Tag Archive for: Enisa

NIS2 Umsetzung gezielt auf den Weg bringen!

The deadline for the implementation of NIS2 is approaching – by October 17, 2024, stricter cybersecurity measures are to be transposed into law in Germany via the NIS2 Implementation Act. Other member states will develop their own legislature based on EU Directive 2022/2555. We have taken a close look at this directive for you to provide you with the most important pointers and signposts for the entry into force of NIS2 in this short video. In this video, you will find out whether your company is affected, what measures you should definitely take, which cybersecurity topics you need to pay particular attention to, who you can consult in this regard and what the consequences of non-compliance are.

Preview image for the video 'What you need to know about NIS2' with European star circle and NIS2 lettering - redirects to YouTube

Learn about the Cyber Resilience Act, which provides a solid framework to strengthen your organization’s resilience against cyberattacks. The ENISA Common Criteria will help you assess the security of your IT products and systems and take a risk-minimizing approach right from the development stage. Also prioritize the introduction of an information management system, for example by implementing ISO 27001 certification for your company. Seek advice about IT baseline protection from specialists recommended by the BSI or your local responsible office.

In addition to the BSI as a point of contact for matters relating to NIS2, we are happy to assist you and offer certified solutions in the areas of vulnerability management and penetration testing. By taking a proactive approach, you can identify security gaps in your systems at an early stage and secure them before they can be used for an attack. Our vulnerability management solution automatically scans your system for weaknesses and reports back to you regularly. During penetration testing, a human tester attempts to penetrate your system to give you final assurance about the attack surface of your systems.

You should also make it a habit to stay up to date with regular cybersecurity training and establish a lively exchange with other NIS2 companies. This is the only way for NIS2 to lead to a sustainable increase in the level of cyber security in Europe.

To track down the office responsible for you, follow the respective link for your state.

Austria France Malta
Belgium Germany Netherlands
Bulgaria Greece Poland
Croatia Hungary Portugal
Cyprus Ireland Romania
Czech Republic Italy Slovakia
Denmark Latvia Slovenia
Estonia Lithuania Spain
Finland Luxembourg Sweden

In the 10th edition of its ENISA Threat Landscape (ETL), the EU’s cybersecurity agency explicitly warns of increasing threats from hacking attacks on public sector entities.

Around a quarter of all security related incidents target administrative or government entities, the ENISA study reports – making the public sector nearly twice as much at risk as hosters and providers, who come in second at 13 %. More than ever, users should protect their networks – for example, with products from Greenbone.

The number one threat still are extortionate ransomware attacks, followed by malware and social engineering, e.g. where attackers try to obtain passwords from employees via telephone.

Geopolitics doesn’t stop at the public data center

However, things have changed in the last two years – not only the war in Ukraine ensured that “geopolitical aspects have a significantly greater influence” on threat scenarios, the ENISA authors write. Attacks are becoming more destructive, motivated by the armed conflict and are being flanked by targeted disinformation campaigns – which are increasingly directed against public institutions.

Businesses and government agencies, however, are worried by the fact that attackers have gained in skill level, aggressiveness and agility since 2021. The better organizations have adapted their cybersecurity programs and thus their defenses to the threat environment, the more they have forced attackers to adopt newer attack vectors, to the point of developing new, unknown zeroday exploits and more. At the same time, hacker groups are constantly becoming more agile, renaming themselves and continuously regrouping, further complicating attribution (matching an attack to individuals).

Progressive professionalization of attackers

As if that weren’t enough, the hacker-as-a-service model continues to gain traction; people are becoming more professionalized. Attacks are also increasingly targeting the supply chain, managed service providers and are becoming more and more, as they have been doing every year, especially in the upcoming reporting period – the phase at the end of a fiscal year when reports relevant to the stock exchange may have to be prepared.

What is new, however, according to ENISA, is the increase in hybrid threats, which are also fueled by state actors and software. The study specifically cites the spyware “Pegasus” developed by the Israeli government, as well as phishing and attacks on data infrastructures.

Machine learning and artificial intelligence

The professionalization of attacks has had a particularly fatal effect, because they have become much more sophisticated through the use of machine learning and artificial intelligence. For example, there are already bots that act as deep fakes, disrupt chains of command, and are also capable of disabling government institutions with masses of fake comments.

ENISA groups the typical attackers into four categories: State-sponsored, organized crime (cybercrime), commercial hackers (“hackers for hire”), and activists. The goal of all these attackers is usually unauthorized access to data and disruption of the availability of services (and in many cases the associated extortion of ransom money), they said.

Vulnerability Management protects

The only safe option that government agencies and companies have to counter these attacks is Vulnerability Management, which allows them to look at their own IT infrastructure from the outside, from the perspective of a potential attacker. This is the only way to identify and close security gaps before an attacker succeeds.

This is exactly where our Vulnerability Management products come in – as a hardware or virtual appliance or in the Greenbone Cloud Service. Greenbone develops an Open Source Vulnerability Management and allows users to detect vulnerabilities in their own network infrastructure within a few steps. Our products generate reports with concrete action instructions that you can implement immediately.

We work strictly according to German/European law and offer an Open Source solution. This means best data protection compliance and is thus guaranteed free of backdoors.

Greenbone: Many years of experience in the public sector

For many years, Greenbone has been offering customized products for the public sector, e.g. for requirements of higher security levels (classified, VS-NFD and higher).

Even networks that are physically separated from other networks can be scanned for vulnerabilities with Greenbone. Such areas separated by an “air gap” often occur in public authorities when network segments must be operated separately from the Internet and the rest of the public authority network due to a special need for protection. Greenbone’s products support strict airgap via special USB sticks, but also data diodes that allow traffic in one direction only.

No matter if you already have a frame contract with us or if you contact us for the first time, e.g. via the form on our website: We are happy to help you. Greenbone can look back on many years of experience with public authorities and is always ready to help you with words and deeds. Contact us!


Contact Free Trial Buy Here Back to Overview