EU Cybersecurity Research Articles

Internet of Things, critical infrastructures, and the governance of cybersecurity in 5G network slicing

Over the last decade, cybersecurity has become a disruptive challenge driven by the shift to 5G networks. 5G is an application-agnostic general-purpose technology (GPT) characterized by its major role as multidimensional upstream technology for a large and open set of downstream Internet of Things (IoT) applications and use cases in various network industries and, more generally, within the economy as a whole. The focus of this paper is on the network economics of cybersecurity governance, considering the interplay between the recent EU cybersecurity regulatory framework, the extensive standardization efforts of international standardization organizations, and the economic incentives to tackle 5G network performance and security challenges. Based on the economic concept of 5G-based network slicing, the entrepreneurial challenges driven by the Internet of Things (IoT) are analyzed with an eye towards the complementarity between the physical side and virtual side of IoT applications. Network slicing gains particular relevance in the context of different types of logically separated, QoS-differentiated 5G bandwidth capacities, which are combined with other virtual resources such as sensor networks, data storage and processing, together with end-to-end slice security. It is shown in this paper that economic incentives for the implementation of 5G cybersecurity cannot be considered in isolation but must be viewed in combination with other performance requirements of 5G network slices. This is the driver for implementing network slicing architectures within 5G networks that feature a multitude of heterogeneous network slices with different QoS differentiation and various cybersecurity requirements.

The 2024 EU elections and cybersecurity: A retrospective and lessons learned

This article analyses the cybersecurity threats to elections and draws out the lessons learned from the EU (Parliament) elections of June 2024, putting forward recommendations for further improvement. The objective of the analysis is thus manifold. First, it summarises the cyber threats pertinent to elections—those capable of influencing or distorting the election process and outcome. Second, it discusses the measures adopted in preparation for the 2024 EU elections and provides an analysis of how the election campaigns and actual elections across the 27 member states developed. Third, it offers recommendations for improving the cyber resilience of future elections. The analysis will cover both strictly cyber-specific threats and broader hybrid threats.

Operational Technology resilience in the 2023 draft delegated act on cybersecurity for the power sector—An EU policy process analysis

The EU’s 2020 Cybersecurity Strategy promotes cybersecurity as essential for building a resilient, green, and digital Europe. Cleaner energy sources such as wind and solar are more volatile and thus need digital integration with Industrial Control Systems (ICS) for grid balancing. However, the digitization and the properties of cyberspace provide the ability to coordinate disruptive cyberattacks against power grid infrastructures. Digital weapons may be launched against ICS to start multiple cascading outages with a keystroke, causing large-scale blackouts we have never seen before. To reduce risk, the EU’s Strategy describes three objectives for ICS: Secure-by-design, resilient, and timely patched. In the strategy, the European Commission suggests a ”network code,” i.e. a delegated act for the electric power sector, setting rules for cybersecurity in cross-border electricity flows. The draft delegated act of November 2023 presents security requirements for Information and Communication Technology (ICT) and Network and Information Systems (NIS). Although ICS systems are used directly to manage electricity flows, ICS is only mentioned in one of the delegated act’s recitals as a subcategory of ICT products. Suppose Information Technology (IT) rather than Operational Technology (OT) is the focus of the delegated act. In that case, policymakers may not fulfill the EU cybersecurity strategy’s ICS objectives, thus failing to improve the resilience of power grid infrastructures and cross-border electricity flows. This study is a policy process analysis, and its contribution is threefold. First, a literature review is conducted to understand the extent to which the delegated act covers OT. Second, a framework condition analysis is applied to understand why the delegated act lacks OT-specific security requirements. Third, the analysis is extended to understand whether OT is sufficiently covered to achieve the EU strategy’s ICS objectives. In conclusion, our analysis shows a strong intention to include OT-specific security in the preparatory work of the delegated act, but that a stronger position of the IT communities forced OT onto the sideline. Further, the study shows weak fulfillment of general secure-by-design principles and security patch management. These results indicate that OT coverage in the delegated act is not in line with the expectations of the EU’s cybersecurity strategy and the delegated act’s early preparatory work. Therefore, we have suggested three measures to increase OT resilience focus in the act: (a) Define the expressions NIS, ICT services, ICT processes, and ICT in general as umbrella terms that include OT, (b) The foreseen minimum and advanced cybersecurity controls should require OT-specific measures, including holistic secure-by-design principles and patch management covering all patching phases, (c) Develop an OT implementation guide for the delegated act. Our work can be used by policymakers to optimize cybersecurity policy processes and by researchers studying socio-technical gaps in the cybersecurity domain.

Cyber Resilience Act 2022: A silver bullet for cybersecurity of IoT devices or a shot in the dark?

Internet of Things (IoT) is an ecosystem of interconnected devices (IoT devices) that is capable of intelligent decision making. IoT devices can include everyday objects such as televisions, cars and shoes. The interconnectedness brought forth by IoT has extended the need for cybersecurity beyond the information security realm into the physical security sphere. However, ensuring cybersecurity of IoT devices is far from straightforward because IoT devices have several cybersecurity challenges associated with them. Some of the pertinent cybersecurity challenges of IoT devices in this regard relate to: (i) Security During Manufacturing, (ii) Identification and Authentication, (iii) Lack of Encryption, (iv) Large Attack Surface, (v) Security During Updates, (vi) Lack of User Awareness and (vii) Diverging Standards and Regulations.Against this background, the Cyber Resilience Act (CRA) has been proposed to complement the existing EU cybersecurity framework consisting of legislations such as the Cybersecurity Act and the NIS2 Directive. However, does the CRA provide a framework for effectively combating the cybersecurity challenges of IoT devices in the EU? The central crux of the CRA is to lay down and enforce the rules required to ensure cybersecurity of ‘products with digital elements’, which includes IoT devices. To this end, several obligations are imposed on manufacturers, importers and distributors of IoT devices. Manufacturers are mandated to ensure that the essential cybersecurity requirements prescribed by the CRA are met before placing IoT devices in the market. While the cybersecurity requirements mandated by the CRA are commendable, the CRA suffers from several ambiguities which can hamper its potential impact. For instance, the CRA could provide guidance to manufacturers on how to conduct cybersecurity risk assessment and could clarify the meanings of terms such as “limit attack surfaces” and “without any known exploitable vulnerabilities”.When the fundamental themes of the CRA is analysed from the prism of the cybersecurity challenges of IoT devices, it becomes clear that the CRA does provide a foundation for effectively addressing the cybersecurity challenges of IoT devices. However, the expansive wording in various parts of the CRA, including in the Annex I Requirements, leaves scope for interpretation on several fronts. Consequently, the effectiveness of the CRA in tackling the Security During Manufacturing Challenge, Identification and Authentication Challenge, Large Attack Surface Challenge and Diverging Standards and Regulations Challenge would be largely contingent on how harmonised standards develop and how the industry adopts them. The CRA seems to be more effective, albeit not fully so, in significantly addressing the Lack of Encryption Challenge, Security During Updates Challenge and Lack of User Awareness Challenge of IoT devices. However, the manner in which the CRA addresses all these cybersecurity challenges could be improved upon if an agency such as the ENISA was given the legal mandate to set elaborate standards for cybersecurity requirements under the CRA.

Reporting cybersecurity to stakeholders: A review of CSRD and the EU cyber legal framework

The purpose of this article is to explain, through a doctrinal review of the EU sustainability and cybersecurity legal framework, how the cybersecurity obligations contribute to the cybersecurity content and quality of the sustainability reporting. Previous studies are limited to voluntary cybersecurity disclosure in annual reports because they date back to before the adoption of CSRD. The CSRD harmonized sustainability reporting in the EU and introduced the ESRS, the standards for sustainability disclosure. As stated in the ESRS S4, the sustainability reporting should now address how the company manages the risks linked to data usage and data collection. Therefore, cybersecurity measures must be included in the sustainability report. This information can be used by stakeholders to assess the risk appetite and the potential long-term profitability of the company. The cybersecurity measures adopted by companies must comply with the cybersecurity obligations of the EU legal framework. While it is out of the scope of these cybersecurity obligations to inform ex ante the stakeholders of a company of how the company is managing cyber risks, these same obligations can improve the quality and content of the sustainability discourse.

