Overview
Directive 2022/2555 (NIS2) replaces NIS1 and aims to improve cybersecurity by protecting network and information systems, their users, and other affected individuals from cyber incidents and threats. Directive 2022/2557 (CER) aims to strengthen the resilience of critical entities against natural hazards, terrorist attacks, insider threats, sabotage, and public health emergencies.
Industry 4.0 technologies have driven massive distributed systems creating new vulnerabilities beyond traditional cybersecurity. Various laws exist in specific sectors: ENISA (energy), DORA (financial), NCCS (cross-border electricity). Compliance with standards (notably ISO/IEC 27001:2022) is insufficient for infrastructure resilience.
Timeline & Location
2016: NIS1 directive. 2022: NIS2 directive launched. 2023: CER directive launched. Location: European Union, all 27 member states.
Stakeholders
Critical Entities (public and private). Private and public sector technology firms. ENISA (EU Agency for Cybersecurity). NIST (US reference framework). Sector-specific regulators.
Sector Threats
Utilities & Energy
Data integrity risks, predictive maintenance manipulation.
Telecommunications
Denial-of-service attacks, side-channel attacks, physical security risks.
Manufacturing & Industry 4.0
Intellectual property theft, process sabotage, systemic vulnerabilities.
Healthcare
Data breaches, adversarial AI attacks, device manipulation, digital twin exploitation.
Defence & Aviation
Digital twin and AI exploitation, mission planning compromise, edge and IoT vulnerabilities.
Transportation
Data breaches, AI manipulation, digital twin exploitation, privacy risks, service disruptions.
Digitalisation & Data
Digital approaches include: AI, cryptography, education/workforce, emerging technologies, human-centred cybersecurity, identity/access management, privacy, risk management, trusted networks.
Data sources classified into: network (IDS logs, firewall logs, traffic data, packet data, honeypot data), host (OS logs, database access logs, web server logs, email logs), and hybrid.
Hazards
Exogenous Hazards
Cyber attacks by external attackers targeting critical infrastructure systems.
Endogenous Hazards
Deliberate exposure of vulnerabilities by inside attackers. Threats from Industry 4.0 technology integration — while technologies like AI with Blockchain enhance threat detection, they also amplify adversarial attacks.
Cost & Benefit
Cost: Estimated €31.2 billion per year to implement NIS2 alone.
Benefit: Minimisation of disruptions to essential services; avoidance of fines for personal data loss; avoiding large ransomware payments (cumulative $2.6B to 2023); reducing repair and recovery costs.
Resilience Principles Assessment
Assessment of meeting Principles of Resilient Infrastructure
Clearly Defined Accountabilities and Shared Responsibilities (P1)
Collaboration between digital providers and critical infrastructure designers, architects, engineers, operators.
Proactively Protected (P2)
PKI used for digital identity but fails to address systemic vulnerabilities including over-reliance on centralised trust hierarchies, inconsistent governance and slow response. Protection needs to be adaptive to emerging technologies and attack vectors.
Environmentally Integrated (P3) To Do
Issues with additional energy consumption for cybersecurity processes.
Socially Engaged (P4)
ENISA promotes cyber hygiene for individuals: strong passwords, 2FA, software updates, email caution, data backups, secure Wi-Fi, antivirus, education, limiting personal info sharing, monitoring accounts.
Adaptively Transforming (P5)
As digitalisation grows, new threats require approaches beyond traditional methods. Supported through Socially Engaged principle (citizen information) plus Continuously Learning.
Continually Learning and Improving (P6) To Do
Details pending.
Futures
The most expensive reported cyber breaches relate to technical data integrity inconsistencies leading to confidentiality breaches for which no standards controls exist. Use of open data standards for interoperability and responsibility for data integrity are essential for infrastructure resilience.