Info notes production and review mechanism : WP2016 2.2A 1 infonotes mechanism.
Date: 2017-02-03
Institutions: European Union Agency for Cybersecurity
Subjects: European Union Agency for Cybersecurity, computer crime, cybernetics, data protection, digital technology, information technology

Info Notes Production and 
Review Mechanism  
WP2016 2.2A 1 Infonotes Mechanism 
FINAL 
VERSION 1.0 
INTERNAL 
DECEMBER 2016 

www.enisa.europa.eu                    European Union Agency For Network and Information Security 

 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

About ENISA 

The European Union Agency for Network and Information Security (ENISA) is a centre of network and 
information security expertise for the EU, its member states, the private sector and Europe’s citizens. 
ENISA works with these groups to develop advice and recommendations on good practice in information 
security. It assists EU member states in implementing relevant EU legislation and works to improve the 
resilience of Europe’s critical information infrastructure and networks. ENISA seeks to enhance existing 
expertise in EU member states by supporting the development of cross-border communities committed to 
improving network and information security throughout the EU. More information about ENISA and its 
work can be found at www.enisa.europa.eu. 

Contact 
For queries in relation to this paper, please use opsec@enisa.europa.eu 
For media enquiries about this paper, please use press@enisa.europa.eu. 

Legal notice 
Notice must be taken that this publication represents the views and interpretations of ENISA, unless 
stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA 
bodies unless adopted pursuant to the Regulation (EU) No 526/2013. This publication does not 
necessarily represent state-of the-art and ENISA may update it from time to time. 

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external 
sources including external websites referenced in this publication. 

This publication is intended for information purposes only. It must be accessible free of charge. Neither 
ENISA nor any person acting on its behalf is responsible for the use that might be made of the 
information contained in this publication. 

Copyright Notice 
© European Union Agency for Network and Information Security (ENISA), 2016 
Reproduction is authorised provided the source is acknowledged. 

ISBN: 978-92-9204-193-9 

02 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Table of Contents 

1. 

Introduction 

2.  Development 

  Philosophy and goals 

3.  Evolution 

  Manpower 

  Roles and resources 

  Tools 6 

InfoNotes dissemination 

3.4.1  NLOs 
3.4.2 

Public web site 

4. 

Future evolution 

  Objectives 

  Report form 

  Procedure 

  Liaising with others and use of external material 

  Dissemination and Marketing 

  Re-branding 

Annex A: Resulting Notes 

Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

4 

5 

5 

6 

6 

6 

7 
7 
7 

8 

8 

8 

8 

9 

9 

9 

12 

03 

 
 
 
 
 
 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

1.  Introduction 

ENISA began in 2015 to produce regular information notes, dubbed “InfoNotes”. This activity was the 
object of a final report that advised to continue the development of InfoNotes and their dissemination [1]. 

ENISA’s Amended Work Program 2016 defines the following objectives for the info notes project: 

 

Improve the mechanism that will allow the Agency to provide timely and high-quality responses to 
NIS developments. 

  Timely information provided to key stakeholders on NIS incidents and on significant developments 

in the field. 

This document aims at reporting on the activities related to infonotes during 2016, and point at ways to 
make the InfoNotes product evolve for the future. This document is not a complete presentation of the 
InfoNotes product and the different kinds of notes – it only highlights changes where they occurred. 

The public for this document is ENISA staff involved in the project and its future. 

04 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

2.  Development 

  Philosophy and goals 

The philosophy and goals of the product are to provide an expert point of view, that is not driven by 
urgency; one that delivers a reasonable point of view, not drive by politics; one that delivers 
recommendations, unbiased by financial or partisan interests. 

The team followed the same methodology of “Learning by doing” 

05 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

3.  Evolution 

  Manpower 

The team welcomed the addition of a person dedicated to the production of InfoNotes. This led to a 
change in the production process. Instead of having all the team members monitor news and write up 
InfoNotes in turn, this person drafted the reports under the guidance and the responsibility of the internal 
expert. 

  Roles and resources 

With the addition of a dedicated team member, the roles were spread as follows: 

  Dedicated person: monitor news, and pre-select potential topics; draft InfoNotes 
  Experts from the team: final selection of topics; expert guidance as to the direction of the draft; 

final edition; peer review. 

