ENISA: Cybersecurity policy in Energy Dr. Andreas Mitrakas, LL.M., M.Sc., Head of Unit Quality & data mgt

Transcription

1 ENISA: Cybersecurity policy in Energy Dr. Andreas Mitrakas, LL.M., M.Sc., Head of Unit Quality & data mgt Cyber European Union Security Agency for Network Energia, and Informa8on Rome, Security 24/09/15

2 Agenda 01 About ENISA 02 PuQng Security at the Service of the Economy 03 Building Effec8ve NIS Communi8es 04 ENISA Recommenda8ons 05 Policy Implementa8on 06 Learning by Doing : a Hands on approach 07 Conclusions 2

3 About ENISA

4 ENISA ENISA was formed in The original mandate was renewed and extended in 2013 The Agency is a Centre of Exper8se that supports the Commission and the EU Member States in the area of informa8on security ENISA seeks to facilitate the exchange of informa8on between communi8es, with par8cular emphasis on the EU ins8tu8ons, the public sector and the private sector 4

5 PuQng Security at the Service of the Economy

6 Using NIS to Support Growth ENISA promotes approaches to NIS that support economic growth, by: Assis8ng opera8onal communi8es in transla8ng abstract policy statements into real- world opera8ons Making lessons learned in one community available to other affected communi8es promo8on of best prac8ce Ensuring that policy can be implemented in an economically efficient way by promo8ng economically efficient processes Iden8fying gaps and barriers to EU economic development that arise out of NIS issues 6

7 Building Effec8ve NIS Communi8es

8 ENISA ac8vi8es Recommenda5ons Mobilising Communi5es Policy Implementa5on Hands on 8

9 ENISA Recommenda8ons

10 Emerging Threat Landscape series Significant physical disasters affec8ng CIIs Complex networks and services Low quality of sobware and hardware Asymmetric threats allowing remote acacks to CII Increasing organised cybercrime and industrial espionage Lack of interna8onal agreements and regimes Lack of well func8oning, interna8onal opera8onal mechanism 10

11 ENISA Threat Landscape

12 Na8onal Cyber Security Strategies 20 NCSS in EU; a few under development Different maturity levels CIIP key subject in NCSSs PPPs limited success so far SMEs not properly covered Overlaps in authori8es and mandates Assessment of NCSS is an issue 12

13 Policy Implementa8on

14 Cri8cal Sectors in EU28 + EFTA Sectors Energy ICT Water Food Health Financial Public & Legal Order Civil Admin. Transport Chemical & Nuclear Industry AU P P P P P P P P P P BE P P P P CZ P P P P P P P DK P P P P P EE P P P P P P P P P FI P P P P P P P P FR P P P P P P P P P P DE P P P P P P P P EL P P HU P P P P P P P P IT P P MT P P P P P P NL P P P P P P P P P PL P P P P P P P P P SK P P P P P ES P P P P P P P P P P UK P P P P P P P P CH P P P P P P P P Space & Research 14

15 CIP, CIIP and NCSS 15

16 Security & Data Breach No8fica8on Suppor8ng MS in implemen8ng Ar8cle 13a of the Telecommunica8ons Framework Direc8ve Supported NRAs in implemen8ng the provisions under ar8cle 13a Developed and implemented the process for collec8ng annual na8onal reports of security breaches Developed minimum security requirements and propose associated metrics and thresholds Suppor8ng COM and MS in defining technical implementa8on measures for Ar8cle 4 of the eprivacy Direc8ve Recommenda8ons for the implementa8on of Ar8cle 4 Collabora8on with Art.29 TS in producing a severity methodology for the assessment of breaches by DPAs 16

17 Ar8cle 13a - Incidents incidents from 18 countries, 9 countries without significant incidents, 1 country with incomplete implementa8on Most incidents are caused by System failures (61%), Human errors (19%), malicious ac8ons (6%), natural disasters (14%) 14 Natural phenomena Human errors Malicious ac8ons System failures 17

18 Na8onal CERT outlook SITUATION IN 2014: SITUATION IN 2005: Finland France Germany Hungary The Netherlands Norway Sweden United Kingdom Lithuania Armenia Luxembourg Austria Malta Belgium Netherlands Bulgaria Norway Croatia Czech RepublicPoland Portugal Denmark Romania Estonia Slovakia Finland Slovenia France Spain Georgia Sweden Germany Switzerland Greece Turkey Hungary Ukraine Iceland United Kingdom Ireland Israel EU Institutions Italy Latvia We are building and ac8vely suppor8ng a growing network of na8onal/governmental CERTs CERT Interac8ve MAP: hcp:// by- country- interac8ve- map 18

19 ICS- SCADA tes8ng ICS security tes8ng appears to be uncoordinated No real ICS security educa8onal environment in the EU Low maturity level of ICS security tes8ng methodologies and ini8a8ves in Europe 19

20 Cer8fica8on of skills in ICS/SCADA Skills gaps in safety and security Handle the confluence of contents, objec8ves and needs of two very different topics such as cyber security and industrial automa8on Cover from the lower opera8ve levels to the top management Avoid commercial interests that could impair the credibility of cer8fica8ons Obtain stakeholders support to underscore the relevance, credibility and strength of future cer8fica8ons 20

21 Learning by Doing

22 Cyber Exercises Cyber Europe 2010 Europe s first ever interna8onal cyber security exercise EU- US exercise, 2011 Also a first : work with COM & MS to build transatlan8c coopera8on Cyber Europe 2012 Developed from 2010 & 2011 exercises Involves MS, private sector and EU ins8tu8ons Highly realis8c exercise, Oct

23 Conclusions

24 Conclusions ENISA works together with opera8onal communi8es to iden8fy pragma8c solu8ons to current security issues We issue concrete advice on how to improve system security and which implementa8ons to favour The solu8ons we propose are based on industry best prac8ce and are therefore known to work By working in this way, we put security to the service of EU industry and improve the compe88veness of our industries 24

25 Thank you for your acen8on! PO Box 1309, Heraklion, Greece Tel: