Blog Archives
EU NIS 2-Priority on cybersecurity
The progress of digitalization is putting cybersecurity at the center of the EU’s actions, resulting in the adoption of a legislative framework that aims to emphasize proactive security monitoring and the creation of a more resilient digital infrastructure capable of dealing with the threats of the modern digital world.
The European Commission has brought forward the NIS 2 Directive, which provides legal measures to strengthen the overall level of cybersecurity within the EU and was adopted in 2023. This Directive introduces comprehensive cyber measures for Member States and significantly enhances the functioning of the market through strong security protocols and incident response capabilities.
While NIS 1 was primarily addressed to seven sectors, specifically energy, transport, banking services, financial market infrastructure, drinking water, healthcare and digital infrastructure, NIS 2 broadens its scope and addresses new sectors based on the degree of digitization and the role they play in the economy and society.
It is important to know that the NIS 2 Directive applies to both public and private entities, which are divided into “essential” and “important”, depending on the sector in which they are involved. Even public administration bodies are subject to certain conditions.
Each Member State must designate competent bodies to monitor implementation of the Directive and carry out inspections for compliance with it. In cases of non-compliance, they must impose fines that can reach up to 10,000,000€ or 10% of the total worldwide annual turnover of the business they own.
NIS Directive 2- A comprehensive set of cybersecurity measures
NIS 2 contains a comprehensive set of cybersecurity measures that companies and institutions must implement:
- Appropriate technical and operational measures are taken to manage the risks of systems and information.
- Report incidents, to the appropriate authorities or Computer Security Incident Response Teams (CSIRTs), that affect the security of network systems.
- Smooth cooperation with the competent authorities or CSIRTs.
- In case of an incident, information to the public is required. Information to the public is required even in the case of preventive measures.
- Compliance with codes of conduct or standards of practice established at EU or national level is required.
Cybersecurity is now at the center of the EU’s attention, especially after the adoption of NIS 2, where the benefits will be obvious for operators. Dealing with cyber-attacks preserves the reputation of businesses, consumer confidence and the protection of fundamental rights such as the protection of personal data.
Digitalization: One of Europe’s main priorities
Digital investment continues to be at the center of Europe’s efforts to prepare the EU for a resilient and better future. The new budget amounts to €189.3 billion. for 2024, with a significant amount allocated to technology and digitalization. This funding is aimed at modernizing and empowering Member States for the digital transition, strengthening Europe’s role around the world. The focus is on empowering businesses in a sustainable and resilient digital environment.
Substantial investments are directed towards digital infrastructure, skills, and innovation through programs. One of the most important EU’s funding programs is «Digital Europe Programme», which focuses on introducing digital technology to businesses, public administrations and citizens.
Digital Europe Programme
Digital technology now plays a crucial role in the business environment and in the private lives of Member States. Europe’s main concern is not to depend on systems and solutions from other countries but to support projects in essential areas such as artificial intelligence, cybersecurity, advanced digital skills, promoting the use of digital technologies and high-performance computing. In this way, it will be able to support SMEs and public administrations in their digital transformation. In order to achieve a secure digital transformation, it is considered necessary to promote human rights and create a secure digital environment where citizens can be empowered and protected.
The budget allocated for this program amounts to €1.3 billion to shape Europe’s digital future and €348 million for the InvestEu program aimed at research, innovation and digital transition. The Digital Europe program does not tend to address individual challenges but at the same time supports other digitalization-related programs such as «Horizon Europe». More specifically, Horizon Europe is a funding program designed to tackle climate change, support sustainable development objectives and boost research and innovation.
The main targets of the program are:
- Increasing capacity and excellence in technology
- Increasing interest of European Union citizens in seeking careers in the digital sector
- Cooperation between research centers, businesses and higher education institutions
Digital transformation can affect all areas of modern life. The change for Europe has already begun, and rapidly, as it can be an important part of the economic and green recovery and the strategic autonomy of the European Union. The European Digital Strategy aims to make Europe fit for the digital age by boosting digital skills, infrastructure and innovation, making Europe independent of other countries’ systems and solutions.
Europe’s sustainable and technological development
In recent years, we have seen the European Union investing in technological development and sustainability, shaping a future where innovation is compatible with environmental responsibility. The EU budget plays an important role in achieving this and in exploiting technology, providing significant resources for the greater good.
