Cyber Europe 2016: After Action Report
Cyber Europe 2016: After Action Report
THE EU CYBER SECURITY AGENCY
CYBER EUROPE 2016: AFTER ACTION REPORT
Findings from a cyber crisis exercise in Europe JUNE 2017 CONTACT For queries in relation to this paper, please email: c3@enisa.europa.eu For media enquiries about this paper, please email: press@enisa.europa.eu LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not necessarily represent the current state of affairs and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources, including external websites, referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. COPYRIGHT NOTICE © European Union Agency for Network and Information Security (ENISA), 2017 Reproduction is authorised provided the source is acknowledged. Catalogue number: TP-01-17-327-EN-N ISBN: 978-92-9204-224-0 DOI: 10.2824/218244 Copyright for the images on the cover and pages 31 and 45: © Shutterstock. For reproduction or use of these photos, permission must be sought directly with the copyright holder.
CYBER EUROPE 2016: AFTER ACTION REPORT
Findings from a cyber crisis exercise in Europe 2
TABLE OF CONTENTS
Executive summary 6 Key findings and recommendations 8 SECTION I EXERCISE OVERVIEW 11 1.1 GOALS AND OBJECTIVES 11 1.2 TARGET AUDIENCE 11 1.3 SET-UP 11 1.4 SCENARIO 13 1.5 PLANNING 13 1.6 EVALUATION PROCESS 15
CYBER EUROPE 2016: AFTER ACTION REPORT 3
EXECUTIVE SUMMARY
Cyber Europe 2016 was the fourth pan-European cyber crisis exercise organised by the European Union Agency for Network and Information Security (ENISA). Over 1 000 participants working mostly in the ICT sector, from public and private organisations from all 28 Member States of the European Union and two from the European Free Trade Association (EFTA), joined in a programme of activities ranging from training sessions and communication checks to technical competitions and cooperation exercises. The exercise simulated a realistic crisis build-up over an actual period of 6 months, culminating in a 48 hour event on 13 and 14 October 2016. Cyber Europe 2016 was based on three pillars essential to the successful mitigation of large-scale crises caused by cybersecurity incidents: cooperation at national and international levels and sound cybersecurity capabilities. First, the exercise fostered cooperation between targets of simulated cybersecurity incidents, security providers and national authorities, shedding light on national-level public–private and private–private cooperation. Participants had to follow existing business processes, agreements, communication protocols and regulations to mitigate effectively the situations presented to them. Such mechanisms were not always in place for all participants, which hindered the overall ability to reach full EU-level situational awareness. The EU network and information security directive identifies many of the associated shortcomings and proposes measures that ENISA and Member States are already implementing to improve the situation. Second, Cyber Europe 2016 helped participants understand how cybersecurity authorities would cooperate with each other and EU bodies in the event of a large-scale crisis. Undoubtedly, crisis cooperation at EU level is very much maturing and improving. Most, if not all, Member States have come to realise the importance of sharing structured information across national borders. With the active support of ENISA, they have leveraged the benefits of EU-level situational awareness for their own crisis management activities. Yet despite such progress, Cyber Europe 2016 highlighted, as previous exercises did, the absence of a cooperation framework at EU level for crises stemming from cybersecurity incidents, officially endorsed cooperation procedures or a centralised
4
hub. The creation of the EU CSIRTs Network and the European Commission initiative to publish a crisis cooperation blueprint in 2017 are excellent developments in that regard. They will surely benefit from the detailed findings in this report. Last, the exercise offered countless opportunities for participants to enhance their cybersecurity capabilities, from their technical and operational expertise to their capacity to handle crisis communication. Organisational and individual cybersecurity preparedness and capabilities in the EU were excellent overall. Technical expertise, business continuity and crisis communications procedures were of a high standard. Nevertheless, the vision required to link technical- and operational-level response activities to strategic crisis management mechanisms was sometimes lacking, which proved detrimental to fostering crisis exit strategies supporting decision-making. Additionally, many lessons were learned from the use of the prototype platforms developed by ENISA to support cooperation at EU level; they will reflect positively on the development of the EU-level crisis cooperation infrastructure financed by the Connecting Europe Facility (CEF).
