ENISA quarterly review. Vol. 5, No. 4, December 2009.
Date: 2010-01-22
Institutions: European Union Agency for Cybersecurity
Subjects: European Union Agency for Cybersecurity, data protection, information network, serial publication, transmission network

ENISA EQ Dec 2009  22/12/09  15:01  Page 1

ENISA Quarterly Review

Resilience,
 Incident Reporting
and Exercises
Awareness Raising and
     Security Status
Interoperability
and Protection

ISMS

Vol. 5, No. 4, December 2009

I N   T H I S   E D I T I O N

A Letter from the Executive Director

A Word from the Editor

Resilience, Incident Reporting and
Exerccises
Measuring Resilience – the Next
Challenge

ENISA’s Good Practice Guide on
National Incident Reporting Schemes

Good Practice Guide on National
Exercises

The ENISA Virtual Working Group

Awareness Raising and Security
Status
OSI: A Security Helpdesk for Internet
Users in Spain

Awareness Raising in Japan

Information Security Threats and
Countermeasures in Korea

Interoperability and Protection
Cloud Computing

Electronic Signature Interoperability

ISMS
Standardised Management and
Control of Information Security –
Austria

Risk Analysis in an Italian Public
Body: ISPESL

2

3

4

4

6

8

10

12

12

14

16

18
18

19

21
21

23

ISSN1830-3609

ENISA EQ Dec 2009  22/12/09  15:01  Page 2

A LETTER FROM THE EXECUTIVE DIRECTOR
A Vision for ENISA 

2

Udo Helmbrecht

Europe. My vision is of the Agency working
with the active trust of the Member States.
In  this  way,  we  can  promote  co-operation
between  governments,  industry  and  non-
governmental organisations (NGOs), to the
benefit  of  all  citizens.  We  will  therefore
engage in dialogue, listening and carefully
considering  our  stakeholders’  views  so
that  we  can  translate  them  into  action  in
our  work.  And  we  will  analyse  current
technological,  economic  and  societal
developments.  Only  in  this  way  can  we
respond adequately to current threats.

It  is  my  firm  opinion  that  all  Member
States  should  develop  a  clear  cyber-
security  strategy.  There  should  be  well
defined  roles  and  responsibilities  for  the
organisations 
In  addition,
involved. 
European  policies  must  complement
national  efforts.  Clear  direction  and  an
overall European strategy for the next five
to ten years is needed.

its  Work  Programme  on
As  part  of 
resilience,  the  Agency  has  analysed  the
Member States’ efforts to address security
and the resilience of public communication
networks.  Different  Member  States  have
reached varying degrees of understanding,
maturity and preparedness. There are still
countries  in  Europe  that  do  not  have  a
Governmental 
(Computer
Emergency Response Team). 

CERT 

Moreover,  public  and  private  institutions
should  co-operate  better  on  sensitive
issues. There is, unfortunately, not enough
trust  between  them  today.  This  reduces
their ability to understand problems and to
respond  accordingly.  ENISA  is  ready  to
continue  its  work  in  assisting  any  country
with its expertise in setting up a CERT.

In  the  final  analysis,  security  is  about  the
economy of a modern society. Businesses,
governments  and  citizens  will  only  go
online if they are confident that electronic
services  are  correctly  secured.  Therefore
trust – in particular in the Internet – is key
to  success.  The  privacy  and  security  of
digital identities are of crucial importance.

Despite  our  good  work,  new  challenges
will  certainly  arise,  beyond  our  present
mandate. The Agency’s term of office must
therefore  be  made  permanent,  beyond
2012. We have a lot of work in front of us!

Yours sincerely
Udo Helmbrecht
Executive Director, ENISA

Anyone  who  has  taken  up  a  new  job
recognises  the  feeling:  many  challenges
and new procedures to learn. At the same
time,  you  have  to  keep  the  overall
objective, the visions and goals in mind. As
the  new  Executive  Director  since  mid-
October, I have had the privilege of starting
to learn the Agency’s operations, and to get
to know its staff and many of its partners.
It  has  been  a  truly  inspiring  journey  to
comprehend  where  we  are,  what  we  do
today  and  what  we  could  do  better
tomorrow.  How  can  we  optimise  our
resources and activities? This exercise has
been  an  important  step  for  the  Agency  to
take, and it is the right time for it to rethink
and revitalise itself. As with any private or
public body, this kind of exercise should be
undertaken  at  regular  intervals  as  part  of
its normal development.

But not only is the Agency evolving. At the
same  time,  our  policy  context  and  the
political agenda are also rapidly changing.
On  3  September,  EU  President  Barroso
announced  his  policy  priorities  for  the
European  Commission.  For  the  ‘networks

of the future’, Barroso declared the need to
“develop  a  European  Digital  Agenda
(accompanied  by  a  targeted  legislative
programme)  to  tackle  the  main  obstacles
to a genuine digital single market, promote
investment  in  high-speed  Internet  and
avert an unacceptable digital divide”. Since
then,  Barroso  has  also  nominated  his
Digital Agenda Commissioner, Mrs. Neelie
Kroes,  subject  to  her  approval  by  the
European  Parliament  in  January  2010.  As
its  contribution  to  the  discussion,  ENISA
presented  its  work  at  the  Swedish  EU
Presidency  Resilience  conference 
in
Stockholm.  The 
‘Visby
Agenda’  for  an  eUnion  2015  and  the
conclusions  of  the  Malmö  eGovernment
conference  all  point  towards  the  digital
future. 
policy
discussions are shaping a new ICT agenda
for the EU. 

far-reaching 

path-finding 

These 

Clearly  security  is  heating  up  on  the
political  agenda.  ENISA  will  use  this
momentum  to  reinforce  its  role  as  a
‘pacemaker’ 
NIS
stakeholders,  to  increase  IT-security  in

amongst 

all 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 3

A WORD FROM THE EDITOR

3

Panagiotis Trimintzios

recommend  you  take  a  look  at.  Finally  in
the  resilience  topic,  we  have  an  article
which  reports  the  output  of  the  ENISA
Virtual  Expert  Group  on  Network
Providers’  Resilience  Measures  that  was
established during 2009.

Under  the  heading  of  awareness  raising,
end-user  support  and  security  status  in
different  countries  we  have  three  articles.
The  first,  by  Victor  M.  Izquierdo  Loyola,
comes  from  Spain  and  describes  the
security  helpdesk  for 
Internet  users
established  by  the  Spanish  NIS  Agency,
the
INTECO.  The  second  presents 
awareness 
the
of 
raising 
Information-technology Promotion Agency
(IPA)  in  Japan.  The  third  and  final  one
sums  up  the  information  security  threats
and  countermeasures  being  adopted  in
Korea,  as  seen  by  the  Korean  Internet  &
Security Agency (KISA). 

efforts 

Our  own  experts,  Giles  Hogben  and
Danielle Catteddu, present the results of a
study  of  the  privacy  and  security  issues
that  underlie  the  much  hyped  technology
of  Cloud  Computing,  which  seems  to  be
gaining  more  and  more  momentum  every
day.  Vincent  Tilman  and  Alfredo  Esposito
wonder where we stand in Europe when it
comes to the interoperability of electronic
signatures, a topic which is very important
for the eMarket and eBusiness. 

public  bodies.  The  first,  co-authored  by
Leopold  Koppensteiner  and  Markus
Kloibhofer, presents a case study of ISMS
development 
in  the  Austrian  Federal
Ministry  of  Finance,  while  the  second, 
co-authored by Francesco Merlo, Salvatore
D’Emilio  and  Francesco  Gaudieri,  talks
about the application of risk analysis in an
Italian public body, ISPESL. 

I have been editor-in-chief of EQR for three
and a half years now. Over the years I have
tried  constantly  to  improve  this  ENISA
publication,  to  serve  NIS  stakeholders  in
Europe and beyond. I have sought to make
EQR a useful source of information, and at
the same time provide a platform on which
stakeholders can make their activities and
important  results  widely  known.  To  what
extent  this  target  has  been  achieved
cannot be proved, but the positive feedback
from reports and individuals reassures me
that my efforts have been worthwhile. It is
time  now  for  me  to  move  on  to  other
projects.  Thank  you  for  your  support  over
the  years.  I  am  sure  you  will  support  the
new  editor-in-chief  as  enthusiastically  as
you  have  me,  that  EQR  will  develop  still
further and that its quality will reach even
higher levels in the future. 

Finally, I would like to wish all of you all the
best for 2010!

The  edition  closes  with  two  articles  on
Information 
Security  Management
Systems  (ISMS)  and  their  applicability  in

Dr.  Panagiotis  Trimintzios  is  an  Expert  at
ENISA  responsible  for  Relations  with
Stakeholders.

Yet another year is coming to an end. It was
a  very  successful  year  for  ENISA  and  for
EQR in particular. We managed to increase
considerably the number of submissions to
the  magazine  and  therefore  the  quality  of
the  selected  articles,  and  the  EQR  pages
are  among  the  top  hits  on  the  ENISA
In  2009  we  covered  many
website. 
important  areas  in  NIS,  including  the
Resilience  of  Communication  Networks,
Information  Sharing,  Business  Risks,
Privacy, Wireless Security, CIIP, Emerging
and Future Risks, Skills and Certifications,
Awareness  and  End-User  Issues,  and
Technologies.  Next  year,  I  am  sure,  will
continue  with  the  same  high  standards
that we have set in 2009.

The last edition of EQR for 2009 opens with
a  number  of  articles  in  the  area  of
resilience,  a  topic  that  has  attracted
considerable  attention 
from  Member
States,  partly  due  to  the  EU  Commission
communication  on  CIIP 
this  spring
(http://ec.europa.eu/information_society/p
olicy/nis/strategy/activities/ciip/index_en.h
tm).  Paul  Therón  presents  the  challenges
which  lie  behind  measuring  resilience,
highlighting  the  importance  of  metrics.
ENISA  plans  to  study  this  topic  and  to
make  suggestions  during  2010.  Next  we
have  a  summary  of  the  two  good  practice
guides that were recently published by our
own experts. One is in the area of running
preparedness
national 
exercises; 
incident
reporting  schemes.  They  are  both
extremely  useful  guides  which  I  certainly

resilience 
the  other 

is  on 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 4

RESILIENCE, INCIDENT REPORTING AND EXERCISES
Measuring Resilience – the Next Challenge

4

Paul Théron

1. Resilience  is  a  threefold  aptitude
including the ability firstly to ‘get by’,
while  secondly  resisting  destruction
until, thirdly, it becomes possible to
resume nominal operations

2. Resilience  is  achieved  because  the
organisation  has  developed  ad  hoc 
capabilities

3. Target  resilience  levels  can  be

specified.

1.  Resilience  is  a  threefold  aptitude
including  the  ability  firstly  to  ‘get  by’,
while  secondly  resisting  destruction
until,  thirdly,  it  becomes  possible  to
resume  nominal  operations –  Since  the
’60s, both literature and actual experience
of  catastrophes  have  emphasised  that
being  resilient  means  to  perform  as  well
as  possible  under  extreme  adversity,  not
just  surviving  minor  blows  that  can  be
dealt  with  swiftly  by  activating  incident
response  procedures.  The  organisation
has  to  be  destabilised,  taken  aback  by  a
course  of  events  that  overwhelm  it,  and
even crush it to such an extent that it may
foresee  its  own  destruction.  The  studies  I
have  performed  over  the  past  years  show
that,  in  order  to  get  by,  i.e.,  to  manage  to
deliver  despite  exceptional  adversity,  an
organisation  must  resist  the  destructive
power  of  circumstances.  Measuring  how
low an organisation falls in times of crisis
is  the  first  measure  of  resilience  that
interests  professionals.  It  gives  an  idea  of
how resistant the organisation was (which
is just one component of resiliency). But it
is  also  good  to  monitor  the  ‘level  of
collapse’  an  organisation  undergoes  as
response  plans  may  differ  at  each  level
(see diagram below).

has 

ENISA 

is  defined  as 

Resilience has been a long-standing issue.
It 
the  aptitude  of
organisations to maintain or resume their
normal functioning under or despite major
disruptions. 
launched
numerous  studies  of  resilience  in  the
telecommunication sector. Now has come
the  time  to  provide  a  framework  to
measure  resilience  by  setting  clearer
targets  against  which  results  can  be
evaluated.  But  how  to  define  such  a
framework remains an issue that requires
the notion of resilience to be clarified. This
article  provides  food  for  thought  in  that
area… 
three
propositions:

is  centred  around 

It 

The Collapse Ladder

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

Let us say, as a convention that, as long as
the  organisation  controls  the  course  of
events,  through  its  business  continuity
plans  for  instance,  its  ‘level  of  collapse’
(the  opposite  of  resistance)  is  0.  Should  it
lose  control  of  the  course  of  events
because  it  is  surprised  (e.g.,  by  some
unexpected  combination  of  events),  the
‘navigate’  through
organisation  must 
circumstances  in  order  to  keep  acting  on
its  missions  and  to  resist  destruction.  Its
level of collapse would be measured as 1.
If it is overwhelmed by circumstances and
loses  its  grip  on  its  course  of  action,  the
organisation, whose vital functions are still
intact  but  whose  margins  of  manoeuvre
are  reduced  to  virtually  nothing,  can  only
place itself in a position of survival and wait
for  the  storm  to  pass.  Its  collapse  level
would  then  be  2.  But  then,  if  survival
becomes  difficult  and  the  organisation
loses its vital functions and can no longer
act,  like  a  body  whose  breath  or  blood
circulation falls to a dangerous minimum,
it  has  to  be  rescued  from  the  outside.  Its
level  of  collapse  reaches  3.  Fate  can,  at
that point, be totally adverse. Rescue may
itself  fail.  The  organisation  is  swept  away
and  is  destroyed.  Collapse  is  total,  at
level 4.

That  Crisis  Intensity  Scale,  or  ‘Resistance
Scale’,  sheds  much  light  on  how  to
respond to circumstances. For instance, in
a  power  company,  if  a  15kV  line  or  a
transformer  breaks  down,  contingency
plans  exist  to  reroute  the  electricity  and
the  organisation  retains  control  of  the
situation. It has not collapsed. Therefore it
gets  a  0  mark,  meaning  maximum
resistance.  Should  its  400kV  lines  break,
then  the  whole  grid  might  stop,  and
collapse would be deemed maximum, say
level 4. 

first  measure  of  resilience  could
A 
therefore  be  based  upon  the  Resistance
Scale.  The  actual 
level  of  collapse,
measured  in  real  time,  would  act  as  a
situation  awareness  indicator,  directing
the  organisation  in  the  way  it  should
respond to circumstances.

