论英国NIS法规作为强制性网络安全报告制度的有效性
On The Effectiveness of the UK NIS Regulations as a Mandatory Cybersecurity Reporting Regime
AI总结：
通过分析2024年英国NIS法规下报告的事件和情报机构数据，发现NIS报告仅覆盖了实际重大网络安全事件的三分之一，且针对医疗系统的攻击100%为勒索软件，表明该法规有效性有限。
摘要：
现有的网络安全文献缺乏关于关键国家基础设施网络攻击真实情况的实证代表性数据。我们获取了2024年根据《网络和信息系统（NIS）法规》报告的、对基本服务连续性造成重大影响的全英数据，以及来自情报机构的比较数据。我们发现29%的NIS报告已涉及网络安全事件。在英国政府寻求扩大网络安全报告范围之际，我们发现NIS法规的有效性有限；尽管我们的请求揭示了30起根据NIS法规报告的网络安全事件，但在2024报告年度，国家网络安全中心捕获了89起被归类为“高度重要和重要”的事件。虽然网络安全和基础设施安全局报告的攻击中有36%涉及间谍活动，但从NIS数据中我们发现，2024年英格兰所有可报告的针对医疗系统的网络攻击均为勒索软件。
英文摘要：
Existing cybersecurity literature lacks a source of empirical, representative data as to the true nature of cyberattacks on Critical National Infrastructure. We have obtained UK-wide data on incidents reported under the Network and Information Systems (NIS) Regulations in 2024 causing "a significant impact on the continuity" of essential services and comparator data from intelligence agencies. We find that 29% of NIS reports already concern cybersecurity incidents. As the UK Government seeks to extend cybersecurity reporting, we find the NIS Regulations are limited in their effectiveness; whilst our requests revealed 30 cybersecurity incidents reported under the NIS regulations, there were 89 incidents classified as "highly significant and significant" captured by the National Cyber Security Centre in the 2024 reporting year. Whereas 36% of Cybersecurity and Infrastructure Security Agency reported attacks concerned espionage, from NIS data we find 100% NIS-reportable cyberattacks concerning healthcare systems in England in 2024 were ransomware.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
