The EU National Telecom Authorities met in Athens, Greece for the 35th meeting of the ECASEC group. The European Union Agency for Cybersecurity also hosted the 1st Telecom Security Forum on this occasion.
Launched more than 10 years ago, the European Competent Authorities for Secure Electronic Communications (ECASEC) group serves as a platform for collaboration and exchange of information among the national authorities supervising telecom security in Europe. The ECASEC group also develops and endorses guidelines for telecom security authorities on how to implement different aspects of EU telecom security policy.
Besides the ECASEC meeting, the EU Agency for Cybersecurity (ENISA) hosted the 1st edition of the ENISA Telecom Security Forum on 13 October. The goal of this event, held in a hybrid format, was to bring together experts from both national authorities and the private sector to exchange views and discuss cybersecurity challenges and good practices.
Highlights of the 35th ECASEC Expert Group meeting
A total of more than 50 experts from national authorities supervising the European telecom sector in the EU, EFTA, EEA, and EU candidate countries attended the meeting held on 14th October, with almost a third of them being present physically.
The meeting was the opportunity for the experts to follow an analysis of the supply chain threat landscape recently published by ENISA. BEREC also presented their report on the location of the Network Termination Points. The location of the Network Termination Points has an impact on whether an equipment is part of the public network or part of the telecommunications terminal equipment (TTE) and that distinction affects in turn the legal power of the National Regulatory Agencies (NRAs).
ENISA introduced the main points of the upcoming ENISA reports on Consumer Outreach and Network Function Virtualisation (NFV) Security and participants listened to an analysis of Confidentiality, Integrity and Authenticity attacks in public electronic communication networks. This type of attacks is of great interest for the members of the ECASEC Expert Group since the definition of security in the EECC includes also confidentiality of communications.
Finally, the group dived into the recent Facebook outage and stressed the need for streamlining the incident reporting process so as to avoid unclear and overlapping obligations on providers and effectively cover cross-border incidents that involve several countries.
The 1st edition of the ENISA telecom security forum in a nutshell
A total of more than 250 telecom security experts met both physically in Athens and online to discuss the following points of the agenda:
- latest developments on the Electronic Communications Framework and other legislative initiatives at both European and national levels;
- good practices and experience in dealing with emerging security threats;
- emerging technologies and related initiatives.
The Forum was opened by Evangelos Ouzounis, Head of the Policy Development and Implementation Unit of ENISA and by Warna Muzenbrock, chair of the ECASEC group. They both highlighted the challenges and opportunities of the new regulatory environment for the telecom sector.
On behalf of the Greek mobile operators, George Stefanopoulos welcomed the participants and highlighted the challenges for operators during the pandemic and in view of the 5G rollout. The forum had three parts: a policy session about EU legislation, a technical session about ongoing cyber threats and a future networks session, with talks including topics such as 5G and edge computing.
- The Policy session:
The Forum focused on the latest policy developments, the European Electronic Communications Code (EECC) and the updated NIS Directive (NIS2) and how these affect the European telecom operators.
The policy session started with an intervention from the European Commission presenting the NIS2 proposal and its implications for the telecom sector. Magnus Falk from ZOOM and Paolo Grassia from the European Telecommunications Network Association analysed the impact of the new legislation on telecom providers, both Number-Independent Interpersonal Communication Services providers and traditional ones. Finally, Kinga Pawlowska from a Polish media law firm discussed recent legislative proposals in Poland addressing the EECC and the NIS Directive.
- The Analysis of current threats and attacks – Technical session:
The technical session of the Forum included a presentation of the sub-sea fibre network of Liberty Global and an analysis of SIM Swapping attacks by Europol. Additionally, the Centre for Cybersecurity of Denmark shared their work on the threat from ransomware for the telecoms sector. Kevin Meynell, from the Internet Society, explained the MANRS project, an industry collaboration that aims to set good practices for more secure Border Gateway Protocol (BGP) routing.
- The future networks session:
Julie Ruff, Deputy Head of Unit of Cybersecurity Technologies and Capacity building of European Commission DG CNECT, introduced the work of the 5G cybersecurity work stream of the NIS Cooperation Group. Silke Holtmanns, from Adaptive Mobile Security, member of the ENISA Advisory Group, presented an analysis of the Secure Integration of 5G Private Networks. The discussions focused on threat vectors seen in Multi Edge Computing (MEC) deployments and the security controls deployed by service providers. GSMA presented its Network Equipment Security Assurance Scheme (NESAS).
The presentations given by the experts during the forum are available here: ENISA Telecom Security Forum - Agenda
NIS Cooperation Group Work Stream 10 and joint meeting with the ECASEC Expert Group
ENISA hosted the NIS Cooperation Group Work Stream 10, the group of EU national authorities supervising the security of the digital infrastructure under the NIS Directive, the day before the Telecom Security Forum. On the day of the Forum, the members of ECASEC Expert Group and of WS10 had a joint meeting to discuss about common threats, challenges and possible synergies.
Background on ECASEC Expert Group, formerly known as the ENISA Article 13a group
Established in 2010, the ENISA ECASEC expert group, formerly known as ENISA Article 13a group, consists of about 100 experts from national telecom security authorities from all EU countries, the EFTA countries, and EU candidate countries.
The group is a forum for exchanging information and good practices on telecom security. It produces policy guidelines for European authorities on the implementation of EU telecom security rules and publishes an annual summary report about major telecom security incidents.
This work is done under the ENISA's Annual work programme Output 2.3 “Recommendations, technical guidelines and other activities to assist and support the implementation of the policies within NISD sectors, in the area of trust services and electronic identity, under the EECC and its implementing acts, in the field of privacy and data protection (especially Privacy by Design, Privacy Enhancing Technologies and security of personal data processing building on the work of previous years) and artificial intelligence (building on ENISA’s AI Threat Landscape)”.
Further Information
ENISA website - Incident Reporting Topic
European Electronic Communications Code Directive
Technical Guideline on Incident Reporting under the EECC
Security supervision changes in the new EU telecoms legislation
Contacts
If you want to join the ENISA telecom security mailing list, to be kept up to date about this group and our telecom security work, and to receive invitations for events and projects, please contact us via resilience (at) enisa.europa.eu
For questions related to the press and interviews, please contact press(at)enisa.europa.eu
Contact
For press questions and interviews, please contact: press@enisa.europa.eu.