EU Cybersecurity Research Articles

A Governance Model for an EU Cyber Security Collaborative Network – ECSCON

A Governance Model for an EU Cyber Security Collaborative Network – ECSCON

Cybersecurity of Medical Devices: Regulatory Challenges in the EU

This book chapter assesses the EU medical devices legal framework in light of the EU cybersecurity policy objectives and the complexity aspects inherently characterizing the healthcare sector. First, it outlines the core cybersecurity-related elements in the EU Medical Devices Regulation (MDR) and offers critical remarks on the Medical Device Coordination Group’s Guidance on medical device cybersecurity. Second, the chapter illustrates other relevant pieces of the EU legislation that become applicable in the context of medical devices’ cybersecurity, namely the NIS Directive, the Cybersecurity Act, the GDPR, the Radio Equipment Directive. Third, the chapter offers critical remarks concerning the possible regulatory challenges stemming from their interaction with the MDR. Here, the analysis finds that regulatory challenges persist due to regulatory specialization, possibly leading to regulatory overlapping, fragmentation risks, regulatory uncertainty and duplication. In its final section, the chapter provides recommendations for EU lawmakers dealing with the cybersecurity of medical devices in the EU.

Governmental Regulation of Cybersecurity in the EU and Hungary after 2000

The term information security evolved to cybersecurity nowadays, which emphasises the interdependence of information assets and the importance of cyber-physical systems. Parallel to this, the need for appropriate management of the EU and government strategies and new public administration tasks also appeared.In the European Union, the first measure concerning this issue was the establishment of the European Union Agency for Network and Information Security (ENISA) in 2004, mostly with consultative tasks. The first official cybersecurity strategy in the EU, called the Open, Safe and Secure Cyberspace, was accepted in 2013. Afterwards, ENISA’s role has been strengthened as well as its range of tasks were broadened. Beside the critical infrastructure protection efforts, the Network Information Security (NIS) directive and related legislation were a giant leap towards a common level of cybersecurity in the community. The formation of an EU Cybersecurity Act and filling NIS with more practical guidance is an ongoing process nowadays.Despite being a post-socialist country, Hungary is in the first line of legislation on cybersecurity in the community. Since 2005 there were several government decrees, from 2009 the first act-level rules on the information security of some governmental services. Based on the National Security Strategy, the National Cybersecurity Strategy was formed in 2013. The same year the first information security act applicable to all government, local government, governmental data processing and critical infrastructure service providers has come into force. The alignment of the National Cybersecurity Strategy to NIS directive happens these days.Thus, the regulation of cybersecurity in the EU and in Hungary are heading in the right direction, but the practical implementation today is far away from the strategic objectives. The community is lagging far behind the United States of America and China, just to mention the most important players in the field.

EU Cybersecurity in the Context of Increasing Cyberthreats in the Modern Globalized World

The article is an attempt to analyze the EU’s ever-increasing cybersecurity challenges in today’s globally digitalized world. The researcher remarks that since 2013 the European Union has been pursuing the policy of developing awareness of cyber-attacks targeting and beefing-up restrictive measures. The author underlines that the European Council has adopted the regulation known as the Cybersecurity Act to become more cyber-proof. This is evidenced by a number of studies carried out within the EU as well as that this legal regulation facilitated imposing targeted restrictive measures to deter and respond to cyber-attacks in EU and abroad. Furthermore, the EU cybersecurity market is one of the fastest growing in the ICT sector, providing huge economic opportunities. Underpinning the cybersecurity industry will enable European companies to take advantage of these opportunities and increase citizens and businesses’ confidence in the digital world, while significantly contributing to the goals of the EU Digital Single Market Strategy. Broadly speaking, the problem can be addressed by such strategic priorities for enhancing EU cybersecurity as followed: achieving cyber resilience; dramatically reducing cybercrime; elaborating the common cybersecurity and defence policy; developing industrial and technological resources to ensure cybersecurity; establishing coordination mechanisms to prevent, detect, mitigate and respond to cyber bullying and information security as well as improving engagement with the private sector to enhance cybersecurity. The ultimate goal of the above-mentioned EU strategy appeared to be a Public Private Partnership (cPPP) that was concluded on 5 July, 2016 between the European Commission and the European Cyber Security Organization (ECSO). The objective of such partnership is to ensure awareness and resilience in an increasingly multifaceted cyber threat environment and to foster collaboration between public and private actors in the early stages of the research and innovation process to enable the EU Internet users to access secured innovative and credible European solutions (ICT products, services and software).

