{"id":43068,"date":"2025-10-28T14:44:39","date_gmt":"2025-10-28T13:44:39","guid":{"rendered":"https:\/\/www.uni.lu\/fstm-en\/?post_type=news&p=43068"},"modified":"2025-11-20T15:04:38","modified_gmt":"2025-11-20T14:04:38","slug":"across-disciplines-navigating-legacy-systems-and-innovation-in-cybersecurity","status":"publish","type":"news","link":"https:\/\/www.uni.lu\/fstm-en\/news\/across-disciplines-navigating-legacy-systems-and-innovation-in-cybersecurity\/","title":{"rendered":"Across disciplines: navigating legacy systems and innovation in cybersecurity"},"content":{"rendered":"\n
\n

For the European Cybersecurity Month, three professors from the University met to discuss the challenges to create a cohesive cybersecurity approach for Europe. All hailing from different disciplines,  Prof. Vincent Lenders<\/a>, FNR PEARL Chair in Cybersecurity, Prof. Niovi Vavoula<\/a>, Chair in Cyber Policy, and co-director of the Master in Cybersecurity and Cyber Defence Dr. Andy Rupp<\/a> explored tensions between technology innovation, infrastructure, and regulation to expose risks that are defining the field and shaping behaviour. <\/p>\n\n\n\n

The interview has been transcribed and edited for clarity. <\/em><\/p>\n<\/div><\/section>\n\n\n\n

\n
\n

\n \n \n What cybersecurity issue keeps you up at night? <\/span>\n\n <\/use><\/svg> <\/button>\n <\/h3>\n
\n
\n \n

Vincent Lenders:<\/strong> \u201cThe speed new threats develop, and how cutting-edge technology like AI and quantum computing are about to radically change cybersecurity.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cThe risks of regulation not keeping up with technology innovation, or worse, slowing down our responses to vulnerabilities.\u201d <\/p>\n\n

Andy Rupp:<\/strong> \u201cThe slow pace between technology innovation and real-world implementation. Companies too often see privacy as a cost, not an enabler.\u201d <\/p>\n <\/div>\n <\/div>\n<\/div>\n\n

\n

\n \n \n How can Europe\u2019s ambition for digital sovereignty be balanced with international cooperation?\u00a0\u00a0 <\/span>\n\n <\/use><\/svg> <\/button>\n <\/h3>\n
\n
\n \n

Niovi Vavoula:<\/strong> \u201cDigital sovereignty doesn\u2019t mean isolation. Europe must pursue autonomy without turning inward. The EU needs to diversify its partnerships to reduce technological dependencies while staying active in global governance forums. Achieving this balance requires strategy and trust.\u201d <\/p>\n\n

Andy Rupp:<\/strong> \u201cThat balance is exactly where the challenge lies. We certainly can\u2019t produce everything in Europe, not every chip, not every device, but we can design security critical technology here. The challenge is to verify that what\u2019s built then elsewhere given our chip design does what we expect it to, and nothing more.\u201d <\/p>\n\n

Vincent Lenders:<\/strong> \u201cCybersecurity can\u2019t be achieved by any one country. The threats we face are global. Sharing intelligence about attacks helps everyone build stronger defences. Even if nations differ politically, we\u2019re all facing the same vulnerabilities.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cThat\u2019s why Europe\u2019s strategy has to combine both competition and collaboration \u2014 to be sovereign, but never isolated. Cybersecurity isn\u2019t a national issue anymore; it\u2019s a global one.\u201d <\/p>\n\n

Reality check: <\/strong>Global rhetoric tends to focus on how cybersecurity policies from governments diverge from one and other, but global supply chains make maintaining digital sovereignty complex. At the same time, with borderless technology comes borderless risks, and this brings us together more than headline news acknowledges.   <\/td><\/tr><\/tbody><\/table><\/figure>\n <\/div>\n <\/div>\n<\/div>\n\n
\n

\n \n \n What are the biggest technical or organisational bottlenecks to securing physical systems (energy grid, smart cities, industrial control systems) in Europe?\u00a0 <\/span>\n\n <\/use><\/svg> <\/button>\n <\/h3>\n
\n
\n \n

Vincent Lenders:<\/strong> \u201cCritical infrastructure have been designed for lifetimes of 30 or 40 years and they were built for safety, not security. To protect them, systems used to be relatively disconnected and isolated, but now, with the digital transformation, normal threats from the internet can also start spreading to critical infrastructure. While a personal phone can be replaced every few years to maintain cutting-edge security, we cannot really replace a power plant from today to tomorrow.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cExactly. And while the critical infrastructure technology lags, the law is moving fast \u2014 sometimes too fast. In just a few years we\u2019ve seen the NIS2 Directive<\/a>, DORA<\/a>, and the Cyber Resilience Act<\/a>. Each one adds complexity, and organisations often struggle to comply when rules overlap or contradict each other. To manage this, organisations need resources to have people implement risk management measures, while member states also need to enforce the directives, which is not always effective.\u201d <\/p>\n\n

Andy Rupp:<\/strong> \u201cAnd companies are ready to take advantage of that. Even when the rules are clear, there\u2019s still a gap between regulation and implementation. Companies will often do the minimum required to comply, not the maximum possible to protect. Without incentives, or proper enforcement, advanced privacy-preserving tools never make it into practice.\u201d <\/p>\n\n

Vincent Lenders:<\/strong> \u201cThat\u2019s an important point. Regulation alone doesn\u2019t secure systems; it has to be practical and aligned with how infrastructure operates. In my discussions with energy companies I have been told about a contradiction here. On the one hand there is a requirement to certify the software running critical systems, but on the other hand strong cybersecurity requires immediate updates to prevent attackers from exploiting vulnerabilities. You can\u2019t certify a software update everyday though, so this puts the operators in a contradictory position.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cWhich is why we need lawmakers and engineers in constant dialogue. Otherwise, the law becomes outdated before it\u2019s even enforced.\u201d <\/p>\n\n

Takeaway: <\/strong>There is still a mismatch between regulation and the realities of the technology at stake. Fixing this is the key to Europe\u2019s resilience. <\/td><\/tr><\/tbody><\/table><\/figure>\n <\/div>\n <\/div>\n<\/div>\n\n
\n

\n \n \n Who should bear liability or responsibility when a cyberattack leads to physical harm or disruption?\u00a0 <\/span>\n\n <\/use><\/svg> <\/button>\n <\/h3>\n
\n
\n \n

Niovi Vavoula:<\/strong> \u201cLiability is a complex ecosystem. On one hand, we have the criminal liability of attackers \u2014 the perpetrators of cyber incidents. But on the other, organisations themselves can be held responsible if they fail to implement adequate cybersecurity measures or to report incidents in time. The legal framework has become far more concrete, mirroring the logic of data protection under the GDPR.\u201d <\/p>\n\n

Vincent Lenders:<\/strong> \u201cThe real challenge is how that plays out in practice. When an organisation is attacked, we see too often that their immediate reaction is to call it a \u2018sophisticated\u2019 attack. If it\u2019s considered sophisticated, they\u2019re not held liable. But sometimes, those so-called advanced attacks are things a well-trained student could have prevented. We need to look more closely at whether an incident was truly unavoidable, and when it was just poor preparation.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cAnd for the first time, managers themselves are being held accountable. For example, under the NIS2 Directive, managers can face personal sanctions, even temporary suspension, for non-compliance. It\u2019s a major cultural shift. We\u2019re moving toward a world where cybersecurity isn\u2019t just a technical or organisational issue, it\u2019s a question of governance.\u201d <\/p>\n\n

