Aspects of Cooperation between CSIRTs and LE - Toolset 2021

Toolset, Document for trainees V2.0 - MARCH 2022 0 ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

For contacting the authors please use CSIRT-LE-cooperation@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu

AUTHORS

Domenico Ferrara (ENISA), Silvia Portesi (ENISA), Koen Van Impe

This training material is an updated version of the training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, available at https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-trainingmaterial/legal-cooperation#Aspects, whose authors (in alphabetical order by surname) are: Philip Anderson, Sandra Blanco Bouza, Smaragda Karkala (ENISA), Gregoire Kourtis, Alexandra Michota (ENISA), Catalin Patrascu, Silvia Portesi (ENISA), Václav Stupka, and Koen Van Impe.

ACKNOWLEDGEMENTS

ENISA would like to thank:

• The participants in the two training sessions organised by ENISA in August and October 2021 to pilot the ENISA training material developed in 2020 Aspects of Cooperation between CSIRT and LE - Handbook, Document for trainers, and Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, available at https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/onlinetraining-material/legal-cooperation#Aspects • The persons and organisations listed in the Acknowledgements section of the training material developed in 2020 Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees available at https://www.enisa.europa.eu/topics/trainings-forcybersecurity-specialists/online-training-material/legal-cooperation#Aspects.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881.

ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2022

This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”.

Cover image © Shutterstock, shutterstock.com

For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN: 978-92-9204-550-0, DOI: 10.2824/14089

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

TABLE OF CONTENTS

1. INTRODUCTION 4

1.1 THEMATIC AREA 4

1.2 LEARNING OUTCOMES 5

1.3 COURSE DURATION AND TRAINING OUTLINE 5

1.4 COURSE CONTENTS 5

2. USE CASES 7

2.1 USE CASE 1: THEFT OF CONFIDENTIAL DATA 7

2.1.1 Objectives 7 2.1.2 Scenario 8 2.1.3 Tasks 15 2.1.4 Lessons Learned 17

2.2 USE CASE 2: RANSOMWARE 17

2.2.1 Objectives 17 2.2.2 Scenario 18 2.2.3 Tasks 23 2.2.4 Lessons Learned 27

3. BIBLIOGRAPHY 28 A ANNEX: SUPPLEMENTAL USE CASE 30

USE CASE 3: DDOS AND MALWARE BLENDED ATTACK 30

Objectives 30 Scenario 31 Tasks 35 Lessons Learned 37

B ANNEX: MAIN ABBREVIATIONS 38 C ANNEX: SEGREGATION OF DUTIES (SOD) MATRIX 39 ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

1. INTRODUCTION

1.1 THEMATIC AREA

This training material is an updated version of the ENISA training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees , that was developed based particularly on the ENISA 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU MS/EFTA countries (an updated and expanded version of it is expected to be published in Q1 2022). Some of the 2020 report's conclusions are that, in terms of incident response and cybercrime, the position and role of the Computer Security Incident Response Teams (CSIRTs) and Law Enforcement (LE) in the national institutional framework varies from country to country. Similarly, the structure and the organisation of the Judiciary also depends on the country.

In addition, between the three communities - CSIRTs, LE and Judiciary - different approaches and different levels of cooperation exist. While the operational cooperation, especially in the daily interactions and informal communication, seems to be well-established, sometimes it seems that more structured cooperation could be achieved to have less fragmented information flow between the three communities. Also, there is a more significant gap in the interaction between CSIRTs and the Judiciary, compared to the cooperation established between LE and the Judiciary. CSIRTs would rather often interact with the Judiciary in case they are called as an expert witness in court.

Moreover, LE is not solely involved in the detection and investigation of cybercrimes. A key component of their role is the preventive aspects of cybercrime, and it is in this role that cooperation with other communities, particularly the CSIRT community, becomes apparent to support preventive strategies. Preventive aspects of incidents/cybercrimes can also be seen as the initial ground for establishing cooperation between the CSIRTs and the LE communities, which can then extend to other phases of the incident/crime investigation. On the other hand, CSIRTs play an important role in informing (potential) victims of cybercrime and providing them with information on how to report a crime to the Police.

CSIRT and LE communities also need to closely cooperate to mitigate the risks of having evidence compromised or destroyed.

Regarding the incident handling and cybercrime investigation, several competences are required. While each community has developed its own set of skills and knowledge, they can all benefit from the competences of the other communities.

Furthermore, the 2020 report on CSIRT and LE cooperation also concluded that despite the initiatives that are already in place to facilitate training within each community, or joint trainings engaging two communities (e.g. CSIRTs and LE, or LE and the Judiciary), it seems that there is a need for more training and exercises addressing the three communities together.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

This training material, as mentioned, is an updated version of the ENISA training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees published in January 2021 . The updates have been made based on the feedback received during the two training sessions organised by ENISA to pilot the training material. These pilot sessions took place as virtual events in August and in October 2021 and representatives from CSIRTs, LE, Judiciary and some EU Agencies participated in these pilots.

Finally, the 2020 report on CSIRT and LE, the handbook and this toolset are a set of deliverables complementing each other as follows:

• The report analyses roles, duties, competences, synergies and potential interferences across the three communities (CSIRTs, LE and Judiciary). • The handbook helps the trainer explain these concepts through scenarios. • The toolset contains exercises for trainees based on these scenarios.

1.2 LEARNING OUTCOMES

As a result of attending this training, the trainee should be able to: • demonstrate knowledge of interactions across the three communities (CSIRTs, LE and Judiciary); synergies, interferences and challenges • use the Segregation of Duties (SoD) matrix to collect the data to identify the key responsibilities for their communities (CSIRTs, LE, and Judiciary) and link them with the skills required to fulfil these duties • better understand the legal and organisational framework defining the competences of CSIRTs, LE, and the Judiciary, in their activities related to fighting cybercrime • understand different decision-making processes among the communities • capture potential synergies and possible overlaps • overcome possible interferences of cooperation between CSIRTs and LE and their interaction with the Judiciary • ensure structured integration of liaison officers for coordination between the different communities • perform uniform and effective communication between CSIRTs, LE and the Judiciary toward victim and relevant stakeholders • coordinate basic first responder actions at victim site (collecting evidence without tampering it, informing partners of which evidence is gathered) • explain technical terms to non-technical participants, e.g. to the Judiciary • better translate legal constraints to CSIRTs • identify appropriate approaches and tools to help support effective collaboration • identify and develop a common plan to enhance cooperation

1.3 COURSE DURATION AND TRAINING OUTLINE

3 hours and 5 minutes, including one break.

1.4 COURSE CONTENTS

The training includes three scenarios where trainees learn when and how CSIRT members cooperate with LE when dealing with cyber security incidents. The three scenarios cover:

- Theft of confidential data - Ransomware - Distributed Denial of Service (DDoS) and malware blended attack

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

The use case 1 (theft of confidential data) and use case 2 (ransomware) are updated with the feedback from the pilot sessions. The use case 3 is added as a supplementary case.

Training sessions should cover only one-use case and use the material from the other use case to steer further discussion or re-iterate on certain topics.

The training agenda consists of

• An introduction to the training (25') • Explanation of the frameworks and models used in the training (25') • Introduction to the use cases (15') • Study of one-use case (85') • The closure and overview of the learning outcomes (10') • A final section with room for questions and feedback (10')

One break of 15' is foreseen before the start of the study of the use case. The trainer can optionally add additional breaks. The total course duration is 185 minutes, including one break.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

2. USE CASES

2.1 USE CASE 1: THEFT OF CONFIDENTIAL DATA

Figure 1: Overview of use case 1

Overview of the use case 1

2.1.1 Objectives

In this exercise, the trainees will learn when and how CSIRT, LE, and Judiciary representatives can cooperate. In particular, the objectives of the exercise are to:

• Understand and appreciate the specifics of CSIRT/LE activities

• Analyse roles of different actors and how they can cooperate

• Identify synergies that can be exploited

• Grasp the complexity of cooperation

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE 2.1.2 Scenario

2.1.2.1 Setting the stage

This scenario describes an incident where carefully selected individuals working for different Member States (MS A, MS B, and MS C) subscribe to a fake event. The event website mimics an event organized by an EU Commissioner and contains malicious documents. Once installed on the victim’s computer, the malware included in the document exfiltrates domain, Virtual Private Network (VPN) access login credentials and selected documents with sensitive information. The credentials and the sensitive information are then monetized by the attacker via a semi-public website.

The internal security team of the Ministry of Education of MS A, to which one of the victims belongs, detects the incident. The internal security team of the Ministry of Education of MS A notifies the MS A national CSIRT, which in turn contacts Law Enforcement (of MS A).

The location where the exfiltration of data took place is in European MS D - whereas the website making the exfiltrated data available is located in Country Z, a non-EU/EFTA country.

In this use case, we use the concept of lanes to describe two distinct events that are part of the same security incident. The concept of lanes is used to demonstrate to the students that different security events which at first seem unrelated, can in fact be related to the same security incident. It is an opportunity for students to understand that separate investigations, started from different security events, will eventually merge because they deal with the same security incident. Students should cover both lanes to grasp the full details of the security incident.

Figure 2: Graphical representation of scenario 1 – Attack

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 3: Graphical representation of scenario 1 – Overview of interactions

2.1.2.2 Before the breach

Reconnaissance

The attackers in this scenario spent a considerable amount of time on the reconnaissance of their potential new victim. They used online research of the Ministry of Education of MS A to find individuals of interest. They mapped out with whom these individuals typically collaborate, in particular with individuals at other ministries in MS A but also at Ministries of Education in other countries and with the European Commission. The attackers supplemented this information with the publicly available calendar information from the Commissioner.

The attackers used the following tactics and techniques:

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

The attackers then used one of the appointments in the Commissioner’s calendar to set up a fake round table event to collect future views on a specific topic, hosted by the Ministry of Education of MS B. The attackers identified which individuals in the Ministry of Education of MS A would be the most interested in this topic. Then, the attackers set up fake personas to impersonate representatives of the Ministry of Education of MS B, and they created a website mimicking the event registration website of the Ministry of Education of MS B.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Initial access

Armed with a list of targets selected during reconnaissance, the attackers used the personas impersonating staff working for the Ministry of Education of MS B to send out invitations for the fake event. The event website requested that visitors enter personal information, and it contained documents, such as a call for proposals or Q&A, which were prepared by the attackers to include malicious code.

Execution

The event website included text to lure the visitors into opening the documents because they contained “essential” information on the event. The malicious documents were Office documents, with a blurred image and a text stating that to see the content, the user needed to “Enable Decryption via Enable Content”, which enabled Word macros. Once the macro was enabled, it downloaded and ran the malicious executable file.

Credential access and collection

The malicious executable was, in fact, a variant of a well-known keylogger specifically designed to collect credentials entered by a user when starting a VPN client. The captured credentials were regularly sent out to an external website. Apart from a keylogger, the malware was also able to collect files on the local system of the victim. It searched for specific types of files with particular names which were sent out to an external website.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

2.1.2.3 Initial response

Breach notification

Lane 1

During a weekly review of network activity, the security operations team of the Ministry of Education of MS A noticed that there was a substantial amount of outbound traffic to an external website located in MS D. Their initial investigation showed that the internal source of the traffic was on a network segment used by individuals working on sensitive material.

The security team of the Ministry of Education of MS A alerted its internal CSIRT and started collecting information on the affected assets.

Lane 2

At the same time, the CSIRT team of the Ministry of Education of MS A got an alert from one of their public crawlers. The team received an internal notification from the Analysis Information Leak framework (AIL) framework showing that there was a hit on the name of the Ministry of Education of MS A for a website located on a Virtual Private Server (VPS) in Country Z. The website was protected with a password and required payment to access it. It provided some screenshots and extracts of texts to show what type of information was available for potential “customers”.

