EU Member States incident response development status report

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT Security and Resilience for NOVEMBER 2019 Smart Health Service and Infrastructures 0

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

ABOUT ENISA

The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of crossborder communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

CONTACT

For queries in relation to this study, please use: csirt-relations@enisa.europa.eu.

PGP Key ID: 31E777EC 66B6052A PGP

PGP Key Fingerprint: AAE2 1577 19C4 B3BE EDF7 0669 31E7 77EC 66B6 052A for media enquiries about this paper, please use press@enisa.europa.eu.

AUTHORS

Edgars Taurins, ENISA

ACKNOWLEDGEMENTS

ENISA performed this study with the help of contractor CEIS and with the input from Informal Expert Group on EU Member States Incident Response Development.

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged.

Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN 978-92-9204-310-0, DOI 10.2824/74233

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

TABLE OF CONTENTS

1. OVERVIEW AND SCOPE OF THE STUDY 7

1.1 CONTEXT 7

1.2 OBJECTIVE OF THE STUDY 7

1.3 SCOPE OF THE WORK AND DEFINITIONS 8

2. METHODOLOGY AND DATA COLLECTION 11

2.1 OVERVIEW OF THE METHODOLOGY 11

2.2 A SEVEN-STEP APPROACH 11

2.2.1 Step 1 – Definition of the research focus for the data collection 11 2.2.2 Step 2 – Desktop research in open source on NISD Sectors IRC 12 2.2.3 Step 3 – Designing and validating the survey 12 2.2.4 Step 4 – Conducting the survey and complementary interviews 12 2.2.5 Step 5 – Collation of raw data 13 2.2.6 Step 6 – Analysis and identification of trends 13 2.2.7 Step 7 – Final report 13

2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY 13

2.3.1 Desktop research – Data collection assessment 13 2.3.2 Survey – data collection assessment 14 2.3.3 Interviews – data collection assessment 14

3. KEY FINDINGS 15

3.1 KEY FINDING #1 15

3.1.1 Member States’ organisational culture and resources tend to shape IR layout and set-up 15 3.1.2 Lessons learned and recommendations 19

3.2 KEY FINDING #2 20

3.2.1 The NIS Directive has improved the IR organisation and governance by clarifying actors’ roles and responsibilities 20 3.2.2 Lessons learned and recommendations 21

3.3 KEY FINDING #3 22

3.3.1 The implementation of the Directive raises operational and regulatory challenges and highlights MS willingness to move forward by extending the scope and number of sectors targeted 22 3.3.2 Lessons learned and recommendations 26

3.4 KEY FINDING #4 27

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

3.4.1 A blend of bottom up and top down incentives could be the most efficient driver for the creation of sectorial CSIRTS, depending on MS IR layout maturity. 27 3.4.2 Lessons learned and recommendations 30

3.5 KEY FINDING #5 31

3.5.1 National CSIRTs have developed mature reporting processes and notification tools, as have sectoral CSIRTs who provide solutions specific to their sectors’ needs 31 3.5.2 Lessons learned and recommendations 37

3.6 KEY FINDING #6 38

3.6.1 There is a multiplication of information-exchange tools to facilitate cooperation at sectoral, national and EU/international level, but the quality of the exchange depends on both organisational and structural criteria 38 3.6.2 Lessons learned and recommendations 44

3.7 KEY FINDING #7 45

3.7.1 There is a growing interest in training to enhance and foster preparedness in NISD sectors at European level 45 3.7.2 Lessons learned and recommendations 47

3.8 FINAL RECOMMENDATIONS 47

4. PRESENTATION OF THE RAW DATA 48

4.1 DESKTOP RESEARCH – SECTORAL IR SET-UP 48

4.1.1 Data structuring and classification criteria 48 4.1.2 Overview of the Sectoral IR Set-up within the 28 Member States 48

4.2 SURVEY AND INTERVIEWS – IR APPROACH AND SECTORAL CAPABILITIES 49

4.2.1 Survey - Data structuring and classification criteria 49 4.2.2 Complementary Interviews – Rationale and key figures 50

5. BIBLIOGRAPHY 52 A ANNEXES: 55

A.1 ANNEX 1 – LIST OF CRITERIA 55

A.2 ANNEX 2 – LIST OF FIGURES 55

A.3 ANNEX 3 – LIST OF TABLES 55

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

EXECUTIVE SUMMARY

Following the recent transposition of the NIS Directive (NISD) into European Member States (MS) legislation, this study aims to analyse the current operational Incident Response set-up within NISD sectors and identify the recent changes. The study provides a deeper insight into NISD sectoral Incident Response capabilities, procedures, processes and tools to identify the trends and possible gaps and overlaps.

Incident Response Capabilities (IRC) within NISD sectors is a growing concern to tackle potential incidents which could have a major impact on European societies and citizens. To assess IRC, the analysis framework for the research included the following aspects:

 Impact of the NIS Directive on national CSIRT/IR layout and operational set-up in the NISD sectors;  IR cooperation and operational models within the NISD sectors  IRC development in the NISD sectors  Lessons learned and recommendations.

A series of seven findings were identified while conducting the research activities.

Key Finding #1 – Member States’ organisational culture and resources tend to shape the overall IR layout and set-up

Depending on whether a Member State’s organisational culture is centralised or decentralised, the Incident Response layout and set-up is often structured in a similar manner, i.e. with a central authority or instead with shared responsibilities between different actors. The main entities in charge of Incident Response at national level, tend to be the national CSIRT and the Operator of essential Services (OES) . However, the mandate and the resources of the National CSIRT or national cybersecurity authority is another important element influencing a centralised or distributed incident response model.

Key Finding #2 – The Directive’s main positive impact was to clarify actors’ roles and responsibilities within the IR organisation

The main positive impact of the Directive was to improve the IR organisation and governance by clarifying actors’ roles and responsibilities. The data collected also suggest that the NISD had an unequal effect from one country to another. Indeed, this positive impact is less visible in Member States with a more mature layout and pre-existing national regulations to govern incident response in NISD sectors. However, the Directive has led/is leading to the formal identification of OES in countries who had not previously done so.

Key Finding #3 – The implementation of the NISD raises operational and regulatory challenges for the MS regulators and competent authorities

The implementation of the Directive raises operational and regulatory challenges, in particular for the definition of OES and competent authorities and the legal balance between sharing

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

information and respecting privacy regulations. The operational implementation of the Directive in the Member States also highlights MS willingness to move forward since most of them extended the number of sectors targeted and their scope.

Key Finding #4 – The success of demand or regulatory drivers for the creation of sectoral

IR entities and capabilities depends on IR layout maturity

The creation of sectoral IR entities and capabilities is driven by both operational demand and policy regulation. A blend of bottom-up and top-down incentives could be the most efficient driver to enhance capabilities, however an important element to take into account is the MS IR layout maturity. In countries with a very mature or centralised IR layout, there is less need for sectoral IRC. For all NISD sectors and/or sub-sectors, the main entities in charge of IR for 51% of the respondents are the national CSIRT and the OES

Key Finding #5 – Sectoral CSIRTs rely on similar notification and reporting tools as

National CSIRTs but provide sector-specific knowledge and expertise to their constituents

Both national CSIRTs and sectoral CSIRTs have developed mature reporting processes and notification tools. The main added value of sectoral CSIRTs is to provide services specific to their sectors’ needs, in particular a more in-depth knowledge of the threat and actor landscape, better adapted tools and solutions and operational expertise. Sector-specific regulations which include guidelines and requirements for reporting and management of incidents are crucial to enhance capabilities at the sectoral level. However, there is a lack of skilled staff, making it difficult for sectoral CSIRTs to reach full capacity.

Key Finding #6 – There is a growing number of sectoral cooperation and information-

exchange initiatives, yet they often lack visibility or resources to sustain their efficiency

There is a multiplication of information exchange tools and initiatives to facilitate cooperation at sectoral, national, regional and EU level. These initiatives can take various forms and be more or less formalised. This quantitative evolution is an encouraging sign but does not provide information on the quality and outcomes of the exchanges. The long-term benefits of these initiatives will depend on the presence of both organisational and structural elements to sustain the efficiency of the initiatives.

Key Finding #7 – Training at sectoral level is key to foster and enhance preparedness

Training is an area of constantly growing interest for sectoral CSIRTs and for other operational entities and it is considered as a crucial pillar of the cybersecurity value chain and IR actors’ preparedness and expertise. Interesting good practices to organise training have been gathered by national CSIRTs, which could provide an answer to the need for skilled personnel training opportunities.

