text: Roadmap for European Cyber Security Month

text: November 2013

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: © European Union Agency for Network and Information Security (ENISA), 2013 Reproduction is authorised provided the source is acknowledged. ISBN 978-92-9204-079-6 doi: 10.2824/276 978-92-9204-079-6

text: November 2013

text: http://www.enisa.europa.eu/media/news-items/european-cyber-security-month-2013-get-involved [accessed in October 2013]

text: November 2013

text: 1.1 The general policy context 1

text: 1.2 The context of ECSM 2013 2

text: 1.3 The stakeholder model of engagement 3

text: 2.1 Participation rate of public-private stakeholders 4

text: 2.2 International cooperation 6

text: 2.3 European level kick-off event 6

text: 2.4 Campaign Analytics and Benefits 7

text: November 2013

text: Training sessions in Nigeria http://cybersecuritymonth.eu/ecsm-countries/africa-1 [accessed in October 2013] Safety tips for mobiles - ENISA supporting world-wide cyber security efforts https://www.enisa.europa.eu/media/news-items/safety-tips-for-mobiles-enisa-supporting-world-wide-cybersecurity-efforts [accessed in November 2013] More on the National Cyber Security Awareness Month and the National Cybersecurity Awareness Campaign -Stop.Think. Connect. - organised in the United States http://www.dhs.gov/stopthinkconnect [accessed October 2013] EU-US Summit Joint statement http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/er/117928.pdf [accessed in October 2013]

text: November 2013

text: 8 Following the publication of the 2011 Feasibility Study and the 2012’s pilot phase, European Cyber Security Month 2013 was deployed to reach to new partners. ECSM is set to promote cybersecurity among citizens of the EU, change their perception of cyber threats, and provide current security information through education and the sharing of good practices. The ENISA Work Programme for 2013 mentions that work should continue together with the Member States and the Commission to further develop the campaign. The approach was established to widen the number of participating Member States, to ensure sufficient focus on a number of key themes and to profile the event as a joint EU campaign with global outreach. Moreover it is anticipated to increase the involvement of the private sector in this initiative by working through industry representation bodies to make full use of material that has been developed already and to build upon this material when necessary. The objectives were brought into line with the final recommendations and objectives of the 2012 pilot:  generate general awareness about cyber security, which is one of the priorities identified in the EU Cyber Security Strategy;  generate specific awareness on Network and Information Security (NIS), which is addressed in the proposed NIS Directive;  promote safer use of the Internet for all users;  build a strong track record to raise awareness through the ECSM;  involve relevant stakeholders;  increase national media interest through the European and global dimension of the project;  enhance attention and interest with regard to information security through political and media coordination.

text: February 2013 http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667 [accessed in October 2013] For previous relevant Policy documents please consult CIIP action plan for Europe [2009] and The Digital Agenda for Europe [2010] ENISA report 2011 http://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage-1/europeancyber-security-month-advocacy-campaign/2011/europeansecuritymonth [accessed in October 2013] ENISA report 2012 https://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage-1/europeancyber-security-month-advocacy-campaign/2012 [accessed in October 2013]

text: November 2013

text: E.g. EUROPOL, EESC and Europe Direct Network E.g ISACA, ISSA

text: November 2013

text: country profiles may be consulted in the annexes

text: November 2013

text: November 2013

text: th The international cooperation in ECSM had its climax on 29 of October with the coordinated release of 12 Mobile Safety Tips . ENISA supported the global efforts for achieving improved Network and Information Security for users worldwide, either in their capacities as business users, home users or peers. Together with the National Cyber Security Awareness Month in US, the National Cyber Security Alliance in Singapore and many partner countries the top 12 Mobile Safety Tips were released. th Furthermore, the release was to coincide with European Cyber Security Month 2013, the 10 year of National Cyber Security Awareness Month in the United States and the 4th annual Asia Pacific Economic Cooperation Telecommunications and Information Working Group (APEC-TEL) Cyber Security Awareness Day.

text: Keep a clean Machine

text: Protect Your Personal Information

text: Connect with Care & Be A good Online Citizen

text: ENISA release http://www.enisa.europa.eu/media/news-items/safety-tips-for-mobiles-enisa-supportingworld-wide-cyber-security-efforts

text: November 2013

text: European overview from www.cybersecuritymonth.eu In permanent increase

text: November 2013

text: November 2013

text: Press release 10.09.2013 https://www.enisa.europa.eu/media/press-releases/online-security-it2019s-inyour-interest-1st-european-cyber-security-month-coming-up-in-october [accessed in October 2013]

text: November 2013

text: November 2013

text: November 2013

text: th 17 On 11 of October 2013, 67 participants representatives from the private and public sectors gathered in Brussels to the Kick off event of the European Cyber Security Month initiative. Numerous topics were discussed but they all had in common the growing importance of sharing information, knowledge, expertise and responsibility across Europe to improve its resilience to the numerous and worldwide Cyber Security threats. The agenda of the event was balanced between presentations and panels from public bodies with experience in raising network and information security (NIS) awareness and private bodies with initiatives or public–private partnerships (PPPs) in the field. In the opening session, Steve Purser (ENISA) underlined that 2013 was the first fully fledged edition of the European Cyber Security Month and thanked the Lithuanian presidency for its support to promote its visibility. Paul Timmers and Giuseppe Abbamonte (EU DG CONNECT) highlighted the importance of a comprehensive longterm and common strategy for cybersecurity (e.g. ECSM, NIS platform, Directives, eIDAS Regulation, Horizon 2020). Rytis Rainys (RRT- Lithuanian Presidency of the Council of EU) focused on the work already achieved to make the Lithuanian cyberspace more secure. He reiterated their strong support to promote cybersecurity initiatives across EU. In the keynote, Nick Coleman (IBM) asserted on the need to build a risk aware culture across the different stakeholders.

text: Rapporteur Jean-Christophe Pazzaglia (SAP, Product Security Research) 67 in presence/ 44 remotely by web stream

text: November 2013

text: November 2013

text: November 2013

text: November 2013

text: November 2013

text: th  In the perspective of the upcoming 6 edition of the International Forum on Cyber Security , the FIC Observatory invited the participants to the event.  ECSM activities presented (e.g. Germany, Norway, Sweden and Belgium): All the activities have in common the use of multiple communication channels (e.g. social network, seminar, traditional press and videos) to address a majority of citizens. Story telling and effective advertisements are used to raise awareness outside the cybersecurity gettho. To be more effective, the german strategy was to split the month per week focusing on a particular topic (e.g. password hygiene, social engineering) but also to involve Media to host Q&A sessions with experts. Ederly and kids also deserved a specific treatment with respectively a contest and a dedicated web site using cartoons code. The Norway initiative has choosen the humour to carry the message and to raise awareness. Like the Belgian and German initiatives the campaigns are global and span the whole society with numerous actions including technical vulgarisation but also more advanced lectures. The Swedish ECSM campaign is smaller and it should be understood as a way of gaining experiences for a larger campaign next year. Still the campaign runs in cooperation with the The Swedish Post and Telecom Authority (PTS) and target home users and employees and focus on Secure passwords, Mobile devices, Back up your files, Malicious code and Wireless networks.