European cybersecurity standardisation: a tale of two solitudes in view of Europe’s cyber resilience

Cybersecurity resilience as a concept and EU policy approach encompasses, in broad terms, the preparedness of organisations against and the ability to recover from cyber-attacks. Policy and law makers in the European Union have started endorsing strategies moving both towards reactive measures mitigating the consequences of cybersecurity incidents and proactive measures geared towards prevention. Recently, a political agreement was reached on a new horizontal Regulation addressing cyber resilience of products with digital elements. An essential aspect of the Cyber Resilience Act is technical standardisation to support its goals. How appropriate is however the European Standardisation system for such a role in EU cybersecurity law? The paper argues that for European standards to be conceptualised as a building block of cyber resilience in the European Union, their development process must be inclusive and open, and a prerequisite for that is that the ESOs jointly work towards the common goal of developing and adopting European standards in support of the EU cyber resilience policy and law. This collaborative approach is mandated both by the nature of cyber resilience and cybersecurity as regulated fields, but also the changing nature of standardisation aspiring to contribute to areas pertaining to societal interests and fundamental rights.

Unveiling EU Cybersecurity Law Turf Battles: The Case of the EU Cyber Solidarity Act Proposal

Unveiling EU Cybersecurity Law Turf Battles: The Case of the EU Cyber Solidarity Act Proposal

WHERE ARE THE CHANGES IN EU CYBERSECURITY LEGISLATION LEADING?

Cybersecurity policy is a response to the growing instability of the virtual world and the threats emanating from this area. This article tries to show how changes in legislative and strategic provisions can affect the EU’s cybersecurity policy. The analysis of the field of cybersecurity in the European Union, the subject of which is the union itself, allows the authors to demonstrate the existence of such a policy in the EU. The subject of the analysis is the phenomenon of cyberterrorism as a threat and its specificity as a form of violence. The article shows how policy and strategy are interrelated, paying particular attention to the security concept of the European Union. The starting point of the research is the analysis of issues related to the specific nature of EU cyberterrorism policy and the most important legal bases in this field, on which EU cybersecurity policy is built. The preliminary study defines the concepts of cyberterrorism, cybercrime, and cyberwar, showing their impacts on the national security policy of the information society and, thus, also on the cybersecurity policy of the EU.

Analysis of the EU Cybersecurity Governance Model

The EU regards cybersecurity governance as an important development agenda in Europe, establishing a framework mechanism around the three key dimensions of defense, development, and diplomacy, promoting the construction of laws and regulations, facilitating coordinated development of regulatory agencies, creating supporting policy tools, and mobilizing social stakeholders to participate in co-governance, and a unique multi-level cybersecurity governance model has been formed. This article discusses, summarizes, and analyzes the official documents and governance practices of EU cybersecurity governance, and explores its main measures and development mechanisms. Facing the year 2030, the new development trends of EU cybersecurity governance mainly include actively integrating relevant elements of green Europe and digital Europe construction in funding project supply, expanding and strengthening partnerships in the cybersecurity governance framework in external relations processing, and emphasizing the use of multi-level and diversified behavior in comprehensive capacity building, so as to promote the international dissemination of the cybersecurity governance framework and norms it advocates, and at the same time strengthen Europe's autonomy and leadership in global digital governance.

PRAVNI OKVIR ZAŠTITE OD VISOKOTEHNOLOŠKOG KRIMINALA U BOSNI I HERCEGOVINI – analiza strateških ciljeva i mogućnost usklađivanja sa evropskom strategijom sajber bezbednosti

The topic of this paper is the legal framework for protection against high-tech crime in Bosnia and Herzegovina, with an analysis of strategic goals and the possibility of alignment with the EU Cyber Security Strategy for the Digital Decade, which was adopted the year before last. The paper provides a conceptual definition of high-tech crime and cyber security, as well as their basic characteristics. Then, in brief, the legal framework of protection against high-tech crime in Bosnia and Herzegovina was analyzed. When it comes to the EU Cyber Security Strategy for the Digital Decade, the most significant parts of it are interpreted in the continuation of the work, especially those that could have application significance for Bosnia and Herzegovina. Based on the above, appropriate recommendations were given in the final deliberations for the improvement of the legal and strategic framework of cyber security in BiH.

Sustainable development of the system of formal cyber education: reflection of modern concepts

The article defines the conceptual framework for sustainable development of the formal cyberworld system. An analysis of contemporary regulatory, legal, and scientific sources on the preparation of cyber specialists for the security and defense sector has been conducted. The main research methods identified are synthesis, comparative analysis, focusing method, and cause-and-effect method. The new U.S. Cybersecurity Strategy addressing cyber education issues has been analyzed, which sets new requirements for cyber professionals in the context of the transformation of the global and national security environment. The use of analysis data from EU cybersecurity educational programs revealed the characteristic variability of the cybersecurity educational landscape in the EU and helped identify key gaps in the preparation of future professionals. It has been demonstrated that the integration of Ukrainian cyber education into the Euro-Atlantic educational space should occur through the updating of cybersecurity curricula based on the best international practices, the establishment of a unified system for accreditation, certification, and the development of cyber e-learning platforms for formal education. The competency-based approach in the preparation of cyber specialists is identified as a priority direction in research across various fields of knowledge. It has been revealed that there is a hysteresis of skills within the knowledge-ability-skill triad, acquired during education, in relation to the demands of advanced technologies in professional activities.