Upon inspection of the screenshot of the alert, the CSIRT of the Ministry of Education immediately spotted that the document contained sensitive information which should not be publicly accessible.

The response of the CSIRT

The CSIRT handler on duty for the Ministry of Education of MS A classified the incidents according to the ENISA Reference Security Incident Taxonomy (RSIT) as “Information Content Security”, “Leak of confidential information”.

The CSIRT requested the security operations team to safeguard the logs of the affected assets in their Security Information and Event Management (SIEM) and use Endpoint Detection and Response (EDR) tooling to capture live system memory and collect important system artefacts.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Unfortunately, the EDR had not been deployed to all assets. In the meantime, the security operations team was able to isolate the system process responsible for the exfiltration of the data. Additionally, they still saw active network activity to the external website. This activity meant that the exfiltration was ongoing.

The CSIRT notified the CISO and the Secretary-General of the Ministry of Education of MS A of the possible security incident. A crisis team was formed, including the Press Officer, the legal department, the HR department and a representative of the General Secretariat of the Ministry of Education of MS A.

At this stage, it was unknown which type of data was exfiltrated. Still, because of the volume of data already exfiltrated and the type of assets (workstations and individuals involved), the CSIRT of the Ministry of Education of MS A suggested filtering traffic to the IP in MS D until further investigation. Additionally, according to the representative of the Ministry of Education of MS A, the screenshot in the AIL alert was of a document which had not been published and which was processed on one of the affected assets.

The CSIRT of the Ministry of Education of MS A immediately instructed the network team to filter all traffic to and from the IP in MS D.

The CISO of the Ministry of Education of MS A, together with the head of CSIRT of the Ministry of Education of MS A, contacted the national CSIRT of MS A to report the incident and LE of MS A to file a complaint.

Criminal investigation in MS A

LE officials of MS A were informed of the case details, including the fact that this concerned sensitive information and that there was a very high suspicion that data had been exfiltrated to a server in MS D.

LE conducted an investigation and went on-site to the Ministry of Education of MS A to review the available log material.

The CSIRT of the Ministry of Education of MS A provided LE with their collected reports on network traffic, together with the screenshots and information of the leaked documents on the server in Country Z, a non-EU/EFTA country.

The CSIRT of the Ministry of Education of MS A informed LE that the activity was still ongoing and that they implemented a network filter.

Investigation analysis

Because of the network filter, the malware was unable to contact the server in MS D. This triggered a failsafe mechanism, and it started encrypting all the files on the workstation.

The CSIRT of the Ministry of Education of MS A informed LE that the evidence on the workstation was most likely no longer usable. The logs in the SIEM were still available.

Lane 1

LE analysed the network traffic with support from the national CSIRT of MS A. The logs clearly showed the volume of traffic to the server in MS D.

LE of MS A reached out to their contacts in MS D (with the support of Europol) requesting to seize the server and collect the evidence. Unfortunately, the hosting company, a bulletproof hoster, did not respond to the request. LE then attempted to get a warrant for the server.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Together with the information from the MS A national CSIRT, the LE created a timeline of events.

Lane 2

Based on the alert data of the CSIRT of the Ministry of Education of MS A, LE identified the hosting company where the website was offering the sensitive information. LE contacted their peers in Country Z (with the support of INTERPOL) to formally request the server be seized and investigated. They used the evidence received from the agency to support their case.

Criminal investigation in MS D

Lane 1

LE in MS D was able to identify the individuals that registered and set up the website and VPS. An investigation of the activity on the server showed that it was accessed multiple times via IP addresses belonging to VPN nodes, but also included one residential IP address from MS D. This most likely occurred after a glitch of the VPN killswitch exposed the IP of the user behind the VPN. The activity on the server corresponded with the victim’s VPN login attempts of stolen credentials.

Most of the logs included VPN node accesses, but also had one residential IP address from MS D, most likely after a glitch of the VPN service which exposed the IP of the user behind the VPN. The activity on the server corresponded with VPN login attempts of stolen credentials.

The server also had temporary copies of some of the sensitive documents, sorted according to the collection date.

The server in MS D, however, did not show any activity related to the server in the Country Z.

Lane 2

LE was unable to collect the server in Country Z because, by the time the hosting company received the request, the owners of the server had destroyed their VPS server.

However, LE was able to identify the individuals that purchased the VPS at the hosting company.

LE investigation did take different screenshots of the website before the server’s destruction. These screenshots showed the nature of the site’s documents, along with the methods used to request money to access the website.

LE / Prosecutor requested a warrant and seizure of the electronic devices of this individual.

LE investigation of the computers of the individuals in MS D showed that their devices contained traces of the sensitive documents. An examination of the Secure Shell (SSH) history, browser and e-mail activity also revealed frequent access to the server in Country Z.

The investigation also showed frequent open-source IM (instant messaging) conversations with another individual in MS D, not linked to the website in MS D but seemingly with a form of control on the server in Country Z.

The forensic investigation of these electronic devices showed that this individual had configured and set up the server in Country Z. The e-mail conversation stored on the devices showed an exchange of the content of the documents and methods of payment.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE 2.1.3 Tasks

2.1.3.1 Task 1: Identify and describe the organisational profile

Identify and describe the organisational profile; specifically, the main subjects (actors) involved in the scenario, in particular, CSIRT/LE and Judiciary actors using the table below.

Figure 4: Subjects/Roles template

Specific role Community (CSIRT, LE, Subjects related to the Comments Judiciary, other) scenario

2.1.3.2 Task 2: Describe measures that CSIRT and/or LE can take to prevent the incident/crime

Although the actual preventive measures for the prevention of the incident, such as implementing proper security controls and network segmentation, were already in place there are a couple of additional activities where CSIRT and/or LE can play an active role.

Taking into account the SoD matrix in Annex B and especially the phase “prior to incident/crime”, which activities can you identify?

