PP.LB01.02

Tofan, N; Shtanko, V. A.

doi:10.1097/01.hjh.0000468124.35853.2d

Cited by 1 publication

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…57 The private sector has filled in the gap, be it in the form of privately financed studies, such as the one run by the Ponemon Institute, 58 or cyber-insurance 59 that, according to ENISA, has thus far limited adoption compared to other sectors, but may quickly develop with the entry into force of the GDPR and NIS Directives. 60 As a result, even though the instruments 61 and regulatory authorities 62 acknowledge the overlap between the risks to personal and non-personal data, and the fact that breaches can be triggered by cybercrime, there does not seem to be any methodology to survey the combined effect of cyber security breaches across the different sectors.…”

Section: Secondary (Risks Of) Damage Of Cyber Securitymentioning

confidence: 99%

“…Unfortunately, however, as noted earlier the six instruments do not always provide metrics to evaluate the level of harm. 66 The Framework Directive does not clarify what constitutes a 'significant' impact; ENISA has elaborated some criteria 67 to assess the significance, which are however not mandatory. Moreover, "depending on the national implementation of Art.…”

Section: Notificationmentioning

confidence: 99%

See 1 more Smart Citation

Patching the Patchwork: Appraising the EU Regulatory Framework on Cyber Security Breaches

Porcedda

2018

SSRN Journal

View full text Add to dashboard Cite

ReuseThis article is distributed under the terms of the Creative Commons Attribution-NonCommercial-NoDerivs (CC BY-NC-ND) licence. This licence only allows you to download this work and share it with others as long as you credit the authors, but you can't change the article in any way or use it commercially. More information and the full terms of the licence here: https://creativecommons.org/licenses/ TakedownIf you consider content in White Rose Research Online to be in breach of UK law, please notify us by emailing eprints@whiterose.ac.uk including the URL of the record and the reason for the withdrawal request. ABSTRACTBreaches of security, a.k.a. security and data breaches, are on the rise, one of the reasons being the well-known lack of incentives to secure services and their underlying technologies, such as cloud computing. In this article, I question whether the patchwork of six EU instruments addressing breaches (Framework Directive, e-Privacy Directive, eIDAS Regulation, PSD2, GDPR, NIS Directive) is helping to prevent or mitigate breaches as intended. At a lower level of abstraction, the question concerns appraising the success of each instrument separately. At a higher level of abstraction, since all laws converge on the objective of network and information securityone of the three pillars of the EU cyber security policythe question is whether the legal 'patchwork' is helping to 'patch' the underlying insecurity of network and information systems thus contributing to cyber security. To answer the research question, I look at the regulatory framework as a whole, from the perspective of network and information security and consequently I use the expression cyber security breaches. I appraise the regulatory patchwork by using the three goals of notification identified by the European Commission as a benchmark, enriched by policy documents, legal analysis, and academic literature on breaches legislation, and I elaborate my analysis by reasoning on the case of cloud computing. The analysis, which is frustrated by the lack of adequate data, shows that the regulatory framework on cyber security breaches may be failing to provide the necessary level of mutual learning on the functioning of security measures, awareness of both regulatory authorities and the public on how entities fare in protecting data (and the related network and information systems), and enforcing self-improvement of entities dealing with information and services. I conclude with some recommendations addressing the causes, rather than the symptoms, of network and information systems insecurity. This is the final manuscript for academic use only. Please always refer to the published version:M. G. Porcedda, Patching the patchwork: appraising the EU regulatory framework on cyber security breaches, Computer Law and Security

show abstract

Section: Secondary (Risks Of) Damage Of Cyber Securitymentioning

confidence: 99%

Section: Notificationmentioning

confidence: 99%