Are You Secure? An ENISA Study Can Help You Protect Internet Infrastructure AssetsThe European Union Agency for Network and Information Security (ENISA) has published a new report that analyzes the most important threats to Internet infrastructure assets. The new report focuses on threats to the essential components of the Internet infrastructure that ensure network connectivity from a physical and logical point of view. It also provides a list of countermeasures and best practices to secure the eight types of assets on the Internet.

The report is designed to help readers determine the threats that apply to their specific assets and implement best practices to ensure their safety. It also devotes ample space to the gap analysis, highlighting existing shortcomings of current best practices. While it's a good idea to review the report in its entirety, here's a closer look at what it says — and what you need to know to protect your Internet infrastructure assets.

The Report

The Internet services that you access every day are the result of the coordination of hardware, software, information, human resources, protocols, services, interconnections and infrastructure. All these components are exposed to an increasing number of threats that the ENISA has classified in the following categories:

  • Physical attacks
  • Both natural and man-made disasters
  • Failures or malfunctions
  • Outages
  • Unintentional (accidental) damage
  • Damage (in this case intentional)
  • Nefarious activities and abuse
  • Eavesdropping/interception/hijacking
  • Legal threats

The ENISA's mind map details those threat types, as well as possible associated threats. For example, a physical attack could be an act of vandalism or sabotage, while a failure could be represented by a software bug or a configuration error.

The report also groups threat types and provides the trends for each of them. Trend analysis is another essential aspect of the report, providing important insight regarding the evolution of the threats — an analysis that is particularly important when you are faced with cyberthreats.

The primary threat groups are identified as:

  • Routing threats
  • DNS threats
  • Denial of service
  • Generic threats

The summary of trends per threat type shows a significant increase in almost every threat group, except DNS threats, for which experts observed a lower number of attacks compared to the previous year. However, according to the report, that decrease "does not diminish the importance of this threat." The report states, "In the table, DNS Threat is decreasing. Yet, the number of cyberattacks targeting DNS remains important in relation to the total number of attacks. This decreasing trend shall only denote a diminution of DNS as an attack vector by threat agents."

threat groups and trends from ENISA




The ENISA offers firms both technical and organizational recommendations. It also highlights the importance of identifying threats for your particular organization, and suggests that Internet infrastructure owners continually evaluate their levels of vulnerability using proper risk assessment methods, and prioritize security actions in their mitigation strategies. Components of the Internet infrastructure are treated as living organisms that need to evolve to respond to changing threats. The ENISA also asks that readers cooperate with the Internet community to promote the application of good practices as mitigation measures.

One of the most important organizational recommendations provided in the report is this: Internet infrastructure owners must commit to third-party vendors to apply security measures. Doing so is essential for the divulgation of a "security culture," and it can make an entire chain more resilient against threats.

As Udo Helmbrecht, executive director of the European Union Agency for Network and Information Security explains,"ENISA's guide gives an up-to-date overview of emerging threats and lays the foundations for the community towards a more secure Internet infrastructure through proper risk assessment, training and evaluation." Take time to review the report, secure your online assets and work with a third-party expert to keep your firm safe in the ever-changing threat landscape. The effort will always prove worthwhile.

Photo Source: Flickr

About Pierluigi Paganini

Pierluigi Paganini is Chief Information Security Officer at Bit4Id, Editor-in-Chief at "Cyber Defense Magazine," a member of the DarkReading Editorial team, and a regular contributor for major publications in the cyber security field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, and The Hacker News Magazine.

Comments (0)

Please Post Your Comments & Reviews

Your email address will not be published. Required fields are marked *

Love to learn about Application Security?

Get all the latest news, tips and articles delivered right to your inbox.