Agenzia Per La Cybersicurezza Nazionale

The Agenzia per la Cybersicurezza Nazionale (ACN; Italian: ''National Cybersecurity Agency'') is an Italian government agency established by decree 82 of 14 June 2021.

The ACN was established to provide cybersecurity to information technology, and also for the purpose of protecting national security in the cyberspace, and ensures coordination between the public entities involved in the matter.

It pursues the achievement of national and European strategic autonomy in the digital sector, in synergy with the national production system, as well as through the involvement of the university and research world. It favors specific training courses for the development of the workforce in the sector and supports awareness campaigns as well as a widespread culture of cybersecurity.

History

Cyberattack alerts, monitoring, detection and prevention activities

The agency constantly carries out activities of alert, monitoring, detection and prevention of cyber attacks as in the case of the massive global cyberattack of 5 February 2023.
During the cyberattack, a large part of the TIM network was out of order due to a problem with data flows from the international network which also had an impact in Italy.
The attack exploited a vulnerability on VMware ESXi servers.
The damage to the Italian national network has amounted to millions of euros, and thousands of servers affected.
However, the following day, the agency reduced the scope of the attack, reporting that no critical systems were affected.
On 22 February 2023, the agency issued a new alert against an attack perpetrated by Russian activists. The cyberattack is claimed by the pro-Russian group NoName057(16).

On 7 March 2023, the director of the agency, Roberto Baldoni resigned for differences with the Italian government, following the cyber-attacks suffered by Italy.
The pro-Russian group NoName057(16) comments on the resignation of Roberto Baldoni on its Telegram channel, claiming the attacks against the Italian internet infrastructure as a complete success.

On 9 March 2023, the prefect of Rome, Bruno Frattasi, was appointed new director of the agency in place of the resigned Roberto Baldoni.

On 19 March 2023, the pro-Russian group NoName057(16) attacked again the Italian institutional websites, in particular that of the CSM.
In claiming the cyberattack, they directly addressed the director of the agency, Bruno Frattasi and Francesco Lo Voi, the chief prosecutor of Rome.

On 27 March 2023, there was a new cyberattack against the websites of the Italian ministers and the postal police, however it did not achieve the objective of hindering users from using the sites under attack. The attack was considered failed, only that of Atac, the municipal transport company of Rome, suffered slowdowns and temporary unavailability.

On May 13, 2023, during the visit to Rome in Italy of Volodymyr Zelensky, president of Ukraine, to the Italian president, Sergio Mattarella and the Italian premier Giorgia Meloni and to the Pope, the pro-Russian group Noname057(16) claims a new cyberattack on the website of the Viminale and on the Csm. However, the damage was mitigated and no malfunctions or slowdowns of the affected websites occurred.

On 19 June 2023, the agency sent the 2022 annual report to the Italian parliament which showed that 1,094 cyber attacks took place in 2022, a marked increase due to the Russian invasion of Ukraine.

On 17 February 2025, the pro-Russian activist hacker group Noname057(16) returns to claim attacks against websites of Italian transport companies and banks as previously done, following the statements of the President of the Italian Republic, mainly DDoS (Distributed denial of service) attacks. Among the targets of the attack are the airports of Linate and Malpensa, the Transport Authority and the ports of Taranto and Trieste.
An attack that finds no basis in the speech of the President of the Italian Republic, which Russian media reported as words of almost blasphemous outrage, the result of a bad translation and misinterpretation. The passage of the speech is this: "But, instead of cooperation, the criterion of domination prevailed. And they were wars of conquest. This was the project of the Third Reich in Europe. Today's Russian aggression against Ukraine is of this nature." Which means that the Russian aggression against Ukraine is motivated by a criterion of domination. Therefore, the claims of this attack are completely refuted.

The following day, the pro-Russian NoName057(16) return to attack the website of the Ministry for Business and Made in Italy and that of the Guardia di Finanza. While the President of the Italian Republic, during his visit to Montenegro, issues an invitation to Russia to respect international law.

In the following days the attacks continued, the websites of the port of Genoa, Savona, Ravenna and Civitavecchia were hit, then those of Leonardo, Banca d'Italia, Transport Authority, Edison, Fininvest, Parmalat.

Cyberwarfare

The agency carries out protection and prevention actions against Cyberwarfare.
The cyberattacks mainly have affected hospitals, public facilities, government bodies, and energy production plants.

CSIRT

Computer Security Incident Response Team - Italia (CSIRT) operates within the agency with the following functions defined on the basis of Legislative Decree 18 May 2018, n. 65 and by the Decree of the President of the Council of Ministers of 8 August 2019 art. 4.

References

See also

* List of cyber warfare forces
* Information assurance vulnerability alert
* Cooperative Cyber Defence Centre of Excellence (NATO)
* Cyberwarfare
* Security hacker
* CINECA
* Istituto Italiano di Tecnologia
* Istituto Italiano per l'Intelligenza Artificiale

{{authority control

Government agencies of Italy
Government agencies established in 2021
2021 establishments in Italy
Computer security in Italy
National cyber security centres