Use the template below to list the duties related to “prior to the incident/crime” phase (column 1) and the suggested measures (column 2). The last column (column 3) can be used to note additional comments.

Figure 5: Duty/Suggested measure template

Duty (task) Suggested measure Comments

2.1.3.3 Task 3: Use the SoD Matrix to analyse possible duties (tasks), synergies and potential interferences between CSIRT, LE and Judiciary

Select some duties from column 1 of the SoD in Annex B and in relation to some of these duties, briefly describe the measures that could be taken by each community in the scenario.

The template below can be used by listing the duties (tasks) in column 1 (duties to be taken from column 1 of the SoD matrix in Annex B) and the synergies and potential interferences in column 2. Column 3 can be used to add comments.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 6: Duties, synergies and potential interferences - Template

Duty (task) Synergies and potential interferences Comments

2.1.3.4 Task 4: List possible measures that CSIRT and/or LE can take during the incident response/crime investigation while performing the different duties

List possible measures that CSIRT and/or LE can take during the incident response/crime investigation while performing the different duties.

Column 1 should be used to list the duties (tasks) taken from the SoD matrix in Annex B, in particular duties during the incident/crime (duties 7 to 22 of the SoD matrix in Annex B). Column 2 should be used for the suggested measures related to each duty with specific reference to the scenario. Column 3 can be used for comments.

Figure 7: Duty/suggested measure template

Duty (task) Suggested measure Comments

2.1.3.5 Task 5: Discussion on lessons learned from this scenario

Discuss the issue of balancing the incident mitigation (asset protection) and the criminal investigation (evidence collection and preservation) with reference to the scenario.

One of the responses of the CSIRT of the Ministry of Education of MS A involves filtering outgoing network activity to the attackers, effectively preventing the further exfiltration of sensitive information. This filtering is an understandable activity, certainly as a short-term containment measure. The side-effect of this measure, however, triggers the malware and results in encrypted workstations, and as such a loss of evidence.

Discuss the pros and cons of short-term containment actions to protect the victim, but which might alert the attacker that they have been detected. In general, this depends on the type of incident and the victim.

As a reference, the courses of action matrix from Lockheed Martin can be use. This action matrix includes two significant categories of actions: - passive (Discover and Detect)

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

- active (Deny, Disrupt, Degrade, Deceive and Destroy)

Note that this discussion is not about the chain of custody as such, but rather which options to choose for either taking an active or passive approach in containing an incident.

2.1.4 Lessons Learned

Theft of confidential data is rather complex and demands different skills, including technical and legal.

Although for training purposes the scenario is presented as less complicated than real cases might be, it still allows each party to understand the complexities in terms of actors involved, roles played, duties (tasks) performed, synergies to exploit, and risks of interference.

2.2 USE CASE 2: RANSOMWARE

Figure 8: Overview of use case 2

Overview of use case 2

2.2.1 Objectives

In this exercise, the trainees will learn when and how CSIRT members cooperate with LE. In particular, the objectives of the exercise are to:

• Explain CSIRT and LE cooperation in a health sector-related ransomware scenario • Raise the trainees’ awareness regarding the differences between the legal systems of various countries and the consequences of these differences • Understand and appreciate the specifics of CSIRT/LE activities • Practice setting up and coordinating a task force for dealing with large scale attacks

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

• Provide information on how to cooperate and share information • Practice how to identify and propose post-incident reactive and preventive measures

2.2.2 Scenario

2.2.2.1 Setting the stage

A ransomware attack has been discovered in a large municipal hospital on the hospital patient records servers. All computers are locked and display a message indicating that the files have been encrypted; the hacker is demanding 11 bitcoins (approx. €100,000) to provide the decryption key. The image on the computer screens also states that if the payment is not received within five days, the price will increase. Within ten days, the patient data will be erased on the servers and leaked to a public website, and a notification will be sent to the national data privacy agency.

You are a member of a task force established to help the hospital’s network and information security team to deal with the incident. You have been assembled; it is now 05:45. It appears that all significant servers are affected. An initial assessment shows that the hospital email system and patient record systems are inaccessible, and the hospital intranet sites are also unavailable.

Figure 9: Graphical representation of scenario 2 – Attack

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 10: Graphical representation of scenario 2 – Overview of interactions

2.2.2.2 Organisational profile

The hospital is the largest municipal hospital in your area. Last year the hospital took care of almost 1 million patients and had about 5,000 employees. As such, the hospital relies on a network with up to 10,000 connected devices, which includes workstations, diagnostic tools and servers storing patients’ data. In recent years, hospital management was somewhat reluctant to invest in cybersecurity, and even though most computers are relatively well taken care of, some, especially that operating specialised equipment, are running legacy systems like Windows XP, due to compatibility issues. The network is not segmented, and critical systems are in the same network as specialised equipment, as well as all workstations. The hospital has no clear rules on data management and backup. Patient data that are stored in the hospital’s information systems are backed up and protected from ransomware. Still, a lot of relevant data about currently hospitalised and treated patients are not stored in the information systems, but on the doctors’ workstations, which are not being backed up.

2.2.2.3 Before the breach

The COVID-19 pandemic is still very much going on, which leads to heavy pressure on your country’s hospital system. Some cybercriminals decided to take advantage of this situation and started targeting medical facilities with their ransomware campaigns. The hospital’s security team issued and distributed a directive that explained this threat to the employees and informed them how to be cautious and prevent their devices from getting infected with malware.

Reconnaissance

The attackers in this scenario spent a considerable amount of time on the reconnaissance of their potential new victim. They researched the online available information of the hospital to

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

find out its departments and individuals of interest. None of this required any specific access. This type of research is also typically called OSINT, Open-source intelligence. The attackers used the following tactics and techniques:

The attackers compiled a detailed picture of the hospital infrastructure based on the information from:

- The hospital public website, with the full names and roles of the medical staff; - IT security job descriptions, disclosing the type of security devices that are in use; - Procurement documents, disclosing details on the current network infrastructure and network layout as well as information for maintenance framework contracts for legacy medical equipment.