text: http://www.forum-fic.com/2014/en/ Details on the activities here www.cybersecuritymonth.eu

text: November 2013

text: November 2013

text: November 2013

text: November 2013

text: Recommendations Highlight of the for future ECSM event events

text: The link between EU Host more policies, strategies coordinators from and the ECSM ECSM countries

text: Presentations of To develop more on activities form ECSM the practical aspects country experience of ECSM activities

text: The Kick-off should Exchanging work ideally be organized practices between at the start of the similar organizations campaign

text: Provide more material that can be used by all ECSM countries

text: Better marketing for the event

text: Better presence from EC and ENISA for this important event

text: Twitter Wall with visible tweets

text: November 2013

text: November 2013

text: November 2013

text: November 2013  International partners for Mobile Safety tips:

text: November 2013

text: November 2013

text: November 2013

text: November 2013

text: November 2013

text: November 2013

identifier: Roadmap for European Cyber Security Month

nummer: ecsm-roadmap

title: Roadmap for European Cyber Security Month

text: ECSM final report

text: November 2013

text: European Union Agency for Network and Information Security www.enisa.europa.eu

text: ECSM final report

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Editors of the report Demosthenes OIKONOMOU and Daria CATALUI.

text: Contact

text: For contacting the editors please use StakeholderRelations@enisa.europa.eu For media enquires about this report, please use press@enisa.europa.eu

text: Acknowledgements

text: We would like to express gratitude for the work and support of Ann-Sofie RONNLUND (EC DG CONNECT), Vangelis Stavropoulos (ENISA), Jean-Christophe Pazzaglia (SAP). Furthermore appreciations for the work of all coordinators from the 27 ECSM countries who participated with input: Austria, Belgium, Bulgaria, The Czech Republic, Germany, Estonia, Greece, Spain, Finland, France, Hungary, Ireland, Iceland, Italy, Latvia, Lithuania, Luxembourg, Moldova, The Netherlands, Norway, Poland, Portugal, Romania, Slovenia, Serbia, Sweden and the United Kingdom.

text: Legal notice

text: Copyright Notice

text: Page ii

text: ECSM final report

text: Executive summary

text: The European Cyber Security Month 2013 took place in October in 27 countries. By consulting this report the reader will be introduced to the context of ECSM deployment, the policy context, the stakeholder model of engagement, the activities that were implemented and the results of the fully fledged EU advocacy campaign on NIS topics. This report presents the model of building together a joint EU advocacy campaign, a campaign on cybersecurity topics of interest for all digital citizens, and at the same time for institutions and Small Medium Enterprises. The main recommendations regarding future editions of the advocacy campaign are mentioned in the conclusions of the evaluation effort and are structured in three pillars as below.

text: Develop a stable Model of coordination at European level and MS level: o Plan in advance all steps and communicate them o Improve content and participation o Improve interactivity Enhance Content of ECSM: o Continue the development of repository of materials o Keep encouraging private-public common activities o Introduce a best practice section on the website Improve International Cooperation: o Exploring common webinars and e-learning solutions o Develop an International training kit for NIS activities o Advance planning

text: European Cyber Security Month (ECSM) is an EU advocacy campaign that takes place in October. The main objective of the ECSM is to promote cyber security awareness among citizens, to modify their perception of cyber threats and to provide updated security information through education, good practices and competitions. Coordination efforts were managed by the Commission (DG CONNECT) and ENISA, and a large number of NIS stakeholders participated as a result of the open call published early during 2013 .

text: Page iii

text: ECSM final report

text: Table of Contents

text: Executive summary iii 1 Introduction 1 2 The ECSM 2013 deployment 4 3 The Roadmap 8 4 Conclusions 10 References 11

text: Page iv

text: ECSM final report

text: 1 Introduction

text: In October 2013, the first fully-fledged European Cyber Security Month (ECSM) took place all over Europe with the aim to promote cyber security education and sharing of good practices. Furthermore, synergies were built with Africa and world-wide cyber security efforts were embarked on by a shared release of top 12 Mobile Safety Tips . The Goal of this report is to describe what has been achieved, taking account of the policy context and making reference to country profiles and analytics. Furthermore, a number of recommendations are made and a best practice path is proposed in order to set a roadmap for future deployments. The Target Audience consists of ECSM country coordinators, public and private stakeholders involved in the campaign, policy makers and all those that participated to ECSM activities. The document is structured in 3 parts:  The introduction with general considerations on the context;  The ECSM 2013 deployment with details on coordination and activities. This section includes annexes with important details on each ECSM country, analytics and a report of the Kick-off event;  The Roadmap for future deployments; For the specific purpose of this report, data was collected from ECSM coordinators talks, ECSM kick off evaluation meeting, webforms with activity evaluations, reports from stakeholders and team meeting evaluations.

text: 1.1 The general policy context

text: In this section we describe the general Network Information Security (NIS) background and the specific context surrounding the ECSM as a method of raising awareness and empowering the digital user. This concept was piloted and developed in Europe taking into account the experience gathered from worldwide actors that have been implementing it . The work is in line with the Awareness Raising work stream of the EU-U.S. Working Group on Cyber-security and Cyber-crime established in the context of the EU-U.S. Summit of 20 November 2010 held in Lisbon . Additionally, the work benefited from a multiannual planning.

text: Page 1

text: ECSM final report

text: Furthermore, the Cyber Security Strategy for the EU calls for "An Open, Safe and Secure Cyberspace" including the importance of raising awareness as a common responsibility where end users need to be made aware and be empowered, as developed on page 8. This is being put in practice in a yearly Cyber Security Month advocacy campaign deployed currently in 27 countries. The basis being a Feasibility Study conducted in 2011 and an initial Pilot with 8 participating countries in 2012. As an example of the common responsibility practice, more than 60 public and private stakeholders supported the month, including ENISA, together with the European Commission and vice president Neelie Kroes and the Directorate General CONNECT.

text: 1.2 The context of ECSM 2013

text: Page 2

text: ECSM final report

text: 1.3 The stakeholder model of engagement

text: At a time when cybersecurity is increasingly important, our challenge is to update the skills of end users, increase the capabilities of SMEs and improve trust in public and private services. All these 9 10 goals can be achieved by building synergies with EU organizations , professional associations and industry representatives. Following the model of stakeholder involvement depicted in the graph below, the ECSM team acted as an information broker, supporting stakeholder mapping and building public-private partnerships for activities.

text: Furthermore, the support from the European level contributed to make the work more efficient, and build up a strong NIS community behind the campaign. This role is central in advocacy. Additionally, the concrete activities that bring added value happen most of the time at local level, with public bodies, private stakeholders, professional associations and citizens, all working together for greater cyber security in the digital environment. All these sustained efforts aim to create active involvement in the promotion of cyber security for citizens, placing the topic firmly on the agendas for both citizens and governments. Where can you intervene? Are you interested in getting involved in the European and global effort towards this common challenge? We all should engage and ask these questions since everyday life in a digitally connected society requires better informed users and more aware decision makers.

text: Be aware, be secure!

text: Page 3

text: ECSM final report

text: 2 The ECSM 2013 deployment

text: As specified in the stakeholder model of engagement, ECSM2013 had a complex interconnected coordination between European-National-International stakeholders. We consider the multistakeholder approach as being the appropriate path to follow also for future years, whilst continuing to refine the level of interactions and permantly searching for tailored solutions that may be requested.

