{"id":125986,"date":"2021-04-23T15:58:04","date_gmt":"2021-04-23T13:58:04","guid":{"rendered":"https:\/\/www.erasmusmagazine.nl\/en\/?p=125986"},"modified":"2025-12-19T11:25:34","modified_gmt":"2025-12-19T10:25:34","slug":"eur-scientist-initiator-of-the-national-cybersecurity-lab","status":"publish","type":"post","link":"https:\/\/www.erasmusmagazine.nl\/en\/2021\/04\/23\/eur-scientist-initiator-of-the-national-cybersecurity-lab\/","title":{"rendered":"EUR scientist initiator of the National Cybersecurity Lab"},"content":{"rendered":"

The National Cybersecurity Lab was launched officially on Friday. Cybersecurity researcher Bernold Nieuwesteeg from Erasmus School of Law is one of the initiators. In the lab he aims to bring together scientists and business sector experts to brainstorm and find concrete solutions for cybersecurity problems in society.<\/p>\n

\"\"

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\tUnsplash \/ Philipp Katzenberger<\/span>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure>

\u201cThe aim of the lab is to test new ideas in practice. We do that by bringing together scientists and business sector representatives,\u201d explained Nieuwesteeg, who is also the director of the EUR Centre for Law and Economics of Cyber Security<\/em>. He established the lab together with Petra Oldengarm from Cyberveilig NL and Rutger Leukfeldt (The Hague University of Applied Sciences).<\/p>\n

In practice this means that Nieuwesteeg and his colleagues organise regular brainstorming sessions in the lab on specific themes. Although the lab was only officially launched this week, the first session has already taken place. \u201cAnd that was an immediate success,\u201d explained Nieuwesteeg proudly.<\/p>\n

Data breach at the municipal health service<\/h2>
\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button>

Bernold Nieuwesteeg<\/span><\/p>

\n\t\n\n<\/svg>\n<\/span>\n\tImage by:<\/span>\n\n\t\t\t\n\t\t\t\t\t\t\town archive<\/span>\t\t\t\t\t<\/span>\n\t<\/p>\n<\/figcaption><\/figure><\/div>

The first session covered the theme of cybersecurity companies and their duty of care. \u201cIt\u2019s perhaps not the first thing you\u2019d think of, but it is very important,\u201d argued the researcher.\u00a0 Take the GGD, for example. They had a huge data breach in January, in which almost all employees could access all data on people who had been tested for the coronavirus. There was even a \u2018handy\u2019 export function with which data from thousands of patients could be taken away with one click. Nieuwesteeg: \u201cThe media then mainly focused on the GGD\u2019s responsibility. But it\u2019s not correct that only the purchaser should be accused. Why not confront the software supplier when there\u2019s a data breach? The GGD is good at vaccinating people and testing, not necessarily in cybersecurity. A software company, however, deals with that everyday. So who is better able to prevent such a breach?\u201d<\/p>\n

In contracts it\u2019s often stated that the supplier is not responsible for data breaches and that it\u2019s the purchaser\u2019s responsibility. \u201cI\u2019d do that too if I were a supplier,\u201d stated Nieuwesteeg. \u201cBut that\u2019s not really in society\u2019s interests.\u201d The brainstorming session even provided a concrete solution.<\/p>\n

Duty of care<\/h2>

\u201cIt\u2019s perhaps a bit cumbersome, but we came up with the idea of the cybersecurity duty of care standard<\/em>,\u201d explained Nieuwesteeg. This means that the supplier and the user make standardised agreements about who is responsible for what. You can then deviate from these standards, but only with \u2018good reasons\u2019 and only if both parties agree. \u201cSo if the user is a well-known IT company, it\u2019s probably logical that it will want to take its own responsibility for this. It can do that, but this always needs to be explained.\u201d Insurers could demand such a standard clause in the future.<\/p>\n

What is unique about the lab is that many cybersecurity companies helped us think about the solution. \u201cThere was a director of a hundred staff members in the room. These are serious players. That means it\u2019s not just a scientist bleating on about a duty of care standard; big companies from the cybersecurity sector are immediately endorsing this.\u201d<\/p>\n\n\t

\n\t\t\t\t\t

De redactie<\/h2>\n\t\t\n\t\t
\n\n\t\t\t\n\t\t\t