The identification of the legacy medical equipment gave the attackers opportunity to compile a set of default access credentials, potential vulnerabilities of these devices as well as a list of typically network exposed services. Note that they did not take the approach of using for example, Shodan to look up vulnerable Internet exposed medical systems, although this would most likely have given them an easier access into the hospital network.

The attackers identified which individuals in the hospital would be the most interested to target with initial infection. Then, the attackers created the malware mimicking a tool for the analysis of the diseases symptoms and setup a website to distribute the malware. Afterwards the link to this website was distributed via phishing e-mails, specifically send to the targeted individuals.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

2.2.2.4 Initial response

Breach notification

When a receptionist in the X-ray department tried to log in at the start of her shift, she could not open the files and a message indicating that the files have been encrypted appeared on her screen. She notified a supervisor who then called the hospital’s IT helpdesk to report what happened, who in turn notified the hospital’s network and information security team.

The response of the CSIRT team

The hospital’s network and information security team handler received the alert from the hospital staff and identified it as a high priority threat. The handler classified it according to the ENISA RSIT as an incident of “Information Content Security”, “Unauthorised modification of information”, caused by the ransomware.

From an initial analysis, it appeared that the ransomware was called UnluckyLocky, a new type of ransomware with limited online information. Therefore, it was assumed that there was no known decryption key. The handler uncovered a news report online that described another hospital that seemed to have been infected by a similar attack with ransomware named Gotcha. The news article suggested that the response to the incident was slow and that almost all the computers and servers were infected. Additionally, the public was made aware of the incident as it had a significant impact on the hospital not being able to offer essential services. The incident went on for six days during which time even the hospital’s most basic functionality was forced to stop.

The handler then attempted to identify the source of the ransomware with the limited publicly available information on UnluckyLocky published by the respected security company.

The handlers analysed the activity that was related to the affected system and user, and used the logs from the web proxy server and e-mail server to further investigate the source of this problem.

They were able to find out that the source was a malicious website that informed about the COVID-19 pandemic and offered for download a tool for analysis of the decease symptoms.

The handler was able to download a sample of the malware.

The malware was executed by the user who downloaded it from the website, after clicking a link received via a phishing e-mail.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Upon execution, the malware first enumerated and encrypted the data within the target computer system and any connected storages. This rendered most of the data unavailable to the user while still allowing the user to operate the essential functions of the computer system. The malware also regularly prompted a window warning the user that the system was encrypted and decryption keys would be provided upon payment of the ransom.

The malware also regularly launched a task that attempted to spread the malicious code via email messages sent to stored addresses and through executing software on remote computers via legitimate network tool (psexec). For the latter the attackers made use of the default credentials of the legacy systems, as well as abusing misconfigurations in these systems.

The handler proceeded to analyse the extent of the issue by randomly checking workstations within the hospital for signs of the malware. He found out that the malware managed to spread across the whole hospital, rendering some of the critical data and equipment unavailable.

The hospital’s network and information security team was overwhelmed by the attack, so they reached out to the national CSIRT, part of the national cybersecurity authority.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Note: In this scenario, you are a member of the national CSIRT that is helping the hospital with this security breach.

Criminal investigation

The hospital notified this attack to the national CSIRT, which contacted the national cybersecurity authority who then reported this incident to Law Enforcement. The Police cyber unit started the investigation. They immediately contacted the national CSIRT, which provided general information, a sample of the ransomware and a link to the source website. A sample was sent to Europol through the Europol Malware Analysis Solution (EMAS) sandbox for crossmatching.

The Police found out that the website was hosted by a web hosting provider based in one of the EU MSs. The Police ordered the provider, via European investigation order, to provide stored subscriber and traffic data related to the relevant account.

Provided data revealed that the malicious content was uploaded from a country outside the EU. Even though the Police immediately requested legal assistance (including Europol), based on past experiences with this particular country, it was virtually impossible to get any cooperation in such cases from the official authorities.

Note that in this use case we do not focus on investigations on the C&C (command and control) servers that are typically used by ransomware. Information found on these servers can be used during incident response, for example to decrypt the data, as well as to identify the other potential victims and the criminals behind the attack.

Information sharing

Even though it was unlikely that LE would get assistance through official channels, in the third country there is a well-functioning CSIRT community which is regularly and openly sharing information. The national CSIRT involved in dealing with the incident offered to help the LE by requesting traffic data.

2.2.3 Tasks

2.2.3.1 Task 1: Notification of the incident

As stated above, the hospital’s network and information security team notified the national CSIRT, part of the cybersecurity authority of the incident. Who else should be notified within and outside of the hospital? Are there any legal obligations for the hospital to report such incidents to public institutions? Use the template below to list individuals, authorities and other parties that should be informed about the incident. Column 1 should be used to list the parties to be notified and column 2 to identify whether the notification is required or recommended. Column 3 can be used for comments.

Figure 11: Notification list – Template

Who to notify Required / recommended Comments

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

2.2.3.2 Task 2: Setting up the task force, division of duties

The national cybersecurity authority decided that a task force should be established to deal with the crisis. Who should be involved in this task force (e.g. which organisations or [inter]national authorities, the expertise level of members of the task force)? Are there any rules on this in your country?

Use the template below to list individuals/organisations that should be involved in the task force. Column 1 should be used to list the parties to be involved, column 2 to identify what kind of expertise can they contribute and column 3 to identify which tasks they can be involved in and what role should they play. Column 4 can be used for comments. Afterwards, discuss whether there are any relevant rules or best practices on this in your country.

Figure 12: Task force members list - template

Organisation Expertise Tasks/role Comments

While in some Members States the victim is part of the task force, in some other Member States not. Discuss this point and how it works in your country.

