The European Defence Agency (EDA) presented on Friday the results of its 1-year stocktaking study of military cyber defence capabilities. Using an in depth methodology, the study benchmarked the degree of “Cyber Defence Readiness” of 20 participating Member States (pMS) and different EU level organisations.

“Cyberspace can be described as the fifth dimension of warfare, equally critical to military operations as land, sea, air and space. Our study reveals important gaps in military cyber defence capabilities across the EU. The Agency is offering Member States a range of projects to cooperate in the area of cyber defence capabilities as well as in the research & technology domain”, said Peter Round, Capabilities Director of the European Defence Agency.

The study aimed to establish a high-level understanding of cyber defence capabilities across EDA pMS to support progress towards a more consistent level of cyber defence capability across the EU. 20 countries were included in the study.

On the national level, the study revealed a mixed picture with respect to military cyber defence capability. Generally speaking, in pMS where key decision-makers are familiar with cyber-security, cyber defence capabilities are more advanced. The 20 pMS exhibit strengths in the three capability domains of Leadership, Personnel and Interoperability. In the areas of Doctrine, Organisation and Training, an early level of maturity was defined which might be linked to the fact that these three areas require more complex and longer-term efforts to establish organisational structures. Facilities is the capability domain which remains to date highly immature or non-existent. Individual country profiles are classified and cannot be made available.

As regards cyber defence among EU organisations, the study highlights the complex operational set-up between the different institutions involved. While threat analysis and cyber-intelligence gathering capability appears to be emergent, incident response capabilities could be deepened. The study also reveals that the culture of cyber-security good practice needs to be nurtured and that the use of military specific standards and tools is still poorly understood.

Military cyber defence on the European level is at a relative early stage of maturity. The study therefore makes high-level recommendations such as enhancing EU network protection, strengthening intelligence capability, deepening incident response capabilities, creating a culture of cyber-security, promulgating security standards and tools, and reinforcing links between NATO and the EU for cyber defence issues.

On the national level, greater attention should be given to the development of cyber defence training and education initiatives. pMS are encouraged to consider exchanging information on equipment solutions and Pooling & Sharing for cyber defence capabilities, and on processes and shared escalation procedures, especially in EU-led missions. Finally, the study suggests pMS consider sharing – to a certain extent – facilities and to take into account interoperability aspects of cyber defence.

EDA is initiating three ad hoc projects with Member States, including:

(1) The Cyber Ranges project aims at Pooling & Sharing of current and future resources for Cyber Defence Training, exercise & testing in order to increase availability and efficiency of existing assets, and to mainstream and improve cyber defence training, exercises & testing at European level.

(2) The deployable cyber situational awareness kit initiative aims at providing, Pooling & Sharing a common and standardised cyber defence planning and management platform. It shall allow Commanders and their staff in EU-led operations to fulfil their cyber defence related tasks throughout all phases of an EU-led operation.

(3) The “Advanced Persistent Threats Detection (APT-D)” project initiative is focusing on improved capabilities in early detection and smart mitigation of APT.

Together with the Irish Presidency of the European Union and the Estonian Ministry of Defence, the EDA will also co-host a high level conference on Cyber Security Cooperation in the European Union on 20 June 2013.