The EU Cyber-Security Policies: Challenges and Solutions

This report provides an in-depth analysis of the European Union's cyber-security policies, exploring vulnerabilities, potential threats, and proposed countermeasures. It examines the evolution of EU cyber-security strategies, including policy and legislative concepts like the NIS directive and GDPR, and their objectives in enhancing cyber resilience. The report identifies key challenges in constructing a robust legislative and policy framework, such as accountability, coordinated response, uneven transposition, investment alignment, and building a cyber-resilient society. It also delves into the EU's counterattack strategies, including the European Security Agenda, Digital Single Market Strategy, and Global Strategy. The paper concludes by emphasizing the need for modifications and improvements in the EU's cyber-security policies to effectively address evolving cyber threats and protect the digital environment. The report highlights the complexities of the cyber ecosystem and the need for continuous adaptation and improvement to counter cyber-attacks.

Running head: THE EU CYBER-SECURITY POLICIES
The EU Cyber-Security Policies
Name of the Student
Name of the University
Author Note

1THE EU CYBER-SECURITY POLICIES
Executive Summary
The report stretches on the vulnerabilities of the European Union policies and legislations
and the potential threats associated with the cyber space of it. Certain challenges have been
mentioned in a detailed manner along with the counter measurements that can help in resolving
those issues. If proper measures are taken as proposed in this particular paper further threats
regarding cyber security can be easily avoided in the near future.

2THE EU CYBER-SECURITY POLICIES
Table of Contents
Introduction..........................................................................................................................3
Discussion............................................................................................................................4
EU’s counterattack to cyber security...............................................................................4
Policy Concepts:..........................................................................................................4
Legislative Concepts....................................................................................................6
Challenges in constructing a new legislative and policy framework..............................7
1. Accountability and Evaluation...........................................................................7
2. Coordinated Response........................................................................................8
3. Uneven Transposition.........................................................................................8
4. Proper alignment of investment levels...............................................................9
5. Building a cyber-resilient society.......................................................................9
6. Information security governance......................................................................10
7. Threats and assessment of risks........................................................................11
Conclusion.........................................................................................................................12
References..........................................................................................................................13

3THE EU CYBER-SECURITY POLICIES
Introduction
Technological advancements in the resent time are opening up a completely new pathway
for a range of opportunities. New services and products are becoming an inevitable part of our
day to day life. Although it has several beneficial aspects, there is a sudden increment in the
technological dependencies with every new invention in the field of technology along with the
need of cyber security. With the increased connectivity and most of the confidential information
uploaded on internet, there are high chances of falling prey to a cyber-attack (Carrapico, Niehuss
and Berthélémy 2019). The concept of cyber security comprises of detecting, responding,
preventing and recovering the attacked system from a cyber-attack. According to the EU
policies, the concept of cyber security is not only limited to security of information and
networks. Any unauthorized or unlawful act with the potential use of technology within the
cyberspace for the fulfilment of personal propaganda also falls under the key concerns of cyber
security. Hacktivists, states and other several criminal groups are often involved in this act. The
consequences of these attacks often impact the European or even global economy graph.
However, due to the unfathomable nature of internet it is impossible at times to track the
individual or group of individuals associated with the crime. There are various types of cyber-
attacks namely ransom ware attack, phishing, malware attacks etc. that are used by the
perpetrator for personal or political agendas (Bacon et al. 2014). Although, almost 80% of the
organizations within the European Union have faced at least one cyber-attack in the year 2016,
the officials are yet to incorporate severe steps against such attacks. In addition to that, almost
60% of the organizations in the EU are completely unaware or are having a ground level ideas
regarding potential cyber threats. Furthermore, 60% of the organizations in the EU are unable to

4THE EU CYBER-SECURITY POLICIES
estimate their financial losses due to such attacks. Therefore, it can be stated that several
modifications in terms of the policies are required to avoid such cases in the near future.
Discussion
EU’s counterattack to cyber security
Since the year 2001, the European Union started acting as an observer organization to
Cyber Committee that falls under the Council of Europe’s Convention (Christou 2016).
Subsequently after that, various legislations and policies have been imposed for the purpose of
enhancing the cyber resilience. Private organizations, member states, ENISA, EEAS, and the
European Commission proactively take part in framing, proposing as well as implementing these
policies.
Policy Concepts:
The imposed cyber security of the European Union is multi-layered and complex in
nature. The internal policy areas of the EU gets cut across in an array. In case of external policy
of the EU, cyber security plays an important role in enhancing the defense policies (Carrapico
and Barrinha 2018). In the year 2013, a strategic policy regarding cyber security was imposed.
The core purpose of the policy is to safeguard the digital environment of EU and make it the
most secured across the globe at the same time defending the fundamental and basic values. Five
core objectives are comprised in this policy.
 Enhancing the cyber resilience
 Reducing the cyber attacks
 ‘Developing defense policies in terms of cyber security.
 Developing technological and industrial resources of cyber security.