The Commission set the 2024 budget at €189.39 billion in commitments and €142.63 billion in total payments. The draft budget directs funds where they can help address the challenges and needs of EU Member States. A certain amount will also be allocated to the Digital Europe program and to shaping the Union’s digital future, as well as to environmental actions aimed at mitigating and adapting to climate change. The digital sector is vital to ensuring a sustainable future and accelerating economic recovery by boosting investment in various sectors.
On the occasion of Europe’s Digital Program, Cisco has created 10 key technology policies that can make a significant contribution to sustainable growth, leveraging artificial intelligence and connectivity.
Let’s take a look at Cisco’s proposals for empowering Europe’s future.
- AI compliance regulations. It is considered particularly important to adopt regulations that are globally compatible and promote cooperation on risk mitigation through forums.
- Enhancing artificial intelligence skills. It is considered necessary to develop digital skills and to ensure that citizens of the Member States make proper use of artificial intelligence.
- Removal-recycling of old digital devices. The modernization of digital devices can help to enhance the security of the infrastructure and avoid risks.
- Establish security regulations. Establishing strict safety rules can mitigate economic and social risks for individuals and companies.
- Agreement between the EU and the US on government data. With the agreement between these two, the rights and data of citizens would be protected and would reduce tensions in Europe regarding the cloud.
- Strengthening networks through strategic connectivity. A connectivity strategy can play an important role in the development of networks and cross-border service provision through investment.
- Provision of long-range Wi-Fi. Allocating the upper 6 GHz band to Wi-Fi would meet the growing demand for wireless devices and Europe would be one step closer to achieving gigabit connectivity.
- Facilitate the eco-friendly transition through digital innovations. EU policies on industry, digital technology, energy, and the environment need to be coordinated to promote a robust green single market.
- Promote free trade and eco-friendly exchange of goods and services. This will remove barriers to the adoption of sustainable technology and the EU will work with trading partners to promote a circular digital sector.
- Partnerships for economic innovation. Working with like-minded countries and the private sector to implement global standards will unleash the potential of advanced technologies and build confidence and resilience.
Why Every Company Needs a Business Sustainability Plan
Increasing risks derived from climate change, social issues, such as inclusion and diversity, human rights and data privacy, or compliance, have made sustainability an integral part of a business resilience strategy. All organizations, without exception, must adopt a plan to manage risks and opportunities related to sustainability issue, aiming to contribute to the long-term prosperity of the organization itself and the society.
Economic Resilience
A well-designed sustainability program has the ability to enhance the financial resilience of organizations, as it will reduce their operating costs, their exposure to risk and also create new revenue streams and market opportunities. Some significant initiatives they can take are systems and automations, data analytics, governance and risk management systems.
Environmental Responsibility
Environmental challenges should awaken businesses to adopt environmentally friendly practices with the main objective of reducing their environmental footprint and managing resources responsibly. They also position themselves as responsible corporate citizens in their efforts, thereby enhancing their brand (climate adaptation & climate mitigation actions).
Social Impact
Sustainability is not just for individuals but for the whole society, as only in this way the difference can be seen. The practices adopted by a sustainable business affect the employees, customers and the community. A sustainable business plan can make a significant contribution to working conditions, equity and customer relations, enhancing the long-term prosperity of the business.
Ethical Considerations
A well-designed sustainability plan helps companies to set ethical standards and guidelines for their operations e.g. fair labor practices, transparent supply chains or even cyber security.
Competitiveness
Most consumers are now aware of the urgency of the situation and are looking for environmentally responsible solutions and brands. With the help of a sustainability plan, a business can differentiate itself in the market through innovation and attract more customers who prioritize sustainability in their purchasing decisions.
Risk Mitigation
Businesses are given the opportunity to mitigate risk, as through the plan a potential risk can be identified and addressed immediately, ensuring that a company is better prepared to face unexpected challenges.
Adopting a sustainable plan is a one-way street for businesses, not only because of the potential impact it can have but because the planet is everyone’s concern, and we need to contribute to ensuring a healthy planet.
EU AI Act: 7 key principles
Recently, the European Council adopted the EU AI Act, the world’s first comprehensive AI law.
