Europe - Report on barriers to and incentives for cyber security information sharing, stressing the economic incentives

[enisa] The EU ‘cyber security’ Agency ENISA, i.e. the European Network and Information Security Agency, launched a new report on barriers to and incentives for cyber security information sharing. The report shows e.g. that the economic incentives are much more important for practitioners than what academic literature indicate.

The importance of information sharing for the Critical Information Infrastructure Protection –CIIP-is widely acknowledged by policy-makers, technical and practitioner communities alike. The Agency has researched peer-to-peer groups, e.g. Information Exchanges (IEs) and Information Sharing Analysis Centres (ISACs). The report identifies the most important barriers and incentives in day-to-day practice in IEs and ISACs for CIIP. This research differs from other reports by being focused on the practitioners’ experiences. The material stems from three sources, literature analysis, interviews, and a two-round ‘Delphi’ exercise with security professionals. The report is launched in conjunction with the NIS Summer School, taking place 13-17 September, in Crete.

Many of the barriers and incentives identified in literature are of low importance to practitioners and security officials working in IEs. The ‘real’ list of incentives for practitioners is instead: economic incentives (i.e. cost savings), incentives of quality, value, and use of information shared. Main barriers to sharing information are poor quality information, poor management, and/or reputational risks.

Incentives & challenges for cyber security information sharing