Recommendations to ENISA

 Knowledge: Collect deeper insights on both national and sectoral CSIRT maturity when the NISD will have been fully practically implemented;  Cooperation: Bolster cross sectoral knowledge between the stakeholders;  Information sharing: Continue to collect available resources to enhance IRC & enhance information-sharing and build a repository;

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Training: Evaluate a possibility to develop a continuum for training activities which include assessing sectors trainings needs, promoting the “train-the-trainers» approach and developing basic sectoral trainings.

Recommendations to the IRC community (National and sectoral CSIRTs)

 Transparency: Publish a clear list of the sectors covered within NISD at national level (same as the NISD or extended);  Information sharing: Encourage the use of secure communication tools, common taxonomy and sharing of lessons learned after incident with peers and everywhere; The responsible disclosure of vulnerabilities should be fostered by setting incentives;  Cooperation: Build trust within communities and engage with OES and DSP;  Resources: the IR community should have adequate resources to conduct their missions.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

1. OVERVIEW AND SCOPE OF THE STUDY

1.1 CONTEXT

In 2019, ENISA is assisting European Member States (EU MS) with their Incident Response Capabilities (IRC) by providing a state-of-the-art overview of the CSIRT landscape and development in Europe. This work aims to further develop and apply ENISA recommendations for CSIRT capability development.

ENISA’s public website features both a European CSIRT inventory with an interactive map,

OES in the seven

which gives an overview of the actual situation of publicly listed CSIRT teams in Europe and a

sectors identified

published Study on CSIRT landscape and IR capabilities in Europe 2025 . These two elements

in the NISD are

support an overall picture of current CSIRTs’ incident handling and response capabilities (IRC),

accelerating their

with initial facts on sectoral CSIRTs.

efforts to build or

Following the adoption of the NIS Directive, EU Member States (MS) transposed the different upgrade their measures and guidelines into national legislation, including those focusing on OES and critical IRC. infrastructure. For example, the NIS Directive requests MS to appoint at least one Computer Security Incident Response Team to monitor incidents at national level and facilitate collaboration at European level. Beyond national and/or governmental CSIRTs, operators of essential services (OES) in the seven sectors identified in the NISD are accelerating their efforts to build or upgrade their IRC. This effort includes the set-up of specific capabilities within the NISD sectors and the development of sector-specific IR collaboration mechanisms and fora at sectoral, national, EU and international level.

1.2 OBJECTIVE OF THE STUDY

The objective of this study is to help ENISA gain a better understanding of and draw conclusions about the recent and current changes in the European Incident Response landscape based on NISD requirements. This study aims to dive deeper into IRC in NISD sectors and to study the procedures, processes and tools used either by designated CSIRTs in particular sectors or by an entity responsible for IR in these sectors in all EU MS and collect existing good practices from neighbouring countries.

The specific objectives of this study are:

 To collect and aggregate comprehensive data on current IRC of NISD sectors;  To analyse and evaluate the recent changes since the implementation of the NIS Directive;  To identify potential gaps, overlaps and challenges in national IR procedures, processes and tools.

To achieve these objectives a series of three research activities have been conducted in parallel, namely desktop research of open sources, a survey of EU national and sectoral CSIRTs (response received from 17 Member States and Norway) and complementary interviews with sectoral IRC experts and national CSIRTs.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Norway has also been included in the scope of the study because it provides interesting case studies within its financial sector. The country is highly digitalised and faced important cyberattacks targeting their operator of essential services in the past which led them to develop sectoral IRC before the publication of the NISD.

An overview of the methodology, an assessment and presentation of the data collection are presented in chapter 3 and 4.

1.3 SCOPE OF THE WORK AND DEFINITIONS

This study provides data and analysis on the recent changes and evolutions of IR capabilities (IRC) within NISD sectors in Member States (and Norway).

The study focuses on:

 The impact of the NISD on the organisation and conduct (layout) of IR and on CSIRT operational set-up in all EU MS;  The cooperation models and the capabilities (including processes, procedures and tools) developed by MS for each NISD sector;  The way sectoral CSIRTs and other IR actors (private sector, OES) function in conjunction with the national CSIRT in crisis/large incident situations from communication processes to escalation procedures and incident management;  Good practices, lessons learned and key challenges in this area.

It was therefore important to agree on the definition of the key structuring concepts and elements of the study.

The following definitions have been used in this document and shared to define the scope and key concepts of the research:

Incident response (IR): The protection of an organisation's information by developing and implementing an IR process (e.g. plans, defined roles, training, communications, management oversight) in order to quickly discover an attack and effectively contain the damage, eradicate the attacker's presence, and restore the integrity of the network and systems.

Incident response capabilities (IRC): Incident response capabilities are the processes (e.g. plans, defined roles, training, communications, management oversight), procedures and tools (log analysis, Intrusion Detection Systems, Vulnerability scanners, Data Capture & Incident Response Forensics Tools, Patch management systems, etc.) used to respond to identify, respond and mitigate an attack, to restore continuity of service.

Incident response models: Within the survey, a typology of four Incident Response models have been defined:

 Centralised: the national CSIRT is in charge of handling incidents across the different sectors; it provides a centralised point for incident reporting and analysis, decision making, response coordination, and information dissemination.  Distributed: the national CSIRT has core responsibilities to handle incidents and works with a competent authority for each sector (e.g. national ministries or public agencies); the role of these actors may be to facilitate incident notification and information dissemination.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Hybrid: a national CSIRT and the sectoral CSIRTs share the IR responsibilities and operations, which may depend for example on the sector(s) impacted or the scale of the incident.  Decentralised: a sectoral CSIRT is in charge of handling incidents in a given sector from incident detection to response coordination and decision making, including coordinating with other stakeholders.

National/Government (N/g) CSIRTs: Teams that serve a country’s government by helping to protect its critical information infrastructure. N/g CSIRTs play a key role in coordinating incident management with the relevant stakeholders at national level. They also bear responsibility for cooperation with other countries’ national and governmental teams.

Sectoral CSIRTs: Entities that respond to computer security or cybersecurity incidents affecting a specific sector. Sectoral CSIRTs are usually established in NISD sectors such as Healthcare, Public Utilities, and the Financial Sector. Unlike the National/Government CSIRTs who serve the public sector, sectoral CSIRTs provide services to constituents from a single sector only (in the context of this study, the Sectoral CSIRTs and sectors mentioned are mainly NISD sectors).

NIS Directive: The Directive on Security of Network and Information Systems (NISD) was adopted by the European Parliament on 6 July 2016 and entered into force in August 2016. The NISD provides legal measures to boost the overall level of cybersecurity in the EU.

NISD sectors: Sectors vital for the European Union’s society and economy and heavily dependent on ICT. Seven sectors are listed in the NIS Directive (NISD sectors), for which Member States have been requested to identify operators of essential services (OES). The seven sectors – and related sub-sectors - listed in the Directive are:

 Energy (electricity, oil, gas);  Transport (air, rail, water, road);  Banking;  Financial market infrastructures;  Health sector;  Drinking water supply and distribution;  Digital Infrastructure.

Operator of Essential Services (OES): Operators of essential services are private or public sector entities who play an important role in providing security in healthcare, transport, energy, banking and financial market infrastructure, digital infrastructure and water supply. According to the NIS Directive, the Member States should be responsible for determining which entities meet the criteria of the definition of operator of essential services .

Digital Service Provider (DSP): A digital service provider is an entity who provides one or more of the three types of digital service:

 Cloud computing services: digital services that enable access to a scalable and elastic pool of shareable computing resources.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Online marketplaces: digital services that allow consumers to conclude online sales or service contracts with traders online using computing services provided by the online marketplace.  Online search engines: digital services that allow users to perform searches of, in principle, all websites or websites.