2.  Resilience  is  achieved  because  the
organisation  has  developed  ad  hoc
capabilities –  All  studies  undertaken  on
this  subject  have  demonstrated  that,  in
times  of  crisis,  when  organisations  or
communities  are  surprised  by  the  course
of  events,  those  which  collapse  are  the

>>

ENISA EQ Dec 2009  22/12/09  15:01  Page 5

RESILIENCE, INCIDENT REPORTING AND EXERCISES

5

ones  which  significantly  lack  resilience
capabilities  whereas  those  which  resist
better and get by display such capabilities.
Take  Hurricane  Katrina,  for  instance.
Rescuers  saw 
their  communication
capacities  vanish  after  only  a  short  while.
Among  other  factors,  that  was  because,
having  thought  that  they  would  have  to
deal  only  with  disasters  and  not  with
catastrophes,  they  had  not  taken  spare
batteries. That little margin of manoeuvre
could have made a significant difference to
their  resilience.  On  the  other  hand,  they
reinvented their working methods and did
not  do  so  badly.  Imagine  if  they  had  also
lacked that creativity…

So  a  second  measure  of 
(potential)
resilience  is  that  of  resilience  capabilities
built  up  in  peace  times  which  are  most
needed  as  an  organisation  descends  the
Collapse Ladder.

indicator 

In  the  same  way  that  the  USA  have
of
an 
implemented 
telecommunication infrastructures at each
level  of  government,  or  that  logistics
companies build agility into their genes, it
is  possible  to  measure  the  level  of
resilience capabilities achieved on each of
the thirty axes I have found to be active in
the provision of resilience.

Resilience targets

• to reduce the duration of interruptions

and 

• to  maximise  the  level  of  (degraded) 
an
a  major

reached 
suffering 

by 

performance 
organisation 
disruption. 

Though  that  picture  seems  promising,  its
logic could be pushed further (see diagram
above).

Performance targets for an organisation’s
resilience could be defined as follows:

• T1:  the  level  of  collapse,  expressed  in 
terms of minimum level of production/
coverage under which the organisation
should not fall

• T2:  the  maximum  time  during  which 
the  organisation  should  endure  a  T1 
level

• T3: the maximum time to return to an
acceptable 
of 
(degraded) 
production/coverage  starting  from  the
T1 level

level 

• T4: 

the  minimum 
(degraded) 
level 
coverage that should be restored

acceptable 
of  production/

• T5:  the  maximum  time  in  which  the
nominal  level  of  production/coverage
should be restored.

T1  would  allow  for  comparisons  between
resilience requirements and achievements
while T2 to T5 targets would help to specify
the 
the
level  of  responsiveness  of 
organisation.

Engaging in work in the area of resilience
important
metrics  could  provide  an 
contribution 
the
to 
telecommunication  sector  but  also  to
Governments and the economy at large. It
is only a matter of time and workshops…

only 

not 

Paul Théron (paul.theron@thalesgroup.com)
is  an  expert  on  Resilience  Engineering  at
Thales.

The Resilience Capabilities Indicator

This  is  what  I  have  called  a  ‘Resilience
Capabilities  Indicator’.  How  much  you  are
prepared  for  the  worst  can  be  assessed
against  both  your  actual  performance  in
times of crisis and your goals.

3.  Target  resilience 
levels  can  be
specified – Goals are the last, though not
the  least,  set  of  variables  that  should  be
measured.  But  how  can  we  define  the
resilience
quantitative  objectives  of 
applicable to times of crisis?

The  ISO  PAS  22399  standard  has,  for  the
first time in normative history, stated that
preparedness  should  serve  the  following
objectives:

1st European Workshop on Internet Early Warning
and Network Intelligence (EWNI 2010)

The goal of this workshop is twofold: to evaluate the current state of the art in Early
Warning Systems and to explore both related and future research areas. EWNI 2010 will
take place on 27 January 2010 in Hamburg, Germany.

Organised by PRESENSE Technologies GmbH and supported by ENISA, EWNI 2010 will
focus on European activities but welcomes contributions and participants from all over
the world. It is held in co-operation with the SIG SIDAR of the German Informatics
Society and collocated with the joint FIRST/TF-CSIRT event.

More information: www.pre-sense.de/ewni2010.html

www.gi-fg-sidar.de/

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 6

RESILIENCE, INCIDENT REPORTING AND EXERCISES
ENISA’s Good Practice Guide on National Incident Reporting Schemes
Evangelos Ouzounis, Konstantinos Moulinos, Panagiotis Saragiotis and Ingo Naumann

6

A  guide  was  prepared  by  surveying  and
interviewing  stakeholders  from  public
authorities,  network  operators  and  IT
industry  players  about  their  experiences,
expertise  and 
for
in  planning  and
effective  practices 
implementing 
reporting
procedures.

recommendations 

incident 

In  recent  years,  the  use  of  public
eCommunications networks has expanded
rapidly to encompass a far wider range of
services and applications. These networks
have  become  critical  infrastructure  for
public
Europe’s  Member 
institutions, societies and economies. 

States, 

Due  to  the  rapid  pace  of  development,
regulations, 
frameworks,
legal 
technologies  and  network  architectures
are  not  always  designed  to  withstand  all
threats 
Continued
transformation  constantly  opens  up  new
challenges for those aiming to secure the
networks  and  ensure  their  resilience
against all threats.

incidents. 

and 

such 

about 

Incident reporting processes play a pivotal
role  in  these  efforts.  Effective  reporting
procedures can ensure that all those who
need to know about an incident learn about
it  quickly.  They  can  also  enable  a
co-ordinated  response  and  give  those
responding  access  to  a  wide  pool  of
expertise 
incidents.
Furthermore,  they  ensure  that  national
authorities  can  follow  up  with  network
operators  in  a  regulatory  capacity,  if
necessary.  Finally, 
the
collection of a tremendous amount of data
about 
threats  and  prior
experiences to be used for the analysis of
threats  and  the  identification  of  good
practices in responding to specific kinds of
incident.

they  enable 

incidents, 

the 

The policy context
The European Council and the Parliament
have  recognised 
importance  of
network  and  information  security.  In  its
Communication  on  Critical  Information
(“Protecting
Infrastructure  Protection 
Europe  from  Large  Scale  Cyber-Attacks
and Disruptions: Enhancing Preparedness,
Security and Resilience” (COM (2009) 149),
the  European  Commission 
(EC)  has
for
directed  attention 
prevention,  preparedness  and  awareness
to combat the growing threats to both the
economy and society. It has defined a plan
of  immediate  action  to  strengthen  the
security  and 
resilience  of  Critical
Information Infrastructures (CII)s.

the  need 

to 

When  discussing  the  weaknesses  that
were 
improvement,  the
identified  for 
following comment was made:
“… processes and practices for monitoring
and reporting network security incidents
differ significantly across Member States.
Some do not have a reference organisation
as a monitoring point. More importantly,
cooperation  and  information  sharing
between Member States of reliable and
actionable  data  on  security  incidents
appears  underdeveloped,  being  either
informal or limited to bilateral or limitedly
multilateral exchanges.”

field 

in 
is 

evolution 

the
recent 
A 
telecommunication 
the
telecommunication package reform which
was announced on 5 November 2009. (The
full  text  of  the  proposed  changes  is
available  at:  http://register.consilium.
europa.eu/pdf/en/09/st03/st03674.en09.pdf.)
One  of  the  key  elements  of  the  reformed
package  is  the  obligation  imposed  on
communications  providers  to  inform  the
authorities  and  their  customers  about
security  breaches  affecting  their  personal
data.  In  practical  terms,  this  means  that
each  Member  State  should  launch  and
maintain  a  national  incident  reporting
scheme.

2008, 

report, 

available 

To  reflect  these  changes,  the  findings
of  its  stocktaking  activities  (‘Stock  Taking
of  Member  States’  Policies 
and
Regulations  related  to  Resilience  of
Public  eCommunications  Networks’,
ENISA 
at
www.enisa.europa.eu/act/res/policies/
sto c k - ta k i n g - o f - n a t i o n a l - p o l i c i e s / )
and  consultations  with  its  constituency,
ENISA  launched  a  new  initiative.  This
initiative 
available
incident
information  on  practices  for 
reporting  procedures,  interviewed  experts
throughout  the  EU  and  beyond,  identified
good  practices  and  shared  these  good
practices  throughout  the  EU  (Minutes  of
the Second Workshop on the Resilience of
communication networks, Brussels, 12-13
November 
at:
www.enisa.europa.eu/act/res/workshops-
1 / 2 0 0 8 / s e c o n d - w o r k s h o p / s e c o n d -
resilience-workshop).

examined 

available 

2008, 

the 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

In parallel with the survey and interviews,
secondary  research  was  conducted  to
identify  incident  reporting  procedures  in
other  regions  of  the  world.  ENISA  also
followed  up  with  some  key  experts  to
discuss verbally some of the exercises and
this
practices 
procedure.

identified 

through 

A  short  overview  of  the  results  of  this
initiative is presented below.

the 

ENISA’s  Good  Practice  Guide  on  Incident
Reporting
The term ‘incident reporting’ is understood
in very different ways among stakeholders
in different countries engaged in efforts to
ensure 
public
communication  networks.  That  is  partly
due  to  varying  legal  frameworks  and
individual  national  cultures  of  public-
private co-operation, but especially due to
the  fact  that  the  schemes  include  varying
purposes,  planning  organisations  and
types of incident addressed.

resilience 

of 

Distinguishing factors:
• Purpose: The  three  main  purposes  of
incident  reporting  are:  a)  emergency
response,  b) 
failure  prevention  and
c) problem rectification. Each of the three
types  is  driven  by  a  distinctive  logic,
understanding  of  which  is  indispensable
for  setting  correct  priorities  when
designing  a  new  scheme.  This  typology
has  a  demonstrative  function,  as  actual
reporting  schemes  may  represent  a
mixture of two or even three objectives.

• Types  of  incidents: The  primary  area  of
reporting  may  be  either  focusing  on  data
security  incidents  or  network  faults  or
both. These two areas are connected, but
they  tend  to  involve  different  reporting
purposes  and  different  constituencies.  As
a  result,  the  specific  arrangements  for
reporting may differ significantly.

• Host  organisation: An  incident  reporting
scheme  may  be  run  and  managed  by:
regulatory  authorities,
a) 
Emergency
b) 
Response  Teams  (CERTs),  c)  Critical
>>

telecoms 
national  Computer 

ENISA EQ Dec 2009  22/12/09  15:01  Page 7

RESILIENCE, INCIDENT REPORTING AND EXERCISES

7

Information Protection (CIP) authorities or
d)  GovCERTs  or  other  CERTs.  This
distinction  comes  into  play  especially
when  the  scheme’s  organisers  consider
expansion  into  new  areas,  as  different
starting  positions  offer  different  growth
opportunities.

Lifecycle model:
Planning  and  implementing  an  incident
reporting  scheme  are  challenging  goals.  To
achieve  success,  it  is  necessary  to  proceed
carefully  and  diligently 
through  many
individual steps, working out a huge amount
of detail in the process, while balancing the
sensitivities  of  various  organisations  and
individuals  that  you  will  have  to  work,
co-ordinate  and  co-operate  with  in  both
establishing  and 
the
scheme.  These  numerous  steps  together
form  the  lifecycle  of  the  incident  reporting
scheme.

then  managing 

The incident reporting scheme’s lifecycle

The  point  of  departure  for  setting  up  an
incident  reporting  scheme  is  to  identify  the
needs  such  a  scheme  should  address.
Identified needs will have a strong impact on
shaping the scheme that you will develop.

When  the  key  parameters  of  an  incident
reporting  scheme  have  been  identified,  the
organisers need to engage the co-operation
of  the  potential  reporting  parties.  The  main
targets  here  are  to  create  trust  in  the
scheme  and  a  certain  level  of  commitment
to its functioning. Trust and commitment are
not  easily  generated.  Engaging  and
maintaining  co-operation  is  a  long-term
process that should not be underestimated.

Having  drawn  the  broad  outline  of  the
reporting scheme and listed the participants
to  be  engaged  in  co-operation,  it  is  time  to
begin  mapping  the  details  of  the  reporting
scheme.  This  step  involves,  for  example,
reporting 
incident
requirements, 
prioritisation,  follow-up  procedures  and
media policies.

Apart  from  these  tasks,  which  are  mostly
located  around  the  launch  of  the  scheme,
the  scheme  needs  attention  while  it  is  in
operation. On the one hand, incidents must
be  monitored  and  evaluated  in  order  to
implement  appropriate  reactions:  network
topology  upgrades,  awareness  raising,
changes  in  data  security  or  emergency
response  policies.  On  the  other  hand,  the
organisers  must  manage  the  evolution  of
their scheme. Then it becomes important to
collect 
scheme’s
functioning  and  to  plan  improvements  or
extensions.

feedback 

the 

on 

Recommendations
Based  on  the  analysis  performed  on  the
collected  material,  the  report  makes  a
number of recommendations:

Identifying the need:
• Before  planning  your  own  reporting
scheme,  identify  the  gaps  in  existing
procedures.

• Avoid unnecessary duplication of effort by
taking advantage of the existing processes,
procedures,  institutions  and  stakeholder
interest 
Information
Infrastructure Protection (CIIP). 

Critical 

in 

• Based  on  the  gaps  identified,  determine
the  types  of  incident  that  your  scheme
will address, and the purpose or purposes
of the scheme. 

• With an understanding of the types of area
of focus and the broad objectives, consider
which stakeholders should report into the
system. 

• Determine  whether  your  scheme  can  or

should be mandatory or voluntary. 

• Consider  the  thresholds  that  you  will  set

for reporting. 

Engaging co-operation:
• Map 

the  existing  arrangements 

for
incident  reporting,  response, 
industry
co-operation and CIIP, and build on them,
if possible.

• Expectations,  possibilities  and  the  value
proposition  of  the  scheme  should  be
formulated 
to
reporting parties clearly.

communicated 

and 

• As  an 

incentive  to  the  participants,
consider  offering  in  particular:  efficient
and fast information distribution; access to
information  unavailable  elsewhere;  the
role of an information broker; assistance in
emergencies;  improved  reaction  to  crisis
situations.

• Demonstrate your scheme’s advantages to
C-level 
also

the 
management 
educating the potential reporting staff.

support,  while 

participants. 

Secure 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

• Work to build trust between the reporting
scheme  managers  and  the  reporting
parties. 

• Balance your reporting requirements with
the  load  they  place  on  reporting  parties’
resources. 