The university that cooperates with the hospital offered their volunteer ICT experts (students and employees) who can help to deal with the crisis. Can they be involved? In which activities (e.g. reinstallation of hospitals computers, incident handling, attempting to break the encryption, track the source of the attack, etc.)?

Explain which activities related to the incident handling can volunteers be involved and how. Column 1 should be used to name the activity and column 2 to describe the involvement.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 13: Involvement of volunteers – Template

Activity Description

Figure 14: Duties, synergies and potential interferences – Template

2.2.3.3 Task 3: Possible duties (tasks), synergies and potential interferences between CSIRT, LE and the Judiciary

Select some of the duties from column 1 of the SoD in Annex B and with some of these duties, briefly describe the measures that could be taken by each community in the scenario.

The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B) and the synergies and potential interferences in column 2. The last column, column 3, can be used to add comments.

Figure 15: Duties, synergies and potential interferences – Template

Duty (task) Synergies and potential interferences Comments

2.2.3.4 Task 4: Incident handling, evidence collection, coordination

Experts in the task force found out by using sandbox analysis that the ransomware is not only encrypting data from the information systems but is also exfiltrating patient data outside the organisation. CSIRT members immediately proposed to block communication to the C&C server to prevent further disclosure of sensitive information. LE, however, suggested to wait with this measure and try to track the data in an attempt to locate the attacker, since they’re suspecting

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

that the attacker is based in the EU even though s/he used servers located in third countries to disseminate the malware.

Explain, how you would deal with this issue, what should have priority – protection of sensitive data or locating the attacker, and whether there are any official rules on this in your country?

The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B) and the measures to be taken to deal with the issue in column 2. The last column of the template below, column 3, can be used to add comments.

Figure 16: List of suggested measures to deal with mutual interferences – Template

Duty Suggested Comments (task) measure

2.2.3.5 Task 5: International cooperation and information sharing

As stated above, the CSIRT can provide support to the LE, they can for instance ask the third country network operators to unofficially provide traffic data that could help to identify the attacker.

Explain whether LE would be able to provide the CSIRT with necessary identifiers and traffic data acquired from the web hosting provider for this purpose. Also, whether the unofficial data collected by the third country network operator that leads to identifying the attacker would be usable as evidence in court by LE.

Figure 17: Information sharing and use – Template

Information sharing and use

2.2.3.6 Task 6: Post incident preventive measures

Explain based on information you have about the incident and hospitals systems, what kinds of post incident preventive measures would you recommend to the Network and Information Security Team to implement.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

The template below can be used to categorise proposed measures in column 1 (whether these measures are organisational, technical or legal by nature), and list and describe the proposed measures in column 2 and 3. The last column of the template below, column 4, can be used to identify who should implement these suggested measures.

Figure 18: List of preventive post-incident security measures – Template

Category (e.g. organisational, Measure Description To be implemented by technical, legal)

2.2.4 Lessons Learned

Ransomware cases are rather complex and demand many different skills, including technical and legal, as well as the ability for other communities to share information and cooperate.

Although for training purposes the scenario is presented as less complicated than real cases might be, it still allows each party to understand the complexities in terms of actors involved, roles played, duties (tasks) performed, synergies to exploit, and risks of interference.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

3. BIBLIOGRAPHY

ENISA (2018), Review of Behavioural Sciences Research in the Field of Cybersecurity, https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspectsof-cybersecurity (retrieved on 13 October 2020)

ENISA Training Resources page: https://www.enisa.europa.eu/topics/trainings-forcybersecurity-specialists/online-training-material (retrieved on 14 October 2020)

CSIRTs by Country –Interactive Map, https://www.enisa.europa.eu/topics/csirts-in-europe/csirtinventory/certs-by-country-interactive-map (retrieved on 13 October 2020)

ENISA, 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU Member States/EFTA countries, https://www.enisa.europa.eu/publications/2020report-on-csirt-le-cooperation (26 January 2021)

ENISA, An overview on enhancing technical cooperation between CSIRTs and LE (2019), https://www.enisa.europa.eu/publications/support-the-fight-against-cybercrime-tools-forenhancing-cooperation-between-csirts-and-le (retrieved on 13 October 2020)

ENISA, Cooperation between CERTs and Law Enforcement Agencies in the fight against cybercrime - A first collection of practices (2012), https://www.enisa.europa.eu/publications/cooperation-between-certs-and-law-enforcementagencies-in-the-fight-against-cybercrime-a-first-collection-of-practices (retrieved on 15 October 2020)

ENISA, Cooperation between CSIRTs and Law Enforcement: interaction with the Judiciary (2018), https://www.enisa.europa.eu/publications/csirts-le-cooperation (retrieved on 13 October 2020)

ENISA, Cybersecurity Culture Guidelines: Behavioural Aspects of Cybersecurity (2018), https://www.enisa.europa.eu/publications/cybersecurity-culture-guidelines-behavioural-aspectsof-cybersecurity (retrieved on 13 October 2020)

ENISA, Electronic evidence - a basic guide for First Responders (2014), https://www.enisa.europa.eu/publications/electronic-evidence-a-basic-guide-for-first-responders (retrieved on 15 October 2020)

ENISA, Good Practice Guide for Addressing Network and Information Security Aspects of Cybercrime (2012), https://www.enisa.europa.eu/publications/good-practice-guide-foraddressing-network-and-information-security-aspects-of-cybercrime (retrieved on 15 October 2020)

ENISA, Improving Cooperation between CSIRTs and Law Enforcement: Legal and Organisational Aspects (2017), www.enisa.europa.eu/publications/improving-cooperationbetween-csirts-and-law-enforcement (retrieved on 13 October 2020)

ENISA, Information sharing and common taxonomies between CSIRTs and Law Enforcement (2015), https://www.enisa.europa.eu/publications/information-sharing-and-common-taxonomiesbetween-csirts-and-law-enforcement (retrieved on 15 October 2020)

ENISA, Reference Incident Classification Taxonomy, https://www.enisa.europa.eu/publications/reference-incident-classification-taxonomy (retrieved on 13 October 2020)

