Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Matteo Cavallini Cybersecurity: State of the Art and Future Trends in Italy Digital Agenda Assembly - Cybersecurity: barriers and incentives 16 June 2011, Brussels

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Since 2007 I have been the manager of the Local Security Unit (LSU) of the Italian Ministry of Economy Positions held: ● Senior security member fo the GovCERT.it team project ● Senior security expert for the Testing Commission of the Public Connectivity System ● Internet security manager of the Italian Ministry of Economy Certifications: ● Lead Auditor ISO ● EUCIP Professional “Security Adviser” About me

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Agenda Local Security Units and CERT-SPC - the security infrastructure of the Italian Public Administration Italian Governmental CERT - a start-up project National and International security exercises - the way to assure the right level of preparedness Italian AntiBotnet Center - an example of an incentive proposal

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives LSUs are the Operational CERT in the PA Internal Organization Operational groups Reperibili Monitoring of the Information sources Supporting incident handling Operational activities for incident prevention and handling Receiving incident alerts & reports

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Consip Incident Prevention ● Monitoring of the sources ● Verifying & Prioritizing the reports ● Establishing the prevention activities LSUs are the Operational CERT in the PA MEF Incident Prevention Planned Activities Incident Prevention Planned Activities Tech. & Security Providers Security Information Sharing

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives LSUs are the Operational CERT in the PA Operational coordination MEF Incident Reporting ● Incident triage ● Incident analysis ● Incident response plan definition Involvment of the Police cyber unit Incident Response Consip Incident handling operational support Incident handling operational support

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives CERT-SPC is the Coordination Centre Tech. & Security Providers LSU SOC PCS’s Providers SOC PCS’s Providers SOC PCS’s Providers SOC of PCS Providers

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives CERT DIFESA TC National Cyber Response Exercise Cybershot 2010 Coordination CERTs Operational CERTs “Real” injections: ● Network scan ● Brute force attack ● Intrusion ● Web Defacement

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Cyber Incident Exercise ● ISCOM – MISE partecipated in the first pan-European exercise (Cyber Europe 2010) acting as the Italian focal point and playing the roles of planner and moderator ● On the basis of the experience, ISCOM will partecipate in the second pan-European exercise in 2012, to start testing the planned EU cyber- incident contingency plan ● ISCOM will partecipate in the EU/US exercise within the area of EU/US Working Group on Cybersecurity and Cybercrime ● ISCOM will organize a national exercise in cooperation with other governmental institutions and private stakeholders

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives ● ISCOM contributes to the “ad hoc” ENISA working group in order to define and harmonize the security measures among MSs to be accomplished by TELCO operators ● ISCOM has established a national working group with network operators and service providers to receive feedback from the private stakeholders Minimum Security Measures Art. 13 Directive 2009/140/EC

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Governmental CERT ● Currently Italian CERTs are dedicated to specific networks and users, such as Public Administration and Defense ● In order to establish a well-functioning network of CERTs at the EU level by 2012, the MSs are requested to implement an operational national/governmental CERT ● ISCOM will cooperate with other institutions to create a national CERT that will coordinate the other internal CERTs and will be a unique national contact point for the European counterparts

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Italian AntiBotnet Center Botnets are networks of infected PCs remotely managed by cybercriminals to perform illegal activities such as the following: spam, phishing, DDoS attacks, financial fraud, identity fraud, clickfraud, etc. Why Botnet? Botnets have a strong social impact on citizens and represent a serious obstacle to the development of the high value services (e-commerce, e- government programs, etc. ) over the Internet

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Italian AntiBotnet Center At the moment, the Center is a proposal still in the evaluation and feasibility study phase. The proposed structure would be linked to the German AntiBotnet Center and should be a Public-Private Partnership with the involvement of the: ● Internet Service P roviders ● Security and Technology Vendors ● Various Professional Associations The proposed funding would be limited to the start-up and the first two years of activity. The following years would be financed by the private sector, encouraged by the benefits achieved. In our view, this initiative is a good example of an incentive to deliver a higher level of network and information security.

Matteo Cavallini – ULS MEF/Consip Digital Agenda Assembly – Cybersecurity: barriers and incentives Thanks twitter