Setting the reporting procedures:
the 
• Determine 

list 

information  based  on 
scheme’s objectives.

of 
reportable
the  reporting

• Standardise the reporting format if a large
number  of  reports  is  expected  or  if 
statistical analyses are planned. 
• Automate for very large volumes. 
• Retain 

low 
informal  procedures 
volumes,  making  reporting  as  easy  and 
flexible as possible. 

for 

• Have  the  initial  report  filed  as  soon  as 

possible; updates can be sent later. 

• Introduce your scheme as the single point
of  contact  for  reporting  incidents  within 
the eCommunications sector. 

• Depending  on  the  objectives  of  the 
scheme, ensure that your scheme and its
managers  can  co-operate  reliably  and
effectively in emergency response. 

• Ensure  effective  information  distribution 

within the scheme.

Managing the reporting scheme:
• Managing  the  reporting  scheme  ensures
not  only  effective  handling  of  the  incident
reports,  but  also  completing  the  desired
ex-post  analysis  and  long-term  evolution
of the scheme.

• Ex-post  analysis  can  include  analysis  of 
individual  incidents,  as  well  as  longer-
term statistical analysis.

• Long-term evolution may lead the scheme
and  its  department  to  play  a  gradually 
increasing role in CIIP procedures.

This only scratches the surface of the steps
required  by  organisers  of  an 
incident
reporting scheme, but it is hoped it will help
organisers to stay on track, remain aware of
the  major  issues  they  need  to  address  at
each  step  and  point  them  towards  more
detailed good practices.

Evangelos  Ouzounis  (Evangelos.Ouzounis@
enisa.europa.eu)  is  a  Senior  Expert  in
Network  Security  Policies  at  ENISA.

(Konstantinos.
Konstantinos  Moulinos 
Panagiotis
Moulinos@enisa.europa.eu), 
(Panagiotis.Saragiotis@enisa
Saragiotis 
.europa.eu) 
Naumann
(Ingo.Naumann@enisa.europa.eu)  are  all
Seconded National Experts at ENISA.

Ingo 

and 

ENISA EQ Dec 2009  22/12/09  15:01  Page 8

RESILIENCE, INCIDENT REPORTING AND EXERCISES
Good Practice Guide on National Exercises
Evangelos Ouzounis, Panagiotis Saragiotis and Konstantinos Moulinos

8

developed  a  good  practices  guide  on
national
planning 
exercises.

conducting 

and 

The  guide  was  prepared  by  surveying  and
interviewing  public  authorities,  network
operators, IT industry players and network
security  experts  about  their  experiences
and 
making
recommendations for effective practices in
planning and executing exercises. 

expertise, 

and 

In parallel with the survey and interviews,
secondary  research  was  conducted  to
identify  exercises  and  practices  in  the
critical information infrastructure sector in
other regions of the world. As a result, the
guide  represents  a  broad  consensus  of  a
wide selection of public and private sector
experts.

The guide aims to support authorities that
do  not  have  significant  experience  in
planning and executing exercises. It helps
authorities  to  identify  and  develop  the
skills  needed  to  select  measures  and
processes  to  be  tested,  to  plan,  execute
and 
on
interdependencies  themselves  and  to  use
the experience gained by the stakeholders
to improve their measures and processes.
Potentially 
these  skills  could  help
authorities to participate in pan-European
exercises in this sector.

exercises 

evaluate 

To  plan  and  conduct  an  exercise
successfully,  it  is  necessary  to  proceed
carefully  and  diligently  through  many
individual  steps.  These  steps  together
form  the  lifecycle  of  an  exercise.  The
authorities  will  have  to  work  out  a  huge
amount  of  detail  in  the  process,  while
balancing  the  sensitivities  of  various
organisations  and  individuals  that  they
would like to commit their time, resources
and  attention.  These  organisations  and
individuals  will  represent  specific  roles  in
the  exercise.  The  lifecycle  of  an  exercise,
together with the roles of the stakeholders
and  their  relations,  are  depicted  in  the
diagram below.

of 

exercises 

Examples 
that  help
authorities  in  the  EU  Member  States  –
and  the  rest  of  the  world  –  to  achieve
their duties are numerous: 
Ireland, 
• In 

telecommunication
authorities recently organised a tabletop
exercise,  focused  on  performance  and
mutual communication between teams,
in  which  several  telecoms  network
operators simulated a physical incident.

• “Waterproef” was a national exercise in
The  Netherlands  that  involved  multiple
ministries,  crisis  response  centres  and
others.  The  scenario  focused  on  the
large-scale  flooding  of  several  parts  of
the country. 

• “ICT 08”, a national Norwegian exercise,
was  conducted  in  December  2008.  The
exercise  covered  several  sectors
including  network  operators,  service
providers,  power  providers,  finance  and
various  kinds  of  customers  vital  to
communities. 

• “Cyber  Storm”,  a  series  of  full-scale
international exercises organised by the
United States Department of Homeland
Security,  tested  the  response  to  and 
recovery 
from  a  cyber-attack  on 
infrastructures.

ENISA’s Good Practice Guide on National
Exercises
Planning and executing a national exercise
effectively is a challenging task. In its effort
to support EU Member State authorities in
enhancing 
the  resilience  of  critical
information  infrastructures,  ENISA  has

Exercises  have  long  been  widely  used  in
various  sectors.  They  are  now  also  widely
deployed  by  many  players 
the
communication
information 
technologies  (ICT)  sector,  particularly  by
telecommunication network operators and
Computer  Security  Incident  Response
Teams (CSIRTs). 

and 

in 

Exercises  are  particularly  useful 
for
training staff on the procedures to follow in
the event of an emergency at some point in
the  future.  They  form  an  integral  part  of
many  organisations’  business  continuity
planning.

by 

and 

disaster 

following 

Exercises  ensure  that  staff  members  are
fully prepared and capable of responding to
existing
incidents 
preparedness  measures  (e.g.,  business
recovery
continuity 
procedures) 
Increasingly
efficiently. 
Member  States  and  businesses  with  an
understanding of infrastructure protection
and  disaster  management  are  viewing
exercises  as  an  essential  means  to
highlight  and  gain  greater  knowledge  of
security and preparedness gaps. 

Benefits of performing an exercise
Authorities  in  the  EU  Member  States
responsible  for  determining  the  level  of
resilience  of  public  communication
networks use exercises to: 
• Observe incident handling in practice
• Increase awareness of interdependencies
various  organisations
among 
responsible  for  public  communications
networks

the 

• Stimulate  co-operation  and  public-
in  an  effort  to
the  resilience  of  public

private  partnership 
increase 
communications networks
that 

they  deem
important,  or  specific  procedures  or
functions  where  they  have  identified  a
need for improvement

• Target  scenarios 

• Track  changes  over  time  (by  repeating

exercises) and 

• Contribute 

at 

the  pan-European

level

Lifecycle of an exercise and
participants’ roles

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

>>

ENISA EQ Dec 2009  22/12/09  15:01  Page 9

RESILIENCE, INCIDENT REPORTING AND EXERCISES

9

Lifecycle Model
The exercises lifecycle can be divided into
four segments:
• Identifying  the  exercise: the  organiser
must  identify  the  need  for  an  exercise.
This  will 
identification  of
procedures  or  measures  that  require
practice  or  improvement  and  which
should  be  exercised.  Based  on  this
need,  organisers  can  then  select  what
type  of  exercise  to  conduct,  and  what
organisations should participate.

include 

• Planning  the  exercise: the  organiser
will  drive  the  planning  process.  This
process  will 
involve  recruiting  the
participants;  developing  the  scenario,
rules,  tools  and  training  materials  for
the  exercise;  selecting  monitors  and
specifying  what  and  how  they  will
monitor;  and  planning  the  evaluation
process.

• Executing  the  exercise: the  exercise
itself  takes  place.  As  specified  in  the
planning  process,  participants  go
through (by discussing or actually acting
out)  the  scenario  and  their  response
procedures  and  decisions.  Monitors
observe  and  note  these  actions,  and
inject information into the scenario.
• Evaluating  the  exercise: Finally,  after
the  exercise  has  been  completed,  the
evaluation  process  takes  place.  This
process 
final
to 
evaluation  report,  or  multiple  reports
tailored  to  different  audiences.  These
reports  review  the  exercise,  identifying
weaknesses 
recommending
improvements.  In  addition,  evaluation
may  include  an  ongoing  process  or
forum  by  which  to  continue  to  address
the  weaknesses  and  recommendations
identified.

include  a 

tends 

and 

is 

The  organiser 

Roles
There are different roles that organisations
and individuals should play in an exercise.
The most important and discrete roles are:
the
• Organiser:
organisation  that  drives  the  process  of
running  the  exercise  and,  typically,
takes  the  lead  in  setting  the  goals  for
the  exercise,  choosing  the  measures
that  need  testing,  establishing  the
planning  team(s),  leading  the  planning
process  and  providing  resources  to
co-ordinate and moderate the execution
of the exercise.

• Planners: Planners  are  organisations
that  participate  in  the  planning  of  the
exercise.

• Participants: A  participant 

is  an
organisation  or  individual  that  will  play
its  role  during  the  execution  of  the
exercise.

• Monitors: Monitors observe the actions
and decisions of the participants during
the exercise, checking the performance
tested  measures,  noting
of 
the 
effectiveness 
weaknesses,
and 
communicating with the moderator and
providing much of the material that will
be required for evaluating the exercise.
• Observer: Observers  are  individuals  or
organisations that are invited to observe
the exercise, without participating.

• Evaluator:

Evaluators  are 

those
individuals  involved  in  the  process  of
evaluating the exercise.

An organisation should provide individuals
in  several  roles,  depending  on 
its
involvement. A specific individual can also
have several roles in the exercise lifecycle,
while the playing of specific roles prohibits
participation  in  others.  For  example,  an
evaluator can also be part of the planning
team while a participant cannot. 

Towards the first pan-European exercise
There  are  several  reasons  to  conduct
cross-country,  pan-European  or  even
international exercises. The risks faced by
infrastructures, services and organisations
are no longer constrained or separated by
borders.  Communications  networks,  the
organisations 
in  operating
involved 
networks  and  offering  services,  the  users
dependent  on  them  and  the  threats  to
these  networks  and  services  are  all
international and interdependent.

For that reason, the European Council and
the Parliament requested discussion of the
policies  for  network  and 
information
security,  and  the  Commission  followed
with  a  Communication  specifically  on  this
topic  in  2009,  called  “Protecting  Europe
from  Large  Scale  Cyber-Attacks  and
Disruptions:  Enhancing  Preparedness,
Security and Resilience” (COM (2009) 149). 

focused 

Communication 

This 
on
prevention,  preparedness  and  awareness,
and defines a plan for immediate action to
strengthen  the  security  and  resilience  of
critical information infrastructures (CIIs.)

Among  the  actions  proposed 
in  this
Communication  are  steps  to  conduct  the
first  pan-European  exercises  on  large-
scale network security incidents by the end
of  2010,  and  to  prepare  a  proposed
framework  and  roadmap  for  European
participation  in  global  exercises.  In  this
context 
the  European  Commission,
together  with  ENISA,  has  already
organised  two  workshops  to  discuss  with
relevant  stakeholders  the  objectives  of

a 

pan-European 

exercise
such 
(http://ec.europa.eu/information_society/p
olicy/nis/strategy/activities/ciip/impl_activi
ties/ep3r_workshop/index_en.htm).

Conclusions
The increasing reliance of society and the
economy on ICT means that the resilience
of  public  eCommunications  networks  has
become critically important. 

Exercises  are  a  tool  that  competent
authorities  in  EU  Member  States  can  use
in  co-operation  with  stakeholders  to
ensure they are fully prepared and capable
of  responding  to  incidents  that  affect  the
resilience  of  the  networks.  ENISA  has
paved  the  way  forward  by  modelling  the
exercises lifecycle and the required roles of
the stakeholders and by preparing a good
practices guide.

The  guide 
www.enisa.europa.eu/act/res/.

is  available  online  at

Evangelos Ouzounis (Evangelos.Ouzounis@
enisa.europa.eu)  is  a  Senior  Expert  in
Network Security Policies at ENISA.

Saragiotis 

Panagiotis 
Saragiotis@enisa.europa.eu) 
Konstantinos  Moulinos 
Moulinos@enisa.europa.eu) 
Seconded National Experts at ENISA.

(Panagiotis.
and
(Konstantinos.
both

are 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 10

10

RESILIENCE, INCIDENT REPORTING AND EXERCISES
Network Providers’ Resilience Measures
The ENISA Virtual Working Group 

Charalampos Koutsouris and Louis Marinos

densely  routed  physical  cables.  This  has
the  effect  of  creating  diverse  logical
architectures  without  the  assurance  of
physical  separation.  Similar  problems  are
manifested  in  cable  landing  stations,
submarine  cables,  backhaul  connectivity
and  border-crossing  locations,  failure  of
any  of  which  can  jeopardise  backbone
connectivity.  Furthermore,  if  we  consider
threats  with  an  impact  of  high  magnitude
and the signs of concentration of EU traffic
in  just  a  few  Internet  exchange  points
(IXPs),  the  diversification  of  locations
between  different  countries  seems  to  be
significant. It was also recognised that the
effects  of  private  interconnections  should
be  considered;  however  this  can  only  be
achieved with the extensive involvement of
industry,  since  relevant  information  is  not
currently  publically  available.  In  addition,
resilience  of
when  addressing 
interconnections, 
to
it 
consider the protocols used and the policy
aspects  governing  their  existence  and
operation.

is  necessary 

the 

of 

the 

use 

infrastructures 

impact  on 
the 

for  new  services, 
of 

Technology platform challenges
The evolution of technology, together with
is
market  needs 
emerging
increasing 
the
technologies  whose 
current
resilience 
is
telecommunication 
currently  unknown. 
In  many  cases
interoperability  between  different  vendor
solutions  and  standardisation  lags  behind
deployments. Thus, network providers are
assessing the maturity of technologies and
their  implementations  on  their  own.  New
technologies  are  being  adopted  but  older
technologies  are  also  still  in  use.  The
existence  of  older  technologies  imposes
limitations 
introduce
and  may 
vulnerabilities  that  will  not  be  feasible  to
address,  especially 
light  of  their
foreseeable decommissioning. 

in 

In  addition,  the  new  packet  networks  are
based on the well known IP protocol stack
that  is  now  required  to  deliver  increased
functionality  beyond  what  was  initially
envisaged.  As  the  IP  control  plane  is
constantly  retrofitted  with  functionality  to
support  traffic  engineering,  Quality  of
etc., 
provisioning 
Service, 
new
vulnerabilities 
Consequently
arise. 
exposure to threats increases. At the same
time,  attacks  at  the  core  protocols  can
have  propagating  effects,  potentially
leading  to  systemic  failures.  The  security
of  the  network  and  the  use  of  end  point
devices  to  initiate  attacks  has  therefore
been identified as a major challenge.
>>

As  part  of  its  multi-annual  thematic
programme  for  resilience,  in  May  2009
ENISA  set  up  the  Virtual  Working  Group
(VWG)  on  Network  Providers  Measures.
The  Group’s  creation  was  driven  by  the
findings  of  the  stocktaking  survey  (ENISA
Survey  on  Resilience  of  Communication
Networks  –  Network  Provider  Measures,
www.enisa.europa.eu/doc/pdf/deliverables
/enisa_network_provider_measures_on
_resilience.pdf)  conducted  in  2008  that,
among  other 
issues,  highlighted  the
reluctance  of  operators  to  discuss  the
subject  and  identified  the  immaturity  of
new entrants in the market.