This change allowed the rest of the team to spend significantly less time on InfoNotes, and made the 
continuous production of notes easier by making it less dependent on volunteer availability. 

  Tools 

The team used essentially the same tools as before, with the addition of ENISA’s web site. In the course of 
2016, ENISA revamped its web site, and InfoNotes got a dedicated section as “Publications” 
(https://www.enisa.europa.eu/publications/info-notes, Figure 1) 

Figure 1InfoNotes on the ENISA web site 

06 

 
 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

  InfoNotes dissemination 

3.4.1  NLOs 

As part of the evolution of the service, ENISA started to send InfoNotes as pdf files to its Network of Liaison 
Officers (NLOs). These people are designated by EU Member States to facilitate the flow of information 
between ENISA and interested parties in their respective MS.Some NLOs did that very effectively, one of 
them forwarding every InfoNote to about 500 public and private organisations in their country. 

Some of them forwarded feedback from their constituencies, but that feedback was very limited. It 
consisted mainly of requests to directly receive Info Notes.  

3.4.2  Public web site 

Following the revamp of ENISA’s web site, the team started to also publish InfoNotes on the public web 
site, new notes first, then over time the team also published the notes from 2015 retroactively. 

07 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

4.  Future evolution 

  Objectives 

Make current Info Notes an ENISA-wide resource that will serve as an active disseminator for the entire 
ENISA work produced. This means that triggers for a note will come from various colleagues/units. 
Similarly, depending on the topic and context of the trigger, editorial leadership of the note will be with 
the relevant unit. 

With regards to ENISA’s stakeholders, Info Notes will be changed into a kind of Cyber Security Intelligence 
Service. The notes will be drafted mostly for NON-CERT and if possible NON-security expert (i.e. decision 
makers) and should be consumable by non-experts. 

In recent time, experts warn about the absence of CONTEXT in cyber security information. ENISA will 
contribute in establishing context out of news. This will done by putting current events/incidents/news 
into the context of internal and external work references. 

With this, older ENISA results will be “re-animated” and put in new context under the light of current 
events/developments. For example, on the occasion of an event, a note may indicate content from past 
ENISA work as a mitigation. Hence, past ENISA work will be validated and eventual the need for 
updates/revisions will be generated thus helping the WP process. 

This will facilitate dissemination and knowledge transfer from internal and external pools and will make up 
the added-value of the “service”. 

Buy-in by all operational units is necessary for the success of this service. 

  Report form 

Provide short (possibly one page) reports, which - depending on the information security 
incident/development to be reported - will be the result of the collaboration of the Info Notes core team 
(needs to be defined) with experts of this particular topic across the CODs. 

A better classification of the covered content should be achieved. This will be achieved by developing an 
underlying structure that covers all possible types of information that is part of cyber security intelligence 
(e.g. vulnerabilities, threats, threat agents, assets, controls, attach vectors, victims, sectors, etc.). Then this 
structure will be used as Tagging for the note. 

  Procedure 

On a per request basis (and possibly on a regular basis as currently done) such as security incidents and 
developments, the Info Notes core team will evaluate the incident/development against certain criteria, 
threat vectors, sector of concern etc. in order to:  

-  Categorise it and  

-  Request contribution from the appropriate ENISA experts 

The Info Notes team will initiate the preparation of the report (Info Note), and will essentially provide an 
overview of the incident/development. 

08 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

In collaboration with other ENISA experts on the topic, recommendations will be given providing a 
coherent report in accordance with current or past ENISA projects.  

The timeline of the whole publication procedure needs to be defined (a cross COD collaboration requires 
good coordination and thus publication cycle must be carefully considered). 

  Liaising with others and use of external material 

In order to not compete but complement CERTS, vendors, governmental bodies, etc. references to their 
advisories can be provided.  

Additionally, in collaboration with other parties, e.g. AV companies, MoU partners, etc. references to their 
material can be also provided. 

  Dissemination and Marketing 

Disseminating Info Notes, is something that must be considered in more detail (there is already a place for 
Info Notes in the ENISA website). 