Figure 1: NISD sectors (Source ENISA)

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

2. METHODOLOGY AND DATA COLLECTION

2.1 OVERVIEW OF THE METHODOLOGY

The methodology to identify, collect and analyse data on Incident Response set-up and capabilities within the NISD sector is illustrated in the graphic below. It aggregates a succession of steps which are presented in this chapter. Figure 2: Overview of the methodology

2.2 A SEVEN-STEP APPROACH 2.2.1 Step 1 – Definition of the research focus for the data collection

The research focus of the study was defined by building an analysis grid to be used to classify the information collected on Sectoral IRC, by defining a set of analysis criteria and theme. The list of criteria was defined according to elements of interest for ENISA and additional criteria pertaining to the specific data sought in the context of this study (e.g. cooperation aspects, recently created entities, etc.). The list of criteria defined are presented in Annex 1.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 2.2.2 Step 2 – Desktop research in open source on NISD Sectors IRC

This step consisted in conducting a literature review and open source research to collect data on sectoral IRC and recent trends in the field of IRC.

During this step, the research team used the pre-defined classification criteria to build an analysis grid. The purpose of this analysis grid was to facilitate the data collection by focusing the research work on the key topics of interest for ENISA and to present the raw data in a structured way.

During a preliminary data collection phase, the relevant data was gathered in the data classification grid by a first team of analysts. The preliminary data was then validated and further enriched by a second team of analysts.

2.2.3 Step 3 – Designing and validating the survey

Publicly available information on Sectoral IRC procedures and tools was, as anticipated, not detailed enough to provide insightful input (see part 3.1.2). It was therefore planned early on to conduct a survey to collect comprehensive data from relevant parties.

Once the objective of the survey was defined, two categories of organisations were identified to participate to the survey:

 28 Member States’ national CSIRTs and Norway;  Additional sectoral CSIRTs from the 28MS and Norway.

Norway has also been included in the scope of the study because it provides interesting case studies within its financial sector including FinCERT, an entity involved in the IR for Financial sector also in other Nordic countries. The country is highly digitalised and faced important cyber-attacks targeting their operator of essential services in the past leading to the early creation of sectoral IRC, before the publication of the NISD.

The Project Team then drafted the survey which could be sent to both audiences considering aspects such as data protection, privacy and legal aspects, language, size and format, and structure.

2.2.4 Step 4 – Conducting the survey and complementary interviews

The survey was sent by ENISA to the 28 national CSIRTs and additional sectoral CSIRTs CSIRTs that were recommended by CNW members. To maximise participation the survey included a presentation of the study and its context.

Targeted emails were sent to relevant contacts and followed-up on, to ensure answers from a maximum of Member States and sectors.

Following the survey, additional interviews were conducted to complement and further enrich the data collected with the survey and desktop research with both:

 National and sectoral CSIRTs who replied to the survey;  National and sectoral CSIRTs who did not reply to the survey.

A list of entities was drafted for each with a rationale for the interview which was validated by ENISA.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Once an organisation agreed to participate in the interview, a timeslot was scheduled and a list of 6 to 7 questions was sent to the interviewees ahead of the interview based on the answers provided in the short questionnaire or additional element to fill in information gaps.

2.2.5 Step 5 – Collation of raw data

The raw data collected from the desktop research, the survey and the interviews, was gathered in structured tables in a collaborative tool.

The collaborative tool allowed the aggregation of all raw data, the generation of statistics and the identification of key input.

2.2.6 Step 6 – Analysis and identification of trends

The methodology used in this step was a qualitative use of the Delphi Method, which ensures that the data collection team and the data analysis team benefit from and build on each other’s expertise, and that the final analysis addresses all aspects of the request presented in a concise, coherent and comprehensive way.

A first analysis of the raw data was made by the data collection team and the data analysis team to develop a draft set of key findings. Once analysis methods were applied, a first version of the key findings of the study was drafted and subjected to validation and further discussion.

At a second stage, a virtual workshop held via videoconference was organised with members of the ENISA Informal Expert Group on Sectoral Incident Response Capabilities .

Once the virtual workshop was held and all final comments received, a second version of the key findings of the study was drafted and subjected to validation and further discussion.

2.2.7 Step 7 – Final report

This final step consisted in further developing findings of specific interest to ENISA and in drafting the final report of the study in collaboration with the member of the IEG.

2.3 OVERALL ASSESSMENT OF THE DATA & INFORMATION AVAILABILITY

The identification of reliable and qualitative data was crucial throughout the study. For each of the three activities conducted during the study, namely the desktop research phase, the survey and the complementary interviews, an overall assessment the data and information availability was conducted, and several assumptions are noteworthy.

2.3.1 Desktop research – Data collection assessment

During the open-source desktop research phase, information on IR layout and set-up were collected for 17 out 28 Member States.

 The clarity and level of information available on the national IR approach in NISD sectors was very different from one Member States to another and not all of them had information publicly available;  Information on procedures, processes and tools used by Sectoral IR teams were rarely, if ever, detailed in publicly available documents;  Publicly available information about cooperation models or cross-border procedures was not detailed;

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Qualitative information on information exchange communities and fora were rarely, if ever, detailed in publicly available documents.

2.3.2 Survey – data collection assessment

The survey collected answers from 24 respondents: 18 National CSIRTs and 6 Sectoral CSIRTs from 17 Member States and Norway (knowing that the minimum planned requirement was responses from 15 MS).

 Efforts were made to cover all Member States, but the survey was conducted between June and August, a challenging moment to find available yet relevant respondents;  A majority of respondents were National CSIRTs, resulting in the collection of input

more focused on national approaches towards IR in NISD sectors rather than

sectoral approaches and capabilities;  18 out of 24 respondents provided one or several qualitative comments through the survey.

2.3.3 Interviews – data collection assessment

In total, 8 complementary interviews were conducted: Two with national CSIRTs representatives and one with a Sectoral CSIRT representative who had replied to the survey. One with a sectoral expert who did not participate to the survey and four with experts from the Informal expert group.

 Efforts were made to collect additional inputs from sectoral stakeholders. It allowed to draft interesting case studies but not to develop an analysis at sectoral level;  The interviews allowed to get deeper insights on procedures, processes and tools used within the interviewees’ organisation.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

3. KEY FINDINGS

3.1 KEY FINDING #1 3.1.1 Member States’ organisational culture and resources tend to shape IR layout and set-up

The sectoral Incident Response layout and set-up at national level across the EU is strongly impacted by the national organisational culture of each Member State. Countries with a very centralised state culture tend to have a centralised Incident Response model under the supervision of the national CSIRT, whereas decentralised countries tend to have more hybrid or decentralised models with sectoral CSIRTS in charge of Incident Response.

According to the survey and as illustrated in the graph below, the IR model is centralised or hybrid for 90% of the respondents and 100% of countries with centralised organisational culture have a centralised IR model.

Figure 3: Entity in charge of Incident Response by Sector

0 6 12 18 24 EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

NB: The respondents to the survey could select the competent entity in charge of Incident Response within each sector and sub sectors. NA is the number of respondents who did not provide an answer for the sector or sub-sector. As an example, for the energy sector:

 The national CSIRT is the entity in charge or IR for the Energy sector for 8

respondents;  A Sectoral CSIRT is the entity in charge or IR for the Energy sector for 4 respondents;  The OES are the entities in charge or IR for the Energy sector for 6 respondents;  5 respondents did not provide answer to for this sector;  Both the national CSIRT and the OES are the entities in charge or IR for the Energy

sector for 1 respondent.

National CSIRTs

Based on Figure 1, all NISD sectors and/or sub-sector, the main entities in charge of incident

and OES are the

response for 51% of the respondent are the national CSIRT in cooperation with the OES.

entity in charge of IR for 51% of the respondents

Table 1: Case study - Sectoral IR layout and set-up: France vs The Netherlands

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

The national CSIRT’s mandates and financial resources also strongly impact the sectoral Incident Response layout and set-up.

Within each Member State, National CSIRTs can have different mandates, among others:

 Raising awareness on threats;  Identifying risks;  Protecting and hardening systems;  Deterring attacks;  Monitoring and detecting incidents;  Responding to incidents;  Recovering from incidents;  Integrating and disseminating lessons learned.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

As an illustration, when building CERT-UK, the United Kingdom’s national CSIRT, the UK Cabinet Office identified 47 possible functions of a national CSIRT, but ultimately prioritised only four in the creation of CERT-UK .

Another interesting case to mention is the Czech Republic layout. The Czech governmental Sectoral IR CERT constituency is consists of owners of important information networks and providers of layout depends

essential services (energy, etc.). The national CSIRT provides Incident handling for all other strongly on the subjects within the sectors and some private subject have their own IR teams . Hence, there

national CSIRT

are no sectoral CSIRTs in the Czech Republic.

mandate and budget

The research highlighted that several national CSIRTs’ mandates do not include Incident Response, often because of a lack of resources. National CSIRTs tend to delegate functions such as identification of Operator of Essential Services (OES) and Incident Response activities to sectoral authorities and sectoral CSIRTs. Additionally, even if national CSIRTs do not include the IRC, they do include and are responsible for national Incident coordination.