Working Group members

Daniel Constantin

SC Romtelecom SA,

Romania

Dave Clarke

Telefónica O2, UK

De Lutiis Paolo 

Telecom Italia, Italy

Jean-Luc Chataignon

FT-Orange, France

Joe Stevens

Interoute, Czech Rep.

John van Leeuwen

KPN, The Netherlands

Juan Carlos Gomez 

Telefonica, Spain

Kostas Strakadounas

Forthnet, Greece

Manuel Carpio 

Telefonica, Spain

Nicolas Tinguely

Swisscom, Switzerland

Shaun Lockwood

BT, UK

Yannis Markoulidakis

Vodafone, Greece

The  VWG  brought  together  field  experts
from network providers operating in one or
more  of  the  27  EU  Member  States  and
beyond.  Through  discussion,  the  Group
identified  some  of  the  challenges  for
resilience  and  the  relevant  measures  that
could be taken. 

These  challenges  focus  on  four  areas,
which  the  VWG  has  aligned  with  ‘abstract

assets’ of public communication networks
that  it  has  identified,  namely:  physical
infrastructure, 
technology  platforms,
operational processes and people, as well
as  the  organisation  of  continuity.  The
challenges  within  the  commercial  and
regulatory  environments  were  also
recognised to be crucial. The results of this
work  are  a  list  of  challenges  to  be
addressed  and  a  set  of  measures  to  deal
with  them.  Where  possible,  the  identified
measures  were  expanded  with  tips  and
good practices drawn from the experience
of VWG members.

Resilience targets
The  first  key  milestone  of  the  VWG  work
was to put resilience in the context of core
networks  and  to  identify  the  scope  of  this
work. The objectives of resilience are:
• The  maintenance 

seamless
interconnectivity  of  communication 
networks across the European Union 
• The  ability  to  differentiate  services  and

of 

offer the desired resilience level

• The ability to protect against threats and
recover from their effects in due time
• The  agility  and  re-configurability  to 
in  emergency

support  authorities 
communications and crisis situations.

Defining the work on core networks in this
way,  including  the  relevant  operational
support and business support systems and
processes,  assisted  the  identification  of
the challenges involved.

of 

the 

trends 

current 

Physical infrastructure challenges
The  sharing  of  physical  infrastructures  is
in
one 
telecommunications.  The  Group  focused
on  physical  cable  routing  and  network
interconnection  locations  and  on  the
management  of  these  shared  assets.  A
serious  concern  is  the  concentration  of
logical  connections  over  far  fewer  and

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 11

RESILIENCE, INCIDENT REPORTING AND EXERCISES

11

processes. 

Operational process and people
challenges
Continuous  network  changes  are  also
hindering  full  integration  with  network
management 
a
consequence  of  the  complexity  and  the
integration requirements, the probability of
failure  increases.  So  does  the  duration  of
the problem resolution. This is aggravated
by  the  limited  experience  of  personnel
involved  in  new  technology,  especially  in
initial phases.

As 

the  operations  of 

Since  network  disruptions  of  small
networks or providers can have an impact
larger  ones,
on 
organisations have to address threats and
risks spanning organisational boundaries.
The current processes need to be adapted
to  handle  these  blurred  areas  of  risk.  To
this end, new proposals are needed for the
provision  of  cyber-threat  mitigation
capabilities  and  co-ordinated  proactive
responses  to  incidents.  Due  to  the  global
nature of the network as well as the cross-
operator
border 
presence,  communication, 
information
sharing  and  collaboration  on  security  are
key challenges.

international 

and 

responses, 

together  when 

Continuity organisation challenges
In terms of continuity, the VWG recognised
the  need  to  develop  the  ability  to  identify
and  adapt  to  changes  that  may  lead  to
disruption  –  in  a  proactive  way.  Instead  of
event-driven 
balanced
proactive and reactive approaches, as well
as policy and process alignment, should be
sought.  Applying  this  rule  to  projects
means  bringing  designers  and  security
people 
technology
implementations  or  business  projects  are
in  their  infancy.  In  addition,  given  the
the  diverse
variety  of 
threats  and 
to  successfully
backgrounds  needed 
manage 
to
respond 
incidents, 
the  challenge  of  human
resource  availability  is  rising.  A  word  of
caution  is  appropriate,  though,  as  to  the
need  for  a  broader  scope  and  stronger
motivation 
infrastructure
managers  to  see  beyond  their  individual
responsibilities  and  to  act  collectively  for
the  mitigation  of  shared  risks.  This
principle  expands  to  inter-infrastructure
dependencies  and 
this
responsibility  for  the  good  of  all  EU
citizens; the cost of such co-ordination is a
significant  challenge  that  can  only  be
properly  addressed  by  EU  or  national
authorities.  However,  currently  neither
customers  nor  authorities  are  sufficiently

resilience  and 

taking  up 

to  enable 

informed  to 

well 
identify  their  own
requirements  or  assess  their  fulfilment
and  thus  steer  the  activities  towards
resilience.

reluctance 

On  the  topic  of  business  continuity
exercises, network operators point out that
senior  management’s 
to
embark  on  full  scale  Business  Continuity
Management (BCM) exercises is fuelled by
the  fear  of  causing  a  service  delivery
failure  with  impact  disproportional  to  the
benefit  of  the  exercise.  Limited  exercises
add an additional challenge with regard to
the  effectiveness  of  existing  Business
Continuity  (BC)  plans  within  and  between
organisations.  Clearly, 
the  24x7x365
requirement  of  service  provision  further
complicates the issue.

Commercial annd regulatory challenges
The VWG pointed out the limited customer
preparedness  for  spending  in  support  of
the  development  of  resilient  services.
Public  communication  networks  are
mostly  owned  and  operated  by  private
organisations; making revenues out of the
services  they  provide  is  one  of  their
primary  objectives.  Due  to  the  heavy
industry,
competition 
investments  are  usually  prioritised
towards  the  development  of  new  services
and functionalities. Virtual mobile network
operators are believed to be affected even
more due to pressure to keep costs low. It
is important for organisations to be able to
quantify the financial impact and return on
investment  (ROI)  of  resilience  measures.
Yet  such  Key  Performance  Indicators
(KPIs) are missing.

within 

the 

On the other hand, pressure to meet time-
limitations  and  to  reduce
to-market 
service costs increases the involvement of
third  parties.  Thus  in-house  knowledge
and  experience  of  new  services  and
technologies is limited, if available at all. In
addition,  third  parties  involved  in  service
provision  need 
to  establish  proper
management  approaches  and  new
contracts and contract fulfilment practices
need  to  be  developed.  Even  then  the
implementation  of  these  contracts  may
depend  on  individual  consultants,  which
could  be  critical.  Consequently,  when  it
comes  to  security  (and  hence  resilience),
the  issue  of  due  diligence  in  contractual
relationships is a great challenge.

Finally,  in  terms  of  regulation,  operators
see the lack of EU harmonised regulatory
requirements  as  a  serious  obstacle  for

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

standardisation  and  a  major  problem  in
increasing resiliency.

Lessons learnt
It  was  a  privilege  for  ENISA  to  host  and
facilitate  the  work  of  a  multi-disciplinary
expert 
resilience
challenges. The diversity within the Group
led to a wealth of different viewpoints and
experiences that greatly contributed to the
output.

focused  on 

team 

to 

this 

available 

It  is  still  evident  that  progress  with
resilience  requires  stable  groups  of
experts  for  longer  periods  than  the  six
VWG.
months 
Furthermore, the busy schedules of these
highly  experienced  professionals  limited
their  availability.  This  is  a  hurdle  that  can
only  be  overcome  through  long-term
planning,  stronger  commitment  from  the
participating  organisations  and  funding  to
support more physical meetings. Last but
not least, overcoming issues of confidential
information  exchange  and  commercial
secrets  was  a  significant  problem  that  in
several cases could not be resolved.

To summarise its achievements, the Group
has  worked  towards  lifting  barriers  to
increased  resilience  and  reached  a
converged  view  on  key  terms,  agreed
common  resilience 
targets,  grouped
challenges  around  abstract  assets,  and
proposed  and  rated  measures  to  address
the  challenges,  supported  where  possible
with good practice. Network operators can
now leverage on the measures identified to
fertilise  their  individual  resilience  efforts.
National  and  EU  authorities  can  benefit
from  seeing  resilience  from  a  network
operator’s  viewpoint  and  can  provide  the
most appropriate support and partnership
options. The VWG has identified many ways
in  which  national  and  EU  authorities  can
play  a  part  in  achieving  the  common  goal
of resilience.

The  report  of  the  VWG  is  available  at:
www.enisa.europa.eu/act/res/providers-
measures/vwg-2009. Please disseminate it
widely.

Charalampos  Koutsouris  (Charalampos.
Koutsouris@enisa.europa.eu) 
a
is 
Seconded National Expert at ENISA.

Marinos 

Louis 
(Louis.Marinos@
enisa.europa.eu) is a Senior Expert in Risk
Assessment  and  Risk  Management  at
ENISA.

ENISA EQ Dec 2009  22/12/09  15:01  Page 12

AWARENESS RAISING AND SECURITY STATUS
OSI: A Security Helpdesk for Internet Users in Spain

Victor M. Izquierdo Loyola 

12

while  at  the  same  time  improving  their
skills.  In  Spain,  apart  from  the  initiatives
for growing the Internet community, which
includes  the  development  of  broadband
communication  networks,  the  Ministry  of
Industry,  Tourism  and  Trade,  through  the
Secretary  of  Telecommunications  and
Information Society, has launched several
initiatives in the field of computer security
and e-trust. One of the most recent is the
Security  Helpdesk  for  Internet  Users
(Oficina  de  Seguridad  del  Internauta,  or
OSI, http://osi.gob.es and www.osi.es).

OSI  was  created  as  a  public  service
designed  to  increase  the  confidence  of
Internet  users  through  a  combination  of
general  undertakings  along  with  more
specific  and  personalised  actions  such  as
attending  and  resolving  user  inquiries,
helping  and  giving  support  in  cases  of
electronic  fraud,  recommending  security
tools etc.

OSI objectives and services
Given the need to increase the IT security
knowledge  of  all  Internet  users,  OSI
services  were  designed  and  implemented
using the following criteria and objectives:
• Create  a  single,  close  and  accessible
reference  point  for  every  aspect  of
computer  security  available  to  the
user,  providing  high  availability  user 
support through different channels.

• Bring  security  services  to  all  users 
through  a  multi-channel communication
platform that  meets 
their  needs: 
website, email and call centre support.

• Provide  training  and  support using
user-friendly  language  adapted  to  the
general  public so  that  those  without
technical  knowledge  can  acquire  basic 
information related to the safe use of the
Internet.

that 

require 

• Customise, improve and enrich similar
services 
technical
knowledge,  such  as  those  successfully
provided  since  2001  to  small  and
medium-sized  enterprises  (SMEs)  and
citizens  by  INTECO-CERT (INTECO’s
Computer  Emergency  Response  Team,
http://cert.inteco.es). 

• Establish additional metrics to measure
the  level  of  users’  safety  background  in 
order  to  improve  OSI’s  services  and 
detect new needs.

As  a  result  of  this  strategy,  OSI  has  been
defined as an agile, flexible and interactive
instrument that offers Internet users high
quality  information  services,  awareness,
support  and  advice  to  help  them  avoid
potential 
The
security 
implementation  of 
these  criteria  by
INTECO  has  materialised  as  a  multi-
language  website,  with  easy  access  and
navigation  methods  that  offer  information
about the safe use of the Internet:

incidents. 

1. Understand  security  concepts  and
threats. A  simple  test  allows  users  to
evaluate  their 
information  security
background,  while  the  ABC  of  security
shows users the main security concepts
and  threats  in  relation  to  use  of  the
Internet.

2. How  to  protect  oneself. Preventive
recommendations  and  tips  for  the  safe
use of Internet services (web browsing,
email,  mobile  phones,  P2P  networks,
instant messaging etc.) and information
about tools to protect users’ computers
and  their  Internet  connection.  It  also
offers daily information on security and
alert  services  through  other  channels
such 
Simple
Syndication).

as  RSS 

(Really 

3. Help  and  support  to  solve  questions,
problems  and  incidents. Through  the
Spanish  phone  number  901  111  121,
users  can  access  the  OSI’s  Call  Centre
for  direct  and  personalised  assistance.
In addition, a Forum and Online Security
Assistant  are  available  on  the  OSI
team  of  skilled
website  where  a 
technicians  can  answer  doubts  and
solve problems.

In  order  to  successfully  offer  these
services, OSI is structured with two levels
of user support during the following hours:
from  9am  to  7pm  from  Monday  to  Friday,
and  Saturday  from  9am  to  2pm  except  on
public holidays:

>>

According  to  the  report  on  “Confidence  in
the  Information  Society”  prepared  by  The
Gallup  Organisation  for  the  European
Commission  and  published  in  May  2009,
46%  of  European  Internet  users  have  the
perception  that  Internet  transactions  are
secure  enough,  while  42%  expressed  no
confidence in the safety of such operations.
In Spain, the confidence level drops to 31%.
This  study  also  provides 
information
regarding key issues on the safe use of the
Internet: 
threats  when
browsing, security incidents and the use of
tools to minimise these risks and threats.
Although  there  has  been  an  increase  in
users’  knowledge  of  security, 
this
development  is  not  proportional  to  the
increase in the use of Internet services.

the  different 

to 

Moreover,  according 
the  Spanish
National  Statistics  Institute,  last  year  the
number of people aged 16 to 74 years old
who  have  used  the  Internet  in  the  last
three  months  grew  by  4.7%,  to  a  total  of
56.7%  of  the  population.  Altogether,  it  is
estimated  that  there  are  more  than  24
million Internet users in Spain.