It can later be migrated to a different platform that was proposed (ETL Web App).  

Advertising new Info Notes on twitter and LinkedIn. 

Feedback (from comments on twits) or public comments on published Info Notes can be enabled and 
moderated for receiving more direct feedback. This will need to be automated but it will need some 
resources. 

Upon publication, the content will be also automatically published in as a tweet and as news item in 
LinkedIn accounts (proposed to be a dedicated one, otherwise ENISA). 

Users should be in the position to respond to publications feedback (eventually depending on 
implementation, but anyway through social media – the main reason for separating from ENISA’s ones). 

  Re-branding 

Turn Info Notes into a Cyber Security Intelligence Service (the official name to be finalized). 

The notes will be drafted mostly for NON-CERT and if possible NON-security expert (i.e. decision makers) 
and should be consumable by non-experts. 

The product will be disseminated in the ENISA site and will be appropriately integrated in the social 
networking sites. 

Proposed titles of this “service” are: 

-  Cyber Security Information Service (CSIS),  

-  Cyber Threat Intelligence Brief (CTI-Brief),  

-  Cyber Security Intelligence Brief (CSI-Brief),  

-  Cyber Security Summary (CSS),  

- 

Security Event Notification Service (SENS). 

09 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

-  Cyber Security Advisory (CSA). 

10 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

5.  References 

[1]  

ENISA, “Development of the Info Notes service,” 2015. 

11 

 
 
 
 
 
 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

Annex A: Resulting Notes 

TITLE 

DATE 

KIND 

DDoS on DNS root servers 

13/01/2016 

What’s Behind 

Home insecurity 

27/01/2016 

Info Note 

How to avoid losing a lot of money to CEO Fraud 

10/02/2016 

Info Note 

Malware infiltrates Russian trading system 

24/02/2016 

Info Note 

The DROWN Attack 

09/03/2016 

Info Note 

Information Operations – Active Defence and Offensive Countermeasures 

23/03/2016 

Glossary Entry 

Malvertising 

Locky Ransomware 

Blockchain 

06/04/2016 

Info Note 

20/04/2016 

Suggested Reading 

04/05/2016 

Glossary Entry 

ImageMagick Vulnerability 

18/05/2016 

What’s Behind 

The Dangers of Trusting User Input 

01/06/2016 

Info Note 

A Novel and Stealthy Hardware Trojan/Attack 

15/06/2016 

What’s Behind 

Massive Data Breaches 

29/06/2016 

Info Note 

Breaking Android’s Full Disk Encryption 

13/07/2016 

What’s Behind 

Microsoft Windows Printer Spooler Legacy Vulnerability 

27/07/2016 

Info Notes 

Responsible Vulnerability Disclosure and Response Matter 

10/08/2016 

Info Notes 

Vulnerabilities - Separating Reality from Hype 

24/08/2016 

Info Note 

Certificate Authorities - The Weak Link of Internet Security 

07/09/2016 

Info Note 

Point of Sale Attacks 

21/09/2016 

Info Note 

The “Shadow Brokers” Story 

05/10/2016 

Suggested Reading 

12 

 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

TITLE 

DATE 

KIND 

Malware in Browser Extensions 

19/10/2016 

Info Note 

Major DDoS Attacks Involving IoT Devices 

03/11/2016 

Suggested Reading 

AtomBombing – A New Code Injection Attack 

15/11/2016 

What’s Behind 

13 

 
 
 
 
 
 
 
Info Notes Production and Review Mechanism 
FINAL  |  Version 1.0  |  Internal  |  December 2016 

Intentionally left blank 

14 

 
 
 
 
ENISA 
European Union Agency for Network  
and Information Security 
Science and Technology Park of Crete (ITE) 
Vassilika Vouton, 700 13, Heraklion, Greece 

Athens Office 
1 Vasilissis Sofias  
Marousi 151 24, Attiki, Greece 

Catalogue Number: TP-06-16-354-EN-N 

PO Box 1309, 710 01 Heraklion, Greece 
Tel: +30 28 14 40 9710 
info@enisa.europa.eu 
www.enisa.europa.eu 

ISBN: 978-92-9204-193-9 
DOI: 10.2824/253147