1. Dimitra Liveri | NIS Expert CSA CEE Summit 2017|Ljubljana - 9 March
The NIS Directive and the Digital Single Market- what does the cloud need?
Dimitra Liveri | NIS Expert
CSA CEE Summit 2017|Ljubljana - 9 March

2. Positioning ENISA activities
CAPACITY
Hands on activities
POLICY
Support MS & COM in Policy implementation
Harmonisation across EU
Mobilizing EU communities
COMMUNITY
EXPERTISE
Recommendations
Independent Advice

3. ENISA’s work in the area of Cloud
2009 Cloud computing risk assessment
2009 Cloud security Assurance framework
2012 Procure secure (Security in SLAs)
2013 Critical cloud computing
2013 Incident reporting for cloud computing
2013 Securely deploying GovClouds
2013 Support EU Cloud Strategy
2014 Cloud Certification Meta-Framework
2014 Procurement security in GovClouds
2015 Cloud Security guide for SMEs
2016 Exploring Cloud Incidents
This is an overview of the work we did in the past and are doing.
Our early papers from 2009 are still widely downloaded and quoted.
They basically give an overview of the main risks and benefits when moving to the cloud.
Let me go over some of them quickly.
Put in about “ENISA’s work on Cloud Computing, but concentrating on how we have helped industry secure a developing business model (work with CSA, support for the EU Cloud strategy). Here we can stress the fact that we look for security solutions that are economically viable and provide a reasonable trade-off between opportunity and risk. This is ENISA supporting economic growth.”
All SecureCloud events are coorganized with CSA

4. First comprehensive EU cybersecurity legislation adopted!
06 July 2016
First comprehensive EU cybersecurity legislation adopted!

6. Obligations for MS on DSPs
Minimum security measures: Technical and organizational measures proportionate to the risk (Implementing act by the COM, August 2017)
Incident notification: prevent and minimize the impact of incidents on the IT systems which provide the services (Implementing act by the COM, August 2017)
Notes:
Light touch approach to be applied for DSPs
NIS directive applicable only to large and medium enterprises
Define DPS: cloud providers, online market places, search engines
Implementing acts: legal texts which ensure uniform conditions for implementing legally binding Union legislative documents
Light touch approach means:
- security requirements for DSPs should be lighter than those for OESs,
- DSPs are not subject to identification
- MS are not allowed to impose any further security and notification requirements on DSPs
- The criterion of main establishment of the DSP is applied vis a vis the applicable law to avoid multiple parallel jurisdictions
- Security measures relevant, ONLY, to the following domains
1. Security of systems and facilities
2. Incident handling
3. Business continuity
4. Monitoring, auditing and testing
5. Compliance with international standards

7. ENISA’s role in supporting MSs on DSPs
ENISA supported COM and the MSs with the following projects in 2016
Guidelines for implementing incident notification – DSPs
- Assist COM(by providing input for the implementing acts) and MS (by providing guidelines) in incident notification requirements for DSPs
Guidelines for implementing security measures – DSPs
- Assist COM (by providing input for the implementing acts) and MS (by providing guidelines) in implementing minimum security measures for DSPs
MSs discussed the provisions on DSPs in an informal group created by COM
2 meetings of the informal group took place in 2016
next meeting, 15 March 2017, Brussels: discussion on the draft implementing acts
Our input is discussed with an informal group, created by COM, with representatives from MS
Its role is to prepare the implementing acts and the ToRs for the Cooperation Group
The implementing acts will pass through the comitology procedure.
Main challenge is the identification of the DSPs

8. ENISA supporting the NISD

9. EC implementing acts ENISA input
A non exhaustive list of 29 security measures which fall under the article 16(1) elements.
(a) the security of systems and facilities; (b) incident handling; (c) business continuity management; (d) monitoring, auditing and testing; (e) compliance with international standards.
Examples of implementation for all these 29 measures
A list of definitions which accompanies the list of security measures
The process
Deadline for the adoption: 9 August 2017
First comitology meeting: 15 March 2017

10. The DSM and the Cybersecurity Industry
Opportunities and tools for growth
Supports the DSM

11. How NIS Products and Services can benefit from the DSM?
NIS Products and services are used to:
Protect digital and physical assets from cyber threats;
Enhance the awareness and preparedness level;
Ensure availability, privacy and integrity…
Non-exhaustive list of NIS Products and Services:
Software (e.g. antivirus, firewall, SIEM)
Hardware (e.g. network probe)
Information exchange (e.g. ISAC)
Service (e.g. cloud storage, threat intelligence, certification)
Awareness (e.g. education, training)
Support (e.g. product maintenance, CERT)
etc.

12. Current and Emerging Trends & the Evolution of the Demand Side
Common requirements in NIS products and services across all sectors.
Prioritization based on specific business context.
Need for enhanced intelligence, analytics, automation etc. (AI?)
Investment in NIS and ease of use are key issues
Landscape is changing due to evolving threats
Trend
Online Banking
Online Marketplaces
Cloud Storage
Wireless Telecommunications
Online Media
Cloud 
IoT
Mobile
SDN/NFV AI
Big Data
Business Models / Use Cases / Application Areas
Vulnerabilities / Attack Surface
NIS Tools

13. Recommendation Highlights
Raise awareness on the user side to increase demand (educate the market, Cyber-Insurance, regulatory impact on NIS investment, SME policy, NIS training and education, pursue board-level involvement etc.)
Foster innovation and support EU NIS start-ups to bridge the gap from prototyping to industrialization/commercialization (focused R&D planning, link research to NIS industry, preferential procurement policy, innovation clusters etc.)
Address market fragmentation (harmonized certification, standards etc.)
Build NIS ecosystem (industrial clusters, added value chain positioning etc.)

14. Thank you