Regulatory Impact on 5G Security and Privacy 413
The different approaches have been analysed from the regulatory objectives’ perspective in Table 17.2. The objectives were introduced in Section 17.2. The most relevant
Security and Privacy issues to keep in mind in this analysis have been elaborated on in
Sections 17.4.4.
The table summarizes how the different regulatory approaches would contribute
to the different regulatory objectives. The statement “Yes” in the table means that
there is positive impact on the regulatory objective in question, and the statement
“No” means that there is no impact.
The Government regulation would promote many of those targets and Industry
self‐regulation, also many of them, at least slightly. Clearly, the Consumer or market
regulation would have the most difficulties in promoting any of the targets; in this
approach, the Service Providers, which offer such a level of Security and Privacy that
pleases consumers and corporate users, would succeed, but most of the issues would
remain unresolved.
17.7 Summary of Issues and Impact of New Technologies
on Security and Privacy Regulation
Several Security and Privacy issues related to the new network technologies have been
identified both on the Service Provider side and on the customer side. These issues may
be complicated, especially arising from the inherently global nature of the Clouds. The
wide‐scale deployment of Cloud Computing, Network Function Virtualization and
Software Defined Networking can trigger a number of security and data protection
risks, stemming mainly from the new interfaces, shared environments, new players
with different views and objectives on Security and Privacy, and from the more complicated value networks.
Data is subject to specific legislative requirements that may depend on the location
where they are hosted, and for what purposes they are processed. Different countries
have different laws regarding which kind of data may be hosted where, and how it is to
be protected. Clarification of applicable law governing the flow, processing and protection of data are desirable, so that both the Service Providers and customers (private and
corporate) have a clear understanding about which rules apply where and how [33].
On 14 March 2014, the European Parliament voted on the proposed Network and
Information Security (NIS) Directive [15]. In addition to provisions aimed at Member
State governments (e.g. to improve cyber security capabilities and cooperation to prevent and respond to cyber‐attacks), the Directive targets private companies in the
energy, transport, financial services and health sectors. These sectors are seen to be
dependent on the correctly functioning network and information systems.
The policy options for ensuring NIS have been assessed in the Impact Assessment of
the NIS Directive (Section 17.4.2). The three policy options identified are:
1) Business as usual;
2) Regulatory approach; and
3) Mixed approach.
The different approaches have been analysed from the regulatory objectives’ perspective in Table 17.2. The objectives were introduced in Section 17.2. The most relevant
Security and Privacy issues to keep in mind in this analysis have been elaborated on in
Sections 17.4.4.
The table summarizes how the different regulatory approaches would contribute
to the different regulatory objectives. The statement “Yes” in the table means that
there is positive impact on the regulatory objective in question, and the statement
“No” means that there is no impact.
The Government regulation would promote many of those targets and Industry
self‐regulation, also many of them, at least slightly. Clearly, the Consumer or market
regulation would have the most difficulties in promoting any of the targets; in this
approach, the Service Providers, which offer such a level of Security and Privacy that
pleases consumers and corporate users, would succeed, but most of the issues would
remain unresolved.
17.7 Summary of Issues and Impact of New Technologies
on Security and Privacy Regulation
Several Security and Privacy issues related to the new network technologies have been
identified both on the Service Provider side and on the customer side. These issues may
be complicated, especially arising from the inherently global nature of the Clouds. The
wide‐scale deployment of Cloud Computing, Network Function Virtualization and
Software Defined Networking can trigger a number of security and data protection
risks, stemming mainly from the new interfaces, shared environments, new players
with different views and objectives on Security and Privacy, and from the more complicated value networks.
Data is subject to specific legislative requirements that may depend on the location
where they are hosted, and for what purposes they are processed. Different countries
have different laws regarding which kind of data may be hosted where, and how it is to
be protected. Clarification of applicable law governing the flow, processing and protection of data are desirable, so that both the Service Providers and customers (private and
corporate) have a clear understanding about which rules apply where and how [33].
On 14 March 2014, the European Parliament voted on the proposed Network and
Information Security (NIS) Directive [15]. In addition to provisions aimed at Member
State governments (e.g. to improve cyber security capabilities and cooperation to prevent and respond to cyber‐attacks), the Directive targets private companies in the
energy, transport, financial services and health sectors. These sectors are seen to be
dependent on the correctly functioning network and information systems.
The policy options for ensuring NIS have been assessed in the Impact Assessment of
the NIS Directive (Section 17.4.2). The three policy options identified are:
1) Business as usual;
2) Regulatory approach; and
3) Mixed approach.