text: 2.1 Participation rate of public-private stakeholders

text: One of the strong points of the 2013 deployment was the number of stakeholders that were involved in the campaign( a record number of 27 countries, consisting of 23 EU MSs and 4 partner countries). In order to have a general overview on the level of participation and the type of activities that were organized we summarize below data for the 27 participating countries : Austria: Security awareness, data protection in enterprises and public campaigns: “Safe Usage of the Internet” Belgium: Online campaign, Information Security Solutions Conference Bulgaria: InfoSec and data storage Czech Republic: Online and outdoor campaigns, workshop for NGOs operating helplines Germany: Internet Day, Security Fair and Congress, online campaigns: secure surfing, mobile-secure, and shopping-secure; use of social networks, activities for SMEs, journalists and citizen Estonia: ICT for Business, lectures on cyber security Greece: Security trends and CIIP workshop for students and young professionals Spain: Impact of cyber security, security campaigns, university lectures Finland: Digitour, web and social media, network behaviour education for rural stakeholders France : Online campaigns «Rester alerte, rester serein: la sécurité informatique se construit avec vous», meetings with students Hungary: Mysec Talk, Cybersecurity conferences Ireland: Launch of CyberPsychology Research Centre Iceland: Insights in InfoSec industry ‘Hacker Halted’ Italy: Regulatory Framework on Cyber Security workshop, online fraud, social networks; online child protection Latvia: Social networks used as a method for targeted attacks, free computer check-ups: removal of computer viruses and malware Lithuania: Network information security Luxembourg: Ecommerce, Ebanking and Cyberbullying quizzes

text: Page 4

text: ECSM final report

text: Moldova: Cyber Security in Government Week Netherlands: Cyber Security Awareness & Integrity Help and Hotline, Alert online, college tour Norway: Online and outdoor campaigns, security tips Poland: ICT in education, online quizzes Portugal: Information Security training, round table discussions, workshops Romania: Series of technical workshops, online campaign, Cyber Security conference Serbia: Exhibitions and Cyber Security discussions Sweden: Advice on the protection of personal information, identity, PC/handheld devices, secure use of Wi-Fi, how to create strong passwords Slovenia: Online campaign-Safe On the Internet United Kingdom: Poster competition, awareness week on behaviour, ethical hacking, viruses and malware, using your home computer, social media, emails.

text: With the occasion of the launch of the campaign the Executive Director of ENISA, professor Udo Helmbrecht commented:

text: “Cyber security is about the possibility to live your digital life. We encourage you to get involved in the campaign: online security requires your active participation!”

text: In adition to the data collected we present below the visual presence of ECSM in activities meant to update the citizens on cyber security topics.

text: Page 5

text: ECSM final report

text: 2.2 International cooperation

text: 2.3 European level kick-off event

text: Sharing of experiences and further recommendations for the implementation of the campaign were th exchanged in a kick-off event on 11 of October. Here ECSM community members discussed methods for involving the citizens. The main questions asked were in which way may the digital citizen get engaged effectively, how should we measure the impact and which performance indicators to include? We’ve also learnt that multidisciplinary training in NIS education is emerging in top universities over the world, also that we should be heading towards both technology aware users and user aware technologies. Moreover, as a key message for cyber security advocacy we mention the concept of security by design and user empowerment through better education. All these and more details may be read in the annex where we edited the report of the Kick-Off event.

text: Page 6

text: ECSM final report

text: 2.4 Campaign Analytics and Benefits

text: In the 2011 Feasibility study we foresaw the benefits associated with a fully fledged campaign. Table 6 and the graphics above from the report mention increased impact and visibility, increased efficiency, potential use of ready-to-use material, reduced costs and investments, all advantages of a coordinated approach.

text: Once with the implementation of the fully fledged campaign we may add from experience the following advantages reported to us by participants in different occasions: Strengthening ties with EU bodies Networking with NIS actors in the country and internationally Gaining EU visibility for grass root actions e.g. website presence and events participation Brokerage support from the side of ENISA and from the side of DG CONNECT to EU policy makers Sharing of best practices Access to an inventory of NIS materials useful for NIS work Broader outreach and impact towards digital citizens, e-users According to the country rate of participation [27] and the number of activities organized [more than 50], twitter ECSM community [approx. 1000], website visits [more than 9.500], Media reach [approx. 60 million peak] the 2013 deployment went as planned.

text: Page 7

text: ECSM final report

text: Furthermore a detailed overview from meetings, social media, website, rate of involvement of stakeholders may be consulted in annex B.

text: By participating in ECSM advocacy campaign it did simplify the work and achieved a greater impact …time, effort and resource wise!

text: 3 The Roadmap

text: Taking into account the multi-annual framework in which the campaign is deployed, we put forward below concrete ideas for the advanced planning of 2014 campaign. It is important to mention that the ideas were inspired from the evaluation meetings, completed evaluation forms and also from the direct interactions with stakehoders. The evaluation work will be the main source for feeding information into the future editions of European Cyber Security Month.

text: Coordination considerations

text:  The team meetings ENISA-CONNECT were essential. For 2014 they should continue already setting the objectives to mapping stakeholders and building synergies with other stakeholders and other initiatives. ECSM countries may be invited to participate in the EU coordination, rotating over the years.

text:  The ECSM coordinators calls/meeting proved to be efficient and appreciated by the coordinators. The format should be developed further.

text:  The EU level kick-off event should be organized at the beginning of the month with more ECSM coordinators invited and more materials.

text: International collaboration

text:  Advanced planning is needed.  Exploring common webinars and e-learning solutions.  Develop an International training kit for NIS activities.

text: Feedback ideas for implementation

text: o It would be helpful to produce some small number of ECSM posters, official Factsheets and FAQs about ECSM and have them translated in all official EU languages. o It should coordinate a common message for the campaign translated in all languages. o Aim to achieve a stronger collaboration with industry and between bodies at country level. o Improve interactivity by all means.

text: Page 8

text: ECSM final report

text: In order to further develop a stable model of coordination at European level and MS level the team should firstly plan in advance all steps and communicate them, secondly improve content and participation, thirdly outline action points templates and develop the “Guidelines for stakeholders”. It should be mentioned that resources are scarce, however when budget is not available in kind offers should be agreed. In order to continue the implementation of ECSM, further ideas should be taken on board to increase the overall impact and start creating an ECSM footprint in the European society.

text: Enhanced content of ECSM

text:  Continue the development of repository of materials with:

text: 1. Most watched NIS videos

text: 2. Reports and Briefs world wide  Launching the NIS Driving Licence roadmap in October together with a pilot application for testing basic/advanced NIS knowledge  Prepare Online templates and few give away materials

text: Building synergies

text:  Keep encouraging private-public common activities  Partnering with more universities in order to reach out to students  Continue the mapping of NIS initiatives and active stakeholders

text: Evaluate and scale up the results

text:  Introduce a best practice section on the website  Create a basic training kit for NIS multipliers  Improve the interactions between Participants-coordinators-visitors

text: ENISA’s Executive Director, Professor Udo Helmbrecht commented in regards to ECSM importance: “ENISA is a broker of cyber security knowledge. The European Cyber Security Month campaign makes it possible to share best practices, and to increase the results of the security communities’ work. It’s about your security, and in your best interest; online security requires your active participation”. He added

text: “In a time when cyber security is of increasing importance for society and the economy, the challenge is to bring the skills of citizens and SMEs up to speed, to improve the trust in public and private IT services, used in everyday lives.”