The new EU cybersecurity framework: The NIS Directive, ENISA's role and the General Data Protection Regulation

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

Editorial

Editorial

Brexit and Cyber Security

Brexit is likely to have an effect on UK–EU cyber security cooperation. While there are ongoing reasons to be positive about the state of UK–EU cyber security, Tim Stevens and Kevin O’Brien show how Brexit will have negative impacts on cybercrime policing and cyber threat intelligence sharing, particularly in a ‘no-deal’ scenario, and argue that the absence of a negotiated settlement will damage the cyber security of the UK and the EU.

European Parliament Position on EU Cyber Security and Defense Policy

Ensuring cyber security in scope of cyber defense is currently among the top priorities of the EU Common Security and Defense Policy (CSDP). Matters included in scope of cyber defense are a competence of the Member States and cooperation at EU level in this area is governed by decisions of the EU Council based on unanimity. This means that the European Parliament (EP) in the field of cyber defens acts only as an opinion-forming body expressing its position through the adoption of non-legislative resolutions. The aim of the article is to analyze the content of these resolutions and present the EP’s opinion on the challenges facing the EU in the field of cyber defense. It should be stressed that the EP is the EU body that strongly emphasizes the need for a common EU approach to these issues. Given that the area of cyber defence is subject to intergovernmental cooperation mechanisms, the EP considers that the EU needs to develop not only cooperation and coordination mechanisms at the level of its institutions, but also to take action to enhance the EU’s capability to counter cyber threats. These significant cyber defense capabilities should be essential elements of the CSDP and of the development of the European Defense Union, as it is becoming increasingly difficult to counter cyber attacks for the Member State level alone. The role of the CSDP should be to ensure that the EU, in cooperation with NATO, has an autonomous strategic capability to act in the field of cyber defense.

The New EU Cybersecurity Framework: The NIS Directive, ENISA’s Role and the General Data Protection Regulation

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

The European Union’s cybersecurity industrial policy

ABSTRACTThe European Union was founded as an economic cooperation of its member states. It has as a major objective to create a large internal market with free flow of people, goods, services and capital. Over its 60-year history, the EU’s mandate has expanded beyond economic matters and the internal market into areas such as justice and international affairs. In this paper, I discuss EU policy to address cybersecurity concerns, bolster the cybersecurity market, and assess the impact of these interventions. EU-level cybersecurity policymaking is challenging due to the wide diversity of interests of the EU countries and the limited EU mandate where matters of national security are concerned. The conclusion is that, nevertheless, it has been possible to establish clear EU policy in cybersecurity and even to a degree joint EU cybersecurity industrial policy. The EU approach, though sui generis, may also provide insights for wider international cooperation in cybersecurity.

The emerging EU framework on cybersecurity certification

The emerging EU cybersecurity certification framework proposed by the European Commission by means of the Cybersecurity Act seeks to complement the efforts of the EU Member States in the area of certification of products and services. While EU Member States retain full operational capacity in the aftermath of this proposal, a European Cybersecurity Coordination Group undertakes the governance of the certification framework and ENISA assumes a role in the drawing up of certification schemes. The expectation that the EU certification framework build upon is that it will enhance the ability of the EU to compete in the global cyber-security arena and improve security conditions for consumers and businesses in the EU as a whole.