CYBER EUROPE 2016: AFTER ACTION REPORT 5
KEY FINDINGS AND RECOMMENDATIONS
KEY FINDINGS Participating organisations responded adequately to most challenges they faced during the exercise. Cybersecurity experts employed in a wide array of sectors in the EU demonstrated high levels of expertise and appetite to resolve complex cybersecurity issues. Their ability to cooperate in the most difficult times is an important finding. No participant questioned the essence of cyber incident cooperation at EU level. Rather, all actors focussed their efforts on lifting the remaining barriers. Such cooperation was particularly insightful and led to a full understanding of all facets of the crisis within a few hours, which supported the swift mitigation of a simulated large-scale attack against EU interests. In particular, the EU Cyber Standard Operational Procedures helped to provide EU-level situational awareness and structured cooperation activities. The exercise in itself proved to be an excellent opportunity to increase individual and collective knowledge in the field of cybersecurity. Participants developed skills, procedures and relationships. Most importantly, they reiterated their appreciation in the exercise series: 99% indicated interest to participate in the next exercise. Innovation and transformation were at the heart of Cyber Europe 2016. From a product, process, rhetoric and service perspectives, the exercise planning team, composed of Member States and ENISA representatives, pushed established boundaries to transform the EU cybersecurity society. The European Union Ombudsman underlined this joint effort in March 2017 with an award for excellence in innovation and transformation. Participants repeatedly asked for more opportunities to test their technical skills regularly against a variety of advanced scenarios. Many were grateful for the multiple options offered by ENISA to involve media, legal and financial policy experts and hope for more to come as leaders across the EU realise that cybersecurity goes beyond information security.
6
The Cyber Crisis Cooperation Platform prototype developed by ENISA provided numerous insights into technical means supporting EU-level cooperation. These will be of paramount importance in order to ensure the buy-in from Member States in such a cooperation platform, currently under development. The Cyber Exercise Platform proved to be a powerful tool to plan, conduct and evaluate the exercise. In particular, the simulated environment developed by ENISA supported the crisis build-up in a realistic fashion with an unprecedented emphasis on written and visual storytelling. Key recommendations 1. Following their revision, the operational procedures which drive the cooperation activities during a cyber crisis should be endorsed by the CSIRTs Network established by the Network and Information Security Directive. Training opportunities on the use of these procedures and tailored exercises should be offered regularly. 2. An EU-level cyber crisis cooperation framework is currently being developed by the European Commission. It should build upon these findings to develop interconnections between cooperation mechanisms, identify and empower key actors, from CSIRTs to law enforcement, and set a clear vision for the future of EU cyber response. 3. Future Cyber Europe should focus on cooperation activities on technical and operational topics. Other options should be pursued to offer training and exercise opportunities on a variety of other topics increasingly associated with cybersecurity. In particular, ENISA should support EU-wide capacity building on cyber crisis communication.
CYBER EUROPE 2016: AFTER ACTION REPORT 7
I
SECTION I EXERCISE OVERVIEW
1.1 GOALS AND OBJECTIVES Some Member States chose to involve individuals and organisations from other sectors as well, as The three goals of the Cyber Europe 2016 exercise indicated in Figure 1. built upon those set in Cyber Europe 2014, following an in-depth assessment of their relevance performed In total, 948 participants officially registered for in the after action report of the latter exercise . the exercise, of whom two thirds came from the private sector. G1. Test EU-level cooperation processes. G2. Provide opportunities for Member States to test NB: These figures account only for those participants their national-level cooperation processes. who registered in the Cyber Exercise Platform. G3. Train EU- and national-level capabilities. Several organisations chose to use one account and distribute exercise information between multiple Consequent objectives were derived from the participants. As a result, one can assume the actual high-level goals in order to drive the development total number of participants to be significantly higher. of the exercise, as presented in Table 1 (next page). 1.3 SET-UP 1.2 TARGET AUDIENCE Cyber Europe 2010 and 2012 were 1-day all-inclusive Participation in Cyber Europe 2016 was limited to exercises. Cyber Europe 2014 was the first exercise organisations from the European Union institutions, in the series in which technical cybersecurity incident European Member States and European Free Trade handling was combined with operational crisis Association Member States (collectively called management activities in three different phases. Member States hereafter), and private companies Building upon the latter, Cyber Europe 2016 was operating in the latter countries. a collection of exercising activities, offering prolonged opportunities to participants to learn, train and The main target audience of the exercise exercise their technical and operational capabilities. was individuals and organisations involved in information security activities in the information and telecommunications technology (ICT) sector.