DNS4EU: a step change in the EU’s strategic autonomy?

ABSTRACT The Domain Name System (DNS) is vital to the internet, enabling everyday uses such as browsing, emailing and chatting. One function in particular – the DNS resolution, performed by resolver operators – allows us to reach what we are looking for online. The market of recursive resolution is highly dynamic and is currently shifting towards open or public resolvers, which tend to belong to large tech companies. In 2022, the European Commission launched the DNS4EU initiative, which established a European resolver as part of the new EU cybersecurity strategy, in order to respond to the resilience, security and privacy needs of the union. This article provides a comprehensive analysis of the DNS4EU project, which provided seed funding to a European competitor in a market increasingly dominated by non-EU players. As a critical infrastructure service, the DNS4EU represents one of the first concrete steps towards enhancing the strategic autonomy of the union. But it also constitutes an unprecedented public intervention in a largely private market relying on voluntary adoption. This article contextualises the DNS4EU initiative, outlining both advantages and limitations of the European strategy and related tender process and implementation plan, concluding with a discussion on the future of DNS resolution.

Strenthening trust and security in the EU cybersecurity policy

The present work deals with analyzing the legislation of Cybersecurity in the EU context. The European legislator has sought in recent years alongside foreign and defense policy to create an ad hoc order involving all the organs of the Union with the aim of tackling new types of crimes at European and international level. Our analysis seeks to address the new technological challenges and problems relating to cybersecurity by analyzing the acts of a binding or not nature of the Union which certainly show an application by the Member States that seems to be of a decisive nature for the evolution of the coming years of this sector as well as the demonstration that the EU rightly behaves in practice as a global player.

Legal Status of European Union Bodies and Institutions in the Field of Cybersecurity

The relevance of the reasearch topic stems from the fact that different state bodies are involved in addressing cybersecurity services. While each of the state bodies has their own goals and objectives, the successful resolution of the issues entirely depends on their effective cooperation. The existing resources and expertise available in the EU member states and corresponding EU institutions, bodies and agencies provide a solid basis for a collective response to cybersecurity threats. As a result, the EU has established a system of cyber security risk management bodies. The purpose of this article is to investigate the activities of key EU cyber security authorities. To achieve this goal and analyse the activities of the main EU bodies in the field of cybersecurity , the author has used several methods, such as the systematic approach, the formal-legal method, the comparative-legal method and the historical method. The author has come to the conclusion that cooperation and information exchange are essential elements in addressing cyber security issues. At the same time, to achieve coherence among cyber security bodies, the EU is taking measures to strengthen their joint work. In addition, it has been concluded that the EU, as a regional integration organization where member states act on the basis of mutual trust, is a reliable platform for addressing cyber security issues.

Germany’s Cybersecurity Policy

The German Federal Republic is one of the states whose state policy in the field of cybersecurity is considered to be coherent and effective. However, even Germany is a country exposed to numerous attacks. Ubiquitous technology in every aspect of our lives, and in addition the COVID-19 pandemic, introducing widespread mobile work and online education, have created even greater threats. By adapting internal legislation, indicating strategic and specific goals, Germany is part of the EU cybersecurity policy in its cybersecurity strategies. Prior to the adoption of the NIS 2 directive, Germany had already created a legal basis that would effectively and efficiently protect German cyberspace. In order to strengthen the effectiveness of their cybersecurity policy, Germany is strengthening cooperation between federal authorities, business, science and strengthening digital sovereignty.

In a hyperconnected world, is the EU cybersecurity framework connected?