5THE EU CYBER-SECURITY POLICIES
 Imposing an international policy comprising of all the EU values.
These strategies can be interlinked with three of the most frequently adopted strategies:
The European Security Agenda
This strategy was imposed in the year 2015 and the key purpose of this strategy is to
enhance the judicial and law enforcement response in terms of cyber-attacks by updating the
existing legislation and policies (Argomaniz 2015). Furthermore, identifying the specific
obstacles in the investigation process also falls under its key concerns.
The Single Market Digital Strategy
This strategy was imposed in the year 2015 as well with its key purpose being, creating a
better access control system for the digital services and goods by creating suitable conditions for
the purpose of maximizing the potential of digital economy (Reichart 2017). In addition to it, this
strategy also helps in strengthening the online security system.
The Global Strategy
In the year 2016, the global strategy framework was proposed with an aim to enhance the
role of EU across the whole world (Bellantuono 2014). The core pillar of this strategy is cyber
security along with a set of renewed and updated commitments towards the increasing cyber
issues in all the policy areas. Strategic methods of communication is used in order to resolve the
disinformation rebuttal problem.
Over the past few years, cyber security has seen several enhancements in accordance to
the imposed policies of the EU (Kok 2018). In terms of warfare, it is now being considered as the
fifth domain of it. The cyber defense helps in shielding and safe guarding all the system that are

6THE EU CYBER-SECURITY POLICIES
comprised within the cyber space along with the networking infrastructures. A framework for the
Cyber Defense Policy that was adopted in the year 2014, went through a modification in the year
2018. The modified framework comprised of six basic objectives that prioritized the
development of information and communication networks, capabilities of the cyber defense and
the CSDP protection of the EU.
A joint framework of the European Union with a purpose to counter the hybrid threats
was imposed in the year 2016. It helps in tackling the threats faced by private sectors and critical
infrastructures, pointing that cyber-attacks can be launched by spreading wrong information
campaigns via social media. Obscure aspects that are often forgotten like awareness
improvement and enhancing cooperation between the NATO and EU are also taken into
consideration (Ilves 2016). In the year 2017, a new cyber security policy was imposed as an
urgent need of digital protection. As a result, a new commission communication was included
that modified the cyber security strategies along with the blueprint of cyber-attack response,
proposed in the year 2013 (Bacon et al. 2014). Additionally, a set of legislative proposals were
also included within the package.
Legislative Concepts
Since the year 2002, adoption of various legislations, related to cyber security were
imposed. The NIS (Network and Information Security) directive can be stated as the main pillar
of the cyber security strategy that was imposed in the year 2013 (Nikolopoulou 2019). Another
directive that was to be imposed by the end of 2018, was purposed to achieve basic capabilities.
On the other hand, the GDPR (General Data Protection Regulation) came into application
by May of 2018. The purpose of the GDPR to ensure the security of personalized data of the
citizens (Kańciak 2016). This is done by setting several ground rules on the dissemination and

7THE EU CYBER-SECURITY POLICIES
processing of the data. However, specific obligations and rights on the data controllers
comprising of the transfer and use of information are granted to the data entities.
Challenges in constructing a new legislative and policy framework
The cyber ecosystem of the European Union is multi layered and immensely complex in
nature. It also involves a number of stakeholders (Christou 2018). Therefore, bringing together
all the complex parts of the cyberspace is tremendously challenging. Since 2013, various policies
and legislations were imposed for the purpose of imposing a coherent nature within the field of
cyber security. Various challenges, associated with the legislative framework have been briefed
below:
1. Accountability and Evaluation
Framing a policy based on evidence completely depends on the sufficient availability of
reliable statistics and data which helps in monitoring and analyzing the needs and trends. The
unavailability of a common and compulsory monitoring system is what makes the availability of
reliable data fall off (Peeters 2017). Often, indicators are unavailable and impossible to define.
However, development of specific metrics have been done in certain areas. For instance, the EU
cycle of policy is needed to tackle organized and serious crime.
Few Member States collect cyber related official data on a regular basis, thus affecting
the comparability. Till date, a minimal indication of statistics consolidation has been provided by
the EU. However, there are certain wide analysis that are independent in nature and help in
covering up topics, such as the economic statistics of cyber security which also involves certain
behavioral aspects. The behavioral aspects comprise of asymmetries in information or
misalignment in terms of incentives (Ilves et al. 2016). Understanding the consequences of

8THE EU CYBER-SECURITY POLICIES
cybercrimes and cyber failures and providing the best possible solution to a particular threat are
also included.
The assessment done on the achievements of the strategy is mostly qualitative due to
certain aspects like unavailability of potential objectives, reliable or concrete data, and defined
indicators (Shackelford, Russell and Haut 2015). The specific tasks that have been carried out
and the achieved milestones are often described without thoroughly measuring the data with the
help of progress reports.
2. Coordinated Response
The development of a cyber-security framework for the purpose of cooperating with the
lingering crisis is still in progress. The capacity of EU to deal with the ongoing cyber-attacks at
the political as well as operational levels is limited (Bagheri and Ridley 2017). The reason
behind this limitation is partly because, cyber security is yet to be integrated with the crisis
response mechanisms. This was not addressed by the directive imposed by NIS.
3. Uneven Transposition
The rate at which technology and vulnerabilities or threats associated with it are
advancing is one of the core reasons behind a negative impact on the EU legislative framework.
While designing the mainframe of the union procedures, the digital scenario was not taken into
consideration: developing flexible and innovative methods for ensuring a legal and policy
framework according to the requirement is the first priority that has to be kept in mind in order to
shape a better future (Skopik, Settanni and Fiedle 2016). Although there is a tremendous need of
a concrete policy, the legislative framework of the EU is still incomplete. Certain gaps and
fragmentations impact the policy objectives thus leading to inefficiencies. These loopholes and

