Understanding the plural landscape of cybersecurity governance in Spain: a matter of capital exchange

Abstract

This paper empirically explores the contribution and collaborative networks of public and private actors to cybersecurity provision in Spain. The article draws on data from three sources: policy and legal documents, a Delphi study with cybersecurity experts, and 34 interviews. Rooted in the theoretical underpinnings of nodal governance and anchored pluralism, the paper argues that the position of actors and public-private collaboration dynamics involved in cybersecurity governance can be understood through the analysis of capital exchange. Therefore, the study provides a list of the most relevant nodes for cybersecurity in Spain, assesses the capital they possess and how they exchange it through collaborative networks and explores the characteristics and barriers of these collaborative relationships. Analyses reveal that public organisations hold a preeminent position in cybersecurity governance despite large technology corporations’ greater economic and cultural capital. Remarkably, the paper identifies the central position of new public bodies in the network of cybersecurity nodes. Moreover, cultural barriers that are hindering public-private collaboration in Spain are identified. These results indicate that, despite the state’s difficulties in providing public solutions to cybersecurity challenges, Spain is an example of how governance can be anchored in public bodies through symbolic and social capital.

Insider threats among Dutch SMEs: Nature and extent of incidents, and cyber security measures

“…One of the reasons why estimates of cyber victimization in companies may differ is that the definitions of cybercrime, cyber-attack, or cyber security incident are neither clear nor consistent across studies and may include different crime measures. Such differences may also be masked by a large dark figure among SMEs (Statistics Canada, 2020;van de Weijer et al, 2021;Veenstra et al, 2015).A Delphi study involving 129 cyber security experts in Spain suggests that government, large enterprises, and public cybersecurity institutions are aware that SMEs are not prepared to defend against cybersecurity threats (Del-Real & Díaz-Fernández, 2022). These findings align with survey data from other countries.Although most SMEs in the UK, Canada, and the Netherlands adopt basic cyber security measures such as having up-to-date antivirus software and firewalls, it appears that they are still unprepared to respond adequately to many cyber security incidents.…”

“…A Delphi study involving 129 cyber security experts in Spain suggests that government, large enterprises, and public cyber security institutions are aware that SMEs are not prepared to defend against cyber security threats (Del-Real & Díaz-Fernández, 2022). These findings align with survey data from other countries.…”

Boosting Holistic Cybersecurity Awareness with Outsourced Wide-Scope CyberSOC: A Generalization from a Spanish Public Organization Study

“…Holistic cybersecurity foundations and cybersecurity context in public sector [2,3,13,[15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34] Tactical-operational cybersecurity workforce management [1,[35][36][37][38][39][40][41][42][43][44][45][46][47] Cybersecurity talent development and retention [4][5][6][7][8][9][10][48][49][50][51][52][53][54]…”

“…The threats and risks that emerge from this environment require unity of action and a broader holistic approach as studied in Ahmed et al [17], and while some research has been conducted in this area as described by Atoum et al in [18], much more work remains to achieve an acceptable level of holism, something that is covered by Kranemburg and Le Gars [19], and to cover those specific threats emanating from cyberspace for which an information security approach does not fit well. Recent studies also suggest the need to extend this holism not only within the organization itself, but also to its network of collaborators, civil organizations, government entities, and citizens, in order to provide the necessary unity of action to effectively respond to threats and risks, as investigated in [20] by Del-Real and Díaz-Fernández.…”

Panorama institucional de la gobernanza de la ciberseguridad en España

“…La fragmentación institucional, consecuencia parcial del modelo multi-stakeholders adoptado por la UE, se observa en el número de diferentes instituciones involucradas en cada una de las prácticas de ciberseguridad descritas en este artículo. Estudios recientes ya han resaltado que el modelo de gobernanza se ha estructurado en torno a dos actores principales, el CCN y el INCIBE, a los que rodean una enorme variedad de otros actores públicos y privados 93 . La fragmentación política y narrativa de la gobernanza de la ciberseguridad ha sido descrita por otros estudios 94 , consecuencia de complejidad tecnológica, la carencia de modelos de gobernanza del ciberespacio consolidados.…”