How to improve EU cybersecurity?

There may have been some embarrassment for the EU when Hungarian news site Direkt 36 announced on March 29 that the Hungarian Foreign Ministry had been hacked by Russian intelligence for several months since December 2021, days after the European Commission proudly announced it strengthened cybersecurity with a new set of measures to protect EU institutions’ networks against intrusion.

As the Hungarian connection may have compromised sensitive communication channels with Brussels, the incident is further painful proof of just how fragile cybersecurity really is.

This incident is not unique (the hacking of the Spanish Prime Minister is another prominent recent example) and I am sure that many more similar incidents have gone unreported.

In fact, as recently as this month, there have been other clear warnings of more hacks.

Against this background, the EU Commission issued a new cyber security regulation on March 22, which is intended to improve the “governance, risk management and control in the area of ​​cyber security” of its institutions.

This includes a new inter-agency cybersecurity body that will improve cybersecurity capabilities and maturity assessments, as well as better cyber hygiene. More importantly, the Computer Emergency Response Team (CERT-EU) mandate gains additional responsibilities for threat intelligence, information sharing and incident response coordination. These new rules complement existing initiatives to improve EU cybersecurity supported by Enisa, the European Information Security Agency.

But the Hungarian hack that allowed Russian intelligence services to read the shoulders of an EU member state for an extended period of time proves that cybersecurity is still connected and must be guaranteed far beyond the country’s institutions and authorities even.

It requires more rigor than is likely to be achieved by an inter-agency body, which on the surface sounds like little more than another layer of bureaucracy on top of the rest and a parallel to Enisa.

The EU and its members are increasingly dependent on digital infrastructure. This poses enormous risks of serious disruption if this networking is compromised.

While usual cyberattacks naturally involve stealing confidential EU political and economic information, the ongoing war in Ukraine could lead to even more crippling cyberattacks.

The past few months have revealed cyberattacks of varying size, strength and success against digital communications, critical infrastructure and even satellites. The EU and the world are at the dawn of a new digital age where 5G and beyond, AI, quantum computing, smart drones, nanotechnologies and accompanying innovations will enable a true Internet of Things that connects all devices but at the same time exposes those connections at great risk.

The question therefore remains what further steps need to be taken to enable a secure digital environment.

Enisa’s initiatives definitely lead to positive developments and awareness; However, they usually involve the creation of bureaucratic levels and procedures and focus on incentives without enforcement. New paradigms will be needed to detect and deter new attempts to exploit our interconnectedness and to mitigate their impact, and in this respect the EU can learn a lot from its partners.

As a NATO powerhouse, the US remains the world’s best-performing cyberstate in defense, offensive and intelligence capabilities, thanks to decades of significant investment and a clear political direction, and more could be done to share techniques with EU allies. Other examples include the United Arab Emirates, which has emerged as a strong regional cyber power, driven in part by the proliferation of cyber attacks.

Part of his strategy is to enlist the help of cyber experts like Amazon Web Services and Deloitte to train local staff in technology – a technique that EU countries should continue to use with the right partners.

While there are big differences in the assessment of offensive cyber capabilities, to counter the threat from authoritarian powers as members of NATO, many EU states could also try to further improve their offensive cyber capabilities to avoid being outmaneuvered by China and Russia to become investments in this area.

The difficulty for the EU, however, is that it is not a single nation, but the combination of 27 cybersecurity strategies and mentalities, and therefore must find a way to overcome the divisions involved.

Table of Contents

‘To do list

To that end, the EU should improve cybersecurity around three key elements: improving situational awareness, reducing the attack surface through coordinated countermeasures, and enforcing standards.

The EU is in an excellent position to meet all three, but standards need to be tightened and enforced rather than encouraged. Provided that CERT-EU is enabled to process the incoming data, the incentives could include sanctions for non-compliance, help ensure that the most serious incidents are prosecuted and encourage the EU to increase its sizeable Use economic power against states that harbor cybercriminals.

Setting up these capabilities is not only a technical but also an organizational challenge. Cyber ​​security is not built up in isolation, but as holistically and decompartmentally as possible.

But cybersecurity is only as strong as its weakest link.

Leave a Comment