Table 2: Case Study Sectoral IR layout and set-up: Portugal

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.1.2 Lessons learned and recommendations

 The organisational culture of a country could be further taken into account when analysing

the Incident response model of European countries.  A deeper insight into MS national CSIRTs’ mandates would be an interesting topic to be

further studied by ENISA to better assess the overall IR layout. This could be done by using CSIRT maturity products .

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.2 KEY FINDING #2 3.2.1 The NIS Directive has improved the IR organisation and governance by clarifying actors’ roles and responsibilities

The transposition of the NIS Directive into national legislation seems to be having a positive impact on the Incident Response (IR) landscape at national level, contributing to improved overall organisation and governance.

Figure 4: Main features of the changes following the NIS Directive

According to national CSIRTs, the Directive has led to a clarification of the roles and responsibilities of the various actors involved in IR at all levels, and the ongoing implementation is leading to significant organisational changes, including:

 The formal identification of OES;  The creation of sectoral CSIRTs.

The NISD has

This positive impact is less visible in countries with a more mature organisational layout. The

had a positive

data collected indeed suggest that the NISD had an unequal effect from one country to

impact on the

another.

clarification of

During the survey, respondents were asked about the impact of the NISD of the set-up of their the roles and IR capacities on a scale from 5 (high impact) to 0 (no impact). The replies show that: responsibilities

of IR

 10 out of 24 respondents thought that the NISD had an important impact (5 to 3);

stakeholders.

 13 out of 24 respondents thought that the NISD had a relatively small impact (2 to 0);  1 respondent did not provide an answer.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 5: Evaluation of the changes on the CISRT/IR layout and operational set-up

8 7 6 5 4 3 2 1 0 5 (highly) 4 3 2 1 0 (not at all) NA “The NISD didn’t

“Before the transposition of the NISD we had a law and strategy that already set this way. The

change much,

NISD was treated as an update to the previous law and continues the way of thinking.”

since we were

(National CSIRT)

working in the

According to the results of the survey, the countries who tend to be less impacted by the same way

Directive are the countries with a more mature landscape who already had a clear

before.”

governance and definition of roles and responsibilities.

(National CSIRT)

The evolution of the maturity of MS IR landscape could be an interesting area to further study by using the ENISA CSIRT Maturity Toolkit based on SIM3 (https://opencsirt.org/maturity/sim3/). These mixed results highlight the fact that there are still important differences between Member States’ cybersecurity landscape and IRC at large.

3.2.2 Lessons learned and recommendations

 Based on received data, it would be interesting to have another round of analysis to evaluate the mid- and long-term impacts of the NIS Directive on IR layout once the NISD has been completely implemented in all the MS.

It would be useful to conduct a maturity assessment of sectoral CSIRT landscape within NISD sectors (using ENISA CSIRT Maturity Toolkit as a basis) and to identify future changes.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.3 KEY FINDING #3 3.3.1 The implementation of the Directive raises operational and regulatory challenges and highlights MS willingness to move forward by extending the scope and number of sectors targeted

Following the transposition of the Directive into national legislation, EU Member States are now in the process of implementing the regulation. The two main challenges raised by respondents and confirmed by sectoral experts are regulatory and operational.

Figure 6: Assessment of the challenges faced during the implementation of the NISD

5 (strongly agree) 4 3 2 1 (not agree at all) Organisation challenge: find the right governance model 6 10 between national and sectoral actors Regulatory challenge: to develop the right legal framework enabling the 8 11 uptake of security requirements and the notification of… Operational challenge: to establish effective 6 10 response and trusted collaboration mechanisms among sectoral actors Capability challenge: to ensure that sectoral actors 8 12 have the necessary IR expertise and capacities Technical challenge: to develop and/or adopt 2 12 the relevant IR tools at a sectoral level 0 12 24

The legal and administrative definition of what constitutes an OES can pose a challenge

NISD

for the authority in charge of defining the list of OES within the NISD Sectors. There are two

implementation

issues in defining the OES:

poses regulatory

 The legal definition and threshold/criterion of what constitutes an OES; and operational  The administrative identity of the OES: Name, headquarter, VAT number, etc. challenges

The threshold and criterion to identify the OES are defined by the authority which can be the national cybersecurity authority, the sectoral authority or another competent authority. The Directive provides an initial list of entities, but each MS has to define the thresholds and criterion for the sectors which can be based on quantitative aspects (share of market, tons of freight, etc.).

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Table 3: Case-study: Maritime transport OES definition & threshold (United Kingdom)

The identification of all the OES can be an operational challenge in sectors with an extended range of suppliers and service providers. Sectors which include various public and private actors can depend strongly on SMEs in their value chain. Should these SMEs be targeted by a cyberattack, this could impact the entire value chain. It is therefore complex for the

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

regulator and/or the entity in charge of listing OES (be it the national CSIRT, the Sectoral Authority or the sectoral CSIRT) to map the dependencies and identify all the OES within the sectors and set-up thresholds.

Finally, classifying OES can become complex in the case of large companies who have more than one activity/branch which falls under the scope of NISD (e.g. an IXP (OES) might also operate as a cloud provider (DSP)). This could result in a company reporting to several sectoral authorities in a decentralised IR model, generating overlaps and duplication between the competent authorities.

Regulatory challenge: information-sharing and incident notification

A regulatory challenge posed by the implementation of the Directive concerns informationsharing with third countries, especially when there is not an adequate legal basis under GDPR for such sharing. A national CSIRT analyst may find actionable information which could be of great help for another country, but he/she may not legally be able to share this information with that other country’s authority.

As an example, in order to mitigate relevant challenges, the transposition of the NISD into Dutch law allows the NCSC-NL (CISRT for government and OES in the Netherlands) to share actionable information outside of its mandate to third countries’ IR entities as long as the entity is a CSIRT and if it is believed that the entity has the capacity to use the information and will do so in a reasonable manner.

Moreover, it should be noted that in the case of a security breach involving personal data (as e.g. in the bank, finance or health sector), aside reporting to the national CSIRT, the national Data Protection Authorities (DPAs) should be notified, according to GDPR..

According to one of the interviewee, there may be a missing link between the national CSIRT and the national Data Protection Authority, and it would be therefore interesting to think of a communication channel between the two types of authorities covering the incidents where personal data is part of the security breach.

NISD

Extension of the scope and number of NISD sectors

implementation is leading to

As mentioned above, the implementation of the Directive is still in progress in some Member States, but the research highlights significant differences among national operational set-ups: significant

differences

While transposing the NIS Directive into national legislation, some Member States opted for among MS and, using the 7 sectors listed in the NIS Directive (see Section 3.1 Definition) while others decided in some MS, to to extend the scope and number of sectors covered:

an extension of the scope and

 12 out of 28 MS have extended the scope of NISD sectors and added entities not listed in

number of

the NISD as OES.

sectors covered

The sectors mostly added are electronic communications/telecommunication networks (for 7 out 12 MS) and chemical Industry.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Table 4: Extended scope of sectors and OES

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.3.2 Lessons learned and recommendations

 An overview of all MS NISD sectors (including additional ones) should be published by ENISA

to allow MS or sectoral actors to leverage synergies between sectors;  MS who have already defined their OES could continue sharing their lessons learned and

good practices. This information should be made available to the authorities in charge of defining OES and identifying the OES if different.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.4 KEY FINDING #4 3.4.1 A blend of bottom up and top down incentives could be the most efficient driver for the creation of sectorial CSIRTS, depending on MS IR layout maturity.

The NIS Directive is one of the three key drivers for the creation of sectoral CSIRTs, along with lessons learned from past incidents and the lack of sector-specific knowledge of the national CSIRT, according to the respondents.

“[The creation of the sectoral CSIRT was driven by] a need to collaborate and coordinate Incident Response against ongoing cyberattacks” (Sectoral CSIRT)

Figure 7: Key drivers to create sectoral IR capabilities

The implementation of the NIS Directive 6 8 The lack of sector-specific knowledge or capacity of the National CSIRT Lessons learnt from past incidents 8 6 The difficulties of managing the cybersecurity 1 13 incidents in the NISD sectors The complexity of managing the high number 2 12 of OES in some of the NISD sectors Other. Please, specify 3 10 Yes No NA

Demand-driven

For 8 out of 24 respondents, the creation of sectoral IRC was driven by lessons learned from past incidents while for 6 out of 24 respondents it was the lack of either sector-specific knowledge or national CSIRT capacities. In other words, according to the survey, a bottom-up (demand-side) incentive favoured the creation of sectoral IRC.