Frequent users (those who connect to the
Internet  daily  or  at  least  once  a  week)
number  86.7%  of  total  Internet  users,
forming a critical mass of 17 million people
using  the  Internet  and  email  services  for
all kinds of transactions with third parties.
Until  now  many  of  these  tasks  were
performed by other means.

This scenario therefore points to the need
for  the  administration  in  charge  of  the
promotion  of  the  Information  Society  to
in  both
continue  dedicating  efforts 
directions;  i.e.,  to  increase  Internet  users

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 13

AWARENESS RAISING AND SECURITY STATUS

13

•  Level  I  support: OSI’s  first  level
provides  support  services  to  Internet
users  for  information  needs  or  IT
security  incidents  that  may  arrive
through  the  described  channels.  It
also  provides  contact  information
about other possible agents where the
user  may  go 
for  consultation,
processing  claims  or  allegations  that
are  not  within  the  OSI’s  scope.  This
level of support consists of:
•  Call  centre  service: Provides  first
tier  assistance  by  answering
incoming phone questions. Queries
requiring a higher level of expertise
are  transferred  to  the  operations
team Level I.

• Operations Team Level I: Deals with
issues  coming  directly  from  the
website  online  assistant,  and  with
questions  forwarded  by  the  call
centre.  It  is  also  responsible  for
moderating  and  solving  questions
on OSI’s forum.

•  Level  II  support: this  second  level  is
towards  providing  more
oriented 
specialised  support 
for  security
incident  resolution.  Due  to  their
technical  complexity,  these  problems
cannot  be  solved  by  Level  I  support;
they 
include  mail  fraud  analysis,
malware analysis etc.

Operation and service facts
To provide these services, OSI has a team
of  21  people  working  in  different  areas.
First,  the  Call  Centre  Service,  with
capacity  to  handle  500  calls  per  day,  is
supported  by  a  team  of  15  security
technicians and a service co-ordinator.

The Specialised Support Service is a team
of  four  technical experts  in  computer
security  operation  and  one  expert
technician dealing  with  content  and
preventive  services.  Together  these  staff
ensure the proper operation and updating
of the web portal content that can currently
handle 40,000 visits per day.

Security incidents operation

OSI  services’  success  will  depend  on
citizen  demand.  Therefore,  it  is  important
to spread information about OSI services to
all  users.  For  that  reason,  an  appropriate
communication  plan has  been  designed.
This  plan  includes  activities  in  different
media  and  online  services  from  online
media to social networks and multimedia
platforms. The first steps included in this
plan  were  launched  in  June  2009  but  the
current  plan  covers  additional  activities
until at least March 2010. 

In  the  early  months  of  service,  many
website  visits  came  from  security  sector
associations, which is not surprising, given
the  close  relationship  between  INTECO
and  the  security  industry.  Evaluation  of
users’ experience of the services offered is
enabling the creation of an OSI user profile
(see diagrams below).

These facts, as well as the analysis of the
most  common  problems  in  the  Internet
community and the data collected provide
a  snapshot  of 
the  user’s  security
background level.

The chart below shows a high percentage
(26% of handled cases) of users who have
not suffered any security incident but have
contacted  OSI  services  for  information
related to security issues. 

Conclusions
The  Security  Helpdesk  for  Internet  Users
(OSI) 
is  a  further  step  towards  full
development  and  strengthening  of  the
Information Society. Its activity focuses on
a  particularly  sensitive  aspect:  citizens’
awareness  and  eConfidence  –  people  on
the  Internet  must  be  able  to  use  online
services  that  are  powered  by  robust  IT
security safeguards.

The  complexity  of  this  goal  is  due  to  the
inherent  characteristics  of 
Internet
security which cannot be ensured without
adequate commitment by both the service
provider  and  the  user.  The  cumulative
experience 
INTECO’s
relationships  with  service  providers  are
combining  to  promote  safe  use  and
an
development,  working 
appropriate  balance  between  providing
awareness measures and support services
for citizens.

of  OSI 

towards 

and 

M. 

Loyola
Victor 
Izquierdo 
(direccion.general@inteco.es) 
the
General  Director  (CEO)  of  the  National
Institute  of  Communication  Technologies
(INTECO)  promoted  by 
the  Spanish
Ministry of Industry, Tourism and Trade.

is 

User security background

>>

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:01  Page 14

AWARENESS RAISING AND SECURITY STATUS
Awareness Raising in Japan
Ishii Shigeru and Akira Yamada

14

security  measures  to  be  checked.  It  is
designed  to  enable  responders  to  answer
within  five  minutes,  by  just  marking  the
correct  column  which  is  appropriate  to
their  status,  choosing 
from  “Done”,
“Partially done”, “Not” or “Don’t know”.

The 25 questions in the checklist
1.  Is confidential information properly handled?
2.  Is confidential information properly protected 

when brought outside?

3.  Are confidential information and CD-ROMs 

shredded upon scrapping?

4.  Is confidential information properly deleted upon

scrapping used PCs?

5.  Are proper measures taken to prevent 

unauthorised personnel stepping into the office 
area?

6.  Are employees using laptop PCs carrying out 
proper measures to avoid theft of such PCs?
7.  Is lock management undertaken properly by the 

last person to leave the office?

8.  Is the software always kept updated?
9.  Is the use of file exchanges software with the 

risk of information leaks prohibited?

10. Is the use of private PCs for work limited or 

undertaken only with permission?

11. Are PCs switched off upon leaving the office to 

avoid unauthorised use?

12. Is your password well organised to avoid 

someone’s guess?

13. Is your password properly managed to avoid 

misuse by others?

14. Is your password changed periodically to avoid 

misuse by others?

15. Is your PC properly protected from computer 

virus attack?

16. Is your anti-virus software updated with the 

latest virus definition file?

17. Do you check the destination address of your 

email before sending it?

18. Do you use BCC function to avoid email address 

leaks?

19. Upon sending confidential information by email 
as an attachment, do you secure the file by e.g., 
locking the file with passwords?
20. Is confidential information backed up 

periodically?

21. Do you require your employees to sign a ‘Non 

Disclosure Agreement’?

22. Do you provide opportunities for raising the 

awareness of your employees?

23. Do you impose a duty of confidentiality on 

contractors?

24. Are you prepared to respond to any sort of 

security incident?

25. Is your security policy made clear to all of your 

employees?

>>

The  Information-technology  Promotion
Agency  (IPA,  www.ipa.go.jp/index-e.html)
is  a  Japanese  Government  organisation
working  under  the  Ministry  of  Economy,
Trade  and  Industry  (METI).  The  IPA’s  IT
Security  Center  (ISEC)  is  the  core  unit  for
promoting  Japanese  national  IT  security
to
countermeasures. 
is 
disseminate  security  awareness 
to
Japanese  citizens,  by  providing  warning
latest  security
the 
information  on 
vulnerabilities, hosting basic and advanced
security  training  classes  throughout  the
country, and publishing security guidelines
for  small  and  medium-sized  enterprises
(SMEs) and personal computer users.

Its  mission 

Security training classes
Training  courses  have  been  organised  to
raise  the  awareness  of  those  who  are
responsible  for  promoting  IT  security
within an enterprise or other organisation.
We have been providing classes in most of
the  major  cities  in  Japan  since  1995,  at
over 30 destinations a year. We co-operate
with  local  Chambers  of  Commerce  and
Industry,  sending  out  IPA  specialists  as
well  as  training  the  trainer  in  each
location.

We  provide  three  categories  of  training:
Fundamental, Management and Technical
classes.  The  Fundamental  class  focuses
on internal individual countermeasures to
avoid 
and
understanding  the  threats  users  might
face such as computer viruses, spyware or
phishing  frauds.  Anyone  who  wants  to
understand  the  basics  of  IT  security
countermeasures should attend this class. 

information 

leaks, 

The  Management  class  focuses  on  what
managers  should  do 
to  safeguard
organisational IT security.

classes, 

Standard 

There  are  two  classifications  within  the
and
Technical 
Professional.  The  Standard 
version
focuses  on  the  details  of  threats  and
countermeasures from a technical point of
view.  Latest  trends  and  technologies  are
explained  and  attendees  are  able  to
deepen  their  knowledge  of  IT  security
technology. The Professional class focuses
on real world security incidents, providing
technical advice on how to secure websites
and system operation.

2009  is  the  fifteenth  anniversary  of  the
establishment  of  these  training  classes
and,  so  far,  a  total  of  over  40,000  people
have attended.

Countermeasures for SMEs
IT  dependency  among  SMEs  is  growing
IT  security
year  by  year.  However, 
measures  are  not  sufficiently  promoted
and  most  SMEs  have  limited  incentives
and  resources,  and  are  left  behind  by
larger  businesses.  When  entering  into
contracts with major enterprises or public
organisations,  SMEs  are 
frequently
required  to  implement  a  heightened  level
of  IT  security  which  poses  a  huge  burden
on them.

IPA  supports  SMEs’ 

The 
IT  security
measures  with  recommendations  on  how
to  reduce  this  burden  and  to  raise  their
level  of  IT  security,  in  ways  which  are
appropriate to their individual statuses.

Recently, the IPA produced a checklist for
use by SMEs to check the status of their IT
security  countermeasures,  which  was
distributed 
than  250,000
organisations throughout the country. The
checklist  asks  25  questions,  which  allows
implementation  of  the  minimum
the 

to  more 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 15

AWARENESS RAISING AND SECURITY STATUS

15

ETSI SECURITY
WORKSHOP
20-22 January 2010

Call for Papers and
Participation

The ETSI Security Workshop
(www.etsi.org/SECURITYWORKSHOP) has
become the most important annual
international security standardisation
workshop, bringing together international
Standards Development Organisations
(SDOs) and security experts to discuss recent
developments, share knowledge, identify
gaps and co-ordinate on future actions and
work areas. This year’s Workshop will
include overviews of work being undertaken
in the area of security across standards and
technical bodies, along with presentations
from major organisations involved in security
initiatives. The event will take place in ETSI
Headquarters in Sophia Antipolis, France,
from 20-22 January 2010.

ETSI is now calling for
papers!
Please send a short abstract of your
presentation to events@etsi.org,
together with the title of the
presentation, the name and contact
details of the presenter and the topic
of reference as listed below 
by 9 October 2009.

The Workshop would welcome papers
on practical implementations and issues
such as the practical use of standards,
the human factors and examples of
insecurity. In particular this year the
presentations should mainly have a
focus on Security Innovation in one of
the following topics: Next Generation
Networks security, Mobile
Telecommunications systems, ICT
trustworthiness and integrity, Research
and Innovation, RFID and NFC Security
issues, the Internet of Things, Identity
Management and your Privacy,
Cryptography, Smart Cards and future
trends, Quantum Key Distribution,
Machine to Machine communication,
Standards prioritisation and evaluation. 

For updates about ETSI events, join
the recently created ETSI-Events
mailing list at:
http://list.etsi.org/scripts/wa.exe?SU
BED1=ETSI-EVENTS

The prize-winners and the award presenters

Poster and slogan competition for
youngsters
A  programme  for  elementary  to  high
school  children  is  organised  in  Japan.  It
was initiated in Korea, by KISA, the Korea
Internet  &  Security  Agency,  to  raise
security awareness among youngsters.

The  number  of  school  students  who  have
access to the Internet is gradually rising in
the  situation  with
Japan.  However, 
youngsters  is  similar  to  –  or  even  worse
than  it  is  with  –  SMEs.  Knowledge  of
security  measures 
is  not  widely
disseminated  among  children  and  young
people.  This  programme  provides  a  good

opportunity to make them think about what
IT security is, and learn the basics of how
to  avoid  online  incidents.  It  also  helps
teachers to prepare for teaching IT security
in their classes.

Our  project  was  presented  at  the  ‘APEC-
OECD  Joint  Symposium  on  Initiatives
among  Member  Economies  Promoting
Safer  Internet  Environment  for  Children’,
held during the 39th APEC-TEL meeting in
Singapore,  in  April  2009.  We  are  looking
and
forward 
organisations 
similar
competitions  and,  in  the  future,  to  having
exhibitions at major security events around
the globe.

to  more 

countries 

initiating 

At  the  fifth  competition  in  2009,  we  had
6,772  slogans  and  525  posters  submitted
for  50  prizes  awarded  in  October.  The
Slogan Grand Prize Winner was “Anti-virus
Software  and  Password  is  the  Father  and
Mother  of  the  Internet”.  The  author  was
Ms.  Takako  Tonotsuka,  a  2nd  grade
student of Matsugaoka Elementary School,
in Ibaraki.

The  Grand  Prize  Winner  of  the  Poster
competition was Ms. Mikiko Kojima, a 2nd
grade  student  from  Fumioka  Junior  High
School, in Mie. 

Shigeru  Ishii  (s-ishii@ipa.go.jp)  is  the
Group Leader of the Global Alliance Group
at 
the
Information-technology Promotion Agency
(IPA), Japan.

IT  Security  Center  of 

the 

The Poster Grand Prize Winner of 2009 – 
the text says: “Beware of drifting into
somebody’s hands.”

Akira  Yamada  (a-yamada@ipa.go.jp)  is  the
Senior Advisor at the IT Security Center of
the 
Information-technology  Promotion
Agency (IPA), Japan.

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 16

AWARENESS RAISING AND SECURITY STATUS
Information Security Threats and Countermeasures in Korea
Jae-il Lee, Sung-Hoon Kim and Jae Suk Yun

16

The trend of cyber-threats at home and
abroad
Cyber-attacks  are  becoming  increasingly
organised and professional, to the extent that
they  pose  a  threat  to  national  security.  And
their  targets  have  been  expanded  to  all
sectors of society, including financial services,
eCommerce and online game sites. According
to  a  leading  security  company’s  statistics,
damage caused to the global business sector
by cyber-threats was estimated at KRW 1500
trillion (USD 1154 billion) per year in 2008. To
cope with these threats, countries around the
world are designating cyber-security as a core
policy issue.

the 

Recently,  websites  in  Korea  and  the  United
States  were 
targets  of  sustained
Distributed  Denial  of  Service  (DDoS)  attacks;
government websites as well as financial and
commercial  sites  were  paralysed  for  several
days.  Dozens  of  websites  were  flooded  with
more  web  traffic  than  they  could  handle,
effectively  taking  them  offline.  These  attacks
appear to have been carried out by “a few tens
of thousands” of compromised computers, or
‘botnets’.  Although  their  impact  so  far  has
been  considerably  muted,  it  does,  however,
demonstrate  weaknesses  that  could  be
exploited to much more devastating effect.