text: Page 9

text: ECSM final report

text: 4 Conclusions

text: To conclude, it should be stresed that the European Cyber Security Month future role is to reach out to increasingly more European citizens and update their knowledge on how to stay safe and secure online. In addition to the feasiblity and pilot the previous years, 2013 was succesful at increasing the level of stakeholder reach and placing the initiative firmly on the agendas of both public and policy– makers. The multi-stakeholder approach will be kept and the dynamic nature of the network and information security topics will be addressed through tailored solutions. Further effort will follow in order to:

text: Develop a stable Model of coordination at European level and MS level:

text: o Plan in advance all steps and communicate them o Improve content and participation o Improve interactivity

text: Enhance Content of ECSM:

text: Improve International Cooperation:

text: o Exploring common webinars and e-learning solutions o Develop an International training kit for NIS activities o Advance planning

text: Page 10

text: ECSM final report

text: References

text: [1] European Cyber Security Month www.cybersecuritymonth.eu [2] ENISA news item Call for ECSM http://www.enisa.europa.eu/media/news-items/europeancyber-security-month-2013-get-involved [3] Safety tips for mobiles - ENISA supporting world-wide cyber security efforts https://www.enisa.europa.eu/media/news-items/safety-tips-for-mobiles-enisa-supporting-worldwide-cyber-security-efforts [4] ENISA report 2011 http://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage- 1/european-cyber-security-month-advocacy-campaign/2011/europeansecuritymonth [5] ENISA report 2012 https://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage- 1/european-cyber-security-month-advocacy-campaign/2012 [6] ENISA Press release 2013 https://www.enisa.europa.eu/media/press-releases/online-securityit2019s-in-your-interest-1st-european-cyber-security-month-coming-up-in-october [7] National Cyber Security Awareness Month and the National Cybersecurity Awareness Campaign - Stop.Think. Connect. - organised in the United States http://www.dhs.gov/stopthinkconnect [8] EU Cyber Security Strategy calls for "An Open, Safe and Secure Cyberspace" http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667 [9] EU-US Summit Joint statement http://www.consilium.europa.eu/uedocs/cms_data/docs/pressdata/en/er/117928.pdf

text: Page 11

text: ECSM final report

text: Annex A: Report of the ECSM Kick-off event

text: A.1 The discussion and conclusions

text: Page 12

text: ECSM final report

text: The panel "International Good Practices in Securing the Digital Citizen" highlighted the need of a pan-european collaborative approach and it continued on the need of a paradigm shift for the design and protection of cyber systems. A parallel was established with the common control process of the aviation industry that may be a role model for the cyberspace and that may help to fight against a cyber protection divide within Europe. The afternoon started with the presentation of some ECSM activities happening within this year edition of the European Cyber Security Month, the campaigns held in Belgium, Germany, Norway, and Sweden complemented with the report on the French “Forum Intenational de la Cybersecurite”. The last panel “Cyber Security Professional" presented the evolution of the cybersecurity professionals’ skills and their career lifecycle. They supported the existing certifications but also praised the emerging curriculums (e.g. Royal Holloway, Hague University of Applied Sciences, EPITA and ParisTech) in order to equipe Europe with professionals mastering the necessary multidisciplinary scope of technicques to face cybersecurity challenges. The day finished with a visual overview of the main topics addressed during the day done by the rapporteur Jean-Christophe Pazzaglia (SAP). Finally, Steve Purser described the role that ENISA plays for the ECSM and the chosen approach “learning by doing” that may also be used in the new initiatives like the NIS platform. The rest of this report will look into the different sessions one by one.

text: A.1.1 The difference that ECSM common effort can make

text:  ECSM 2013 was a considerable increase in stakeholder participation since last year's pilot and DG CONNECT aims to make this an attractive month for all EU countries to participate in 2014. The Cyber security Month initiative exists because of the combined efforts of all of those involved: Governments, businesses, academia, NGOs, professionals in information security, in communications etc. The events illustrate the wealth of knowledge that exists throughout Europe on cyber security.

text: We must tap into this collective knowledge to make ourselves more aware of and protect ourselves better against the risks and threats said Paul Timmers. This is where a joint European Cybersecurity Month can make a difference.

text:  On the Cyber security Month website one can find information and events relating to a wide variety of themes. For instance: information to the workforce, both in public and private sector; information to end-users and citizens; the importance of cyber security to industrial control systems and nuclear installations; the latest malware analysis and cyber forensics.

text:  We can share experiences and build on awareness raising models that have been proven to work well. We can share messages, re-use them and thereby spare resources. We can instil a sense of joint challenge and enthusiasm. We can make sure that all actors are involved and nobody is left behind.

text: And we can discuss how to measure the success of our activities, putting efforts into developing metrics for the Cybersecurity Month.

text:  EC overview on cyber security:

text: o The European Commission, together with the High Representative on Foreign and Security Policy, adopted the EU Cyber security Strategy in February 2013. It has since then been

text: Page 13

text: ECSM final report

text: endorsed by the Council of the European Union in June. The European Parliament in its September resolution welcomed the initiative to organise a European Cyber Security Month. o DG CONNECT in particular focussing on resilience: How to enhance capabilities and cooperation: NIS Directive; How to identify best practices throughout the value chain: NIS Platform; Funding of new technologies: Horizon 2020; another important on-going activity is the negotiation of the eIDAS Regulation on mutual recognition of electronic identification means and trust services. o There are more activities that are ongoing in other departments, for instance within DG Home Affairs to fight cybercrime and within the European External Action Service to promote dialogue between civilian and military actors in the EU and to establish international dialogues and norms of behaviour in cyberspace. o ENISA's mandate was renewed in 2013 as well. This is important because of the central role the Agency has in supporting Member States and the Commission in enhancing cyber security capabilities.

text:  The state of play of the EU Cyber security Strategy, in particular the resilience chapter, and the accompanying legislative proposal on network and information security: o Growth and jobs agenda depends on the resilience of the ICT systems and networks underpinning the various economic processes of our modern societies. Enhancing the security of the European value chain is of fundamental importance for the Digital Agenda and the completion of the Internal Market. o The Strategy announced that the Commission would set up a public-private platform – the NIS platform - to identify good cyber security practices across the value chain and create the favourable market conditions for the development and adoption of secure ICT solutions. The NIS platform will as a matter of priority aim to identify technologically neutral best practices to enhance cyber security and develop incentives to abide by those best practices and adopt secure ICT solutions. Such best practices will be identified by two Working Groups: the first WG comprises awareness rising, which is of particular interest. o The Directive will promote a security culture across the value chain so that all players across the chain can reap the benefits of new online services. Users are at the moment hesitating to embrace such services, because of security concerns. Such a security culture should include dynamic risk management, but also participation in the exchange of information on threats and vulnerabilities. o The EU Cyber security Strategy and R&D: HORIZON 2020, which will be the EU's research and innovation funding programme from 1.01.2014 will fund cyber security research. Cyber security in HORIZON 2020 will be addressed in two pillars: The Societal Challenge of "Secure societies" and Industrial Leadership Challenge of Future Internet (LEIT.

