CISO

Enterprise Information Security

Network Information Security in Education.ENISA report

by Leave a Comment

ENISA has published a report on Network Information Security in Education. The report provides young digital citizens and stakeholders with an overview and highlights of good practices on how to become educated to feel and behave safer online.

Long life learning, formal, non-formal and informal education are on the agenda of policymakers. Children, youth and their peers, parents and educators are all part of the discussion and the recommendation is that they should cooperate and get involved as much as possible. The material available here is to enable easy transfer of knowledge between stakeholders.

The information in this consolidated report helps all stakeholders to be better informed, better educated and better involved in the area of Network and Information Security [NIS].

Protecting Industrial Control Systems

by Leave a Comment

ENISA, the EU’s ‘cyber security agency, has recently issued the results of a study on Industrial Control Systems (ICS) security. The report describes the current situation on ICS security and proposes seven recommendations for improving it.

Industrial Control Systems (ICS) are command and control networks and systems designed to support industrial processes. These systems are used for monitoring and controlling a variety of processes and operation, such as gas and electricity distribution, water, oil refining and railway transportation.

In the last decade, these systems have faced a notable number of incidents. These include the "Stuxnet" attack, which is believed to have used bespoke malware to target nuclear control systems in Iran, and the recent DuQu-‘upgraded variant’ of this malware. These incidents caused great security concerns among ICS users.

In 2011, ENISA has worked on the main concerns regarding ICS security, and national, pan European and international initiatives on ICS security. The stakeholders involved include ICS security tools and services providers, ICS software/hardware manufacturers, infrastructure operators, public bodies, standardisation bodies, academia and R&D.

This final report proposes seven practical, useful recommendations to public and private sector ICS-actors, as to improve current initiatives and enhance co-operation. The recommendations call for the creation of national and pan-European ICS security strategies, a Good Practice Guide on ICS security, research activities, the establishment of a common test bed and ICS-computer emergency response capabilities.

"Real security for Industrial Control Systems can be only achieved with a common effort, characterised by cooperation, knowledge exchange and mutual understanding of all  involved stakeholders," says Rafal Leszczyna, editor of the report.

Professor Udo Helmbrecht, Executive Director of ENISA added;

"Stuxnet brought the problem of security of industrial control systems to prominence. Our study clearly shows that there is still a lot to be done in this area by all relevant stakeholders. We hope that our seven recommendations will lead to significant improvement."

Read the full report here

First EU-report on Maritime Cyber Security

by Leave a Comment

ENISA has published the first EU report ever on cyber security challenges in the Maritime Sector. This principal analysis highlights essential key insights, as well as existing initiatives, as a baseline for cyber security. Finally, high-level recommendations are given for addressing these risks.

Cyber threats are a growing menace, spreading to all industry sectors that are relying on ICT systems. Recent deliberate disruptions of critical automation systems, such as Stuxnet, prove that cyber-attacks have a significant impact on critical infrastructures. Disruption of these ICT capabilities may have disastrous consequences for the EU Member States. governments and social wellbeing. The need to ensure ICT robustness against cyber-attacks is thus a key challenge at national and pan-European level.

Some key findings of the report;

  • Maritime cyber security awareness is currently low, to non-existent. Member States are thus highly recommended to undertake targeted maritime sector awareness raising campaigns and cyber security training of shipping companies, port authorities, national cyber security offices, etc.
  • Due to the high ICT complexity, it is major challenge to ensure adequate maritime cyber security. A common strategy and development of good practices for the technology development and implementation of ICT systems would therefore ensure .security by design. for all critical maritime ICT components.
  • As current maritime regulations and policies consider only physical aspects of security and safety, policy makers should add cyber security aspects to them.
  • We strongly recommend a holistic, risk-based approach; assessment of maritime specific cyber risks, as well as identification of all critical assets within this sector.
  • As maritime governance is fragmented between different levels (i.e. international, European, national), the International Maritime Organisation together with the EU Commission and the Member States should align international and EU policies in this sector.
  • Better information exchange and statistics on cyber security can help insurers to improve their actuarial models, reduce own risks, and thus offering better contractual insurance conditions for the maritime sector. Information exchange platforms, such as CPNI.NL, should be also considered and by Member States to better communications.