In addition, incidents of personal data leakage
regularly  create  considerable  trouble  for
individuals  and  businesses.  Administrative,
public and financial organisations and portals,
department stores and utility companies store
the  personal  data  of  many  individuals.  Poor
facilities  and  a  bad  data  protection
environment can lead to information leakage.

Last year hackers stole more than 10 million
customers’ data from the Internet, and public
organisations  have  also  fallen  victim  to  this
type  of  crime.  Stolen  data  can  be  used  for
financial fraud, identity theft and illegal spam,
which  causes  economic  and  reputation
damage to its victims. 

Korea  has  taken  stringent  action  to  address
these issues.

Implementing Korea’s information security
policy
• Bolstering 

items  on 

information
the  national 
security system – In July 2008 the Korean
Government  established  an 
‘Internet
Security  Plan’  and  a  ‘National  Information
Security  Plan’  (2008~2012),  and  promoted
73 
its  Information  Security
Agenda in six areas. These cover responses
to  cyber-attacks 
(21),  personal  data
protection  (16)  and  support  for  related
industries  and  organisations  (36).  Under
these plans, public and private sectors are
merged  and 
is
addressed  from  a  national  perspective.  In
addition, countermeasures and prevention,
industry promotion and expert training are
processed  nationally  and  on  a  long-term
scale. The Government has also expanded
the  national  budget  and  infrastructure  to
enhance  the  level  of  information  security.
Finally  the  application  rate  of  information
security systems in the public, private and
individual  sectors  in  2009  rose  to  71%  –
7.4% up on 63.6% in 2007. 

information  security 

• Strengthening  the  systematic  foundation
for personal data protection – To enhance

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

of 

three 

KISA  (the  Korea  Internet  &  Security
Agency)  was  formed  in  July  2009  by  the
consolidation 
existing
organisations:  the  Korea  Information
Security  Agency  (the  national  agency  in
charge of all areas related to information
security,  also  known  as  KISA),  the
National  Internet  Development  Agency
(NIDA) and the Korea IT International Co-
operation Agency (KIICA). KISA’s task is to
improve  Internet  usage,  protect  Internet
users and to share with the world Korea’s
Internet  expertise.  The  intention  is  that
KISA  will  become  the  means  by  which
Korean  citizens  will  be  able  to  enjoy  a
convenient and safe Internet world. 

the  standards  of  personal  data  protection
and produce new policy approaches to fight
online abuse, a revised Act on Promotion of
Information  and  Communication  Network
Network  Utilisation  and 
Information
Protection etc. was submitted in November
2008. The Government amended the Act in
June  2009  to  increase  the  number  of
businesses which are certified for personal
data protection and to require the provision
of  personal  identification  tools  in  addition

to the resident registration number.  >>

ENISA EQ Dec 2009  22/12/09  15:02  Page 17

AWARENESS RAISING AND SECURITY STATUS

17

• Strengthening  the  national  response
system  to  tackle  cyber-infringement  –
The  Government  has  built  a  ‘Security
Control  Center  for  10  National  Core
Computing  Networks’  in  the  fields  of
administration,  national  defence,  finance
and transportation, and has established the
‘Metropolitan  and  Provincial 
Internet
Security  Center’  and  website  malware
detection  systems.  The  number  of  secure
servers  to  encrypt  online  information  has
also  been  expanded  from  about  21,000  in
2007 to over 33,000 in 2008.

‘National 

Achievements 
• The level of national information security
–  was  increased  by  five  points  compared
with  2007.  The 
Information
Security  Index’  rose  from  63.4  points  in
2007  to  68.4  points  in  2008,  as  a  result  of
the installation of various security systems
including 
and
improvements  in  budgets,  experts  and
security awareness.

anti-virus 

software 

• Performance in the areas of personal data
collection,  distribution  and  management
–  The  ‘Online  Collection  Rate  of  Resident
Registration  Numbers’  fell  by  19.5%,  from
65.6%  in  2007  to  46.1%  in  2008.  Legal
statutes were amended and the number of
businesses required to implement personal
data protection rose. The use of i-Pin (used
identification,  to  replace
for  personal 
resident  registration  numbers  in  Korea)
increased when subscribing to information
and communication services – from 99,000
in 2007 to 665,000 in 2008. With intensified
checks  for  personal  data  exposure  by
administrative  and  public  organisations
and  the  establishment  of  data  exposure
firewall  systems,  ‘Personal  data  exposure
from  websites’  by  public  organisations
shrank dramatically – by 66% – from 92,587
cases in 2007 to 31,684 in 2008. Reports of
personal  data  infringement  increased  by
53.3% from 25,965 cases in 2007 to 39,811
in  2008,  due  to  a  rise  in  financially-
motivated personal data crimes. 

• Awareness  of  information  security  – In
recent surveys the rate of recognition of the
importance  of  information  security  scored
highly,  at  98.3%.  The  ‘information  security
execution rate’, representing the utilisation
of anti-virus software and security patches,
stood  at  a  moderate  82.5%.  However,  the
rate  of  carrying  out  measures  to  protect
data,  such  as  password  change  or  file
backup, scored a mere 70%. 

Main plans for the future 
• Strengthening  supervision  of  businesses
and  organisations  which  deal  with
massive  amounts  of  personal  data  – The
Government plans to examine and improve
the  management  of  organisations  and
businesses  that  store  huge  amounts  of
personal  data.  Systematic  and  technical
management  will  be  inspected,  examining
hacking response, personal data protection
and  insider  control.  The  Governement
plans  to  step  up  insider  control  and
intensify the management and supervision
the
by  upper 
designation  of  CPOs 
(Chief  Privacy
Officers), vigilance of the whole process of
data  collection,  distribution  and  storage
will be increased, in recognition that most
incidents  of  personal  data  leakage  are
committed by insiders. 

organisations.  With 

• Enhancing 

and 

systems 

raising
awareness  of  the  need  for  personal  data
protection  – The  Governement  plans  to
enact  the  Personal  Information  Protection
Act  as  soon  as  possible  with  the  co-
operation of the public and private sectors,
in  order  to  strengthen  privacy  foundation
with  a  systematic  approach.  This  Act  will
require  a  full  account  to  be  given  at  every
step  in  the  processing  of  personal  data:
collection,  utilisation,  provision  and
disposal.  The  scope  of  application  will
public
include 
organisations 
including  constitutional
institutions and non-profit organisations. 

business, 

private 

• Strengthening 

of 

the 

ability 

the  Government  plans 

infringement
online 
prevention  and  response  measures  – To
strengthen 
public
organisations  to  respond  to  cyber-attacks
on  major  information  and  communication
to
facilities, 
designate  more  Critical 
Information
Infrastrutures (CIIs) by the end of 2009, and
to  intensify  the  examination  of  security
vulnerabilities.  The  Government  has
distinguished  intranets  from  the  Internet,
since  the  latter  can  be  used  to  prevent
intelligent  hacking  mail  and  strengthen
national 
IT  protection  capabilities  by
building  and  distributing  the  secrecy
control  and  distribution  system.  The  new
‘Metropolitan  and  Provincial 
Internet
Security  Center’  has  a  part  to  play  in  this
work  too.  To  prevent  DDoS  attacks,  DDoS
response  systems  will  be  established  as
soon as possible. For the public sector, by
the  end  of  2009  the  Government  will  have
set  up  the  ‘National  10  key  computer
‘Civic/provincial
the 
networks’ 

and 

computer network’; for the private sector it
will  have  established  a  model  response
system  at  four  primary  information  and
communication  service  suppliers’  Internet
servers. 

• Enhancing 

and 

systems 

Network 

raising
awareness  to  foster  a  sound  Internet
culture – Further planned amendments to
the  Act  on  Promotion  of  Information  and
Network
Communication 
Utilisation  and  Information  Protection  etc.
will  combat  the  distribution  of  illegal
information  on  the  Internet  by  adding
regulations to punish businesses that fail to
delete  illicit  information.  The  Government
has  also  launched  nationwide  education
and  culture  of  security  campaigns  to  fight
cyber-crime on an ongoing basis. 

for 

Conclusion
Korea  is  proud  of  its  well-advanced  network
infrastructure,  its  technologies  and  various
applications,  but  these  can  lead  to  many
undesirable  side-effects  such  as  malicious
software,  spam,  ID  theft  and  so  on.  Against
such  threats,  the  Korean  government  has
implemented  numerous  countermeasures  to
secure its cyberspace and improve reliability.
To achieve this, a holistic and comprehensive
approach 
is
necessary  to  improve  the  overall  level  of
information 
and
communications  networks  are  largely  owned
and  operated  by  the  private  sector,  both
nationally 
Thus,
addressing network security issues requires a
public-private  partnership  as  well  as
harmonised  international  co-operation.  What
is  needed  is  a  comprehensive  framework  to
ensure  co-ordinated  responses  to  significant
incidents or threats, with the Government, the
private sector and others all working together. 

information  security 

internationally. 

Information 

security. 

and 

(jilee@kisa.or.kr) 

is  Vice
Dr.  Jae-il  Lee 
President and Director of the Policy Planning
Division of Korea Internet & Security (KISA) in
Korea. 

Dr.  Sung-Hoon  Kim  (kimsh@kisa.or.kr)  is
Director  of  the  Policy  Development  Team  of
Korea Internet & Security (KISA) in Korea. 

Jae-Suk  Yun  (jsyun@kisa.or.kr)  is  Prinicipal
Researcher  in  the  Policy  Development  Team
of Korea Internet & Security (KISA) in Korea. 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 18

INTEROPERABILITY AND PROTECTION
Cloud Computing
Benefits, Risks and Recommendations for Information Security

18

Giles Hogben and Daniele Catteddu 

• More  timely,  effective  and  efficient
updates  and  defaults: default  virtual
machine  images  and  software  modules
used by customers can be pre-hardened
and  updated  with  the  latest  patches  and
security  settings  according  to  fine-tuned
processes.  Updates  can  be  rolled  out
many  times  more  rapidly  across  a
homogenous platform than in traditional
client-based  systems  that  rely  on  the
patching model.

Risks
The top risks identified include:
• Loss  of  Governance:

in  using  cloud
infrastructures,  the  client  necessarily
cedes  control  to  the  cloud  provider  on  a
number  of  issues  which  may  affect
security. At the same time, Service Level
Agreements  (SLAs)  may  not  offer  a
commitment to provide such services on
the  part  of  the  cloud  provider,  thus
leaving a gap in security defences.

• Lock-in: there is currently little on offer in
the way of tools, procedures or standard
data  formats  or  services  interfaces  that
could  guarantee  data,  application  and
service  portability.  This  can  make  it
difficult for the customer to migrate from
one  provider  to  another  or  migrate  data
and  services  back  to  an  in-house  IT
a
This 
environment. 
dependency  on  a  particular  Cloud
for  service  provision,
Provider 
especially 
is  not
enabled.

if  data  portability 

introduces 

(CP) 

are 

resources 

separating 

• Isolation  failure: multi-tenancy  and
shared 
defining
characteristics  of  cloud  computing.  This
risk  category  includes  the  failure  of
storage,
mechanisms 
memory,  routing  and  even  reputation
between different tenants (e.g., so-called
guest-hopping attacks). However, attacks
on  resource  isolation  mechanisms  (e.g.,
less
against  hypervisors)  are  still 
numerous and much more difficult for an
attacker  to  put  into  practice  compared
with  attacks  on  traditional  operating
systems.

• Compliance 

risks:

investment 

in
achieving  certification  (e.g., 
industry
standard  or  regulatory  requirements)
may  be  put  at  risk  by  migration  to  the
cloud:
•  if  the  cloud  provider  cannot  provide
evidence of its own compliance with the
relevant requirements

• if  the  cloud  provider  does  not  permit

audit by the cloud customer.

>>

Cloud  computing  was  identified  by  ENISA’s
experts and by its Permanent Stakeholders’
Group  as  one  of  the  emerging  applications
which  is  likely  to  have  a  significant  impact
on  European  businesses  and  governments
in the near future. Cloud computing is a new
way  of  delivering  computing  resources, not
a  new  technology.  With  Cloud  Computing,
services  ranging  from  data  storage  and
processing  to  software,  such  as  email
handling,  are  now  available 
instantly,
commitment-free and on-demand. Since we
are  in  a  time  of  belt-tightening,  this  new
economic  model  for  computing  has  found
fertile ground and is seeing massive global
investment. According to IDC’s analysis, the
worldwide  forecast  for  cloud  services  in
2009  will  be  in  the  order  of  $17.4bn.  The
estimation  for  2013  amounts  to  $44.2bn,
with  the  European  market  growing  from
€971m in 2008 to over €6bn in 2013.

ENISA’s new report (www.enisa.europa.eu/
act/rm/files/deliverables/cloud-computing-
risk-assessment)  is  the  first  to  take  an
independent,  in-depth  look  at  the  security
and privacy issues of moving into the cloud.
ENISA  assembled  a  group  of  experts  from
major  cloud  providers,  market  leaders  in
security  and  IT  services  and  research
projects,  along  with  legal  experts  and
independent  security  consultants.  This
group  worked  together  over  a  period  of  8
months to create its report. The main target
audience of the ENISA paper is businesses,
and  medium-sized
especially 
enterprises  (SMEs),  because  they  are  the
biggest  customers  of  cloud  computing.
Generally  such  customers  would  like  to
know  how  to  reap  the  obvious  benefits  of
going  cloud,  while  minimising  their  risks.
The  report  is  also  applicable  to  larger
businesses and includes recommendations
for 
legal
recommendations aimed at governments.

directions 

research 

small 

and 

One of the main conclusions of the report is
that  the  cloud’s  economies  of  scale  and
flexibility  make  it  both  a  friend  and  a  foe
from  a  security  point  of  view.  The  massive
concentrations  of  resources  and  data
present  a  more  attractive 
to
attackers,  but  cloud-based  defences  can
also  be  more  robust,  scalable  and  cost-
effective.  The  paper  allows  an  informed
assessment  of  the  security  risks  and
benefits  of  using  cloud  computing  –
providing security guidance for potential and
existing users of cloud computing.

target 

Benefits
The top security benefits identified include:
• Security  and  the  benefits  of  scale: put
simply, all kinds of security measures are
cheaper  when  implemented  on  a  larger
scale.  Therefore  the  same  amount  of
in  security  buys  better
investment 
protection.  This  includes  all  kinds  of
defensive  measures  such  as  filtering,
patch  management,  hardening  of  virtual
machine  instances  and  hypervisors  etc.
Other  benefits  of  scale  include:  multiple
locations,  edge  networks 
(content
delivered  or  processed  closer  to  its
destination),  timeliness  of  response  to
incidents and threat management.