In some of the cases, operators of essential services (public or private entities) created a sectoral CSIRT on their own initiative. This is also the case for non-EU sectoral CSIRTs such as the NordicFin CERT which provides a good illustration of a cross-border sectoral IRC set up prior to the publication of the NISD to respond to an operational need.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Table 5: Case Study NordicFin

A highly digitalised Financial sector in Nordic countries – vulnerable to cyber attacks

According to the Digital Economy and Society Index (DESI), the most digitalised countries in Europe are Denmark, Finland and Sweden . They adopted digital financial services such as online banking, digital investment services or online provision of credit early, as illustrated in the chart below.

According to The Bank of Finland Bulletin, “Not only have banks in the Nordic countries invested in digitalisation; the position of new FinTech actors is also better in the Nordic region

than in many other countries.”

This growing digitalisation of the Nordic financial sectors opened new vulnerabilities to cyber threats.

A need to collaborate to better respond to an increasing number of cyber attacks

From 2007 to 2016, Nordic countries experienced numerous attacks on their financial sector.

In 2007, Norway was targeted by their first internet banking malware attacks. Between 2008 and 2011, financial operators collaborated through both formal and informal schemes to respond to cyber incidents. In 2012, Sveriges Riksbank (central bank of Sweden) was hit by a Distributed Denial of Service (DDoS) attack which left its website offline for 5 hours. In 2014, a DDoS attack on seven large financial institutions in Norway resulted in suspended services for an entire day. In Finland, at the end of 2014, three banks (Op Pohjola, Danske Bank and Nordea) suffered DDoS attacks that rendered their online services unavailable and for one bank prevented customers from withdrawing cash and making card payments.

Lessons learned from incident called for IR cooperation at national level

In 2012, in Norway, while the National Cyber Security Strategy was in the process of being created, the country experienced a peak of attacks and decided to set up a national platform, FinansCERT, dedicated to responding to cyber threats targeting the financial sector. FinansCERT was created to formalise collaboration between relevant actors, and actively cooperates with the national CSIRT and with the law enforcement computer crime unit. FinansCERT Norway, based in Oslo, was operational from 2013 to 2017.

A demand from operators to create a cross-border capability to collaborate to fight cybercrime

In 2017, the largest banks operating in the Nordic countries, namely Nordea, Danske Bank and DNB worked on a project to set-up a single payment clearance system which would be operated by one company for all the Nordic countries. To secure this project and face a

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

growing number of attacks, Danske Bank, Nordea, DNB, Sparebank 1 and Eika Group, among other Nordic banks, decided to expand FinansCERT, to develop a collaboration platform to the entire Nordic region: Nordic Financial CERT (NordicFin CERT).

Nordic-Fin CERT mandate

The Nordic Financial CERT aims at fortifying the Nordic community in the face of cyber risks to customer assets and at providing a safety net for all financial institutions, big and small. It envisions a Nordic community in which the financial sector actively and responsively identifies, defends against and combats cyber risks. The collaboration will enable the banks to gather the best knowledge available about fighting cybercrime in the Nordic financial sector, and it will lead to synergies that will improve both the customers’ and the banks’ security.

Sources

https://www.bofbulletin.fi/en/2018/2/nordic-banks-go-digital/ Cyber Risk for the Financial Sector – IMF, A. Bouveret, 2018 https://www.nordea.com/en/press-and-news/news-and-press-releases/pressreleases/2017/04-10-08h00-nordic-banks-collaborate-on-fighting-cybercrime.html

Regulation-driven

For other Member States, the NIS Directive was the main reason for initiating such capacities. As a result, their sectoral capabilities are recent or still work in progress. In those cases, the NIS Directive and the GDPR were an opportunity to justify the need for additional resources to increase capabilities and create sectoral CSIRTs. However a major increase of financial resources was rarely noted according to the data collected.

 It was the implementation of the NIS Directive for 6 out of 24 respondents, which was the main driver for the creation of Sectoral capabilities.

As an illustration, Bulgaria is in the process of creating seven sectoral CSIRTs as a consequence of the transposition of the NISD in the national legislation.

In some cases, the creation of sectoral capacities is driven by both national authorities and operators. This is the case in The Netherlands, which features many sectoral CSIRTs although the national CSIRT (and cybersecurity agency) also play a proactive role.

The support of

The support of national CSIRTs to the development of sectoral CSIRTs and capabilities

national CSIRT to

tends to be of great added value because it capitalises on existing expertise.

develop and

A noteworthy initiative, pre-dating the NIS Directive, is that of the Dutch NCSC, which provided enhance Sectoral incentives and guidelines to support the creation of CSIRTs: IRC is key to

capitalise on

 Guidelines to start a collective CSIRT ;

existing

 Guidelines to operationalise a CSIRT: NCSC’ CSIRT Maturity Toolkit .

expertise

NCSC-NL also appointed a liaison officer whose mission was to follow the creation of sectoral CSIRTs. The liaison officer came to the sectoral CSIRT’s premises 2 days a week to support the newly created team.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

It also worth mentioning that countries with a centralised Incident Response model tend not to have, nor to plan to develop specific sectoral CSIRT capabilities since the national CSIRT tend to have sectoral IR teams within its structure. In these countries, IR is directly managed by the OES and reported straight to the National CSIRT or governmental CSIRT such as in Czech Republic (see Key Finding 1).

6 out of 24 respondents confirmed that there are no sectoral CSIRTs in their country.

“Currently we do not provide sectoral CSIRTs and there is no plan to create any” (National

CSIRT)

100% of respondents with no sectoral CSIRT have a centralised IR model with national CSIRT as the competent authority for NISD sectors.

“We don’t tend to use sectoral CSIRTs but [the national CSIRT] ’s Engagements Team do maintain close contact with all NISD sectors.” (National CSIRT)

3.4.2 Lessons learned and recommendations

 Sectoral actors could benefit from the experience and knowledge of national and other sectoral CSIRTs, for instance through the appointment of a liaison officer, sharing of knowhow, expert advice or tailored training.  ENISA should continue to collect available resources (guidelines and toolkits), for example by enabling a GitHub repository.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.5 KEY FINDING #5 3.5.1 National CSIRTs have developed mature reporting processes and notification tools, as have sectoral CSIRTs who provide solutions specific to their sectors’ needs

The nature of the capabilities developed and used by sectoral CSIRTs in contrast with national CSIRTs strongly depends on the range of services that both can provide to their constituents.

According to FIRST “CSIRT Services Framework ”, CSIRTs can provides various cyber

security services and functions:

Table 6: FIRST’CSIRT Services Framework V2.0

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

REPORTING TOOLS

Email-based reporting One of the most common services provided by both National CSIRT and Sectoral CSIRT tools (secured and/or according to the survey is information security incident reporting. To provide this specific encrypted), Secured service, both National CSIRTs and Sectoral CSIRT have developed and/or use mature networks/chats, Web reporting processes and notification tools to allow citizens, OES and other private or public- forms, notification sector organisations to report incidents. portals, collaboration portal, in-house Notification and reporting tools of national CSIRTs and sectoral CSIRTs developed tools (inhouse notification According to the survey, 83% of respondents use incident notification templates and 100% have portal). specific information-exchange tools to enable the notification of incidents.

OTHER TOOLS

The reporting tools used by both national CSIRT and sectoral CSIRT identified through the Early detection survey and the desktop research are: systems, monitoring systems, Industrial  Email-based reporting tools (secured and/or encrypted), Secured networks/chats, Web forms, control systems, notification portals, collaboration portal, in-house developed tools (in-house notification portal, Threat intels systems,

30 Malware Information customized tool based on RTIR ). Sharing Platform (MISP), IntelIMQ,

30 information sharing

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

The other tools identified are:

 Early detection systems, monitoring systems, Industrial control systems, Threat Intel systems,

Malware Information Sharing Platform (MISP) , IntelMQ , information sharing platforms and tools.

