Pravno uređenje bezbednosti informacione kritične infrastrukture

Legal regulation of information critical infrastructure security

Abstract

Mrežni i informacioni sistemi i usluge, kao informaciona kritična infrastruktura, imaju značajnu ulogu u savremenom društvu, pa je njihova  pouzdanost i bezbednost od važnosti za ključne društvene i ekonomske aktivnosti. Ipak, njihovom postojanju i pravilnom funkcionisanju prete određeni bezbednosni rizici u sajber prostoru, koji su sve većih razmera, učestalosti i uticaja. Tako ovi sistemi mogu postati meta sajber napada, odnosno nedozvoljenih radnji koje se preduzimaju sa namerom prouzrokovanja štete i/ili prekida njihovog rada. Ovakvi incidenti mogu ugroziti društvene i ekonomske aktivnosti, koji zavise od informacione kritične infrastrukture. Zbog toga je neophodno posvetiti pažnju sajber bezbednosti. Pri tome, upravljanje rizicima u sajber prostoru mora biti takvo da se ne ugrozi pravna sigurnost. U tom smislu od izuzetne važnosti je način na koji se propisuju smernice za procenu rizika po sajber bezbednost. Dobar primer regulative predstavlja Direktiva Evropske unije o bezbednosti mrežnih i informacionih sistema. Direktiva predviđa da se određene organizacije obavežu da preduzmu odgovarajuće i proporcionalne mere bezbednosti, te da uoče, procene i uzmu u obzir rizike po sajber bezbednost sa kojima se suočavaju, kako bi se smetnje po pružanje usluga sprečile i svele na minimum.  Cilj Direktive je da se propisivanjem tavih obaveza obezbedi da informaciona kritična infrastruktura bude zaštićena od prekida koji bi mogli biti od uticaja po ključne ekonomske i društvene aktivnosti. Predmet rada je analiza obaveze zaštite i informisanja koje Direktiva o bezbednosti mrežnih i informacionih sistema propisuje za pružaoce digitalnih usluga.

Network and information systems and services, as an information critical infrastructure, play a significant role in modern society, so their reliability and security are important for key social and economic activities. However, their existence and proper functioning are threatened by certain security risks in cyberspace, which are of increasing size, frequency, and impact. Thus, these systems may become the target of cyberattacks, i.e. unauthorized actions that are taken with the intention of causing damage and/or interrupting their functioning. Consequently, such incidents may jeopardize social and economic activities, which depend on information-critical infrastructure. That is why it is necessary to pay attention to cyber security. In doing so, risk management in cyberspace must be such as not to jeopardize legal certainty. In that sense, the way in which the guidelines for cyber security risk assessment are prescribed is extremely important. A good example of regulation is the European Union Directive on the Security of Network and Information Systems (NIS Directive). The Directive stipulates that certain organizations are obliged to take appropriate and proportionate security measures and to identify, assess and take into account the cyber security risks they face, in order to prevent and minimize interference with the provision of services. The aim of the Directive is to ensure that information critical infrastructure is protected from disruptions that could affect key economic and social activities by prescribing such obligations. The subject of this paper is the analysis of the protection and information obligations that the NIS Directive prescribes for digital service providers, as well as the analysis of the proposed revision of the Directive.