• Security  as  a  market  differentiator:
security  is  a  priority  concern  for  many
cloud  customers;  many  of  them  will
make buying choices on the basis of the
provider’s  reputation  for  confidentiality,
integrity  and  resilience  and  the  security
services  offered.  This  is  a  strong  driver
for  cloud  providers  to  improve  security
practices.

• Rapid,  smart  scaling  of  resources: the
ability of the cloud provider to dynamically
reallocate  resources  for  filtering,  traffic
shaping etc., to defensive measures (e.g.,
against  Distributed  Denial  of  Service
(DDoS)  attacks)  has  obvious  advantages
in terms of resilience.

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 19

INTEROPERABILITY AND PROTECTION

19

In  certain  cases,  it  also  means  that
using  a  public  cloud  infrastructure
implies that certain kinds of compliance
cannot  be  achieved  (e.g.,  the  Payment
Card 
Industry  Data  Security  Standard
(PCI DSS)).

• Data protection: cloud computing poses
several  data  protection  risks 
for
customers  and  providers.  In  some
cases,  it  may  be  difficult  for  the  cloud
customer (in its role as data controller)
to  effectively  check  the  data  handling
practices of the cloud provider and thus
to be sure that the data is handled in a
lawful way. This problem is exacerbated
in  cases  of  transfers  of  data,  for
example between federated clouds.

• Malicious  insiders:  while  usually  less
likely, the damage which may be caused
by malicious insiders is often far greater.
Cloud  architectures  necessitate  certain
roles  which  are  extremely  high-risk.
system
Examples 
administrators  and  managed  security
service providers. 

include 

CP 

Outputs
The  most  important  outputs  of  the  paper
are: 
• A  security  checklist  or  assurance
framework  for  cloud  computing.  It  is  a
high  priority  for  businesses  to  know
what  questions  to  ask  when  evaluating
cloud  providers’  security.  In  addition,
cloud  providers  are  overloaded  with
requests for audit and assurance – this
takes  up  valuable  time  and  can  even
weaken  their  security  perimeters  if  it
involves  access 
to  premises.  The
checklist  is  aimed  at  addressing  both
these issues.

• A  set  of  recommendations  for  research
directions to advance the state of cloud
security 
trust,  systems
including 
engineering and data protection.

• A  specific  set  of  recommendations
drawn  up  by  legal  specialists  detailing
what  to  look  for  in  a  cloud  computing
contract.

Our  security  checklist  is  only  a  first  step.
We  are  also  now  working  with  a  group  of

Electronic Signature Interoperability 
Where we do stand in Europe?

Vincent Tilman and Alfredo Esposito

Ten  years  ago,  the  European  Union  (EU)
adopted  the  eSignature  Directive  and  set
up the “Article 9 Committee”. Additionally,
in  1999,  a  group  of  experts  from  the
European 
Signature
Electronic 
Standardisation Initiative (EESSI) listed the
areas  where 
standardisation  was
necessary.  Since  then,  a  number  of  EU-
funded projects (e-Justice, R4EGOV, Brite,
Modinis,  to  quote  just  the  recent  ones)
included interoperability research, both for

signature  and  for  authentication.  The
IDABC (Interoperable Delivery of European
eGovernment Services, the EU programme
the  correct  use  of
that  promotes 
Communication
Information 
for  cross-border
Technologies 
services 
in  Europe)  also  specifically
addressed  the  need  for  interoperability
with  the  establishment  of  a  pilot  Bridge
CA.  Why  are  we  then,  10  years  later,  still
discussing the issue?

and 
(ICT) 

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

interested  organisations 
to  produce
something more formal over the next year.
Together  with  the  Cloud  Security  Alliance
(CSA)  and  ISACA,  the  global  organisation
for 
information  governance,  control,
security  and  audit  professionals,  we  are
also  organising  a  conference  dedicated  to
this  topic.  It  will  be  held  in  Barcelona,
Spain, 
2010
(www.enisa.europa.eu/media/news-items/
call-4-papers-secure-cloud-2010). 

16-17  March 

from 

The  full  report  can  be  downloaded  from:
www.enisa.europa.eu/act/rm/files/delivera
bles/cloud-computing-risk-assessment.
Also  available  are  separate  documents
with  the  assurance  framework  and  the
results  of  a  survey  on  SME  attitudes  to
cloud computing security which was used
as a basis for the report.

Hogben 

Giles 
.europa.eu) 
Policies at ENISA.

(Giles.Hogben@enisa
in  Security

is  an  Expert 

Daniele  Catteddu 
(Daniele.Catteddu@
enisa.europa.eu)  is  an  Expert  in  Risk
Assessment and Management at ENISA.

The first reason for such slow progress is
the respect of subsidiarity and specifically
the right of Member States to decide their
own  security  matters.  The  subsidiarity
principle  is  a  cornerstone  of  European
policies. However, it is not always the best
option  and,  in  this  case,  it  has  not  been
used  in  a  reasonable  way,  i.e.,  taking  into
account  the  problems  that  need  to  be
addressed.  It  is  quite  bizarre  to  read,  for
example,  in  the  second  version  of  the
Interoperability  Framework
European 
(EIF2.0),  that  pan-European  eGovernment
services  should  be  ruled  by  subsidiarity,
with  the  convergence  of  rules  which  have
been designed and defined in very different
local contexts.

Secondly, 
it  appears  that,  for  some
Member  States,  there  has  been  a  direct
interest  in  delaying  interoperability  to
make  the  access  of  foreign  companies  to
public  procurement  more  difficult.  It  has
also  been  a  way  to  protect  a  number  of
national  certification  service  providers
from competition. 

>>

ENISA EQ Dec 2009  22/12/09  15:02  Page 20

INTEROPERABILITY AND PROTECTION

20

Electronic
signatures device

Thirdly,  it  was  believed  that  the  market
to  a
would  spontaneously  converge 
solution.  However,  interoperability  driven
by the market is not always appropriate. In
a  large  number  of  situations,  such  as  in
the  case  of  electric  plugs,  there  is  no
reason  for  spontaneous  convergence  of
different  legal  systems  and  different
traditions.  As  a  further  example,  take  the
IBAN  code  for  bank  accounts,  that  was  in
place  for  years  but  adopted  only  with  the
threat  of  going  out  of  business  after  the
take-off  of  the  Single  European  Payment
Area  (SEPA).  In  addition,  technical  issues
would 
the
applications  and  it  is  not  likely  that  this
would arise spontaneously, at least not in
the short time. 

fine-tuning 

require 

of 

three 

These 
reasons  explain  why
eSignature interoperability remained for so
long a low priority for Member States and
the EU. However, there is now some hope
that this might change. 

The  European  Commission  (EC)  accepts
that  the  ‘market’  is  unable  to  achieve  a
minimum level of interoperability by itself,
and  has  undertaken  a  governing  role  in
setting a common framework for some of
the main interoperability issues.

List 

with 

The need for a network of trusted lists has
been  acknowledged  and  the  ETSI  Trust
Status 
some
(TSL), 
improvements,  was  selected  to  address
this 
issue.  The  need  for  a  common
signature format has also been recognised
as  it  predicts  the  endorsement  of  ETSI
formats  (Cryptographic  Message  Syntax,
Extended  Markup  Language  and  PDF
Advanced  Electronic  Signatures  –  CADES,
XADES  and  PADES).  Furthermore,  the
need  for  reviving  the  EESSI  initiative  in
order  to  create  a  harmonised  standard
landscape has been accepted. 

implementation  of 

The 
the  Service
Directive by the end of 2009 also plays an
important role. Public administrations will
soon  be  forced  to  recognise  cross-border
electronic documents.

The time has probably come to accelerate
work on eSignature interoperability and, to
that  end,  the  authors  would  like  to  put

forward 
the 
recommendations:

following 

six

1. Since  the  need  for  governance  at
European level has been acknowledged,
the  EC  and  Member  States  should
continue in this way, ensuring a proper
supervisory  role,  ready 
if
something goes wrong.

to  act 

2. The  EU  should  be  as  technologically
neutral  as  possible,  and  it  should  no
longer  accept  that  it  is  sometimes
necessary 
to  endorse  a  specific
solution.  A  possible  way  of  keeping
updated  with  technical  progress  is  to
delegate 
to  a
normative technical body.

the  maintenance 

3. The  EC  should  be  more  critical  of  the
implementation  of  the  Directive  by  the
various Member States, bearing in mind
interoperability.

of  Member 

4. The  EC  should  establish  and  fund  a
permanent  and  effective  forum  for  the
States’
exchange 
experiences  so  they  can  discuss  and
address any issue that might arise (e.g.,
formalise  the  role  of  the  Forum  of
European  Supervisory  Authorities  for
Electronic  Signatures 
or
enhance the role of the IDABC).

(FESA) 

(CSPs), 

5. European  Institutions  should  involve
more stakeholders (Certification Service
Providers 
Certification
Authorities (CAs), users) in their policy-
making  process.  At  the  moment,  they
rely  too  much  on  ‘experts’  who  are  not
involved  in  the  day-to-day  work  and
often have a very theoretical approach.

6. Last but not least, the EC represents the
main  market  for  cross-border  public
services.  It  should  prescribe  the  usage
of  electronic  signatures  at  the  internal
level. At the moment, the procedure for
submitting  tenders  or  proposals  to  the
EC  is  pretty  much  paper-based  and,
to  submit
when 
is  possible 
electronically, 
it  does  not  allow
electronic  signatures.  The  Commission
should  set  an  example  by  encouraging
the  use  of  digital  signatures  in  all  its
contracts  and  electronic  invoices  and
also  in  official  exchanges  with  Member
States’ representatives.

it 

initiated 

These recommendations have been issued
within the framework of the Wesign project
(www.wesign.org), 
by
ChamberSign and a number of Chambers
of  Commerce  actively  involved  in  the
eSignature  market.  This  article  is  partly
based on the results of the Wesign project,
which  was  co-funded  by  the  Chambers  of
Commerce  and  the  EC.  The  full  paper  is
available at: www.chambersign.com/images
/stories/ChamberSign/Documents/electroni
c%20signature%20interoperability.pdf

Vincent Tilman (tilman@eurochambres.eu)
is  the  Managing  Director  of  ChamberSign
and Senior Advisor at Eurochambres.

Esposito 

(alfredo.esposito@
Alfredo 
infocert.it)  is  an  Executive  at  Infocert  and
member  of  ETSI  TC  ESI 
(Electronic
Signatures  and  Infrastructures  Technical
Committee). 

AIFS 2010, 27-28 January 
The Athens International Forum on Security (AIFS) is an independent information security
conference held in Greece to deliver vendor-neutral expertise to proactive IT professionals.
AIFS provides a fresh, in-depth look into information security technologies, policies,
techniques and best practices, and helps all parties involved – from front-line IT personnel
to policy-makers – gain valuable insights into key information security issues. This year’s
forum brings together world-class experts to examine security challenges that
organisations will face in the coming decade and introduce opportunities for successfully
overcoming them. AIFS is organised by The Hellenic American Union, a public service
organisation with an international focus and strong community commitment. 

AIFS 2010 is a joint event in co-operation with ENISA and 
takes place in Athens, Greece.

More information: http://conferences.hau.gr/?i=aifs2010.en.home

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 21

INFORMATION SECURITY MANAGEMENT SYSTEMS
Standardised Management and Control of Information Security
The IT Division of the Austrian Federal Ministry of Finance – a case study

21

Leopold Koppensteiner and Markus Kloibhofer  

efficiency  of  the  entire  management
system is confirmed by annual monitoring
audits, and is renewable after three years
by means of a re-certification audit.

Management and control
The  ISMS  itself  is  a  process-oriented
management system, i.e., it is based on a
list  of  processes  and  conditions  which
permit  standardised  management  and
control of the required information security
in  the  processing  of  comprehensive  data
in  existing  statutory
sets  as  defined 
provisions.  The  ISMS  ensures  a  regular
and  systematic  identification  of  risks  to
information  security,  and  the  evaluation  –
and  reduction  –  of  such  risks  to  an
acceptable  and  feasible  degree  by  means
of suitable security measures. In addition,
it  permits  continual  assessment  with  the
aid  of  numerous  system  and  process
audits.  Thanks  to  the  calculation  of
security indicators reflecting the efficiency
of the system, continuous adjustment and
further  evolution  in  line  with  changing
requirements can be achieved. 

operative 

Internal security standards
In  addition,  the  ISMS  clearly  defines  the
security  objectives  for  all  organisational
and  technical  areas  and  determines  the
Its
required 
orientation  to  the  requirements  of  the
security standard ISO/IEC 27001 permits a
high  level  of  standardisation  through
structured  procedures  and  ensures  the
necessary  transparency  in  this  complex
environment.

processes. 

Markus Kloibhofer and Leopold Koppensteiner

Traditionally,  the  Federal  Ministry  of
Finance  (BMF,  http://english.bmf.gv.at/
Ministry/_start.htm)  has  been  entrusted
with the central tasks of shaping Austria’s
budget  and  fiscal  policies,  dealing  with
economic  and  structural  policy  issues,
customs  affairs  and 
information  and
communications  technology  (ICT).  Under
its  statutory  mandates,  the  BMF  handles
comprehensive  data  sets  of  citizens  and
companies. 
of  modern
technologies  and  intensified  electronic
support  and  automation  assures  a  high
degree  of  efficiency  and  stringent  quality
standards of fiscal procedures. As a result,
the  Austrian  fiscal  administration  ranks
amongst Europe’s most advanced systems
information
users  with 
technology.

regard 

The 

use 

to 

demands 

considerable 

The  need  for  confidentiality,  integrity  and
availability  of  the  processed  information
makes 
on
information security management in the IT
Division  of  the  BMF  and,  with  the  ever
more widespread use of ICT, the potential
vulnerability  of  the  system  to  threats  that
could  undermine  information  security  is
growing.

the 

The implementation of an ISMS
IT  Division
For 
reason, 
this 
information  security
implemented  an 
management  system  (ISMS)  as  early  as
2002,  and  this  was  further  developed  in
2007 in order to meet the requirements of
the  internationally  recognised  security
standards  defined  in  ISO/IEC  27001  and
certified 
the  Austrian
certification body, CIS.

in  2008  by 

The  BMF  was  the  first  European  ministry
to obtain a certification in accordance with
ISO/IEC 27001. The certificate is valid for a
three-year period, with the proviso that the

Guaranteeing adequate information
security
Processed data must be protected against
unauthorised  use,  and  citizens  and
companies must have confidence that their
data  is  being  handled  responsibly  by  the
administration.  Guaranteeing
public 
adequate security of information therefore
not  only  constitutes  a  vital  quality  feature
and an obvious characteristic of the role of
the  public  administration,  but  is  also
stipulated by numerous legal provisions.

of 

level 

Legal requirements
Under  the  Austrian  Data  Protection  Act,
action aimed at data security must afford a
protection
reasonable 
commensurate  with  the  risks  involved  in
the use of such data and the type of data to
be protected; in this process, the technical
and  economic  aspects  of  such  protection
measures must be taken into account. For
easier  control  and  the  provision  of
evidence,  the  public  administration  also
has  an  obligation  to  accurately  document
all information security measures taken.