Table 7: Case study: CERT-BE, Belgium

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Depending on their mandate, sectoral CSIRTs tend to offer the same range of incident reporting and notification services as the national CSIRT, including similar notification tools and reporting processes which rely mostly on web forms and email.

Table 8: Case study: DSP-CSIRT, The Netherlands

However, if sectoral CSIRTs appear to use reporting and notification tools and capabilities similar to the national CSIRTs’, they also provide services more adapted to the sector’s

specificities and needs.

Sectoral CSIRT specific capabilities and services

When asked about the main added value of sectoral CSIRT, respondents to the survey and sectoral experts raised the following:

 Better knowledge of specific sectors’ threat landscape;

By working on a more focused perimeter, sectoral CSIRTs gain robust knowledge of the specific risks and threats targeting their sectors. As an illustration, the Dutch Health sector CSIRT, Z- CERT , offers specialized services to healthcare institutions by publishing regular white papers on the specific threats targeting hospitals.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Better knowledge of the entire sector value-chain and better relationship with vendors;

Sectoral CSIRTs tend to have more direct contact with sectoral operators. Operators can often register as participants to sectoral CSIRTs to better benefit from said CSIRT services. Hospitals (ranging from academic "UMCs", top clinical "STZ" to "general" hospitals) as well as mental healthcare institutions ("GGZ") can register with Z-CERT as participants (constituency) .

 More qualitative and operational information sharing, better sharing of good practices.

Sectoral CSIRTs provide or are used as information-exchange entities either to share identified vulnerabilities, incidents or lessons learned. Z-CERT, for instance, informs its constituency of any vulnerabilities detected in medical devices, medical networks and medical applications. To those participants affected by a vulnerability, Z-CERT provides advice on how best to deal with the situation. Z-CERT also sends out alerts regarding possible threats and current attacks. Z- CERT shares its knowledge (through the release of whitepapers, for example) with its participants, facilitates meetings for its participants, and hosts networking events and theme sessions .

Sectoral capabilities maturity assessment

When assessing the maturity of the tools and processes used by national and sectoral CSIRT, two specific factors must be taken into consideration.

First, the maturity of the CSIRT itself: a more mature (see ENISA Maturity Evaluation Methodology for CSIRTs) CSIRT will tend to have better developed tools and processes than others.

In The Netherlands, the national CSIRT appointed a liaison officer to follow the creation of the sectoral CSIRT and support their development and maturity. According to the liaison officer:

There is a

“They [Sectoral CSIRT] are growing in staff but it is challenging to find people with cyber shortage of

security skills. Besides, we have also seen growth in services, number of staff and

skilled staff to

expertise. Our CSIRT for Municipalities and the Health-CERT have been around a couple

conduct IR tasks

years now, grow in more mature CERTs every day, and expand their services from the

within both

traditional incident response activities to activities focused on tackling more long-term cybersecurity problems by writing advisory products and developing threat landscapes for national and

their constituency.” sectoral CSIRTs

The shortage of skilled staff for both national and sectoral CSIRT has been identified has a recurrent issue by IR experts.

Highly regulated sectors and maturity of IRC

Secondly, reporting processes and information exchange tend to be more mature in highly regulated sectors. As stated in the NIS Directive, requirements for notification of incidents can be part of normal supervisory practice in the highly regulated sectors or sectors ruled by a supervisory mechanism.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

For example, the financial sector has particular regulations which require the notification of incidents impacting the network and information systems and call for specific IRC and monitoring tools.

“Financial institutions are particularly exposed to cyber risk due to their reliance on critical infrastructures and their dependence on highly interconnected networks. Critical financial market infrastructures include payment and settlement systems, trading platforms, central

securities depositories, and central counterparties.”

The Financial and banking sectors are targeted by increasingly frequent and sophisticated cyber-attacks. According to an IMF study on cyber risks (Cyber Risk for the Financial Sector: A Framework for Quantitative Assessment, WP/18/143, July 2018) , cyber-attacks targeting the financial sectors can have several effects:

 Business disruptions prevent firms from operating, resulting in loss revenue;  Fraud leads to direct financial losses;  Data breaches take more time to materialize, through reputational effects as well as litigation costs.

To tackle these risks and avoid cascading effects at European level, the European Central Bank (ECB) conducted a thematic review on cyber security risk in 2015 (prior to the NIS Directive) and targeted on-site inspection . In 2016, the ECB Banking supervision has implemented a

cyber-incident reporting framework as a pilot scheme which was rolled out to the

banking institutions in 2017 . All significant institutions from the 19 Eurozone countries have to report significant cyber incidents as soon as they detect them. This enables supervisors to identify and monitor trends in cyber incidents affecting significant institutions and to gain a deeper knowledge of the cyber threat landscape. It also allows for a swifter reaction to a potential crisis caused by a cyberattack .

Table 9: Case study: TIBER-EU - threat intelligence-based ethical red-teaming framework

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.5.2 Lessons learned and recommendations

 Sector specific regulations tend to act as a key driver to enhance IRC. ENISA and sectoral

authorities should collaborate more if possible to streamline IRC-related guidelines or good practices within the future regulation.  The mitigation of the shortage of skilled staff for IR activities at both national and sectoral level

should be a priority for MS. Innovative methods to attract and retain skilled staff could be studied along with relevant incentives such as training building on existing practices within the Member States.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.6 KEY FINDING #6 3.6.1 There is a multiplication of information-exchange tools to facilitate cooperation at sectoral, national and EU/international level, but the quality of the exchange depends on both organisational and structural criteria

The importance of sharing information is widely recognised among Member States, highlighted by a growing number of initiatives to foster cooperation through information exchange at national, European and international level.

These initiatives can take very different forms:

 Cooperation agreements;  Cooperation and information platforms;  Dedicated fora, communities and networks;  ISACs and other information centres.

Sectoral initiatives at national level

There is a multiplication of initiatives such as ISACs, networks and fora at national level to foster information exchange and increase awareness among stakeholders within a sector. Certain fora and communities were created in the early 2000’s but a growing number are currently being created to respond to the need of information exchange.

Table 10: Information exchange initiatives at national level within sectors

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Trans-sectoral initiatives at national level

According to the survey, 55% of respondents have a network of IR actors at a national or sectoral level to exchange good practices on cyber information exchange, capabilities, cooperation etc. to support the development of OES IRC.

National CSIRTs have developed dedicated platforms for information exchange and cooperation which are open to OES from all NISD sectors.

Table 11: Information exchange initiatives at national level cross-sectors

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Initiatives at European / regional level

Several initiatives were identified at both European and regional level to support the creation and/or the uptake of tools facilitating the exchange of technical information about incidents.

Table 12: Information exchange initiatives at European level

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

According to the respondents of the survey, the three most used groups to exchange with peers

at European and international level are the CSIRT Network (27%), the TF CSIRT (23%) and the FIRST Community (22%).

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 8: Main groups use to exchange with peers

12% 27% 23% 22% 12%

A discrepancy was identified between the quantitative data collected through the survey and complementary interviews on the use of the European Government CERTs (EGC) group. Only 12% of survey respondents (8 out the 17 National CSIRTs) use the EGC group to exchange IR good practices and experience, but the interviews with IR experts indicate that there are more frequent and qualitative exchange within this community which could be explained by the fact that not all EGC members have participated to the survey.

Cross-border initiatives

Cross-border cooperation relies mostly on information-sharing between MS (peer to peer exchange in regional communities) and cooperation agreements with other national CSIRTs.

 78% of respondents to the survey have specific measures in place to inform the relevant actors (national authorities and OES) in neighbouring countries about an incident that may impact them.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 9: Assessment of the nature of specific measures to inform relevant actors in neighbouring countries about a cross-border incident

Quality and efficiency of information sharing in sustainable communities

The multiplication of networks and initiatives, however encouraging and a sign of rising awareness on the need to facilitate information exchange, must also be evaluated in terms of quality of the exchange within these fora.

Information-

Certain fora were created in response to legitimate sectoral needs. Yet these fora can lack the

sharing

organisational and structural means to sustain the efficiency of information-sharing, thus

communities and

undermining their raison d’être.

fora need

As an illustration, the European Cyber Security Organisation (ECSO) published a position paper resources to

59 sustain the

on the creation of a European Energy ISAC which the paper claims lacks visibility among most European energy operators. In ECSO’s opinion, “EE-ISAC carries out many activities but the efficiency main outcomes and benefits of the organisation are not clear. In addition, EE-ISAC involves only a few energy operators whereas they should be strongly represented to drive the ISAC

activities according to the energy sector’s needs.”

