ENISA efforts for securing European Internet Infrastructure Rossella Mattioli Security and Resilience of Communication Networks Officer

Securing Europe’s Information Society Operational Office in Athens The European Union Agency for Network & Information Security (ENISA) was formed in 2004. The Agency is a Centre of Expertise that supports the Commission and the EU Member States in the area of information security. We facilitate the exchange of information between EU institutions, the public sector and the private sector ENISA is as a body of expertise, set up by the EU to carry out very specific technical, scientific tasks in the field of Information Security, working as a "European Agency". EU agencies are distinct bodies from the EU institutions – separate legal entities set up to perform specific tasks under EU law The Agency also assists the European Commission in the technical preparatory work for updating and developing Community legislation in the field of Network and Information Security.

Positioning ENISA activities POLICY IMPLEMENTATION HANDS ON MOBILISING COMMUNITIES RECOMMENDATIONS

Increasing reliance on communication networks Today’s challenges Increasing reliance on communication networks Emerging threat environment hampering the availability, integrity and confidentiality of networks based on: Infrastructure vulnerabilities Interdependencies Privacy concerns The Internet infrastructure is the backbone of the information society but as it has become clear in the recent news, different threats, both technical and geopolitical, can hamper its availability. Citizens expect national authorities to be fully aware of the possible interdependencies and put in place all possible measures to ensure the security and resilience of their communications. 11 http://www.enisa.europa.eu/internetcii

Internet Infrastructure assets

ENISA Threat Landscape Report http://www.enisa.europa.eu/internetcii

Current Internet infrastructure threats

Routing threats - good practices

DNS threats - good practices

DDoS - good practices

Internet Threat Landscape - recommendations Evaluate your current level of security by understanding the assets covered (and not covered) by existing security measures Evaluate the application of adapted good practices in a focused manner Cooperate with the community to exchange on threats and promote the application of good practices as mitigation measures For users deploying good practices guides: report on their implementations, assets covered and gaps found Words matter: Ensure the right use of terms and definitions

Internet Threat Landscape - recommendations Use proper risk assessment methods to understand vulnerable assets in your infrastructure and prioritise your protection actions Build an information and communication technology security awareness and training program Infrastructure owners shall commit third-party vendors to apply security measures Infrastructure owners should stay current on any updates

Latest ENISA activities regarding electronic communications “Protection of Underground Electronic Communications Infrastructure” to prevent damages caused by civil work to buried cables “Secure ICT Procurement in Electronic Communications” regarding risks associated with 3rd party ICT products and outsourced services “Methodologies for identification of Critical Information Infrastructures assets and services “to identify which specific assets and services in communication networks are critical for a a particular Member State Annual report regarding the most severe outages of electronic communication networks or services that are reported to the communication authorities of each Member State every year.

Participate in our activities

Studies and community engagement Ideas for upcoming studies/papers Surveys Interviews Previews of our studies Feedback Validation sessions

Workshops 2013 - Before RIPE 67 in Athens 2014 - After Internet Security Days in Cologne 2015 - Q4 TBD - focus on connectivity interdependencies for smart grids

INFRASEC - Internet infrastructure security and resilience reference group Gathering of technical experts Discuss the progress of ENISA projects Info exchange on latest threats Periodic conf-calls Dedicate webpage 1st physical meeting @RIPE69 Validation of ENISA studies List of good practices

Protect Cooperate Exchange

Thank you Rossella Mattioli