Patching the patchwork: appraising the EU regulatory framework on cyber security breaches

Abstract

Breaches of security, a.k.a. security and data breaches, are on the rise, one of the reasons being the well-known lack of incentives to secure services and their underlying technologies, such as cloud computing. In this article, I question whether the patchwork of six EU instruments addressing breaches (Framework Directive, e-Privacy Directive, eIDAS Regulation, PSD2, GDPR, NIS Directive) is helping to prevent or mitigate breaches as intended. At a lower level of abstraction, the question concerns appraising the success of each instrument separately. At a higher level of abstraction, since all laws converge on the objective of network and information securityone of the three pillars of the EU cyber security policythe question is whether the legal 'patchwork' is helping to 'patch' the underlying insecurity of network and information systems thus contributing to cyber security. To answer the research question, I look at the regulatory framework as a whole, from the perspective of network and information security and consequently I use the expression cyber security breaches. I appraise the regulatory patchwork by using the three goals of notification identified by the European Commission as a benchmark, enriched by policy documents, legal analysis, and academic literature on breaches legislation, and I elaborate my analysis by reasoning on the case of cloud computing. The analysis, which is frustrated by the lack of adequate data, shows that the regulatory framework on cyber security breaches may be failing to provide the necessary level of mutual learning on the functioning of security measures, awareness of both regulatory authorities and the public on how entities fare in protecting data (and the related network and information systems), and enforcing self-improvement of entities dealing with information and services. I conclude with some recommendations addressing the causes, rather than the symptoms, of network and information systems insecurity.

Compatibility of leadership styles with information security in organizations

“…Organizations must have a clearly defined security incident response plan, which details the steps to be taken in the event of incidents being discovered. These steps may include isolating compromised systems, collecting forensic evidence, notifying relevant authorities or service providers, and implementing immediate repairs to prevent further spread of the incident (Porcedda, 2018). In addition to incident response, organizations must have recovery plans that detail the steps to be taken to bring the system back to normal after an incident.…”

CYBER-AIDD: A novel approach to implementing improved cyber security resilience for large Australian healthcare providers using a Unified Modelling Language ontology

“…Porcedda 31 examined aspects of this problem with a review of various European data protection legislation and identified a need to describe more than just ‘breaches’. The author defined breaches as being comprised of ‘events’, leading to … destruction , loss , or disclosure of data.…”

Personal Data Protection in the Internet of Things

“…Security requirements also vary considerably; for example, there is a significant difference in the level of security and data protection requirements for different types of devices. This raises the question of whether the services concerned can becalled telecommunications services and whether they should be regulated within a regulatory framework for telecommunications [14].…”