CYBER EUROPE 2016: AFTER ACTION REPORT 9
Table 1 — Goals and objectives
STRATEGIC OBJECTIVE METRICS/QUALITATIVE INDICATORS GOAL
Timeliness, usefulness, structured
O1. Assess the quality of information sharing
vs unstructured
Number of EU CSOPs cooperation activities O2. Monitor occurrences of cooperation activities held, e.g. meetings/audioconferences, during the exercise
G1
Completeness, timeliness, usefulness
O3. Evaluate situational awareness
of EU cyber integrated situation report
Appropriateness and usefulness of the
O4. Assess the ability to develop exit strategies
proposed actions
O5. Provide opportunities to participants to test
Number of opportunities provided to and used their intra-organisational procedures, if they by participants exist (BCPs, crisis management plans, etc.)
O6. Provide opportunities to participants to test
Number of opportunities provided to and used G2 cross-organisational cooperation processes, by participants if any
O7. Provide opportunities to participants to test
Number of opportunities provided to and used national-level cooperation activities and/or by participants contingency plans, if they exist
Number of different types of training opportunities offered, number
O8. Provide opportunities to train a wide variety
of participants who used the training of cybersecurity-related skills opportunities, level of satisfaction of participants in training opportunities
Number of learning opportunities offered
G3 O9. Provide learning opportunities
to participants
Types of self-assessment opportunities offered
O10. Provide self-assessment opportunities
to and used by participants
Number of different types of training
O11. Identify training needs for the future
needs identified
Figure 1 — Participation
ICT
Public/government facilities and services
Defence/military
Financial services
ICT
Emergency and security SECTORIAL PARTICIPATION
services PARTICIPATION
Other
Consultancy services
Academia and Research
Energy Information security
Telecommunications
Internet and digital services
Security companies
Hardware/software industry
10
SECTION I Exercise overview The Cyber Europe 2016 programme was comprised thousands of new jobs. The pervasiveness of highof activities in three areas. speed connectivity and the richness and quality of online services in the European Union are among 1. Training sessions (from September 2015 to the best globally. Such advantages have considerably October 2016) increased the dependability of EU citizens on ICT services. These two elements — quality of On-site training on exercise planning provided services and customer base — make this industry during the initial and main planning conferences. particularly appealing to global business. What if On-site crisis planning and management training this important piece of the global economy becomes for public participants. a target? Computer security attacks are increasingly Online training on the EU cyber standard used to perform industrial reconnaissance, lead operational procedures (EU-CSOPs) and the pilot disinformation campaigns, manipulate stock markets, cooperation platform offered to representatives leak sensitive information, tamper with customer data of EU national and governmental computer and sabotage critical infrastructures. security incident response teams (CSIRTs). The detailed scenario of the exercise consisted of 2. Preparatory exercises hundreds of documents including: (from April to October 2016) structured and unstructured, useful and Technical cybersecurity challenges released every misleading data scattered in simulated online month between April and October 2016, all part blogs, magazines, forums and file storage of the overall Cyber Europe 2016 scenario, building infrastructure; up into a crisis in a realistic fashion over the course thousands of simulated personal and professional of 6 months. social media profiles on simulated platforms; EuroSOPex, an exercise organised in June a simulated news channel, depicting the event 2016 involving 24 countries split into four through filmed news reports in a realistic fashion, separate groups. This exercise helped to train supported by simulated formal written news the representatives of the EU national and websites containing hundreds of news