text: “Priorities for cyber security”

text: The Lithuanian Presidency was characterized by a heavy agenda due to the end of a political cycle before the European Parliament elections in 2014 and the finalization of the Multiannual Financial Framework 2014-2020. The focus of this presidency was Europe, to restore confidence in EU economy, to boost employment and competitiveness and to strengthen openness and security. In the area of the telecom and cybersecurity, Lithuania strongly supported different initiatives such as: TEN-TELE - Proposal for a Regulation on guidelines for trans-European telecoms networks; eIDAS - Proposal for a Regulation on electronic identification and trust services in the internal market; NIS- Proposal for a Directive on Network and Information Security; BB Cost Reduction - Proposal for a

text: Page 14

text: ECSM final report

text: Regulation on reducing the costs of broadband infrastructure deployment; WEB Accessibility - Proposal for a Directive on the harmonization measures of the MS related to making Public sector websites available; STM, EC initiative on Single Telecoms Market - Proposal for a Council Decision on the EU Position for the ITRs and EU representation in ITU. Furthermore, the establishment of the Lithuanian CERT enabled to monitor the incidents, the botnets activity and enable to neutralize a botnet that controlled 5400 bots in September 2013. Proactive measures have been taken to generate automatically alarms for malware, malicious scripts and other anomalies. To assist in the resilience of the Lithuanian internet network infrastructure, research has been conducted to enable: o Description of the model of the Lithuanian Internet network topology o Identification of critical network interconnection nodes o Development of the core of Lithuanian Internet monitoring model This model was linked with national critical infrastructures and its information systems on the internet for 7 domains (ICT sector, Governmental sector, Finance sector, Energy sector, Health sector, Water and food supply, Transport sector) enabling to monitor with different probes.

text: “Involving the Citizen”

text: The landscape for citizens is changing, the adoption of new business models (eg. mobility, social business, outsourcing, SaaS) embracing new technologies (eg. cloud, connected objects, BYOD) is causing an exponential growth of the interconnected digital universe (eg. 30 billions RFID, 1 trillion connected objects). While attacks are becoming more sophisticated and may happen in minutes, cyber hygiene can prevent more than 80% of basic vulnerabilities and may be done quickly (eg. frequent software update). The landscape for security is changing from a threat and a technology perspective: CISO perceive that External threats are rated as a bigger challenge than internal threats, new technology or compliance; more than one-half say mobile security is their greatest near-term technology concern and 2/3 expect to spend more on security over the next two years.

text: People are changing the way they connect, and with who they connect.

text: They frequently exchanged roles as Bank Customer, Online Shopper, Parent, Citizen, Tax Payer, Passenger, Employee, Teacher, Volunteer... within their different roles their needs, their concerns and their behaviours may be extremely different.

text: To raise citizen awareness the quality of the communication is essential, channel should then be pertinent, the message should be relevant and should enable citizen to identify themselfes.

text: IT professionals should also rethink their way to design IT solution and put security in the different stages especially in the Cloud/SaaS perspective : Design phase- Establish a design strategy and implementation plan to get there; Secure by Design - Focus on building security into the fabric of the cloud; Deploy phase-Build services, in the enterprise and/or as a services provider; Workload Driven -Secure resources with innovative features and products; Consume phase- Manage and optimize consumption of services; Service Enabled- Govern through ongoing security operations and workflow.

text: Page 15

text: ECSM final report

text: The aim is to create a risk aware-culture where a public private partnership can engage citizen, manage incidents with intelligence and promote automated security hygiene.

text: Q&A

text:  The initiative of the Lithuanian authorithy to build an exhaustive map of their internet and to map it against critical services by sector was highly appreciated and commented over twitter.  The notion of trust and notably trust toward cloud services run by government was debated; What transparency measures and what meaningful certification schemes can enhance their level of security?  The complexity, the discolsure of vulnerabilities and mismatch between the level of technical skills required to keep device up to date, are all source of concerns and raise the question: who is the CISO of every citizen?  Quick lifecycle and automated updates are usually good for security, but who is keeping the pace? How many of us are upgrading daily our apps? How can we explain that security policies are mainly technically driven and not informative for the users irrelevant of his/her expertise? Why security related upgrade are not highlighted? Why condition check are not embedded?

text: A.1.2 Policy panel, "International Good Practices in Securing the Digital Citizen"

text: o Figthing cybercrime: The mission of EC3 is to fight cybercrime, crimes committed by organised groups to generate large criminal profits such as online fraud, crimes which causes serious harm to the victim such as online child sexual exploitation, crimes which affect critical infrastructure and information systems in the European Union. The efficiency relies on the closed pan-european collaborations between police and justice but also involved private companies (e.g. IT/Telco providers) and other agencies targeting cyber security with for example exchanges with ENISA. EC3 invests in R&D to provide a way to gather and process data during crime investigation. EC3 can neither afford to be only reactive and resources are mobilized to identify future trends, to assess future threats and to raise awareness. EC3 however cannot be trigerred by the private citizen as potential crimes should be reported at national level.

text: Claire Vishik from INTEL starting by empasing that IT Security should be as easy to use than a security belt.

text: o IT security: due to the growth of data traffic and the interconnection of multiple devices the people may loss the control. Some new services will require to be always connected with no clear path to opt out and that the difference between local and cloud storage will fade out making nearly impossible to track data. o As of today, too many parameters are necessary to master the secure construction of such applications and a new approach is needed to built in security and privacy mechanisms. These mechanisms should take into account new threats models caused by the multiplicity of use cases, and professionals should tackle them from a multi disciplinary angle. While applications should be secure and respect the right of privacy by default, users should be aware of the consequence of interacting and sharing information continuously. This will require education to provide solid technical background. Finally, Thinking Global is necessar

text: Page 16

text: ECSM final report

text: and adherence to standards and interoperability are necessary but not enough to deliver such solutions. o Current legislation evolution: Thomas McDonogh and Padraig Kenny gave their perspective about the current evolution of the directives and legislation around cybersecurity. If they praised the ongoing effort they also pointed out that the fragmentation of EU is a problem in the fight against cybercrimes and that the foreseen budget decrease may harm it. The fear is that a cyberfighting divide may appear with only half of the EU states in the leading group. They also defended the opinion that the cybercrime regulation should require a systematic risk management for critical services and that a public repository about the legal entity covered by cybersecurity obligations should be established. This transparency will help the

text: citizen and all stakeholders to better evaluate the effectiveness of the required protection

text: measures.

text: Q&A

text:  The perceived shortage of cybersecurity experts raises the point of dedicated curriculum and asks for better leveraging training initiatives. e.g. Several trainings are emerging in UK, Nederlands, France, and Europol and Interpol started a collaboration to share training material, agencies like ENISA are also key contributors to this area.  If risk management should be at the root of legislation, the question is to understand if current tools are suitable and if they are able to include the dynamic of changes in technology but also their usage? Similarly if a public repository of critical service exists, what will be its added value for citizen? Which KPIs should be relevant and how should they be disclosed publicly without avoiding risk like generalized mistrust or panic or without being sure to not help cyber criminal looking for vulnerabilities ?

text: The fragmentation of Europe is perceived as problematic to fight the international threats of cybercrimes, there is a need for collaboration.

text: A.1.3 Presentations of activities ECSM 2013

text: Page 17

text: ECSM final report

text: Q&A

text:  The scope of the intiatives is ambitious and it is both supported by different communication channels and by creative and innovative material. Still the main question remaining is how to measure the impact of the campaigns, how will they affect the daily behaviour of citizens? How many people will change their cyber hygiene, how many will use different passwords? On the other side of the spectrum, how many providers will promote stronger authentication mean, how many of them will restrain to collect data that may be improperly use to harm their customers without an evident immediate added value?