Andy Rupp:<\/strong> \u201cOf course, with this growing accountability, students looking to study cybersecurity might feel this legal pressure . But I tell my students that if you understand the fundamentals and follow best practice, you have nothing to fear. In our master\u2019s programme,<\/a> we train them to think critically and act responsibly, not just to tick compliance boxes. Liability shouldn\u2019t be a source of stress; it\u2019s a reminder of the trust society places in cybersecurity professionals<\/strong>. With the right preparation, that responsibility becomes empowering rather than intimidating.<\/strong>\u201d <\/p>\n\n

Did you know? <\/strong>
The new regulatory landscape doesn\u2019t simply punish negligence, it demands proof of vigilance<\/em>. As technology and law continue to evolve, accountability will no longer be reactive; it will become a built-in part of digital governance, shaping how systems are designed, managed, and used across society. <\/td><\/tr><\/tbody><\/table><\/figure>\n <\/div>\n <\/div>\n<\/div>\n\n
\n

\n \n \n Europe\u2019s growing skills shortage threatens its digital ambitions. How can education bridge the gap?\u00a0 <\/span>\n\n <\/use><\/svg> <\/button>\n <\/h3>\n
\n
\n \n

Andy Rupp:<\/strong> \u201cCybersecurity has outgrown traditional computer science. That\u2019s why we created a dedicated master\u2019s programme combining technical foundations with policy and ethics. Students need to understand the systems \u2014 but also the context in which they operate.\u201d <\/p>\n\n

Vincent Lenders:<\/strong> \u201cAnd it\u2019s not just about university students. Everyone needs some cyber awareness now, even children. They\u2019re online before they can read. We need to teach security as a life skill, not just a professional one. We can do this by inviting youth to engage with our work and experience the domain hands-on.\u201d <\/p>\n\n

Niovi Vavoula:<\/strong> \u201cYes, I completely agree that universities should build bridges with society. We can be a central cog in the machinery that promotes cybersecurity preparedness. It\u2019s not enough to educate future engineers; we also have to work with civil society, NGOs, and public organisations. Cybersecurity impacts all sectors, and exists for all professionals, not just people in IT teams. Protecting people online is just as vital as protecting data or infrastructure.\u201d <\/p>\n\n

Andy Rupp:<\/strong> \u201cThat\u2019s where collaboration helps. For example, our work with industry partners gives students real-world insight. They see what cyber risk looks like outside the classroom.\u201d <\/p>\n\n

Vincent Lenders:<\/strong> \u201cAnd it motivates them. When you show students how their field of study can protect hospitals or energy systems, cybersecurity becomes more than a technical exercise, it brings it close to home.\u201d <\/p>\n\n

Take action now:<\/strong> Consider cybersecurity skill development a priority. Take courses offered by your workplace, and include it in conversations. From parenting young children, teaching, or executing a profession, digital literacy must become a natural skill for all Europeans. <\/td><\/tr><\/tbody><\/table><\/figure>\n <\/div>\n <\/div>\n<\/div><\/div>\n\n\n\n
<\/div>\n\n\n

\nA wish for 2030<\/h2>\n\n\n\n

When imagining a fictious future where any solution is possible, the professors wished for: <\/p>\n\n\n\n

\u201cA digital world without exploitable software vulnerabilities.\u201d 
Vincent Lenders<\/strong> <\/td>		\u201cLaws that make advanced privacy-enhancing technologies the default, not the exception.\u201d 
Andy Rupp<\/strong> <\/td>		\u201cA regulatory framework that\u2019s coherent, clear, and futureproof.\u201d 
  
Niovi Vavoula<\/strong> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n
<\/div>\n\n\n

Whatever the future holds, it is clear that cybersecurity is not a single-discipline field. It demands cooperation and a holistic approach. The University of Luxembourg is a part of that ecosystem; as graduates become practitioners, researchers discover innovative solutions to the critical risks we are facing, and professors educate the next generation while guiding both public and private institutions towards the future. Everyone, from professionals at work to children in classrooms, to private citizens from all walks of life, plays an essential role. <\/p>\n<\/div><\/section>\n<\/div><\/section>\n\n\n\n

\n

\nMore about our experts<\/h2>\n\n\n