in which the data resides. c. There is no specific regulation governing the CSP obligations in terms of standard operating procedures, the standard actions the CSP has to take in case of investigations to which request the CSP has to comply, the timing for that (e.g. immediately, in a week, in a month), and finally the instructions on how data logs should be kept, managed and stored in order to provide evidence. d. There are currently no agreements among cloud providers, law enforcement and customers to collaborate on investigations when necessary. e. For law enforcement dealing with international investigations, legal access to data is still one of the most relevant challenges. A number of different issues might occur: the concept of locality of the law enforcement mandate (national or regional), the national legislations which do not allow some categories of information to be transferred abroad, privacy aspects related to sensitive information, and finally the presence of consulting authorities or institutions (as centres of expertise). f. International cyber policies and laws must progress to help and solve the issues surrounding multi-jurisdiction investigations. On the other hand, for the private sector, the cross-border and multi-jurisdictional issues can be managed in a better way, as the access and exchange of data for investigations is performed exclusively by the CSP that is the owner of the data.

text: SLAs regarding forensics

text: In most cases, forensic activities and services provisions are not included in SLAs. During the negotiation phase, the customers are not always aware of the relevance of forensics activities, while, the providers often lack transparency in defining what is and what is not included in the contract in terms of forensics services. SLAs that clearly define the forensic process could eliminate most of the organizational issues that hamper an investigation.

text: However, SLAs with clearly defining terms and conditions to enable general forensic readiness in the Cloud, are not usually in place. Moreover, terms and conditions on segregation of duties between CSP and cloud customers are

text: quite often not included in SLAs. Even if these clauses are included, the respective terms and their meaning are, in many cases, not clear to the customers.

text: To facilitate forensics activities, the CSPs should define the terms and conditions in the contracts. General agreements describing clauses like data access and procedures for forensics, as well as roles and responsibilities should be included in the SLAs to address most of the practical issues encountered in the investigations. Examples of clauses to be negotiated in advance are the following:

text:  Type of access granted by the CSP to the customers/investigators and authentication method for eligible investigators;  The apportionment of roles and responsibilities between the CSP and the cloud customer regarding forensic analysis ;  Procedures to follow in the forensic investigations;  Time of delivery of the data;  Type of metadata and type of logging (depending on the deployment models) that will be collected;  Cost related items (What extra costs are defined in case of incidents? Are the costs related to forensics standard fees or extra costs?);  Who can gain access to data collected and under what conditions.

text: Finally, with regard to the SLA a recommendation has been provided by one of the interviewees: Metrics (Service Level Objectives) to be included in the SLA could facilitate the forensics activities, and in particular metrics on implementation of logs and procedures, metrics on the effectiveness of incident resolution and metrics of efficiency of incident resolution.

text: Chain of custody

text: In a legal context, the chronological documentation of evidence handling is required to avoid allegations of evidence tampering or misconduct (chain of custody).

text: In traditional IT investigations, the copy of the hard disk of the targeted machine is used as evidence in court. In the Cloud environment, the distributed, multi-tenancy and the elastic nature of the cloud makes it more difficult for the investigators to prove that the data presented to the court are those of the persecutor. No tool exists at the moment that can solve this issue.

text: However, in practice, this problem is tackled by adhering to good practices; for instance, in the UK and IE, the evidence collected in the cloud and provided by the prosecution has been admitted after proving to the court that investigators had carefully and transparently executed standards procedures and good practices.

text: Horizontal challenges

text: In the context of this paper several horizontal challenges have also been identified as issues related to one or more of the dimension already defined:

text: 1. One of the most relevant issues that might affect cloud forensics activities, especially in the case of critical

text: information investigations, is the time-to-detect and time-to-respond. The time of occurrence of an incident

text: and the actual start-up of the investigation activities, as well as the time spent to complete the evidence collection, are always crucial. The start of the data collection might be delayed due to a series of issues, as described above (mainly organizational) and any delay in having access to the machines/data might invalidate the whole process; given the dynamic nature of the distributed environment, changes can occur at any time:

text: like in any investigation, the delay in collecting evidence might have a strong impact on the results of the prosecution.

text: 2. A second major issue is related to the cost and effort (resources) needed to conduct the investigation from all parties involved (CSP, law enforcement, client, third party, etc.). In most cases, the cost of investigations is incurred only by the customer (if forensic services have not been included earlier in the SLAs contract) and it is translated as extra cost to cover unforeseen activities. As customers actually want to have cost-effective cloud computing solutions, especially if they are just moving to the cloud and have limited digital security awareness, in most cases they are not very keen on including additional services (insurance, basic forensic features, etc.) in the contract to avoid cost increase (risk of unforeseen costs).

