论文标题
调节欧盟（和世界）网络安全的机会：《网络安全弹性法》的建议
The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act
论文作者
论文摘要
在大多数情况下，安全正在成为网络安全。当欧盟提出和同意时，应在《网络安全弹性法》中反映这一点。在本文中，我们定义了一系列未来法案应该建立的原则，并论证了为什么应该尽可能广泛。它基于长期以来要求的网络安全研究社区的要求，以及什么构成了明确的法律规则而不是软体规则。应该认真对待网络安全等重要领域，就像我们看到其他类型的关键基础设施和物理结构一样，并毫不妥协和逻辑，以涵盖其无处不在的混乱的风险和潜力。 我们发现，需要详细规范网络安全系统的生命周期的原则，这清楚地表明，由于柯克霍夫（Kirkhoffs）的原则，正在使用哪种技术，并驳回了技术学术的思想。此外，始终需要仔细分析风险，但是了解系统制造商何时以及如何失败或几乎失败。我们通过以下原则来做到这一点： 事前和事后评估，通过设计进行的评估，安全和安全性，否定晦涩难懂，系统认可，全面透明度，向零值安全模型，网络安全弹性，强制执行的循环风险管理，可靠性，可靠性，危险分析和责任或限制，责任，责任，持续的报告和持续的报告和确定性和确定性和确定性和确定性和确定性和确定性，并进行确定性和降级。 为此，我们建议该法案采用类似的权威和机制作为GDPR，并创建强大的国家当局来协调每个成员国的检查和执行，Enisa是顶级和协调器官。
Safety is becoming cybersecurity under most circumstances. This should be reflected in the Cybersecurity Resilience Act when it is proposed and agreed upon in the European Union. In this paper, we define a range of principles which this future Act should build upon, a structure and argue why it should be as broad as possible. It is based on what the cybersecurity research community for long have asked for, and on what constitutes clear hard legal rules instead of soft. Important areas such as cybersecurity should be taken seriously, by regulating it in the same way we see other types of critical infrastructure and physical structures, and be uncompromising and logical, to encompass the risks and potential for chaos which its ubiquitous nature entails. We find that principles which regulate cybersecurity systems' life-cycles in detail are needed, as is clearly stating what technology is being used, due to Kirkhoffs principle, and dismissing the idea of technosolutionism. Furthermore, carefully analysing risks is always necessary, but so is understanding when and how the systems manufacturers may fail or almost fail. We do this through the following principles: Ex ante and Ex post assessment, Safety and Security by Design, Denial of Obscurity, Dismissal of Infallibility, Systems Acknowledgement, Full Transparency, Movement towards a Zero-trust Security Model, Cybersecurity Resilience, Enforced Circular Risk Management, Dependability, Hazard Analysis and mitigation or limitation, liability, A Clear Reporting Regime, Enforcement of Certification and Standards, Mandated Verification of Security and Continuous Servicing. To this, we suggest that the Act employs similar authorities and mechanisms as the GDPR and create strong national authorities to coordinate inspection and enforcement in each Member State, with ENISA being the top and coordinating organ.