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

>>

ENISA EQ Dec 2009  22/12/09  15:02  Page 22

INFORMATION SECURITY MANAGEMENT SYSTEMS

22

The regular monitoring and re-certification
of  the  ISMS  by  an  accredited  certification
body ultimately underpin the independent,
stringent control of all activities related to
information  security  and  confirm  the  high
quality of the system.

Furthermore, the certification pursuant to
ISO/IEC  27001  constitutes  proof  that  data
are  processed  in  accordance  with  the
technological  state  of  the  art,  with  the
relevant  degree  of  accuracy  and  on  the
basis  of  pre-defined 
technical  and
statutory conditions.

Structure of the ISMS
The configuration of the ISMS is based on
the  PDCA  (Plan-Do-Check-Act)-Lifecycle
Model  and  consists  of  the  following
elements:

PLAN – security requirements
• Security  policy  – constitutes  the  basis
of the management system and defines
the principles of information security to
be applied by the Ministry.

security-process
• Information 
landscape 
in  conformity  with  the
principles  of  ISO/IEC  27001  – both  the
competent  structural  organisation  and
the  process  organisation  of  the  entire
ISMS  are  defined  on  the  basis  of  the
security policy.

management 

• Compliance 

for
information security in conformity with
the  principles  of  ISO/IEC  27001  –
assures consideration of and respect for
the  relevant  legal  requirements  and
to
regulatory  provisions 
information  security  as  well  as  their
completeness, accuracy and validity.
• Security guidelines in accordance with
the  principles  of  ISO/IEC  27001  and
27002 – define all conditions relevant for

relating 

security  with  a  view  to  ensuring  the
confidentiality,  integrity  and  availability
of data.

• Security architecture – on  the  basis  of
the  security  guidelines,  defines  the
technical  standards  applying  to  the
security 
for
devising  security  activities  and  assures
the  monitoring  of  their  implementation
in line with the need for protection.

technology  employed 

DO – risk management
• Awareness  and  training  programme  –
on  the  basis  of  the  defined  security
standards,  delineates  the  training  of
staff  to  whom  information  security
responsibilities are assigned.

• Information  risk  management 

in
accordance  with  the  principles  of
the
ISO/IEC  27005  –
identification, 
and
treatment of existing risks by means of a
standardised  methodology  in  response
to  new  or  further  development  of
electronic procedures.

assessment 

ensures 

• Emergency  and  crisis  management  in
accordance  with  the  principles  of
ISO/IE  27001  and  BSI  100-4  – provides
for  the  prevention  and  elimination  of
incidents  occurring  under  emergency
conditions and assures the continuity of
operations  during  emergencies,  crises
or disasters.

• Security 

control  monitoring 

–
determines  the  documentation  and
monitoring  of  organisational  and
technical security procedures that are to
be implemented.

CHECK – controlling
• Audit  programme  in  accordance  with
the principles of ISO/IEC 27001 and ISO
for  the  regular
19011  – provides 
inspection  of  the  entire  ISMS  for  its

completeness  and  applicability  and  for
the  regular  checking  of  its  compliance
with and the efficiency of standards and
security  action,  as  well  as 
the
undertaking  of  external  penetration
tests by independent service providers.
• Security  indicators  management  in
accordance  with  the  principles  of
ISO/IEC  27004  (Draft)  – supports  the
operation  and  control  of  the  ISMS,
provides  objective  measured  data  and
permits identification of the potential for
improvements.

ACT – continual improvement
• The 

continual 

improvement
programme  in  accordance  with  the
principles  of  ISO/IEC  27001  – provides
for the identification of the potential for
improvement and permits the control of
the  implementation  and  efficiency  of
improvement measures.

With  the  ISMS,  the  Austrian  Federal
Ministry  of  Finance  has  established  an
internationally recognised quality standard
for  information  security  in  the  processing
of sovereign data. This system, it is hoped,
will  strengthen  the  confidence  of  citizens
in the security of the IT procedures used by
its public administration.

Leopold 
(Leopold.
Koppensteiner 
Koppensteiner@bmf.gv.at)  is  the  Chief
Information  Security  Officer  (CISO)  of  the
Austrian Federal Ministry of Finance. 

Kloibhofer 

Markus 
(M.Kloibhofer@
bmf.gv.at) is a Senior Information Security
Expert  at  the  Austrian  Federal  Ministry  of
Finance.

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

>>

ENISA EQ Dec 2009  22/12/09  15:02  Page 23

INFORMATION SECURITY MANAGEMENT SYSTEMS
Risk Analysis in an Italian Public Body: ISPESL
Francesco Merlo, Salvatore D’Emilio and Francesco Gaudieri

23

ISPESL

is 

The  Italian  Institute  for  Occupational
Safety 
(ISPESL,
and  Prevention 
www.ispesl.it)  is  a  public  body  which
deals with research into physical safety
in the workplace. It is the technical and
scientific  research  institute  of  the
National  Italian  Health  Service  whose
mission 
to  promote  accident
prevention,  occupational  safety  and
health  protection  in  living  and  working
environments. 
conducts
research  and  analysis  and  undertakes
experimentation  and  the  drafting  of
criteria  and  methodologies  for  the
prevention 
and
professional diseases, paying particular
attention to the technological evolution
of 
plants,  materials,
equipment and productive processes.

industrial 

accidents 

ISPESL 

of 

ISPESL  has  41  bases 
Italy:  5
headquarters  in  Rome  plus  36  offices
throughout the Italian territory. 

in 

The  evaluation  should  be 
accordance with the following scale:

read 

in

0(cid:2)KPI<4

low

4(cid:2)KPI<5

acceptable

5(cid:2) KP<7

good

7(cid:2)KPI(cid:2)10

excellent

Critical values that
determine a substantial
disregard for security 
It is possible without
significant effort to
obtain good
improvements
Positive values which,
with targeted
interventions, may
allow further
improvements
Acceptable mean values
for the current
requirements in terms
of security

KPI levels 

with 

However,  CNIPA  methodology  is  based  on
questionnaires 
dichotomous
responses (Yes/No), so they do not evaluate
the  efficacy  of  security  countermeasures.
In  order  to  obtain  a  realistic  benchmark,
results  are  weighted  with  those  obtained
when  using  an  evaluation  tool;  using
MAGERIT  methodology,  this  provides  five
possible  levels  for  the  effectiveness  of
countermeasures.

An example of the methodology is shown in
the table overleaf:

>>

At  the  end  of  2008,  ISPESL  set  itself  the
Information
mission  of  achieving  the 
Security  Management  System 
(ISMS)
certification, ISO/IEC IS 27001:2005, for its
Data  Processing  Centre  during  2010.  To
this end, methodologies, tools and metrics
have been identified which will be useful in
performing  a  risk  analysis  of  information
security.

Methodology
There are two types of risk to be assessed:
technological and organisational. 

With  regard  to  technological  risks,  the
architecture of the system has been tested
verify  compliance  with  security
to 
requirements  according  to  the  CVSS
(Common  Vulnerability  Scoring  System)
methodology.  The  CVSS  was  conceived  by
Infrastructure  Advisory
the  National 
in  the
Council  (NIAC,  www.dhs.gov/niac)
United  States  and  was  released  by  its
Department  of  Homeland  Security.
Impartiality  and  exactness  of 
the
methodology  are  guaranteed  by  FIRST
(Forum  of  Incident  Response  and  Security
Teams, www.first.org). 

The analysis was carried out on an internal
network  on  real  systems  using  Nessus
(www.nessus.org)  in  order  to  check  for
vulnerabilities.

The  results  of  the  analysis  refer  to  the
CVSS  base  metrics  and  have  been
processed  using  the  free  tool,  CVSS
calculator,  to  obtain  significant  values
related to the real environment. The level of
risk obtained conforms to the environment
and  establishes  the  priority  of  corrective
actions  required.  The  residual  risk  was
computed using temporal metrics.

To  assess  managerial  and  organisational
risks,  the  MAGERIT  (Methodology  for
Analysis  and  Management  of  Risks  for
Information Technology) open methodology
was  used.  MAGERIT  was  developed  in
for
Spain  by 

the  National  Centre 

the 

and 

Intelligence 
National
Cryptographic  Centre,  in  conjunction  with
the  Ministry  of  Public  Bodies.  Without
this
neglecting 
methodology  focuses  on  highlighting  the
importance  of  management 
the
implementation of an ISMS.

technical 

aspects, 

in 

The analysis was executed using a specific
tool,  acquiring  information  through  audits
conducted  by  the  Chief  Security  Officer
(CSO) and taking into account threats to the
availability,  integrity  and  confidentiality  of
information.

In  order  to  compare  the  results  of  the
methodologies accurately, the levels of risk
obtained have been conformed as follows:

CVSS Level

MAGERIT
Level

Risk level

8, 9, 10

6, 7

4, 5

2, 3

1

5

4

3

2

1

High 

Medium-High

Medium-Low

Low-Medium

Low

CVSS and MAGERIT levels

Finally,  to  obtain  a  significant  benchmark
for  the  public  sector,  the  project  used  the
set  of  questions  produced  by  the  National
Centre  for  Informatics  in  Public  Bodies
(CNIPA,  www.cnipa.gov.it/) to  collect  data
concerning  information  security  in  Public
Bodies.  The  results  were  then  weighted,
and integrated with the results produced by
other tests.

The CNIPA survey consists of 36 questions
and  13  closed  sub-answers,  which  are
collected  into  subsections  and  associated
following  Key  Performance
the 
with 
Indicators (KPIs):
• KPI1: Logical security 
• KPI2: Infrastructure security
• KPI3: Service security
• KPI4: Organisational security

ENISA Quarterly Review  Vol. 5, No. 4, December 2009

ENISA EQ Dec 2009  22/12/09  15:02  Page 24

INFORMATION SECURITY MANAGEMENT SYSTEMS

possible  improvements  there.  The  results
of MAGERIT are used to anticipate various
possible  improvements  in  management
and organisation, in order to mitigate risks
in  an  ISMS,  consistent  with  the  standard
UNI-ISO IS 27001:2005.

This  methodology  is  useful  as  an  internal
meter to improve an ISMS, by following the
analysis through evaluation of the maturity
and  efficacy  of  countermeasures  and  a
review  of  environmental  parameters  in
CVSS  analysis.  Finally,  a  review  of  PKIs
allows 
improvements  to  be  checked
against other public bodies. 

Finally,  the  project  has  produced  one
additional,  important  benefit.  ISPESL  has
provided 
other
standard 
organisations,  so  that  they  can  compare
the  results  produced  by  MAGERIT  and
weighted CVSS.

for 

a 

(Francesco.Merlo@
Francesco  Merlo 
ispesl.it)  is  an  Adjunct  Professor  in  the
Department  of 
the
University of Turin in Italy (www.francesco-
merlo.it/).

Informatics 

in 

Salvatore  D’Emilio  (Salvatore.DEmilio@
ispesl.it)  is  an  ISO  27001  lead  auditor  and
the Chief Security Officer at ISPESL in Italy.

Francesco  Gaudieri  (Francesco.Gaudieri@i
spesl.it)  is  an  ISO  27001  lead  auditor  at
ISPESL in Italy.

Section

Public Body

CNIPA
Average

Content

Questionnaire

Weighted

KPI 1

8.25

7.00

7.33

KPI 2

7.60

KPI 3

5.50

7.08

5.47

KPI 4

4.75

3.25

5.41

Real analysis of a Public Body

Weighting  is  according  to  the  maturity  levels  of
the  system  and  on  the  basis  of  the  findings  of
MAGERIT analysis: 
Response value = X*Lx (level)
Where Lx is:
• 10% 
• 50% 
• 90% 
• 95% 
• 100% 

L1 initial 
L2 reproducible but intuitive
L3 defined process
L4 managed and measurable 
L5 optimised

Key: 
According to the national average 
Non-Conform
Nearly Conform
Conform

Weighting rule for PKI

• organisational model for system administration, establishment 
of policy, resources access control and certification requirements

• authentication systems, software & operating system updates

• security of perimeter and physical access control
• firewall, intrusion prevention/detection systems
• remote access tools

• business continuity procedures, disaster recovery plan
• content and web filtering
• detect intrusions, and/or prevent them, depending on the type of

attacks already suffered

• roles required by laws 
• manage incidents properly
• establish policy and take care of the budget reserved for 

information security

The results
The  methodology  adopted,  including  the
use of tools with different purposes, allows
the possibility of basing future investment
and commitment not only on the results of
a  traditional  risk  analysis,  but  also  after
through
checking  existing  conditions 
the
Nessus  analysis.  This 
analysis and also allows the knowledge of
the  interviewees  to  be  measured.  Nessus
outcomes are then filtered through the use
of  the  environmental  parameters  of  CVSS
in  order  to  produce  real  –  rather  than
theoretical – risk values.

improves 

addition,  weighted  PKIs 

In 
allow
comparisons  to  be  made  with  other
national bodies.

The  results  of  the  technical  analysis  are
directed  to  the  technical  area,  leading  to

ENISA wishes to thank all the contributors
to the publication. Please remember that all
contributions  reflect  the  views  of  their
authors  only,  and  are  not  in  any  way
endorsed  by  the  European  Network  and
Information  Security  Agency.  ENISA
assumes no responsibility for any damages
that may result from use of the publication
contents or from errors therein. 

The  ENISA  Quarterly  Review is
published  once  each  quarter.  You  can  find
information  about  the  ENISA  Quarterly
issues  and
Review, 
information,  on  the  EQR
subscription 
pages 
website:
the 
on 
www.enisa.europa.eu/publications/eqr

including  back 

ENISA 

Editor-in-Chief, Panagiotis Trimintzios:
eq-editor@enisa.europa.eu

More about ENISA
For the latest information about ENISA,
check out our website at:
www.enisa.europa.eu.

European Communities, 2009
Reproduction is authorised provided the
source is acknowledged.

0

W
S
D
D
0
3
<
0
3
3
7
0
H
Q
F

0