Eda Aygen Head of Communications and Advisor to the Secretary General

European Cyber Security Organisation (ECSO)

CYBERSECURITY CONTRACTUAL PUBLIC-PRIVATE PARTNERSHIP

Digitalisation is already there !

Source: https://icsmap.shodan.io/

Global trends

Cyber risk and cyber threats are very diverse Intangible assets growing and vulnerable • Human Capital • Hacking of computer systems, software or code • Reputations & brands • Theft of intellectual property or trade secrets Business disruption • Small events big economic and reputational

losses • Financial loss without physical damage • Extended supply chain risk (just-in-time, virtual

factories, IT providers) Internet of Things creates product risks and may shift liability • Autonomous car technology • Industrial control malfunctions • Wearable devices

Global trends

Global trends

Industrial cybersecurity challenges in Europe

Global cybersecurity and ICT market dominated by global suppliers from outside Europe.

Innovation led by imported ICT products.

Strategic supply chain dependency.

Mature commodity market; professional applications under development / evolution (e.g. Digitizing European Industry)

Market fragmentation.

Innovation: strong in Europe but not always properly funded due to a lack of a consistent transnational approach and global EU strategy. Results of Research and Innovation are hardly reaching the market.

Weak entrepreneurial culture, lack of venture capital.

European industrial policies not yet addressing specific cybersecurity issues.

Human factor.

Sovereignty.

Cyber-insecurity by design

AIM 1. Foster cooperation between public and private actors at early stages of the research

and innovation process in order to allow people in Europe to access innovative and trustworthy European solutions (ICT products, services and software). These solutions take into consideration fundamental rights, such as the right for privacy.

2. Stimulate cybersecurity industry, by helping align the demand and supply sectors to allow industry to elicit future requirements from end-users, as well as sectors that are important customers of cybersecurity solutions (e.g. energy, health, transport, finance).

3. Coordinate digital security industrial resources in Europe.

BUDGET The EC will invest up to €450 million in this partnership, under its research and innovation programme Horizon 2020 for the 2017-2020 calls (4 years). Cybersecurity market players are expected to invest three times more (€ 1350 mln: leverage factor = 3) to a total of €1800 mln.

3

About the cyber cPPP

A DOUBLE APPROACH, BEYOND TRADITIONAL EC PPPs: LINKING RESEARCH AND CYBERSECURITY INDUSTRIAL POLICY The cPPP will focus on R&I, developing a SRIA and supporting its implementation in the H2020 Work Programme The ECSO Association will tackle other industrial policy aspects for the market and the industrial / economic development ECSO will support the development of the European cybersecurity industry and EU trusted solutions, including cooperation with Third Countries. REFERENCE DOCUMENTS 1. Industry proposal 2. Strategic Research and Innovation Agenda (SRIA) proposal (already

evolving)

4

About the cyber cPPP

European Cybersecurity Council (High Level Advisory Group: EC, MEP,

MS, CEOs, …)

ECS - cPPP Partnership Board (monitoring of the ECS cPPP - R&I priorities)

EUROPEAN COMMISSION

ECSO –Board of Directors (Management of the ECSO Association: policy/market actions)

R&I

ECSO General Assembly

INDUSTRIAL POLICY

Coordination / Strategy Committee Scientific & Technology Committee

WG Standardisation /

certification / labelling / supply

chain management

WG Market deployment

/ investments / international collaboration

WG Sectoral Demand

(market applications)

WG Support to SMEs

and regions

WG Education,

training, exercise, raising awareness

WG SRIA

Technical areas Products

Service areas

SME solutions / services providers;

local / regional SME clusters and

associations Startups, Incubators / Accelerators

Large companies Solutions / Services Providers; National

or European Organisation / Associations

Regional / Local administrations (with economic

interests); Regional / Local Clusters of Solution / Services providers or users

Public or private users /

operators: large

companies and SMEs

National Public Authority

Representatives Committee R&I Group /

Policy Advisory Group (GAG)

Others (financing

bodies, insurance,

etc.)

Research Centers (large and

medium / small), Academies /

Universities and their Associations

Governance

WG 1 Standardisation Certification /

Labelling / Supply Chain Management

WG 2 Market development /

Investments

WG 3 Sectoral demand

(vertical market applications)

WG 4

Support SME, coordination with countries (in particular

East EU) and regions

WG 5 Education, training,

awareness, exercises

WG 6 SRIA

Technical areas Products

Services areas

ECSO working groups

Setting the scene

- SMEs make up 99.8% of European enterprises

- 87% of small organisations reported a security breach in the last year; an increase on the 2015 survey (74%)*

- Between €88,000 and €365,000 is the average cost of the worst breach

- Only 51% of all businesses attempted to identify the cyber security risks

Structural weaknesses:

- Financial:

- Missing / low visibility of existing funding mechanisms

- SMEs are cost sensitive

- Lack of EU based venture capital available for SMEs

- Supply and demand:

- Diversified cyber SME industry serving local markets

- Asymmetries between supply and demand (SMEs vs large-sized customers)

- Legislative

- Lack of clear EU wide legislation, regulation and implementation for SMEs

* According to the 2016 UK Government Security Breaches Survey

WG4 Support to SME's, coordination with countries and regions

Review of the DSM

Process of boosting digital skills must go hand in hand with the uptake of the digital technologies by all companies including SMEs.