This article sheds light on the fast-evolving and ever more complex EU cybersecurity policy. It shows that horizontal and sector-specific regulation are being developed simultaneously. It identifies the gaps and investigates to what extent the new Cyber Resilience Act and other policy instruments might address them. It first reviews the stock of existing EU legislation before examining the relevant industry standards for cybersecurity and the Internet of Things. It also reviews stakeholders’ expectations for the Cyber Resilience Act and identifies the need for horizontal legislation, setting flexible but binding rules. We argue for horizontal standards (process-based) that are complemented by sector-specific (vertical) standards. Finally, we propose a governance and enforcement model to make the cybersecurity framework better coordinated and more adequate for tackling the ever-evolving cybersecurity threat landscape.

Cybersecurity in the era of hypercompetitiveness: can the EU meet the new challenges?

In her 2021 State of the Union address, European Commission President Ursula von der Leyen stressed the need to improve EU cybersecurity. The threat landscape is diverse and changing, and includes disinformation and fake news, cyber-attacks on government infrastructure and interference in elections in third countries. With this in mind, in December 2020 the EU unveiled a new Cybersecurity Strategy that includes legislative and institutional initiatives: from the revision of the NIS Directive – the EU’s first cybersecurity legislation – to the establishment of a cybershield to identify large-scale cyber-attacks. To be effective in this field, which involves a multitude of actors, the EU will need to ensure robust cooperation and information exchange, both at national and European level, as well as with NATO.

Tackling cybersecurity challenges in the energy and water sectors in the context of the cybersecurity and sectoral regulatory frameworks: the case of smart metering systems in the new digitalised environment

ABSTRACT Critical Infrastructures (CIs) are the backbone of our societal and economic activities. Safeguarding their uninterrupted operation and keeping them safe against different types of threats, from natural disasters to human-induced acts, is of the essence. This analysis focuses on the energy sector mostly and the water sector secondarily as these two sectors are among the CIs that have mainly suffered the consequences of cyber incidents. In this context, the paper examines the applicability of the EU cybersecurity regulatory framework in the energy (including both electricity and gas) and the water sectors, as well as the sector specific initiatives that have been adopted so far to tackle the cybersecurity challenges the two sectors face. Given the expansive deployment of smart technologies and devices in both sectors, the regulatory regime of smart metres and the complications that are associated with their installation and use in terms of privacy and security of the collected data is examined separately. Finally, the analysis attempts to shed some light on the shortcomings of the existing legal framework and to contribute to its further effectiveness by suggesting further steps that could potentially help make the energy and water sectors more cyber resilient in the new threat landscape.

Digital sovereignty and taking back control: from regulatory capitalism to regulatory mercantilism in EU cybersecurity

ABSTRACT In recent years, we have been able to observe the emergence and mainstreaming of an EU discourse on digital sovereignty, which highlights the importance of gaining back control of EU digital infrastructure and technological production, based on the EU's perceived loss of economic competitiveness, limited capacity to innovate, high degree of dependence on foreign digital infrastructures and service providers and, related to all these factors, difficulty in providing EU citizens with a high level of cybersecurity. Bearing in mind that a considerable percentage of these infrastructures and service providers are under private sector control, the present article asks how this sovereignty discourse conceptualises the role of the private sector in EU cybersecurity. Drawing from a Regulatory Capitalism theoretical model, this article proposes that the EU has instead entered a Regulatory Mercantilist phase where it seeks to reassert its control over cyberspace, impose digital borders, accumulate data wealth and reduce its dependence on external private sector actors whose values may not reflect those of the EU order. A new approach to cybersecurity is emerging, in which the non-EU private sector can be perceived as much of a threat as foreign powers, and from whom digital sovereignty must be secured.

Risk vs. threat-based cybersecurity: the case of the EU

ABSTRACT In a relatively short time, cybersecurity has risen to become one of the EU’s security priorities. While the institutionalisation of EU-level cybersecurity capacities has been substantial since the first EU cybersecurity strategy was published, previous research has also identified resistance from member states to allow the EU to have more control over their cybersecurity activities. Despite a growing literature on EU cybersecurity governance, there are currently extensive gaps in the understanding of this tension. This study suggests that an explanatory factor can be found in the so-far overlooked dynamic of the relative prevalence of risk vs. threat-based security logics in the EU cybersecurity approach. By distinguishing between risk and threat-based logics in the development of the EU cybersecurity discourse over time, this study highlights a shift towards an increasing threat-based security logic in the EU cybersecurity approach. The identified development highlights securitising moves enacting to a larger extent than before objects and subjects of security traditionally associated with national security. The study identifies specific areas of member state contestation accompanying this shift and concludes with a discussion on the findings in relation to the development of the EU as a security actor in the wider international cybersecurity landscape.