9THE EU CYBER-SECURITY POLICIES
gaps are identified by the commission during the strategy assessment process and are specifically
based on the aspects of IOT, mutual responsibility factor between the users and the providers and
other specific aspects that are left unaddressed or partially addressed by the NIS directive
(Christou 2018). The newly imposed cyber security act helps in partially addressing it via
promoting the security design through a certification scheme based on the EU. According to
some stakeholders there are still advancements that are needed to be made in terms of the cyber-
security framework.
The inconsistency in the EU law transposition within the member states can give rise to
operational and legal incoherence. In addition to that, it also obstructs the legislative policies to
reach its full potential.
4. Proper alignment of investment levels
The total amount spent in percentage by the global cyber-security as GDP is
approximately 0.1%. In the U.S. this rises to over 0.35% (taking the private sectors into account).
The federal government of the US spends approximately 0.1% as GDP. It is immensely difficult
to picture a comprehensive scenario due to absence of data. Recent surveys that have been
conducted, portrays that in order to obtain reliable statistical data regarding the amount spent on
both the private and public sectors. Therefore, it can be stated that useful outcomes need to be
yielded in order to decrease the gap in terms of cyber investment.
5. Building a cyber-resilient society
The EU is significantly identified to deal with the cyber security governance in regards to
the constraints of the threat as well as risk management within the organization. The
strengthening of the risks as well as the awareness and capacity is also a significant importance

10THE EU CYBER-SECURITY POLICIES
in regards to the EU cyber security framework (Aggarwal and Reddie 2018). The EU framework
needs to coordinate as well as efficient sharing of information in regards to the development for
the trust in regards to the EU framework is also necessary in this context. The significant
implications in regards to this field is associated with the following facts as stated below:
6. Information security governance
This is depicted as the mechanism of the properly structuring of the policies as well as
rules that will be adhering the EU’s cyber security framework. This is necessary in regards to the
fact that the EU requires to ensure the data security as well as the integrity of the overall data
within the framework of EU. The governance nit only depends on the fact that the information
also needs confidentiality, availability as well as integrity of the data. Within this field the threats
in association with the cyber security that also includes the target as well as the identification of
the potential threats within the environment of the EU. The significant detection as well as
management of the data within the EU environment has also to be maintained by the
professionals of the cyber security (Nagyfejeo 2018). The consequences in regards to the data
threats and integrity of the member States as well as the responsibility of the professionals for the
identification of the activities in regards to cyber security is to be adhered by the data
governance. The risk management as well as the data governance arrangements are to be
highlighted within the data governance mechanism for the secure transmission of the data within
the EU framework.
Moreover, the information security at the different institutions within the EU framework
is to be considered by the different information security assistance is to be adhered by the
commission of the EU for the different institutions as well as agencies (Min, Chai and Han
2015). The Commission, EEAS as well as Council by the 2020 in regards to the Cyber issues

11THE EU CYBER-SECURITY POLICIES
within the EU framework is depicted to be considerable by making the clarification as well as
harmony of the governance of the cyber security within the EU agencies as well as the
institutions. The significant importance in regards to the institutions of the EU framework has to
adhere different structures as well as missions. In this context, the external EEAS board of the
cyber governance will then meet the requirements for the enactment within the EU framework.
7. Threats and assessment of risks
These are depicted to be the significant tools that are necessary for the assessment of the
cyber security threats within the different public as well as private organizations within the EU
legislative framework. The approach for the assessments of the risk that is being adhered by the
organization for the identification of the cyber security within the EU framework are depicted to
be very useful in terms of the threats that could probably hit the organization of EU (Crispim et
al. 2014). The significant concept of the Hybrid Fusion Cell that is enclosed within the EEAS
tends to improve the awareness of the situation as well as intends to support the decision making
technology for broadening the expertise of the institutional approaches of identification and
bodies within the frame work of EU (Christou 2017). There are also significant legal as well as
incentive in regards to the economic constraints of the organization for the targets of the cyber
threats within the organization. Moreover, the monitoring capacity of the threats as well as it
restrictions are significantly adhered by the approach of the EU which provides significant
enhancement to the organization.
The professionals that are responsible for the restriction of the cyber security within the
EU framework should also take the responsibility by raising the awareness as well as the skills
within the employees associated with the EU framework to depict the EU as a cyber-resilient
society. The proper identification can be justified with the help of the efficient professionals