‘General unease’ surrounds the workings of the European Network a...

ENISA does what it’s supposed to, but isn’t living up to its mandate to be Europe’s “voice and main networking node for the security environment.” The report faulted ENISA for lacking success indicators, focussing more on deliverables than on results affecting its key goals, and short-changing communication. Lack of investment in its image and brand recognition have kept the agency too low profile, the report said. Its Web site and newsletter are informative but aimed at traditional communication outlets, with no effort to develop virtual communities or peer-to-peer approaches, analysts said. The agency aims to help Europeans reduce network and information security threats and harmonize security policies and controls, the report said. Most interested parties say it hasn’t had much effect but they expect more the next two years, it said. The operational staff is too small to be effective, and the agency’s location on Crete is “undeniably remote” for a body requiring continuous interaction with main information technology security and policy research centers, the report said. The location is a “fundamental weakness” of ENISA that limits its use as a networking and knowledge- exchange node, and hampers personnel recruitment and retention, it said. ENISA’s considerable weaknesses are balanced by several strengths, the report said. The staff is competent, the agency has made a good start in building relationships, and there is consensus that ENISA should be a well-established single European voice for security problems. But, panelists said, if ENISA’s effectiveness isn’t improved, it quickly will lose its reputation, see staff turnover, and create misperceptions of its roles and goals by external parties. The report recommended creating a task force to develop a strategy for the next three years and marketing its activities better to boost its visibility. It suggested a satellite office in Brussels or another hub. The panel also recommended extending ENISA’s existence past its 2009 end date, reforming the regulation creating to reflect its strategic role, hiring more staff, and improving its control structure.