The main goal of the new legislation is to ensure proper risk assessment and the adoption of safe and reliable AI systems in the European Union market. This will be achieved by ensuring respect for the fundamental rights of citizens and promoting innovation in this area. Within the new law, reference is also made to the categorization of types of AI based on the risk they pose, and they are divided as follows:
- Limited-risk AI systems are subject to mild transparency obligations.
- High-risk AI systems will be allowed after a high level of scrutiny and will be subject to obligations in order to gain access to the EU market.
- AI systems that involve cognitive behavioral manipulation or social scoring are strictly prohibited by the EU due to their risk.
- AI systems that contribute to preventive policing and contain biometric data that promote categorization of people based on certain characteristics such as gender, religion and sexual orientation are prohibited.
To ensure the above, specific administrative bodies are set up:
- AI service primarily concerned with the submission of common rules within the EU.
- Establishment of a scientific group composed of experts involved in supporting enforcement activities.
- The AI Council consists of representatives of Member States with responsibilities to advise the Commission and Member States on the effective implementation of the rules.
- A stakeholder advisory forum to provide technical expertise to the Commission and the AI Council.
The new legislation also contains certain penalties in case of violation of the regulations. In case of non-compliance with AI practices, companies can be fined up to € 35 million or 7% of global annual turnover, whichever is higher. For certain violations the amount is up to 15,000,000€ or 3% of worldwide annual turnover, while for misleading information the amount is up to 7,500,000€ or 1% of worldwide annual turnover, whichever is higher.
7 key principles
For the reliable and correct use of AI systems, 7 basic principles have been defined and they are:
- Justice and mitigation of bias. AI systems should not discriminate or reinforce the prejudices of certain social groups.
- Transparency. There should be a full explanation of the decisions and actions of the systems.
- Accountability. Mechanisms should be put in place to assign responsibility in the event of failure or incorrect decisions by AI systems.
- Privacy. AI systems should not process or share citizens’ information and data in a way that does not respect data protection regulations.
- Security. The main goal is to create systems and mechanisms that are secure and reliable to deal with errors and risks.
- Social and environmental well-being. The social and environmental impact of AI must be considered.
- Human intervention. AI systems need to support human intervention and fundamental rights, while respecting human autonomy and dignity.
Cybersecurity in the commercial enterprise sector
Cyber-attacks are on the rise and as a result, many businesses are procuring solutions to protect their data. Unfortunately, small and medium-sized businesses do not consider themselves to be a target for cybercriminals and as a result they leave their data exposed and this is exactly what cybercriminals are exploiting.
The rapid increase in cyber-attacks, especially in the enterprise sector, is since all their operations are carried out digitally. Every connected device is a doorway for hackers to enter, for example, connecting staff from a different Wi-Fi provider can carry many risks. Remote working has equally contributed to the increase in attacks on businesses as the workforce’s devices are unprotected.
The emergence of artificial intelligence has brought even more risks in addition to ransomware attacks and data breaches. Artificial intelligence (AI) and machine learning (ML) are powerful tools for data analysis and automation but pose significant challenges for cybersecurity as these technologies can be manipulated to create sophisticated cyberattacks.
Data breach not only causes financial losses to commercial enterprises to mitigate the attack but also contains several consequences:
- Purchase and integration of new systems
- Possible fines
- Lawyers’ fees
- Tarnishes their reputation and erodes the trust of partners
- Likelihood of business interruption
An important step to avoid this development is to educate the workforce about the potential risks and the ethical use of these technologies. Also, seeking appropriate security solutions is essential to prevent and address threats. The appropriate choice will be made after determining the risks e.g. outdated software, inadequate authentication mechanism. Commercial enterprises need to improve their digital defense by creating a mitigation strategy and by complying with regulations while maintaining the trust of their partners.
But why is it considered necessary to strengthen the digital defense of commercial enterprises?
- They manage large amount of data, customer information and proprietary business information
- It is based on digital systems and a mistake can cost the business operational continuity
- This sector is subject to strict regulatory requirements on data protection and privacy, and non-compliance can lead to legal consequences
- The evolution of attacks requires integrated cybersecurity strategies that cover all aspects of the supply chain, from manufacturing to delivery
The rapid development of technology and the emergence of artificial intelligence has brought a wealth of opportunities and conveniences, but also several challenges in the field of security. By adopting a multi-faceted approach that includes encryption, regular updates, physical security measures, adherence to standards and user education, we can foster a more resilient and secure digital world.