Governmental Regulation of Cybersecurity in the EU and Hungary after 2000

Tamás Szádeczky

doi:10.32565/aarms.2020.1.7

Abstract

The term information security evolved to cybersecurity nowadays, which emphasises the interdependence of information assets and the importance of cyber-physical systems. Parallel to this, the need for appropriate management of the EU and government strategies and new public administration tasks also appeared.In the European Union, the first measure concerning this issue was the establishment of the European Union Agency for Network and Information Security (ENISA) in 2004, mostly with consultative tasks. The first official cybersecurity strategy in the EU, called the Open, Safe and Secure Cyberspace, was accepted in 2013. Afterwards, ENISA’s role has been strengthened as well as its range of tasks were broadened. Beside the critical infrastructure protection efforts, the Network Information Security (NIS) directive and related legislation were a giant leap towards a common level of cybersecurity in the community. The formation of an EU Cybersecurity Act and filling NIS with more practical guidance is an ongoing process nowadays.Despite being a post-socialist country, Hungary is in the first line of legislation on cybersecurity in the community. Since 2005 there were several government decrees, from 2009 the first act-level rules on the information security of some governmental services. Based on the National Security Strategy, the National Cybersecurity Strategy was formed in 2013. The same year the first information security act applicable to all government, local government, governmental data processing and critical infrastructure service providers has come into force. The alignment of the National Cybersecurity Strategy to NIS directive happens these days.Thus, the regulation of cybersecurity in the EU and in Hungary are heading in the right direction, but the practical implementation today is far away from the strategic objectives. The community is lagging far behind the United States of America and China, just to mention the most important players in the field.

Highlights

The word cybersecurity seems to be a bit overused nowadays, but as other researchers have already demonstrated, it is different from the “classical” term information security
According to the definition of the International Telecommunication Union’s (ITU) definition in 2008, cybersecurity is the collection of tools, policies, security concepts, security safeguards, guidelines, risk management approaches, actions, training, best practices, assurance and technologies that can be used to protect the cyber environment, the organisation and user’s assets
Tasks relating to international cooperation. Another focus is the forming of new European cybersecurity certification schemes: “The European cybersecurity certification framework shall be established in order to improve the conditions for the functioning of the internal market by increasing the level of cybersecurity within the Union and enabling a harmonised approach at Union level to European cybersecurity certification schemes, with a view to creating a digital single market for information and communication technologies (ICT) products, ICT services and ICT processes.”

Summary

Introduction

The word cybersecurity seems to be a bit overused nowadays, but as other researchers have already demonstrated, it is different from the “classical” term information security. In both terms, information-based assets stored or transmitted using information and communication technologies (ICT) are included. The general security objectives comprise the following: availability, integrity—which may include authenticity and nonrepudiation—and confidentiality This is pretty much similar to the term information security. The term cybersecurity includes noninformation-based assets (e.g., a high-voltage substation) that are vulnerable to threats via ICT. This is similar to the interdependency between critical infrastructure elements. This might happen because of lack of knowledge, resources or experience

The new National Security Strategy

Cybersecurity Strategy in the EU

Cybersecurity Organisation in Hungary

Conclusion