Several factors are currently or could in the future jeopardise the quality and efficiency of the information-sharing initiatives such as:

 A lack of representativity and visibility within the sector: if there are multiple communities or platforms aiming the same objective within a given sector and if the communication and dissemination resources are not sufficient to raise awareness on the existence of the initiatives;  A lack of financial resources: If there is not enough budget to sustain the initiative on a long term;  A lack of trust between participants: within over-sized fora with too many stakeholders, it can be challenging to build trust to allow fruitful exchanges among participants;

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 A fear of penalty for the voluntary reporting of incident caused by human error: when reporting human errors, stakeholders should be ensured not to be blamed or penalised to encourage sharing of lessons learned.

Finally, information sharing at sectoral level can also raise operational challenges:

According to one of the interviewees, “one of the difficulties is how to make sure the right

knowledge and information will reach all relevant organisations. On top of that, you want to

have a feedback loop where information flows from the national CSIRT to the sectoral CSIRT to

the individual organisations, it should not be a one-way-street.

Other challenges involve the fact that OES have a notification requirement to their Single Point of Contact and sectoral regulator, but not always to their sectoral CSIRT, which can sometimes

make the information sharing and notification duties a complex set of responsibilities. In addition, there is a risk of inefficiency.”

Finally, it can sometimes be challenging for Sectoral CSIRT and OES to assess when a threat or an incident can also have impact for other sectors and should be shared. In case a major incident which could have impacts in national security the National CSIRT would be in direct contact with the OES, and the Sectoral CSIRT in hybrid or distributed IR models. This situation could raise the question to delegate national security tasks to private sectoral CSIRTs.

This is why it seems like both a continuous exchange with national CSIRT and cross-sectors communication channel could be important to set-up or maintain at national level. This would

allow to share the work and avoid that several CSIRTs (national and sectoral) analyse the

same threat or event and does not share the analysis. Therefore, there it would mitigate the risk of doing double work with the already limited cyber security resources.

3.6.2 Lessons learned and recommendations

 ENISA could further study the drivers to sustain information-sharing initiatives, develop a set of guidelines, user-friendly tools and enablers (such as “Secure Group Communications for incident response and operational communities” and “Proactive detection of network security incidents - incident response tools mapping” ) .  Dedicated collaboration schemes at MS level could avoid duplication of efforts and ensure that all relevant stakeholders are informed such as user-friendly cross-sectoral communication tools or channels between several authorities (NISD and GDPR authorities).  The anonymised voluntary reporting of human errors should be encouraged and supported to ensure that lessons learned are widely disseminated.  The promotion of responsible disclosure programs of vulnerabilities at sectoral level should be foster.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.7 KEY FINDING #7 3.7.1 There is a growing interest in training to enhance and foster preparedness in NISD sectors at European level

The NISD encourages MS to foster their preparedness by requiring the establishment of appropriate measures such as the creation of CSIRTs. Many MS have placed increasing cyber preparedness, in particular that of NISD sectors, as a priority in their national cyber security strategy.

Although, it was difficult to measure how this priority is concretely implemented at operational level, one of the key areas identified to increase preparedness is the set-up of training.

According to the FIRST CSIRTs services framework:

There is a need for sector-

“A training and education programme can help the CSIRT to establish relationships, and to

specific training

improve the overall cybersecurity posture of its constituency, including the ability to

to mitigate

prevent future incidents from happening. Such a programme can help maintain user awareness,

help the constituency understand the changing landscape and threats, train the shortage of

constituency on tools, processes and procedures related to security and incident skilled-staff

management.

This can be done through various types of activities including documenting the knowledge, skills and abilities (KSAs) required, developing educational and training materials, delivering content, mentoring, and professional and skill development. Each of these activities will collectively contribute to the constituency’s and the team’s capabilities.”

According to the survey, out of 24 respondents, sector-specific cybersecurity training activities are conducted:

 Regularly: 5 National CSIRT  Occasionally: 2 National CSIRT and 3 Sectoral CSIRT  No but planned in the future: 8 National CSIRT and 1 Sectoral CSIRT  No and not planned: 1 National CSIRT  Did not provide answer: 3 National CSIRT and 1 Sectoral CSIRT

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 10: Sector-specific training evaluation

Yes, regularly Yes, occasionally No, but planned No and not planned 17% 21% NA 4% 21% 38%

These answers indicate a significant interest from the sectoral CSIRT in training. It could be a concrete way to mitigate the shortage of skills highlighted in the previous findings.

Several initiatives already exist at both national and EU level to conduct trainings on Incident response procedures and tools.

Table 13: Case study: Good practices for training

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT 3.7.2 Lessons learned and recommendations

 ENISA should continue its efforts in the area of trainings and promote the training

programmes also within sectoral CSIRTs .  To mitigate the shortage of skilled staff and enhance IRC capabilities within sectors, raising

awareness in sectors about the added value of sector-specific training could be initiated.  Dedicated training could be created for sectoral actors. This could be done by first assessing

the sector-specific training needs with relevant stakeholders and identifying existing trainings (such as TRANSITS-I, TRANSITS-II, and the ones conducted by ENISA, FIRST, etc.) to build on their experience.  Sectoral CSIRTs might want to prioritize practical areas of IR:  Tools;  Taxonomy;  Responsible vulnerability disclosure;  Trust building;  Information sharing and developing skills and experience.

3.8 FINAL RECOMMENDATIONS EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

4. PRESENTATION OF THE RAW DATA

4.1 DESKTOP RESEARCH – SECTORAL IR SET-UP

The objective of the desktop research was to identify Incident Response (IR) actors and bodies playing a role in NISD sectors across EU Member States.

This comprehensive analysis also focused on the distribution of responsibilities to present draft hypotheses on the emergence of new actors following the publication of the NIS Directive.

4.1.1 Data structuring and classification criteria

The raw data gathered during the study was consolidated in an Excel table. It was first classified based on the 28 Member States.

Then, for each Member State, the following information was provided, when available:

 Summary of national approach towards IR in the NISD sectors  Incident Response general Set-up  NISD Sectors  Competent authorities;  Existing/newly created CSIRT or IR entities;  Role of OES;  Role of DSP.  Cooperation set-up & processes  IR processes and procedures (IR and reporting);  Collaboration procedures with NISD sectors;  Cross-border IR aspects.  Development of capabilities and other initiatives  Operational Preparedness and capacities;  Tools;  Initiatives, communities, etc.

4.1.2 Overview of the Sectoral IR Set-up within the 28 Member States

4.1.2.1 Desktop research – Key Figures

Table 14: Desktop research – Data Collection overview

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT from 17 EU MS and Norway. 4.2 SURVEY AND INTERVIEWS – IR APPROACH AND SECTORAL CAPABILITIES

The objective of the survey and complementary interviews were to fill in the information gaps in the desktop research and gain deeper insight on IR set-up within the 28 Member States.

These activities also focused on the recent changes and evolution of Sectoral IRC and improve the knowledge on Sectoral CSIRTs processes, procedures and tools following the publication of the NIS Directive.

4.2.1 Survey - Data structuring and classification criteria

The raw data gathered from the survey was consolidated in an Excel table. It was first classified based on the 28 Member States.

Then, for each Member State, the table was structured around the answers of each respondent according to the questions of the survey. Overview of the Sectoral IR Set-up within the 28 EU Member States

4.2.1.1 Survey - Key Figures

The data collection relies on 24 responses from 17 EU Member States, and Norway. It also includes insights from another Member States who did not reply to the survey.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 11: Respondents by countries 5 4 3 2 1 0

Two-thirds of respondents were national CSIRTs with IR teams of full-time equivalents ranging

from 4 to 90 people.

Figure 12: Respondents by entity

25% 75% National CSIRT Sectoral CSIRT 4.2.2 Complementary Interviews – Rationale and key figures

The main objective of the survey was to collect main information of the IR set-up, along with quantitative assessment of recent changes and impact of the NISD. After reviewing the first results collected, complementary interviews were schedules with two different rationales:  Interviews with 2 national CSIRT and 1 sectoral CSIRTs who had already answered the survey to clarify some answers or collect additional and more qualitative inputs;  Interviews with other 1 sectoral CSIRTs to obtain deeper insight from the NISD sectors;  Interviews with 4 ENISA NIS Informal Experts Group to obtain deeper insight from their sectors.

