2018年-CEPS欧洲政策研究中心_EU_Cybersecurity_and_the_Paradox_of_Progress_10页_845kb

EU Cybersecurity and the Paradox of Progress Summary

Core Content

The document "EU Cybersecurity and the Paradox of Progress" by Lorenzo Pupillo explores the challenges and opportunities of cybersecurity in the context of technological advancement and global conflict. It highlights the paradox of progress, where increased digitalisation brings greater efficiency but also heightened vulnerability to cyber threats. The EU is seen as a key player in developing cybersecurity policies, especially in light of American diplomatic and political withdrawal from global affairs.

Main Views

• The Paradox of Progress: As digitalisation increases, society becomes more efficient but also more susceptible to cyber threats. Cyberattacks are becoming more sophisticated and frequent, with state-sponsored operations targeting critical infrastructure, societal cohesion, and government functions.

• Cybersecurity as a Collective Responsibility: The WannaCry ransomware attack demonstrated that many users and businesses fail to implement basic cybersecurity measures such as software updates, strong passwords, and data encryption. This negligence leaves systems vulnerable and contributes to the problem of free riding in cybersecurity efforts.

• Smart Policies for Resilience: The EU has taken significant steps with its Cybersecurity Strategy and the recent Cybersecurity Act, which includes measures like strengthening ENISA, improving emergency response, and enhancing cyber defence capabilities. However, the effectiveness of these policies is limited by the fragmented nature of the European cybersecurity landscape and the voluntary cooperation among member states.

• Need for Coordinated Vulnerability Disclosure: The document argues for the development of comprehensive frameworks for managing software vulnerabilities, including coordinated vulnerability disclosure (CVD) and the Vulnerability Equity Process (VEP). These mechanisms are crucial for ensuring that vulnerabilities are handled responsibly and that all stakeholders are incentivised to act in the collective interest.

• Investing in Relationships for Global Cybersecurity: The EU must lead in defining new norms for global cybersecurity to protect civilian use of the internet and prevent its militarisation. The current stalemate in international agreements like the Budapest Convention requires new negotiation strategies and greater engagement with non-signatory states.

Key Information

• WannaCry Attack: Demonstrated the importance of basic computer hygiene, as many affected systems lacked updates.
• Cybersecurity Act: Aims to enhance international cooperation and cybersecurity capacity-building, but needs additional measures for awareness and governance.
• Fragmented Landscape: The voluntary nature of cooperation among EU member states hampers effective coordination and response.
• Trust and Coordination: Essential for a successful cybersecurity strategy, both within the EU and internationally.
• Global Cyber Governance: The EU has the potential to become a 'norm superpower' and lead in defining new international cybersecurity norms, especially with the US stepping back from global leadership.
• Budapest Convention: Important but faces challenges in global adoption, requiring new approaches to negotiations and engagement.

Recommendations

• Increase Awareness: Cybersecurity should be integrated into digital literacy programs and become a collective responsibility.
• Develop Smart Policies: The EU should focus on creating incentive-compatible policies that encourage better cybersecurity practices across all sectors.
• Strengthen Governance: A more federalist approach to cybersecurity governance is needed to ensure effective coordination and response.
• Promote International Cooperation: The EU should take a proactive role in defining new norms and promote initiatives that accelerate the ratification of the Budapest Convention.
• Enhance Diplomatic Engagement: The EU must engage more effectively with 'fence-sitter' states and work towards a more stable and secure global cyberspace.