articles; governmental CSIRTs on the use of the EU-CSOPs. hundreds of tailor-made documents supporting the scenario for participants to analyse, from 3. Main exercise (13–14 October 2016) technical incident material to legal and public An all-inclusive cybersecurity exercise building upon: affairs documents. technical cybersecurity incident analysis; business continuity and crisis management, 1.5 PLANNING including media pressure handling; intra- and inter-organisational cooperation at Key dates of exercise programme planning and national and international levels; delivery of activities were: escalation; 12–13 May 2015: concept development situational awareness. conference — Rome; 26–27 October 2015: initial planning conference — Athens; 1.4 SCENARIO 17–18 February 2016: main planning conference — Lisbon; In the midst of the finalisation of the NIS directive , late May-early June 2016: EuroSOPex exercise; physical sabotage attempts via cyber means and 13–17 June 2016: final planning attacks against the digital market, the following conference — Athens; narrative ark was used as a driver for the April-Oct 2016: pre-exercise release of development of the scenario material: technical challenges; The European ICT industry is one of the most 14–15 September 2016: dry run — Athens; advanced in the world. Making the EU’s single market 13–14 October 2016: main exercise event fit for the digital age could contribute EUR 415 billion — distributed/exercise control in Athens. per year to our economy and create hundreds of
CYBER EUROPE 2016: AFTER ACTION REPORT 11
A graphical timeline of the Cyber Europe 2016 programme planning process and the programme activities is shown in Figure 2.
Figure 2
TIMING 2015 CYBER PLAN 12–13 May EUROPE 2016
Concept development
PROGRAMME
conference
PLANNING TRAIN
Training 26–27 October on CEP Initial Planning usage Conference
Training on 2016 exercise planning
17–18 February
Main Planning SOP Conference e-learning
TEST TEST via CEP
1 available
14–16 June 1
Final Planning 3 Training on Conference MSEL usage
April– September
Technical June incidents SOP small (bi-monthly scale exercise release) (EuroSOPex)
CYBER EUROPE ARN 13–14 OCTOBER CONFERENCE TRACKS LE PLAN MAIN TRAIN EVENT
10 May 2017 2017 TEST
After Action
LEARN
Conference
12
SECTION I Exercise overview A graphical timeline of the Cyber Europe 2016 Observations, challenges, recommendations and programme planning process and the programme actions drawn from the analysis of the findings activities is shown in Figure 2. highlighted in the elements mentioned above, are analysed as follows: Chapter 2: findings related to EU-level cooperation; 1.6 EVALUATION PROCESS Chapter 3: findings related to national-level cooperation; In order to evaluate the exercise against the objectives and key performance indicators Chapter 4: findings related to training at national presented in Section 1.1, ENISA collected feedback and EU levels; from participants to the various activities of the Chapter 5: findings related to exercise organisation. Cyber Europe 2016 programme, as well as statistics from the different exercise platforms. An action plan summary and four annexes containing detailed results complement the report. Technical cybersecurity challenges Given the sensitivity of some of the lessons learned, Anonymised statistics about incident results three versions of this report exist: (see Annex 2). Incident-specific feedback forms. a full version, available only to EU national and governmental CSIRTs (TLP AMBER) and Member EuroSOPex States’ exercise planners; Evaluation survey results (see Annex 1). a version without the findings related to Platform and chat logs. EU-level cooperation, available to all participants National and EU integrated situation reports. in Cyber Europe 2016 (TLP GREEN); a public version (TLP WHITE), containing Audioconference minutes. only Chapter 1. Main event NB: ENISA consulted planners from the respective Evaluation survey results (see Annex 3). participating Member States upon drafting this report Observation and status reports. and integrated consensual feedback. Non-consensual Platform logs. feedback was added to Annex 5. National and EU integrated situation reports. Audioconference minutes.
CYBER EUROPE 2016: AFTER ACTION REPORT 13