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

ENISA, Reference Security Incident Taxonomy Working Group, https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force (retrieved on 13 October 2020)

ENISA, Roadmap on the cooperation between CSIRTs and LE (2019), https://www.enisa.europa.eu/publications/support-the-fight-against-cybercrime-roadmap-oncsirt-le-cooperation (retrieved on 13 October 2020)

ENISA, ENISA Threat Landscape – 2020, https://www.enisa.europa.eu/topics/threat-riskmanagement/threats-and-trends (retrieved on 10 November 2020)

ENISA, Tools and Methodologies to Support Cooperation between CSIRTs and Law Enforcement (2017), www.enisa.europa.eu/publications/tools-and-methodologies-to-supportcooperation-between-csirts-and-law-enforcement (retrieved on 13 October 2020)

ENISA, Training material on CSIRT-LE cooperation area (2019), https://www.enisa.europa.eu/news/enisa-news/training-material-to-enhance-cooperation-acrosscsirts-and-law-enforcement (retrieved on 13 October 2020)

ENISA, Trainings for Cybersecurity Specialists, (handbooks and toolsets) https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-trainingmaterial (retrieved on 13 October 2020)

Reference Security Incident Classification Taxonomy (RSIT taxonomy), https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task- Force/blob/master/working_copy/humanv1.md (retrieved on 13 October 2020)

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

A ANNEX: SUPPLEMENTAL USE CASE

USE CASE 3: DDOS AND MALWARE BLENDED ATTACK

Figure 19: Overview of use case 3

Overview of use case 3

This use case should be conducted in groups so that different results and approaches of each group can be compared. Then, the advantages and disadvantages of individual solutions should be discussed.

Objectives

The current exercise scenario aims to familiarize the trainees with technical, procedural and legal aspects of incident management. In particular, the objectives are to:

• Raise awareness about what types of cyber incidents might affect an airport and what can be the impact of such incidents • Learn about the role of the CSIRT, Law Enforcement, and National Cybersecurity Authority • Understand the importance of efficient coordination between main stakeholders during a large scale/high impact incident

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

• Practice setting up and coordinating task force for dealing with large scale attack • Understand the importance of information sharing during cybersecurity attacks • Practice how to identify and propose post-incident reactive and preventive measures • Learn about preventive measures against such type of incidents

Scenario

Setting the stage

A large size airport in a European capital city is under massive DDoS attack, combined with a malware attack, causing key systems outages and malfunctioning (i.e. systems assuring functions like flight scheduling, passengers’ check-in, baggage routing, etc.).

Already the situation has had significant adverse effects on the airport’s operations and safety. Undetected attacks resulted in the change of the flight plans provoking delays and influencing the aircrafts cleaning and fuelling process, as well as the time required to load the luggage, affecting the world-wide traffic.

You are a member of a task force established to help the airport company to deal with the incident. An initial assessment shows that the IT team has yet to come up with a course of action for stopping the attack and restoring the services. The pressure from the media, authorities, and passengers is rapidly growing.

Figure 20: Graphical representation of scenario 3 – Attack

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 21: Graphical representation of scenario 3 – Overview of interactions

Organisational profile

The affected airport is one of the biggest air traffic hubs in Europe, with an average of more than 100,000 passengers passing through per day.

The management of the airport invested only in perimetral security in recent years (firewalls, gateways, etc.). At the same time, internal network suffers from lack of proper segmentation, and some of the critical systems are running old operating systems due to legacy and compatibility constraints.

The airport is running its own on-prem data centre doubled by a disaster recovery site, but the Business Continuity Plan (BCP) plan wasn’t tested in the last two years.

Before the breach

The attackers gathered information online about the airport company and identified useful data: the IP addresses space, systems and applications, management and key personnel names and contact details, etc.

Reconnaissance was also done at the physical perimeter of the airport by attackers disguised as passengers.

Attackers managed to plant a rogue 3G Raspberry Pi device in the airport network. The device is used to sniff the network traffic for systems discovery and credentials extraction (plain-text credentials sent over the network or easy-to-crack hashes).

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

While the attacker created a diversion with the DDoS attack, some of the internal systems of the airport were infected with a customized malware delivered using two different infection vectors: spear-phishing emails sent from the rogue device to avoid email gateway filtering, and Windows SMB exploits launched from the same device.

Initial response

Breach notification

A lot of people are reporting at the check-in desks that their flights seem to have disappeared from the schedule display systems or they have long delays. At the same time, people can’t obtain information from other online sources because the internet is inaccessible from the airport Wi-Fi network and even if they use their 3G/4G/5G connection the airport website and other related platforms are unavailable.

It becomes clear that the IT infrastructure and applications are affected by an incident, and a cyber-attack is suspected. The network team starts to investigate, and they report that a huge DDoS attack is conducted against the airport’s internet-facing systems.

The security team is also reporting that a high number of database operations were executed in a short interval of time using credentials of a user that is claiming to know nothing about the situation.

The airport management board decides to notify the aviation sectorial CSIRT and to file a complaint to the Police. The sectoral CSIRT share the information with the other relevant CSIRTs, in particular the national CSIRT, which is part of the national cybersecurity authority.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Response of the CSIRT team

The CSIRT Team uses lessons learned from recent similar attacks against airports and starts the Incident Response process with actions meant to contain the incident as much as possible.

The user account responsible for altering the airport databases is disabled, and the user workstation is isolated from the network and sent to the digital forensics laboratory. All recent activity of the user is tracked because there’s plausible suspicion that the user was the victim of a spear-phishing attack which resulted in his workstation being infected with malware.

Additionally, the CSIRT team is working with the airport IT personnel, the ISP, airport IT vendors, and international partners to try to come up with a mitigation plan for the DDoS attack. Multiple scenarios are studied, but for the moment it is decided to ask the ISP to filter the traffic coming from outside of the country the airport is located in.