Patching the patchwork: appraising the EU regulatory framework on cyber security breaches

Breaches of security, a.k.a. security and data breaches, are on the rise, one of the reasons being the well-known lack of incentives to secure services and their underlying technologies, such as cloud computing. In this article, I question whether the patchwork of six EU instruments addressing breaches is helping to prevent or mitigate breaches as intended. At a lower level of abstraction, the question concerns appraising the success of each instrument separately. At a higher level of abstraction, since all laws converge on the objective of network and information security – one of the three pillars of the EU cyber security policy – the question is whether the legal ‘patchwork’ is helping to ‘patch’ the underlying insecurity of network and information systems thus contributing to cyber security. To answer the research question, I look at the regulatory framework as a whole, from the perspective of network and information security and consequently I use the expression cyber security breaches. I appraise the regulatory patchwork by using the three goals of notification identified by the European Commission as a benchmark, enriched by policy documents, legal analysis, and academic literature on breaches legislation, and I elaborate my analysis by reasoning on the case of cloud computing. The analysis, which is frustrated by the lack of adequate data, shows that the regulatory framework on cyber security breaches may be failing to provide the necessary level of mutual learning on the functioning of security measures, awareness of both regulatory authorities and the public on how entities fare in protecting data (and the related network and information systems), and enforcing self-improvement of entities dealing with information and services. I conclude with some recommendations addressing the causes, rather than the symptoms, of network and information systems insecurity.

Patching the Patchwork: Appraising the EU Regulatory Framework on Cyber Security Breaches

Breaches of security, a.k.a. security and data breaches, are on the rise, one of the reasons being the well-known lack of incentives to secure services and their underlying technologies, such as cloud computing. In this article, I question whether the patchwork of six EU instruments addressing breaches (Framework Directive, e-Privacy Directive, eIDAS Regulation, PSD2, GDPR, NIS Directive) is helping to prevent or mitigate breaches as intended. At a lower level of abstraction, the question concerns appraising the success of each instrument separately. At a higher level of abstraction, since all laws converge on the objective of network and information security – one of the three pillars of the EU cyber security policy – the question is whether the legal ‘patchwork’ is helping to ‘patch’ the underlying insecurity of network and information systems thus contributing to cyber security. To answer the research question, I look at the regulatory framework as a whole, from the perspective of network and information security and consequently I use the expression cyber security breaches. I appraise the regulatory patchwork by using the three goals of notification identified by the European Commission as a benchmark, enriched by policy documents, legal analysis, and academic literature on breaches legislation, and I elaborate my analysis by reasoning on the case of cloud computing. The analysis, which is frustrated by the lack of adequate data, shows that the regulatory framework on cyber security breaches may be failing to provide the necessary level of mutual learning on the functioning of security measures, awareness of both regulatory authorities and the public on how entities fare in protecting data (and the related network and information systems), and enforcing self-improvement of entities dealing with information and services. I conclude with some recommendations addressing the causes, rather than the symptoms, of network and information systems insecurity.

Cybersecurity Insurance and New EU Cybersecurity and Data Protection Rules

In today’s marketplace where businesses are constantly being threatened by data breaches and cyberattacks, it is imperative that a global company obtain cybersecurity insurance. This article highlights the importance of cybersecurity insurance in light of the forthcoming security obligations imposed by the General Data Protection Regulation (GDPR) and the Network and Information Security Directive (NIS Directive). In particular, it mentions some cases showing that even wellknown multi-billion dollar companies are vulnerable to cyberattacks and data breach incidents. Also, it describes the types of damage that may be caused by such cyber events and the reasons why many companies have not yet considered cybersecurity insurance to be part of their overall strategy to mitigate cyber risk. Further, it examines the new cybersecurity and data protection requirements established by the GDPR and the NIS Directive. Finally, it evaluates the role that insurance can play as an effective risk mitigation tool, taking into consideration some recent US courts’ judgments in cyber insurance cases.