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Figure 13: Interviewees by organisation National CSIRT representative Sectoral CSIRT representative IEG experts

25% 50% 25% EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

5. BIBLIOGRAPHY

Bouveret, A., Cyber Risk for the Financial Sector, International Monetary Fund, 2018 ECSO, Position paper European Sector-Specific ISACs, European Cyber Security Organisation, December 2018 ENISA, Maturity Evaluation Methodology for CSIRTs, European Union Agency for Network and Information Security, 2019 ENISA, Strategies for Incident Response and Cyber Crisis Cooperation, European Union Agency for Network and Information Security, 2016 Loughlin, J., Centralization and Decentralization in French History, Subnational Government, 2007, pp. 25-44 NCSC, Guide to Starting a Collective CSIRT, National Cyber Security Centre, 2018

WEBSITES AND ONLINE PUBLICATIONS:

ANSSI, “The French CIIP Framework”, 2019. [Online]. Available: https://www.ssi.gouv.fr/en/cybersecurity-in-france/ciip-in-france/ Bank of Finland, Bulletin “Nordic banks go digital”, 2018. [Online]. Available: https://www.bofbulletin.fi/en/2018/2/nordic-banks-go-digital/ CERT-BE, “Report an incident”, 2019. [Online]. Available: https://www.cert.be/en/report-incident CERT-BE, “Traffic Light Protocol (TLP)”, 2019. [Online]. Available: https://www.cert.be/en/traffic-light-protocol-tlp CIRCL, “Training and Technical Courses”, 2018. [Online]. Available: https://www.circl.lu/services/training/ CNCS, “CERT.PT”, 2019. [Online]. Available: https://www.cncs.gov.pt/en/certpt_en/ CSIRT-DSP, “Duty to report incidents for digital service providers”, 2019. [Online]. Available: https://csirtdsp.nl/en/node/1 ECS, Position Paper “European Sector-Specific ISACs”, 2018. [Online]. Available: https://ecs-org.eu/documents/publications/5c0a6a3aac673.pdf European Central Bank, “What is TIBER-EU?”, 2019. [Online]. Available: https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html European Central Bank, “What is cyber resilience?”, 2019. [Online]. Available: https://www.ecb.europa.eu/paym/cyber-resilience/html/index.en.html ENISA, “History”, 2019. [Online]. Available: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/baseline-capabilities

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

EUR-Lex, “The Directive on security of network and information systems (NIS Directive)”, 2016. [Online]. Available: https://eur-lex.europa.eu/legalcontent/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

FIRST, “FIRST CSIRT Framework V0.2”, 2019. [Online]. Available: https://www.first.org/education/csirt_services_framework_v2.0

GitHub, “CERT Tools”, 2019. [Online]. Available: https://github.com/certtools/

GitHub, “Digital Forensics and Incident Response (DFIR) Resources”, 2019. [Online]. Available: https://github.com/The-Art-of-Hacking/h4cker/tree/master/dfir

GPPi, New America, “National CSIRTs and Their Role in Computer Security Incident Response”, 2015. [Online]. Available: http://www.digitaldebates.org/fileadmin/media/cyber/National_CSIRTs_and_Their_Role_in_Computer_Security_Incide nt_Response__November_2015_--_Morgus__Skierka__Hohmann__Maurer.pdf

Industrial Cybersecurity Center, “The center”, 2019. [Online]. Available: https://www.cci-es.org/en/mision

ITU/BDT, “Cyber Security Programme: Global Cybersecurity Index (GCI)”, 2018. [Online]. Available: https://www.itu.int/en/ITUD/Cybersecurity/Documents/GCIv3_documents/GCI%20V3%20Refere nce%20model.pdf

JDSUPRA, “Germany’s Draft Bill on IT Security 2.0 – Extended BSI Authorities, Stricter Penalties and New Obligations on Providers”, 2019. [Online]. Available: https://www.jdsupra.com/legalnews/germany-s-draft-bill-on-it-security-2-0-55094/

MISP Threat Sharing, “Features of MISP, the open source threat sharing platform”, Date? [Online]. Available: https://www.misp-project.org/features.html

NCSC, “CiSP”. [Online]. Available: https://www.ncsc.gov.uk/section/keep-up-to-date/cisp

NCSC, “CSIRT Maturity Toolkit”, 2018. [Online]. Available: https://english.ncsc.nl/get-to-work/cooperation/i-would-like-to-strengthen-my-collaboration/csirt-maturity-toolkit

Nordea, “Nordic banks collaborate on fighting cybercrime”, 2017. [Online]. Available: https://www.nordea.com/en/press-and-news/news-and-press-releases/press-releases/2017/04- 10-08h00-nordic-banks-collaborate-on-fighting-cybercrime.html

OECD, “The Netherland’s experience with decentralisation”. [Online]. Available: https://www.oecd.org/regional/regional-policy/Netherlands-experience.pdf

Open CSIRT Foundation, “SIM3 and references “. [Online]. Available: https://opencsirt.org

SGDSN, “La sécurité des activités d’importance vitale”, 2016. [Online]. Available: http://www.sgdsn.gouv.fr/uploads/2016/10/plaquette-saiv.pdf

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

Z-CERT, Expertise center for Cybersecurity in Healthcare “Home”, 2019. [Online]. Available: https://www.z-cert.nl/en Z-CERT, Expertise center for Cybersecurity in Healthcare “News”, 2019. [Online]. Available: https://www.z-cert.nl/nieuws

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

A ANNEXES:

A.1 ANNEX 1 – LIST OF CRITERIA

 Summary of national approaches towards IR in the NISD sectors  Incident Response general set-up o NISD sectors: o Competent authorities; o Existing/newly created CSIRT or IR entities; o Role of OES; o Role of DSP.  Cooperation set-up & processes o IR processes and procedures (IR and reporting); o Collaboration procedures within NISD sectors; o Cross-border IR aspects.  Development of capabilities and other initiatives  Operational preparedness and capacities;  Tools;  Initiatives, communities, etc.

A.2 ANNEX 2 – LIST OF FIGURES

 Figure 1: NIS Sectors (Source ENISA)  Figure 2: Overview of the methodology  Figure 3: Entity in charge of Incident Response by Sector  Figure 4: Main features of the changes following the NIS Directive  Figure 5: Evaluation of the changes on the CISRT/IR layout and operational set-up  Figure 6: Assessment of the challenges faced during the implementation of the NISD  Figure 7: Key drivers to create sectoral IRC  Figure 8: Main groups use to exchange with peer  Figure 9: Assessment of the nature of specific measures to inform relevant actors in neighbouring countries about a cross-border incident  Figure 10: Sector-specific training evaluation  Figure 11: Respondents by countries  Figure 12: Respondents by entity  Figure 13: Interviewees by organisation

A.3 ANNEX 3 – LIST OF TABLES

 Table 1: Case study - Sectoral IR layout and set-up: France vs The Netherlands  Table 2: Case Study Sectoral IR layout and set-up: Portugal  Table 3: Case-study: Maritime transport OES definition & threshold (United Kingdom)  Table 4: Extended scope of sectors and OES  Table 5: Case Study NordicFin  Table 6: FIRST’CSIRT Services Framework  Table 7: Case study: CERT-BE, Belgium  Table 8: Case study: DSP-CSIRT, The Netherlands  Table 9: Case study: TIBER-EU - threat intelligence-based ethical red-teaming framework  Table 10: Information exchange initiatives at national level within sectors  Table 11: Information exchange initiatives at national level cross-sectors  Table 12: Information exchange initiatives at European level

EU MS INCIDENT RESPONSE DEVELOPMENT STATUS REPORT

 Table 13: Case study: Good practices for training  Table 14: Desktop research – Data Collection overview

-0 -310 4 0 2 -9 -92 978

ABOUT ENIS A

The European Union Agency for Cybersecurity (ENISA) has been working to make Europe cyber secure since 2004. ENISA works with the EU, its member states, the private sector and Europe’s citizens to develop advice and recommendations on good practice in information security. It assists EU member states in implementing relevant EU legislation and works to improve the resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing expertise in EU member states by supporting the development of cross-border communities committed to improving network and information security throughout the EU. Since 2019, it has been drawing up cybersecurity certification schemes. More information about ENISA and its work can be found at www.enisa.europa.eu.

ISBN 978-92-9204-310-0 DOI: 10.2824/74233