text: A.1.4 Practice panel, "The Cyber Security Professional"

text: o The evolution of the cybersecurity professionals’ skills and their career lifecycle: analysis “European trends form the 2013 Global Information Security Workforce Study” of the seniority of the cyber security showed a deficit in young talent, one possible explanation coud be the lack of standardized education despite the emergence of dedicated curriculums in Europe and world wide (e.g. Royal Holloway, Hague University of Applied Sciences, EPITA and ParisTech) while one can also argue that (cyber)security professionals are coming from broader initial skills and specialized later. o In this context professional certifications may be a way to gradually recognize the professional skills acquired by doing security tasks. In order to equip Europe with professionals mastering the necessary broad scope of techniques to face cyber security challenges, intiative like CYSPA maybe a way to match the different stakeholders (e.g. government, agencies, critical sectors and IT provider) expectations and to further define the necessary skills matching specific duties.

text: Life long learning offer clear career level and paths may also boost the interest of young practitioners.

text: A.1.5 Summary

text: Numerous topics were discussed during the day all having in common the growing importance of sharing information, knowledge, expertise and responsibility across Europe to improve its resilience to the numerous and worldwide Cyber Security threats. “Shared responsibility” was a message carried by all presentations:  Reponsibility to make the citizen aware of potential risks with continuous and relevant information where this first fully fledged ECSM is key;  Responsibility to provide the legal framework and research and development tools sustained by the EU with directives, NIS and H2020 program;  Responsibilty to act today with resourceful national CERTs and to think about proactive measures to lower the risks;  Responsibility for providers to propose solutions embedding security and privacy by design during the project’s lifecycle;  Responsibility to be cybersecure and fight cybercrime at the EU-wide level by sharing the right information between all stakeholders;  Responsibility to train highly educated people with the appropriate skillsets.

text: “ENISA role to brokerage”

text: Page 18

text: ECSM final report

text: A.2 The agenda

text: Page 19

text: ECSM final report

text: Page 20

text: ECSM final report

text: Annex B: ECSM Analytics

text: B.1 Coordinators meetings

text:  The ECSM Coordinators’ meeting I took place on the 27th of May in ENISA’s Athens office. The Meeting consisted of 19 online/ 5 in presence participants.  The ECSM Coordinators’ meeting II took place on the 30th of July via online channels. The meeting was attended by 7 online participants and 2 in presence participants.  “ECSM news” sent via e-mail bi monthly;

text: B.2 Kick off event

text:  Participation rate: 67 participants in presence/ 44 remotely by web stream;

text:  Feedback from participants:

text: Page 21

text: ECSM final report

text: B.3 CyberSecurityMonth.eu Website

text:  Traffic from 1.09.2013 to 31.10.2103:

text: B.4 Enisa.europa.eu Website

text:  PR released on 1.10.2013:

text: Page 22

text: ECSM final report

text: B.5 Social media presence

text:  CyberSecMonth Tag online reach on 2.10.2013:

text:  Twitter ECSM followers and Tweets activity increased significantly:

text: Page 23

text: ECSM final report

text: B.6 Feedback and ECSM countries

text:  27 ECSM countries got involved (e.g 23 EU MSs, 4 EU partners):

text:  Activities mapping for ECSM 2013:

text: Page 24

text: ECSM final report

text: B.7 Partners ECSM 2013

text: More than 60 public and private stakeholders, as below:

text: Page 25

text: ECSM final report

text: Page 26

text: ECSM final report

text: Page 27

text: ECSM final report

text: Page 28

text: ECSM final report

text: Annex C: ECSM Info graphics

text: C.1 Overview on ECSM 2010- 2013

text: Page 29

text: ECSM final report

text: C.2 ECSM roadmap

text: Page 30

text: ECSM final report

text: ENISA

text: European Union Agency for Network and Information Security Science and Technology Park of Crete (ITE) Vassilika Vouton, 700 13, Heraklion, Greece

text: Athens Office

text: 1 Vass. Sofias & Meg. Alexandrou Marousi 151 24, Athens, Greece

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 Page 31 info@enisa.europa.eu www.enisa.europa.eu


text: www.enisa.europa.eu European Union Agency For Network And Information Security

text: The European Cyber Security Month 2015

text: Status Published | Version v2 | Public | December 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: For names and logos please see Annex C More on the NLO network and contacts https://www.enisa.europa.eu/about-enisa/structure-organization/nationalliaison-office May be consulted here https://www.enisa.europa.eu/activities/stakeholder-relations/nis-brokerage-1/europeancyber-security-month-advocacy-campaign/2014

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: To consult the graph with more details of each phase please see Annex D

text: The European Cyber Security Month 2015

text: For details on main activities please consult Annex B

text: The European Cyber Security Month 2015

text: DATE CONTENT DIRECT LINK

text: 28/09 29.09 Press release and 29.09 kick-off http://www.enisa.europa.eu/media/pressevent in Brussels releases#b_start=0 Week topic: Cyber security Training for employees - Announcing the activities and partners in each country;

text: - “Tips and recommendations” about cyber security for all users in all EU languages;

text: 5/10 News item http://www.enisa.europa.eu/media/pressreleases#b_start=0 Weekly topic: Creating a Culture - International release with of Cybersecurity at Work partners in US and worldwide; - Twitter chat 8.10 #CyberSecMonth and #CyberAware;

text: 12/10 News item http://www.enisa.europa.eu/media/pressreleases#b_start=0 Weekly topic: Code Week for all - Publishing case studies “Public Private Partnerships in Network and Information Security Education” - Publishing Country Infographics;

text: 19/10 News item https://cybersecuritymonth.eu/references/universities

text: Weekly topic: Understanding - Courses map: NIS long life Cloud solutions for all learning , launch of a new version of the interactive map; - Publish a report “ Status of http://www.enisa.europa.eu/media/pressprivacy and NIS course releases#b_start=0 curricula in MSs”;

text: 26/10 News item https://cybersecuritymonth.eu/references/quizdemonstration Weekly topic: Digital Single - NIS quiz launched; Market for all

text: Every day in October tweets Social media Account @CyberSecMonth / @ENISA_EU Hastags: #CyberSecMonth #OctoberNIS #ENISA

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: For details on 2014 please consult the evaluation report from 2014 The NIS Education Map registered an increase of courses registered, currently with 417 courses in 22 countries The survey was closed and focused on the coordinators involved in the campaign. By comparison in 2014 there were 29 participants in total.

