EU Cyber Defence

Brussels,

The resurgence of wars has highlighted critical deficiencies in the European Union’s approach to security and defence, especially in cyberspace.

Authoritarian regimes and third countries are increasingly targeting the EU’s digital infrastructure, making cyberspace a contested domain alongside traditional arenas like land, sea, air, and space. Recent cyberattacks on critical infrastructure, such as energy networks and transport systems, demonstrate the urgent need for enhanced military and civilian cooperation to strengthen the EU’s cyber defence capabilities.

In November 2022, the EU Commission presented a Communication on EU Policy on Cyber Defence. Here a summary:

Key Objectives of the EU Policy on Cyber Defence

1. Strengthen Collective Cyber Defence Capabilities:
   • EU Cyber Defence Coordination Centre (EUCDCC): Establish a central hub for situational awareness and coordination within the defence community, integrating military and civilian cyber efforts.
   • Cyber Commanders Conference: Enhance the existing forum to improve operational coordination and information sharing among EU military cyber defence leaders.
   • MICNET (Military CERT Network): Expand and operationalize the network to facilitate information exchange and coordinated responses to cyber threats.
2. Enhance Coordination with Civilian Cyber Communities:
   • Foster collaboration between military and civilian Computer Emergency Response Teams (CERTs) and Computer Security Incident Response Teams (CSIRTs).
   • Develop joint exercises and information-sharing protocols to build trust and improve crisis response capabilities.
3. Invest in Cyber Defence Capabilities:
   • Full-Spectrum Cyber Defence: Promote the development of comprehensive cyber defence capabilities, from prevention and detection to active defence and response.
   • Technological Sovereignty: Ensure the EU masters and develops cutting-edge technologies for cybersecurity and cyber defence, reducing dependencies on external sources.
   • European Defence Technological and Industrial Base (EDTIB): Strengthen the EU’s defence industry through increased investments, innovation, and synergy between civilian and military sectors.
   • Cyber Skills Academy: Launch an initiative to address the significant cyber skills gap by training and certifying cybersecurity professionals.
4. Secure the EU Defence Ecosystem:
   • Cyber Resilience of Critical Infrastructure: Implement measures to protect military and civilian critical infrastructure from cyberattacks, ensuring robust security standards and interoperability.
   • Cyber Resilience Act: Introduce legislative measures to enforce cybersecurity requirements for digital products, enhancing the overall security posture of the EU’s defence ecosystem.
5. Partner to Address Common Challenges:
   • Cooperation with NATO: Deepen the strategic partnership with NATO, focusing on shared cyber defence initiatives, interoperability, and joint training exercises.
   • Engagement with Like-Minded Partners: Strengthen cyber defence cooperation with global allies, including the United States, and support cyber resilience in partner countries, particularly EU candidate states.
   • Cyber Defence Capacity Building: Provide tailored cyber defence assistance to partner countries to enhance their resilience and support their contributions to EU-led missions and operations.

Cyber Defence Actions and Civilian Support Actions

• Cyber Defence Actions:
  • Establish the EUCDCC and enhance the Cyber Commanders Conference.
  • Develop and support projects like CyDef-X to conduct comprehensive cyber defence exercises.
  • Expand the concept of cyber rapid reaction teams to provide immediate assistance during cyber crises.
  • Promote joint development and procurement of cyber defence technologies to ensure interoperability and reduce dependencies.
• Civilian Support Actions:
  • Launch the EU Cyber Solidarity Initiative to build an EU-level cyber reserve and strengthen common detection and response capabilities.
  • Develop cybersecurity certification schemes for the defence industry to ensure high standards and trust.
  • Foster cooperation between civilian and military standardisation bodies to harmonize cyber defence standards.

Conclusion

The EU Policy on Cyber Defence aims to create a robust and integrated cyber defence framework that enhances the EU’s ability to prevent, detect, defend against, recover from, and deter cyberattacks. By investing in state-of-the-art cyber defence capabilities, fostering collaboration between military and civilian sectors, and strengthening international partnerships, the EU seeks to secure its digital sovereignty and ensure the resilience of its critical infrastructure. The policy aligns with the broader Strategic Compass for Security and Defence and supports the EU’s overarching cybersecurity strategy, positioning the EU to effectively address current and emerging cyber threats.

Key Takeaways:

• Integrated Cyber Defence: Emphasizes the need for close cooperation between military and civilian cyber communities to enhance collective resilience.
• Strategic Investments: Focuses on reducing technological dependencies and fostering innovation within the EU’s cyber defence capabilities.
• Capacity Building: Addresses the critical cyber skills gap through initiatives like the Cyber Skills Academy and enhanced training programs.
• International Cooperation: Strengthens partnerships with NATO and other global allies to ensure coordinated and effective cyber defence responses.
• Resilient Infrastructure: Implements measures to protect critical infrastructure from sophisticated cyber threats, ensuring the security of both military and civilian sectors.

By addressing these areas, the EU aims to establish a comprehensive and resilient cyber defence strategy that safeguards its interests and upholds the rules-based international order in an increasingly digital and contested global landscape.