Next, the technical investigation of the incident is started: • Analysis of logs from perimeter security solutions (firewall, web and email gateway, proxy, etc.) • Analysis of the recent activity of the user causing the malicious actions of the database and conduction of a forensically-sound investigation of his/her workstation • Try to identify rogue devices in the network

Criminal investigation

The national cybersecurity authority informed the LE of this incident. The local Police cyber unit started the investigation by:

• Analysing security video cameras from the airport in the last month to try to identify attackers planting rogue devices • LE/Prosecutor requesting a warrant and seizure of the electronic devices of the possible suspects

To be complete, in real cases such visual identification might take some time and is not always that straightforward, but we now just assume this happened for the good flow of the use case.

Information sharing

The CSIRT is conducting an information exchange about the incident with other CSIRTs (especially the ones in the aviation sector/sectorial CSIRTs), trying to find out if similar attacks were conducted recently and gather information about investigation results and mitigation measures.

In cooperation with the airport management, the CSIRT will share the gathered information with the national LE and will offer their further support to continue the investigations and facilitate information exchange nationally and internationally.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE Tasks

Task 1: Notification of the incident

The airport security team needs to quickly do an initial assessment of the situation and notify the incident according to existing procedures and legal framework.

As previously mentioned, the National Competent Cybersecurity Authority or the National CSIRT is notified.

To whom else and when should the incident be reported?

Figure 22: Notification list – Template

Required / Who to notify Comments recommended

Task 2: Setting up the task force, division of duties

While in the context of a criminal investigation the prosecutor/judge is in charge of assigning the roles for dealing with the investigation of the cybercrime, the national CSIRT may establish a task force to respond to the incident and deal with the crisis generated by the incident.

Analyse the legal and organisational framework by defining the competences of CSIRTs, LE, and the Judiciary in their activities related to fighting cybercrime, and capture potential synergies and possible overlaps. Analyse the possible interferences in the cooperation between CSIRTs and LE and their interaction with the Judiciary. To collect data and roles and duties, use the SoD matrix in ANNEX B.

The role of the IT contractors of the airport should be decided: will they be part of the task force?

Figure 23: Task force template

Organisation Expertise Tasks/role Comments

Task 3: Possible duties (tasks), synergies and potential interferences between CSIRT, LE and Judiciary

Select some of the duties from column 1 of the SoD in Annex B and with some of these duties, briefly describe the measures to that could be taken by each community in the scenario.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

The template below can be used by listing the phase (e.g. during the incident/crime) in column 1, the duties (tasks) in column 2 (to be taken from column 1 of the SoD matrix in Annex B), and the synergies and potential interferences in column 3. The last column of the template below, column 4, can be used to add comments.

Figure 24: Duties, synergies and potential interferences – Template

Synergies and potential Phase Duty (task) Comments interferences

Task 4: International cooperation and information sharing

Briefly explain how Interpol, Europol and Eurocontrol can collaborate with CSIRTs/LE/Judiciary during the international criminal investigation.

The template below can be used to list the name of the organisation in column 1, the name of the organisation it collaborates with in column 2 and the kind of collaboration they have in column 3.

Figure 25: Information sharing and use – Template

Names of the organisation it Name of the organisation Kind of collaboration collaborates with

Task 5: Post-incident preventive measures

Explain based on information you have about the incident, what kinds of post-incident preventive measures you would recommend to the airport information security team to implement and how you would formulate the outcome as a gap analysis and a remediation roadmap.

The template below can be used by listing the duties (tasks) in column 1 (to be taken from column 1 of the SoD matrix in Annex B), and the proposed preventive security measures in column 2.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Figure 26: Suggestion on preventive security measures – Template

Duty (Task) Proposed preventive security measures

Lessons Learned

DDoS and malware blended attack cases are rather complex and sophisticated. They demand many skills as it’s not easy to identify what is the primary attack vector or what is the ultimate target of the attacker. The scenario allows each party to understand its role under the legal framework of each member state.

Although for training purposes the scenario is presented as less complicated than real cases might be, it still allows each party to understand the complexities in terms of actors involved, roles played, duties (tasks) performed, synergies to exploit, and risks of interference.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

B ANNEX: MAIN ABBREVIATIONS

Abbreviation Description

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

C ANNEX: SEGREGATION OF DUTIES (SOD) MATRIX

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

Some explanations regarding the SoD matrix:

• At the top of the SoD Matrix all the four possible roles that each actor (CSIRT, LE, Prosecutors, and Judges) may play are listed and briefly explained: Responsible (R), Supporting (S) (if applicable), Consulted (C) (if applicable), and informed (I) (if applicable). • In the rows, the duties are listed and numbered for convenience (e.g. 10. Collecting data that may be evidence/Evidence collection). It must be noted that “duties” is used here as a synonymous of “tasks” • Column 2, Column, 3, Column 4, Column 5, refer to the actors, respectively CSIRT, LE, Prosecutors, and Judges. • The interviewees are asked to indicate which role(s) each actor (CSIRTs, LE, prosecutors, judges) has in the performance of duties during a cybercrime (supporting) fighting activity. In other words, the interviewees are asked to identify whether the CSIRTs, the LE, the prosecutors or the judge are for a particular duty responsible (R) for that duty, and, if applicable, which other actor is Supporting (S) the performance of that duty, is Consulted (C) or is Informed (I) during the performance of that duty. • Column 6 (optional) is used to capture information on training topics, which is closely connected to the competencies that are required for the performance of the specific duties. • Column 7 is used for any additional information that the interviewee might provide and to record possible synergies and potential interferences, especially for those cases where a task is performed by more than one community.

ASPECTS OF COOPERATION BETWEEN CSIRTS AND LE

An example of completed information related to one duty in the SoD Matrix in the table below.

Table 1: Example of completed information related to one duty in the SoD Matrix

-N -EN -378 -21 -08 TP

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN: 978-92-9204-550-0 DOI: 10.2824/14089