ПРАВОВИЙ АНАЛІЗ СУЧАСНОГО СТАНУ ТА ТЕНДЕНЦІЙ РОЗВИТКУ ЗАКОНОДАВСТВА ЄС ТА УКРАЇНИ У СФЕРІ КІБЕРБЕЗПЕКИ

The article is devoted to the issue of settling relations on the implementation of cyber security policy in the European Union and Ukraine. The leading role of the EU in the process of determining the key directions of cyber policy in the EU member states, as well as the steps of Ukraine in this area in the course of European integration reforms are studied. The authors analyze the system of normative acts of EU institutions in the field of cybersecurity, including, in particular, strategic documents containing general guidelines for policy implementation, as well as binding regulations and directives, the provisions of which specify mechanisms for implementing cyber policy in EU member states. The main normative documents of the EU in the field of cyber security of both states and private consumers of digital services on the Internet have been identified. The formation of a secure digital market in the EU in the context of the implementation of certification schemes for digital products and services, as well as the regulatory and institutional framework for combating fraud on the Internet are analyzed. The main opportunities, means of implementation and EU institutions responsible for the functioning of the secure European cyberspace, in particular the EU Cyber Security Agency (ENISA), are explored. In the context of the adoption of the new EU Cyber Security Strategy for the next 10 years, future EU steps in the field of cyber security are identified, such as accelerating the implementation of key Internet security standards, application and rapid completion of 5G technologies, cyber intelligence, etc. The authors analyze the system of legal acts of Ukraine in the field of national cybersecurity. The shortcomings of the regulatory and legal regulation of cybersecurity and the implementation of regulations of national legislation are identified. In addition, the authors note the positive developments in the implementation of cyber policy in Ukraine, including the development of the Cyber Security Strategy of Ukraine for 2021-2025.

EU and NATO cybersecurity strategies and national cyber security strategies: a comparative analysis

Given the global nature of cyber threats, assurance of a cyber security policy is very important not only at organization level but also at national level. Currently, cyber security as such is not independently regulated internationally; therefore the role of the EU and NATO in ensuring cyber security has become particularly significant. This article presents a study which compares the cyber security policies of the EU and NATO organizations. An analysis of how national cyber security strategies correspond with the cyber security policies and the strategic directions of these organizations has been carried out. We have also carried out a comparative study of the provision of national cyber security strategies of the EU and NATO. The study reveals that regardless of similar goals, namely assurance of cyber resilience, the selected harmonization and coordination approaches, as well as norms of national cybersecurity strategies, differ.

EU Cybersecurity Directive

EU Cybersecurity Directive

The EU's Cybercrime and Cyber-Security Rulemaking: Mapping the Internal and External Dimensions of EU Security

By taking the EU Cyber Strategy as a case in point, this contribution examines how the distinction between external and internal security in contemporary EU law manifests itself in large-scale risk regulation and in particular, how the EU relies upon external norms to regulate risk. This article also maps the evolution of the rule-making processes themselves.

Kibernetinio saugumo teisinis reguliavimas: kibernetinio saugumo strategijos

Cybercrime has become a global phenomenon, which is causing more harm to individual citizens, organizations, society and the state. Most countries in the world compare cybercrime with offences such as terrorism and drug trafficking due to its risks and profitability. Cybersecurity is the central category to fight cybercrime in cyberspace. Therefore, the strategic legal regulation of cybersecurity is one of the most relevant problems in EU, including Lithuania. So far cybersecurity legal regulation analysis in scientific literature has been rather limited. The European Commission, together with the High Representative of the Union for Foreign Affairs and Security Policy, has published a cybersecurity strategy alongside a Commission proposed directive on network and information security (NIS). The cybersecurity strategy – “An Open, Safe and Secure Cyberspace” - represents the EU’s comprehensive vision on how best to prevent and respond to cyber disruptions and attacks. The purpose of its is to further European values of freedom and democracy and ensure the digital economy can safely grow. Specific actions are aimed at enhancing cyber resilience of information systems, reducing cybercrime and strengthening EU international cyber-security policy and cyber defence. The main goal of the paper is to analyze and compare the EU cybersecurity strategy and experience of several foreign countries with the strategic legal regulation of cybersecurity in Lithuania. The article consists of four parts. The first part dealt with the EU cybersecurity strategy. The second part of the article examines the comparative aspect of foreign cybersecurity strategic legal regulation. The third part deals with attempts in Lithuania to draft cybersecurity law and the holistic approach of cybersecurity legal regulation. The fourth part examines Lithuanian cybersecurity strategy and comments on the main probleas related with the strategy. Several different approaches have been used in the research. The author have used a comparative method to investigate the EU cybersecurity strategy as well a, Lithuanian and foreign situations. The empirical analysis of legal documents was used to determine the legal regulation of the cybersecurity in Lithuania. In addition, Legal acts of the Republic of Lithuania have been analyzed. Having analyzed the official documents, the method allows identifying and describing the relationship between the valid legal regulations accurately. Using literature resources, the author has used the deductive method which allows drawing sufficiently reliable conclusions.