Opportunity for SMEs to create new and better products /services at a lower cost with less resources

Digitising European Industry

In April 2016, the EC adopted a comprehensive strategy on Digitising European Industry which included measures to encourage national initiatives on digitising industry to cooperate and learn from each other.

March 2017: launch of the ‘European Platform of National Initiatives’ during the Digital Day in

Rome

What’s next?

Over the next 3 years, H2020 plans for additional €300 million for activities related to digital innovation hubs (essential to support local start ups and innovation).

+ investments of €3.2 billion in key technologies (nanoelectronics, photonics, robotics, 5G, HPC, big data, cloud computing, AI) + their integration along the value chain with pilot lines and test beds.

WG4 Support to SME's, coordination with countries and regions

WG4 – Support to SME's, coordination with countries (in particular East EU) and regions

Chairs: FISC, DigitalSME

SWG4 .1 – SMEs, start-ups and high growth companies

Chair: Visionware

SWG 4.2 – Coordination with activities in EU countries and regions

Chair: Conseil Régional Brétagne

SWG 4.3 – Support to East EU Members

Chair: Cyber Services

31

Objectives

• Support to the development of SMEs, start ups and high growth companies

• Develop coordinated activities between clusters (both business oriented and triple helix), Regions and local bodies (for local implementation of solutions / education)

• Development of East EU public and private sectors dealing with cybersecurity

Proposed actions (ref: WG4 Position Paper)

1- Boost the demand for SMEs solution

• Establishment of European cyber security SMEs HUB

• Cooperation with WG1 in investigating the requirement to deliver a “Made in the EU/EU trusted solution” label in order to facilitate private procurements oriented towards European SMEs

2- EU Funding for R&I&D of solutions that effectively reach the market

• Input to SRIA /WG6 (request of minimum participation of 20% SMEs in H2020 projects)

• Mapping specific EU funding mechanisms for SMEs and start-ups

• Adoption of cascading funding mechanisms in H2020 calls on cybersecurity

• Review and simplify the SME Instrument (instead of providing 1.5M€ funding, WG4 suggests having many small projects of 50K€ to 500M€ funding at the early phases)

• Mapping of potential capital venture and private funds (link with WG2

3- Marketing and export outside the EU

• Development of SME export networks outside of EU to accelerate SME growth globally

29

WG4 Support to SME's, coordination with countries and regions

The regional cooperation among all stakeholders is a strategic resource for:

• The EU industrial policy: Cybersecurity requires coping with the fast-developing threat landscape and technology evolutions -> A strong regional cooperation among top-class universities, research labs and private companies (both operators and providers) is instrumental in the setting of an ambitious ecosystem supporting the quick emergence of start-ups with products / services that effectively reach the market.

• The cyber risk management: Our analysis revealed that 24 clusters /regions are already investing many human and financial resources in the development of cybersecurity capabilities -> An interregional and cross-sectorial network mechanism should be implemented to foster the cooperation between specialized/no specialized regions (information sharing, incident response, best practices, trainings costs shared at regional level).

**AEI Ciberseguridad, Bavarian ICT security Cluster, Berlin ICT cluster, Brandenburg, Centro (PO), Comunidad de Madrid, Conseil Regional de Bretagne, Estonian ICT cluster, Eurotechnolgies/ Cluster Confiance Numérique et Cybersécurité, Gipuzkoako Foru Aldundia, Finnish

Information Security Cluster, Hague Security Delta, Keski-Suomi, Latvian Information and Communications Technology Association, Métropole de Lyon, Network Security Monitoring Cluster, Oberösterreich, Region Midi Pyrennes - Aerospace Valley, ROMSECA Federation, Sachsen,

Scotland Europa, SecurityMadeinLu, Systematic Paris-Region, Wklaster - Wielkopolska ICT Cluster Pomorskie

WG4 Support to SME's, coordination with countries and regions

Focus on Regions

• ECSO hosted a kick-off meeting on the role of regional cooperation on cybersecurity (29th March 2017)

• 11 regions, 4 DGs (REGIO, CNECT, GROW, JRC), 5 national public administrations and 2 industrial associations

• EC has given a global picture on EU investment mechanisms

• The dialogue revealed some common challenges: training and education, cost sharing on test industrial platform/infrastructure, the need of information sharing on attacks and risk

Actions proposed (ref: ECSO WG4 position paper)

• Mapping regions, clusters, and SMEs’ associations in Europe with interest in cybersecurity market and thus develop a clear view of what is the specification and added value of local/regional cooperation both in terms of industrial ecosystem and risk management for SMEs

• Specific need on workforce development : provide information on training available at regional level in order to facilitate the link between high level skilled students/trainees and SMEs

• Sharing the best practices of regional calls/tenders supporting SMEs and facilitating their integration in applicative solutions tested by large groups.

• Elaborate a strategy of Regional cooperation and the related roadmap

29

WG4 Support to SME's, coordination with countries and regions

Next actions

• ECSO-Meeting with all regions interested in cybersecurity issues (to be scheduled before the 2017 Summer break)

• INTERREG CYBER on “Regional policy for competitive cybersecurity SMEs”

• Next WG meeting in Helsinki (28th September)