text: 3. Finally, CSPs do not typically provide standard features (e.g. logging, monitoring, etc.) to support forensics in common cloud infrastructures that could minimize the cost of ownerships of the infrastructure exploiting economy of scale. For example, the IP logging that is actually one of the most expensive and crucial features needed for the investigations, is not included in the services that the providers offer to the customer. The cost of the investigation (also in terms of effort and manpower) might increase due to the regulation, which in most of the EU countries, does not impose specific obligations for the CSP to provide the data needed for the investigations.

text: 4. Conclusions

text: In concluding this paper, we present recommendations based on evidence collected and on the challenges presented above. These recommendations can enforce cloud security and the process of cloud forensics analysis. To align them with the challenges these recommendations are classified in technical, organisational or legal; keep in mind however that one recommendation might be able to satisfy more than one challenge or on the other hand that one challenge might need a combination of recommendations to reach an adequate solution.

text: Technical For Cloud Service Providers

text:  Solving the issues deriving from the multi-tenant nature of the cloud model, CSP could provide specific tools to enable access and guarantee access control from and for other tenants.  CSPs need to adopt and implement efficient mechanisms for the retrieval of data, for backups and to implement a data retention policy.  Specific training activities focused in forensic analysis of cloud incidents as an essential element to support the effective execution of investigations and cloud forensics should be widely promoted within a CSP. This can extend also to the organisational dimension.

text: For law enforcement agencies and policy makers

text: • LEAs and policy makers should develop or use specific certified tools to support the activities of the forensics analysis.

text: • LEAs and policy makers should support the development of standard procedures and guidelines on forensics analysis, that will facilitate the presentation of the evidence in a jury as robust proof of a methodical and certified process of acquisition of data in such a complex environment as that of the cloud;

text: • LEAs should invest more on education and training on specific tools and methodologies, create common bodies of knowledge and conduct exercises and scenarios (to test also collaboration between stakeholders involved). Specifically, training requirements for CERTs and investigators professionals (that should have the ability to understand technical challenges of the cloud and grasp the specificities of the business model is essential) could be fulfilled with vertical training actions on the specific aspects of cloud technologies.

text: Organisational For Cloud Service Providers

text:  CSP should identify and indicate a “point of contact” for the forensic investigations (responsible for execution of the activities to be realized by the CSP in order to support and assist the forensic investigation activities, main reference for the customer in case an incidents happens and forensics activities are about to begin);  The CSP should enhance collaboration with LEAs and other public institutions to formulate the procedure in conducting forensic analysis in case of cloud incidents. This should explain under which circumstances and following which procedure CSP can enable the forensics investigation.

text:  Policy makers should identify and define specific policies and guidelines for Security Operations Centres at EU level to achieve incident notification and incident collaborative resolution.

text:  Rules and procedures should be proposed at EU level to facilitate the cooperation between the different actors (CSP, customers, third parties that might all belong to different countries each with its own regulation) and law enforcement EU bodies.  Forensic investigation should be part of the national cyber security exercises and part of the national SOPs.

text: Legal For Cloud Service Providers

text:  As per the SLA or contract, the CSP should ensure quick and dependable access to the information/data needed at any time during the investigation through specific and documented procedures.

text:  Transnational agreements and/or procedures to regulate the multi-jurisdiction investigation would support a quick and correct execution of activities during the forensic process.  Chain of custody challenges should be resolved at a national level through specific guidelines created by the policy makers (this should be covered also in the case of cross national cases).

text: Acknowledgments

text: We would like to thank the experts who participated in the interviews and provided their expertise and useful comments on earlier drafts of this document: Neha Thethi (BH Consuilting), Cosimo Anglano (UNIUPO), Ludo Block (Grant Thornton NL), Jose Manas (UPM), Raj Samani (McAfee), Olivier Caleff (ANSSI), Toomas Lepik (CERT- EE), Hellenic Academia (UNIPI). Special thanks for the contribution to Lauri Palkmets (ENISA) and Alexandros Zacharis (ENISA). This work has been done in collaboration with CNIT (under the ENISA tender F-COD-13-C24), and in particular with the experts Maria Cristina Brugnoli, Federico Morabito, Emiliano Casalicchio and Giuseppe Bianchi.

text: Authors

text: Dimitra Liveri, Christina Skouloudi

text: Contact

text: For contacting the authors please email to resilience@enisa.europa.eu For media enquires about this paper, please email to press@enisa.europa.eu.