CYSPA
- “
EC projects supporting NIS”
Nina Olesen, EOS
March 2014
Athens, Greece
•
The European Cyber Security Protection Alliance, or ‘CYSPA’,
is an
initiative by 17 organisations
from the security,
telecommunications, finance, energy and transport sectors
•
The project CYSPA is set up with the financial support of its
founding members as well as the European Commission
research programme
FP7 in ICT Trust & Security
•
CYSPA began in October 2012. The initial output of its
activities will be delivered to the European Commission and
all interested stakeholders during 2013 and 2014, and the
final output is expected by March 2015
•
The CYSPA project
aims to evolve into a self-sustained
Alliance
2
CYSPA – 17 founding members
EHusmann
Users
Research
organisations
Solutions
& Services
Providers
What are the needs?
•
Do you KNOW what your exposure is to cyber
threats?
•
Which assets are the most precious to your
organisation?
•
Where do you need to invest? In operations,
in facilities, in education?
•
Are you aware of the European policies in the
making / applicable to your sector?
•
CYSPA – the European Cyber Security Protection Alliance
– aims to address the need by
Empowering
your organisation
to assess
the level of exposure to
RELEVANT
cyber-threats
through a
simple approach
–
Understand the key cyber threats to YOUR domain
–
Evaluate through a relative approach (is this part of
my operations more at risk than this other part?)
CYSPA – addressing the need
SER
VIC
CYSPA aims to DELIVER
a set of services
to its member organisations
6
CYSPA – concrete benefits
Operational services to
your organisation
Risk methodology
In-house seminar
Sector based analysis (where
are you positioned versus other
players in your domain?)
Strategic services to your
organisation
Contribute to the European
policy on cyber-security => NIS
platform
Put needs of your sector in the
debate => Position papers
SER
VIC
•
CYSPA – the Cyber Security Protection Alliance – aims to
address the need by
Ensuring
your organisation
needs
are voiced as
contributions to the European debate
, leading
to directives and other regulations
applicable to your sector
are shared with other stakeholders from your sector
–
Know what is relevant to your sector at European level
–
Contribute your needs to directives under elaboration
–
Share recommendations with other stakeholders from
your sector
CYSPA – addressing the need
STR
AT
EG
IC
CO
NT
EN
T
The Alliance aims to
analyse and recommend practical methods
, standards,
information, technologies and behaviours to support
protection from cyber attacks and
increase the ability to
respond to them
to work together
to
apply
the practical methods,
standards, information, technologies within member
organisations to evaluate and evolve them, and ‘learn by
doing’
8
CYSPA – the strategic content
STR
AT
EG
IC
CO
NT
EN
T
•
CYSPA is
open
to users, ICT providers, researchers,
sector associations and public authorities
•
CYSPA promotes a
benefits oriented approach
–
For providers, benefits include
faster time to market
for
innovative cyber security capabilities.
–
For public authorities, an
increased understanding of cyber risks
that could limit e-government services.
–
For users, a
tailored approach
better focused on individual
needs.
External stakeholders - relationships
Citizens Research bodies
Cyber security industry e.g. SMEs, large scale vendors Providers Target sectors e.g. Transport, Finance, Energy, Telecom, eGovernment
National cyber security authorities
e.g. OCSIA, CERTs European cyber security bodies e.g. ENISA, DG
CONNECT, Europol etc
Other European/national bodies Prop ose agen da & endo rse Prop ose a ction & ad vise Cre ate aw are ne ss Reco m m en d cap ab ilities Le ad by exam ple Highli ght m arket requir emen ts (thro ugh capa bility gap analy sis) Propo se ne w ide as Com mun icate & im plem ent Users Public Authorities
External stakeholders – benefits of the CYSPA Alliance
Target sectors National cyber security authorities Other European/ National authorities European cyber security authorities Benefits to users• Increased awareness about the existence of cyber risk;
• Increased understanding about the impact of cyber threats on target sectors;
• Knowledge of possible improved protection against and mitigation of effects of cyber disruptions;
• Increased awareness of the value of good cyber security as a market differentiator for organisations.
• Understanding possible ways to decrease costs of cyber threats
Benefits to public authorities
• Increased understanding of cyber risk posed to users across EU;
• Availability of a realistic set of recommendations and advice for policies validated by users and Benefits to providers
• Increased understanding of market requirements;
• Growth in cyber security market through increased awareness amongst consumer organisations;
Users
Providers
CYSPA will focus on
security of individual organisations
economic sectors represented within the Alliance
(egovernment, energy, finance, transport)
recommendations and services to better protect
cyber space for industry
maximising value by considering maturing
pre-existing standards/ technologies wherever possible
complementing on-going activities at European level
and collaborating with the NIS platform
12
•
Risk management and metrics
•
Best practices and information sharing at sector level
and with public authorities
•
Analysis of impact of cyber disruptions on critical
infrastructure
•
Protection of assets and threat detection
•
Linking of users and providers (community approach)
•
Involvement in NIS Platform
•
Coordination with other projects: CAPITAL,
•
CYSPA differentiates itself from other cyber
security initiatives at EU level by:
–
Looking at risk scenarios on a per sector basis
–
Having a dedicated community portal (with a dynamic
online repository of technology & solutions)
–
Linking users and providers (thus creating a unique
network where fighting cyber threats becomes a
shared challenge)
–
Providing the gateway for stakeholders to
communicate their needs at the highest EU level
(policy dimension)
14