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

text: The European Cyber Security Month 2015

identifier: European Cyber Security Month 2015 - Deployment Report

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: European Cyber Security Month 2015 - Deployment Report

serie: rapporter

text: The European Cyber Security Month 2015

type: rubrik

text: Deployment report

text: STATUS PUBLISHED VERSION V2 PUBLIC DECEMBER 2015

text: [Page intentionally left blank]

type: stycke

text: About ENISA

text: The European Union Agency for Network and Information Security (ENISA) is a centre of network and information security expertise for the EU, its member states, the private sector and Europe’s citizens. ENISA works with these groups to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: Authors

text: Daria CATALUI, Project Manager European Cyber Security Month, ENISA

text: Contact

text: For contacting the authors please use stakeholderrelations@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: Acknowledgements

text: NLO network at ENISA (https://www.enisa.europa.eu/about-enisa/structure-organization/national-liaisonoffice/List_NLO.pdf); project support Vasileios Daskalakis; ENISA CERT training team;

text: Legal notice

text: Notice must be taken that this publication represents the views and interpretations of the authors and editors, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 526/2013

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright Notice

text: © European Union Agency for Network and Information Security (ENISA), 2015 Reproduction is authorised provided the source is acknowledged.

text: Table of Contents

text: Executive Summary 5

text: 1. Introduction 6

text: 2. Implementation 7

text: Planning 7

text: Participation 8

text: Advocacy elements 9

text: International cooperation 11

text: 3. Evaluation 12

text: The survey 12

text: The web analytics 15

text: 4. Conclusions 19

text: Annex A: References 20

text: Annex B: Details from MS’ and partners regarding deployment 21

text: Annex C: Partners in ECSM 2015 edition 33

text: Annex D: Overview ECSM from feasibility to 3 full deployment 34

text: Executive Summary

text: The European Cyber Security Month (ECSM) is an EU advocacy campaign that promotes cyber security among citizens and advocates seeking to change the perception of cyber-threats by promoting education, sharing of good practices and competitions in data and information security. The European Union Agency for Network and Information Security (ENISA), the European Commission DG Connect and Partners have been deploying the ECSM each October for the last 4 years.

text: Highlights for 2015 edition:

text:  32 countries were involved in the initiative in 2015, displaying an increase from 2014 with 30 countries involved.  In total there were 242 activities encoded in the official calendar from public and private stakeholders in 32 countries. The NIS Education Map registered an increase of courses registered, currently with 417 courses in 22 countries.  The outreach on social media on the 1st of October alone, was 718,967 accounts reached. Number of visitors for www.cybersecuritymonth.eu peaked in October with 52,574 page views, with 71% corresponding to new visitors from all around Europe.  Numerous trainings for multipliers and online calls for coordinators were supported by ENISA.  The kick-off event had a global partnership organized in the presence of ITU Secretary General, general deployment with partners from the United States (such as NCSAM and DHS), and coordinators from Member States, all supported by ENISA and European Commission DG Connect.

text: Conclusions for the 2016 edition:

text: 1. Member States and EU partner countries are interested in working in partnership for cyber security education. The number of countries involved reached a stable dimension with a tendency for steady growth. With this edition the maturity level was successfully attained, furthermore there is work to be followed to increase the content distribution and content co-ownership between MSs Organisations with the support of ENISA. 2. The European Commission, other EU bodies such as EESC, Agencies continued to get involved and maintain their participation at high level. The campaign created a good environment for European but also international cooperation for cyber security PPPs. 3. The community building process around the campaign is an important win. The EC, MS’ and ENISA may choose to further develop this dimension and extend its use to content distribution on cyber security education and more.

text: October is Cyber Security Month! Follow #CyberSecMonth #ENISA

text: Visit: www.cybersecuritymonth.eu

text: 1. Introduction

text: The European Cyber Security Month (ECSM) is an EU advocacy campaign that promotes cyber security among citizens and advocates for change in the perception of cyber-threats by promoting, education, sharing of good practices and competitions in data and information security. The European Union Agency for Network and Information Security (ENISA), the European Commission DG Connect and Partners have been deploying the ECSM each October for the last 4 years.

text: The objective of this report

text: ECSM 2015 focused on Member States of the EU and EU partners. The project life cycle included coordinators calls, face-to-face meetings, periodic news updates, European Kick-off event, trainings and education seminars, website resources and weekly publication of materials. This report will:

text: 1. Present the preparatory work, materials published and results achieved; 2. Carry out an objective evaluation; 3. Draw conclusions that can be used in future editions of the ECSM.

text: Target audience

text: ECSM is an annual advocacy campaign that includes both the general public , acting as ‘EU digital citizens’ and specific groups focused on Member States stakeholders from public and private organisations e.g. IT experts, NIS authorities, Education organisations, etc. The engagement model that ENISA uses is depicted in the graphic below. It represents the stakeholders that are involved in the ECSM and the way the Agency implements the brokerage role. The main contact in member states is through the National Liaison Officers- NLO network , partners from public and private organisations, and networks of multipliers.

text: Structure of the report

text: This document will present to the reader the organisational aspects of the ECSM 2015 putting things into perspective. It will refer to the motivation and concept behind the advocacy campaign, participation, and evaluation including analytics. The evaluation report of 2014 and associated recommendations were taken into account.

text: 2. Implementation

text: Planning

text: The European Cyber Security Month 2015 benefited from planning that took into consideration recommendations from the roadmap released in the previous year. In 2015 the work programme mentions the ECSM will be further developed following its basic principles, namely: • Support the multi-stakeholder governance approach. • Encourage common public-private activities. • Assess the impact of activities, optimising and adapting to new challenges. Furthermore, in practice the planning phase consisted of an extensive consultation with stakeholders like the Commission, NLO network, and international partners in order to come up with a consolidated version that anyone could easily follow. The campaign partners followed the planning depicted in the graph below which it was updated periodically and communicated to the community. Regarding the management of the communication process, all feedback, issues and ideas were tackled in a tailored manner to fit the needs and purposes of organisations involved.

text: Participation

text: The European Cyber Security Month fully fledged version was implemented for the 3rd consecutive year after a pilot and feasibility study . With the occasion of the launch, the following statements were made.

text: Vice-President Ansip, in charge of the Digital Single Market, has been quoted to say: "Security against cyber-attacks has become central to consumer confidence and the online economy. But we cannot get the best out of the opportunities offered by digital tools and online networks if we do not trust them. Raising awareness of the risks and threats, and the fact that cybersecurity is a shared responsibility, is vital so that when they are online, people can make better informed choices and guard against risks".

text: Commissioner Oettinger, in charge of the Digital Economy and Society, suggested: "To make the digital world a secure place for everyone, we all have to contribute: policy makers, research, industry, citizens. But for Europeans to fully enjoy the benefits of a safe Internet, they also need to be aware of the risks they face online and to know how they can to play an active role for their own security in their daily lives. The European Cybersecurity Month is a great opportunity to spread good practices and increase the overall level of awareness and thus of cybersecurity in the EU".

text: ENISA’s Executive Director, Prof. Udo Helmbrecht, has noted: “As our societies are continuously being digitised and we are moving in the era of IoT and smart cities, e-skills and online security are essential resources that need to be developed and continuously enhanced. The Agency is developing an entire Network and Information Security (NIS) community around the Cyber Security Month initiative."

text: Action! Happening during October

text: ECSM run for the entire month of October, with each week focusing on a different topic. Each week, ENISA published new material. Partners organized activities with focus on training, strategy summits, general presentations to users, online quizzes, etc.

text: 1st week – October 1-4: Cyber security training for employees

text: 2nd week – October 5-11: Creating a Culture of Cybersecurity at Work

text: 3rd week – October 12-18: Code Week for all

text: 4th week – October 19-25: Understanding Cloud solutions for all

text: 5th week – October 26-31: Digital Single Market for all

text: ECSM 2015 ran in Austria, Belgium, Bulgaria, Cyprus, Croatia ,Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, the Netherlands, Poland, Portugal, Slovenia, Slovakia, Sweden, Spain, Romania, the United Kingdom; and Iceland, Moldova, Norway, Serbia, also for the first time in Turkey.

