-
Europe’s talents compete at the European Cyber Security Challenge!
-
One hundred young European white hat hackers representing 10 EU Member States and EFTA countries met in Düsseldorf for the 2nd Cyber Security Challenge competition on the 7th - 9th November.
Located in
News
/
ENISA News
-
Cyber Europe 2010 Report
-
The first pan-European exercise on Critical Information Infrastructure Protection (CIIP) CYBER EUROPE 2010 was
organised by EU Member States (MS), facilitated by the European Network and Information Security Agency
(ENISA) and supported by the Joint Research Centre (JRC).
The objective of the exercise was to trigger communication and collaboration between countries in Europe to try
to respond to large-scale attacks. During the CYBER EUROPE 2010 exercise, experts from the participating public
bodies of European countries worked together to counter simulated attempts by hackers to paralyse the Internet
and critical online services across Europe.
The simulation exercise was based on a fictitious scenario.
Located in
Publications
-
Cyber Europe 2012 - Key Findings Report
-
Cyber Europe was the biggest pan-European cyber security exercise to date. This report gives the key findings from ENISA.
Located in
Publications
-
ENISA Cyber Europe 2014 - After Action Report
-
ENISA's After Action Report of the pan-European cybersecurity exercise Cyber Europe 2014 (CE2014) was approved by the EU Member States and gives a high-level overview of the complex cybersecurity exercise that was carried out in 2014. The full after action report includes an engaging action plan which ENISA and Member States are committed
to implement.
Located in
Publications
-
Latest Report on National and International Cyber Security Exercises
-
During this study ENISA gathered and analysed a large set of over 200 exercises.
In addition to the exercise dataset, ENISA analysed specialised literature such as after-action reports and previous studies that have contributed to the analysis. This report includes a model for describing and reporting on such exercises. The study is a step forward towards better resource for planning and collaboration between nations and agencies interested in cybersecurity exercises.
The findings show a continuous and accelerated increase in the total amount of exercises held after 2012, as well as an increase in the number of cooperative exercises involving private and public actors. This indicates that it is not just a matter of public agencies running more exercises, but also of more actors benefiting from these exercises.
Located in
Publications
-
National and International Cyber Security Exercises: Survey, Analysis & Recommendations
-
Cyber exercises are an important tool to assess the preparedness of a community against cyber crises, technology failures and critical information infrastructure incidents. ENISA supports the stakeholders involved in EU cyber exercises.
This report aims to support European and international bodies involved in cyber exercises with lessons learned about cyber exercises and recommendations for the future. The report presents the results of the ENISA 2012 research and analysis by ENISA in 2012 of national and international cyber exercises carried out.
ENISA examined 85 exercises covering the period between 2002 and 2012. In total, 84 countries worldwide participated in the multinational exercises analysed in this report. A total of 22 European countries conducted national cyber-exercises.
Located in
Publications
-
Common practices of EU-level crisis management and applicability to the cyber crises
-
Despite a number of initiatives within the European Network and Information Security community to establish frameworks and standard operating procedures, the EU-level response to cyber incidents, and in particular these which lead to crisis situations, lacks consistency. Today, should a crisis arise from a large-scale cyber incident, Member States would lack a harmonised framework to effectively respond to the challenges posed by this incident.
Based on detailed analysis of five different EU-level crisis management frameworks, this report highlights those lessons learnt from years of crisis management in five different sectors which would be applicable to the cyber domain, and provides a series of key recommendations regarding EU-level priorities to alter the outcome of the next cyber crisis.
Located in
Publications
-
National-level Risk Assessments: An Analysis Report
-
This report is based on a study and analysis of approaches to national-level risk assessment and threat modelling for cyber security which was conducted between April and October 2013. ENISA aims to provide an evidence-based methodology for establishing a National-level Risk Assessment in order to contribute to the wider objective of improving national contingency planning practices (NCPs) . This report will help towards rationalising national risk assessments in EU Member States in order to reduce or eliminate vulnerabilities of critical Information and Communication Technology (ICT) services and infrastructures.
In conclusion we can see that understanding of the national approach to cyber security and how risk decisions are taken in different countries is important to ensure that the results of any National-level Risk Assessment reach key decision-makers at the right time. It is also clear that there are a variety of approaches and levels of sophistication used in National-level Risk Assessments. Qualitative tools appeared to be preferred due to the complexities of understanding risk in the cyber domain. Depending on the preconditions regarding implementation, risk assessment could be performed using a common set of methods or in a more decentralised fashion. Challenges included the diversity of methodologies and approaches to National-level Risk Assessments (which highlights the need for this guidance document) as well as the complexities of public–private cooperation. As might be expected, many countries studied drew lessons from others when preparing their National-level Risk Assessment programmes. Some countries had identified priorities that they were seeking to focus on, including greater understanding of threats, improved stakeholder engagement and better national CIIP frameworks.
Based on an analysis of the data gathered we recommend the following:
1. Member States should understand better the underlying cyber threats and risks that they face and the impact to society.
2. Member States are advised to integrate National-level Risk Assessment into the lifecycle of NIS incident management and cooperation plans and procedures.
3. Member States should expand public–private sector dialogue and information sharing.
4. A practical step-by-step guide on how to perform National-level Risk Assessments should be developed, tested and maintained. Such a guide should be piloted by countries at the early stages of preparing their own National-level Risk Assessment programme. ENISA or another international institution would be appropriate bodies to oversee this action.
5. A catalogue of scenarios to help Member States in their National-level Risk Assessments should be established at EU level. Such a catalogue could be based on work already being done at ENISA on the threat landscape and incident reporting .
6. The EU community of practitioners with an interest in cyber National-level Risk Assessments should be established and strengthened as information exchange platform, e.g., within the framework of the European Commission’s NIS Platform .
7. Risk analysis expertise must be shared from other domains that assess complex cross-border risks, such as border security, financial services, aviation or public health for example within the European Commission’s NIS Platform and other activities organised by ENISA.
Located in
Publications
-
Artificial Intelligence – An opportunity for the EU cyber-crisis management: presentations
-
Located in
Events
/
Artificial Intelligence – An opportunity for the EU cyber-crisis management
/
Workshop presentations
-
EQR Q1 2007, vol. 3, no. 1
-
Open issue
Located in
Publications
/
ENISA Quarterly Review - Archive
/
Past Issues