text: Advocacy elements

text:  The website: www.cybersecuritymonth.eu was used as a one-stop-shop for citizens to look for information and the place for ECSM coordinators to update details about activities taking place at the local and national level. The web management was done by ENISA, but MS’ Coordinators retained full control and responsibility for their content.  The message was shared among partners: “Cyber Security is a shared responsibility!”  The weekly topics were communicated in all media / broadcasters.  Visual material and content were disseminated in 23 EU languages.  Cyber security Ambassadors shared their motivation to work in this field.  The common planning as presented in section 2.1.

text: In regards to the enhanced content of the 2015 edition, the Agency coordinated the release of the deliverables focused on the EU citizens’ eSkills update according to the weekly topics. The full details in the table below.

text: International cooperation

text: The coordination team had a constructive dialogue with US partners, NCSAM and DHS, and managed to continue the development of common activities such as:

text:  The message ‘Creating a Culture of Cyber Security at Work’, second week of the European Cyber Security Month running through October, was shared at international level, with the US National Cyber Security Month-NCSM.  US National Cyber Security Month-NCSM representative in the Kick-off event of ECSM in Brussels.  International Twitter chat on tips to follow for NIS security, follow the chat text by hashtags #CyberSecMonth and #ChatSTC.  The publication of “Mobile Tips” for users, important to mention that this common actions is already at the third consecutive edition.  An ‘Awareness Calendar’ was launched for use in organizations and users all over the world. A common effort, from all participating partners: US National Cyber Security Month, ITU and the European Cyber Security Month by ENISA with many partners from the Member States. Calendar below.

text: 3. Evaluation

text: The direct beneficiaries of the results of this work are the EU citizens, targeted by different categories, as well as end user organisations from public and private sectors (in particular in the area of EU NIS education). These stakeholders were expected to reap the following benefits: • Develop knowledge and corresponding ICT skills by being part of a best practice sharing community. • Improve and enhance contacts with stakeholders of similar interests and profiles. • Increase citizens’ awareness and governance on privacy when using online tools. The metrics analysed in comparison between 2014 vs 2015 shown a consolidation of the campaign in terms of outreach and content. Comparison in numbers 2014 vs 2015 as following:  Countries involved 2014: 30; 2015: 32  Twitter followers 2014: 2223; 2015: 3605  Materials published 2014: 5 general and 2 tools; 2015: updated 2 tools& published 5 general;  Activities taken place: 2014: more than 184; 2015: 242

text: The survey

text: The survey was an important tool to measure the impact in the 2014 edition and it was used again in the 2015 edition. The survey was sent only to the ECSM community consisting of contact points- coordinators and focused on the similar questions as in 2014. The charts below present their replies. We would like to add that the 2015 survey had 24 replies.

text: In regards to the messages left by the respondents most of them mention:  Improvements: 1.The website improvement regarding the display map and events edit (Here the specific issues encountered in 2015 to be solved for 2016 are web form automation and easy edit by the data owner, standardized display of location not based on clustering and with possibility to give minimum details); 2. Advance planning starting maybe the previous year ( By the time of the publication of this report, the advance planning for 2016 already took place by means of face-toface meeting – 5.11 seminar in Vienna and call on 1.12 concluding with an agreement on a common calendar); 3. Provide printed materials if possible; 4. Introduce new activities e.g. exhibitions;  Messages were also pointing to the need of such a campaign:

text: “Overall the campaign is very well organized and the demand for it is deeply needed.”

text: “Please continue this great initiative!”

text: “Keep up the good work!”

text: In conclusion, 87.5% in 2015 rated the campaign as being positive; 87.5% estimated that ECSM supports their outreach and promotion work; 66.67% consulted ENISA material; 91.64% intend to participate in a future edition. Also the twitter interactions increased to 70.83% in 2015. In terms of solutions offered for

text: issues 62.5% answered positively, however here we note also a 37.5% negative rate caused by website automation flows which are the main point to improve in 2016.

text: The replies reflect the consolidation of the campaign and at the same time they report similarities with the results obtained in the 2014 survey published in the respective report. Some points to be taken into account:

text: - The European Cyber Security Month brings added value to stakeholders involved and there is a clear statement of continuation for their part;

text: - The coordination team responded to the needs of the coordinators;

text: - ENISA publications are used as content for the activities happening in countries;

text: - Communication registered an uptake in terms of social media channels.

text: The web analytics

text: We present below some other graphs regarding the use of the website www.cybersecuritymonth.eu , twitter reach and map with geographical spread of the activities. The outreach on social media was of 718,967 accounts. Number of visitors for www.cybersecuritymonth.eu picked in October with 52,574 page views, with 71% corresponding to new visitors from all around Europe.

text: • Country statistics: users from the countries below visited the most the website:

text:  Website sessions during the period 24.09- 3.11.2015; it is important to be mentioned that 71% were new visits showing a better outreach and increase compared with last year (web sessions in 2014 12.000 vs 15.000 in 2015);

text:  Twitter performance 709,193 accounts reached/ 821,982 impressions in 2014 vs 718,967 accounts reached/ 906,060 impressions in 2015

text:  Media reach as following, approximate 40,000,000 online reach by media in 2014 vs close to 60,000,000 online reach in 2015:

text: 4. Conclusions

text: ENISA is committed to continue supporting the European Cyber Security Month and will encourage the active involvement of Member States organisations in the coordination and deployment.

text: From the deployment of the 2015 edition, the following should be emphasized regarding outcomes:

text: 1. Member States and EU partner countries are interested in working in partnership on cyber security education. The number of countries involved reached a stable dimension with a tendency for steady growth. With this edition the maturity level was successfully attained, furthermore there is work to be followed to increase the content distribution and content co-ownership between MS’ organisations with the support of ENISA. 2. The European Commission, other EU bodies such as EESC, Agencies continued to get involved and maintain their participation at high level. The campaign created a good environment for European but also international cooperation for cyber security PPPs. 3. The community building process around the campaign is an important win. The EC, MSs and ENISA may choose to further develop this aspect and extend its use to content distribution on cyber security education and more.

text: The European Cyber Security Month had developed a model of engagement that makes possible a multistakeholder governance approach, main benefits being reaching to a large number of European citizens through numerous activities organised by stakeholders. ECSM will be further developed following its basic principles, namely:

text: • Support the multi-stakeholder governance approach.

text: • Encourage common public-private activities.

text: Building together a joint EU advocacy campaign on Cyber Security topics!

text: Annex A: References

text: [1] www.cybersecuritymonth.eu [2] www.enisa.europa.eu [3] "An Open, Safe and Secure Cyberspace" EU Cyber Security Strategy http://ec.europa.eu/information_society/newsroom/cf/dae/document.cfm?doc_id=1667 [4] ENISA Work Programme 2016 https://www.enisa.europa.eu/publications/programmes-reports/enisa-workprogramme-2016

text: Annex B: Details from MS’ and partners regarding deployment

text:  From Belgium, Germany, Greece, Hungary, Ireland, Luxembourg, Norway, Poland, Portugal, Romania, Slovenia and Spain.

text: Annex C: Partners in ECSM 2015 edition

text: rd

text: Annex D: Overview ECSM from feasibility to 3 full deployment

text: ENISA

text: Athens Office

text: PO Box 1309, 710 01 Heraklion, Greece Tel: +30 28 14 40 9710 info@enisa.europa.eu www.enisa.europa.eu