Foresight Challenges

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

For contacting the authors, please use foresight@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

EDITORS

Rossella Mattioli, Apostolos Malatras, Marco Barros Lourenco, Eric Vetillard, Evangelos Rekleitis – ENISA and Volker Presse, Eve Naomi Hunter, Marco Gino Biasibetti Penso – Detecon

ACKNOWLEDGEMENTS

ENISA’s Ad-Hoc Working Group on Foresight on Emerging and Future Cybersecurity Challenges

LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881.

ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged.

Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN 978-92-9204-546-3 - DOI 10.2824/187824

FORESIGHT CHALLENGES

TABLE OF CONTENTS

1. INTRODUCTION 5

1.1 OBJECTIVES AND SCOPE 6

1.2 TARGET AUDIENCE 7

1.3 STRUCTURE OF THE REPORT 7

2. STOCKTAKING 9

2.1 OVERVIEW 9

2.2 STAKEHOLDER ANALYSIS 9

3. METHODS AND FRAMEWORKS APPLICABLE TO FORESIGHT FOR CYBERSECURITY 11

3.1 INTRODUCTION 11

3.2 OVERVIEW OF SELECTED METHODS AND FRAMEWORKS 12

3.2.1 Method Categorisation 13 3.2.2 Environmental Scanning / Analysis Frameworks 13 3.2.3 Trend Analysis 14 3.2.4 Expert Group Foresight 14 3.2.5 Scenario Methods 15 3.2.6 Morphological Analysis and Backcasting 15 3.2.7 Cybersecurity Analysis Methods 16

4. SELECTION CRITERIA 17

4.1 FORESIGHT METHOD COMPARISON 18

4.2 TOOLS 24

5. BEST PRACTICES 26

5.1 SUMMARY OF BEST PRACTICES 26

5.2 SUMMARY OF CHALLENGES AND PITFALLS 29

6. APPLICATION USE CASES 30

6.1 OPERATIONAL CONTEXT 30

6.2 OVERARCHING COMPONENTS AND CONSIDERATIONS 31

FORESIGHT CHALLENGES

6.3 IDENTIFICATION OF FUTURE AND EMERGING CHALLENGES (1) 32

6.3.1 Foresight Approach 33

6.4 STRATEGIC DECISION-MAKING DEVELOPMENT (2) 34

6.4.1 Foresight Approach 35

6.5 EVOLUTION OF THREAT LANDSCAPE (3) 36

6.5.1 Foresight Approach 37

6.6 NEEDS AND PRIORITIES FOR CYBERSECURITY R&D (4) 38

6.6.1 Foresight Approach 39

6.7 EVOLUTION OF OPERATIONAL COOPERATION (5) 41

6.7.1 Foresight Approach 42

6.8 IDENTIFICATION OF FUTURE POLICY PRIORITIES (6) 43

6.8.1 Foresight Approach 44

6.9 DISRUPTIVE EVENTS (7) 45

6.9.1 Foresight Approach 46

7. CONCLUSIONS & NEXT STEPS 47

7.1 CONCLUSIONS 47

7.2 NEXT STEPS FOR ENISA 47

A ANNEX: GLOSSARY 49 B ANNEX: INTERVIEW GUIDELINE 50 FORESIGHT CHALLENGES

ABBREVIATIONS

Definitions related to cybersecurity and the European Union can be found on ENISA’s website. PESTLE Political, Economic, Social, Technological, Legal and Environmental dimensions (analysis method) R&D Research and Development SWOT Strengths, Weaknesses, Opportunities and Threats (analysis method) STEEP Sociological, Technological, Economic, Environmental and Political dimensions (analysis method) TARA Threat Agent Risk Assessment FORESIGHT CHALLENGES

1. INTRODUCTION

Foresight is a complex, multi-stage, ideally ongoing process, the ultimate aim of which is informed decision-making with regard to securing strategic plans for possibly diverse

future developments. It enables reflection on various possible futures and strategic preparation for plausible scenarios. Since the mid-1950s and early 1960s, foresight as a discipline has grown to become a major strategic planning tool for private corporations as well as the public sector. .

Foresight is still evolving and changing today. That is largely because it is action-oriented, and therefore has tangible results; it is open, meaning there is freedom within foresight to think outside of the box or to reshape previous notions; lastly it is participatory and multidisciplinary – foresight brings together diverse groups that have expertise in a wide range of topics, thus providing more realistic and thoughtful possible futures.

Figure 1: Foresight Overview

“Foresight is neither prophecy nor prediction. It does not aim to predict the future – to unveil it as if it were predetermined – but to help us build it.” – EU Foresight Platform

FORESIGHT CHALLENGES

There are three main benefits of foresight:

 knowledge generation,  facilitation of stakeholder relationships,  capability enhancement.

Knowledge helps individual stakeholders best position themselves for future developments; with knowledge, they can see beyond the fallacy that the future will look much like the present and imagine leading-edge futures (Wilkinson, 2013). The process of developing this knowledge and insight increases connections between stakeholders, thus strengthening related networks – in this case the cybersecurity community. Finally, foresight can contribute to capability enhancement, during which organizational and stakeholder capabilities may be prioritized based on the findings of the foresight activity. This information is critical for identifying and enabling the development and acquisition of key skills, policies, and technologies.

The application of foresight in the field of cybersecurity is not currently widespread. However, we strongly believe that embedding these methods into the cybersecurity industry will lead to an even more nuanced, clear, and multidisciplinary understanding of risk, as well as the strategic ramifications of security measures.

Foresight is already a key element of ENISA’s strategy; it increases knowledge and understanding of emerging and future challenges, thus providing a path to find solutions that address those challenges and bolster EU resilience to cybersecurity threats.

As an additional resource for integrating foresight into the field of cybersecurity, this report provides an overview of key aspects of foresight, a selection of key methods and tools, best practices for applying foresight, and finally, an exemplary guide to putting this knowledge into practice, and running a foresight activity. We provide recommendations tailored specifically to ENISA’s wide range of functional needs – executive strategy, policy support, capacity building, operational cooperation, and certification activities. As these functional needs are likely shared by many readers of this report, the recommendations are formulated as to be easily adapted to fit other organizations and contexts.

With this initiative we hope to inspire and support Member States and other partners to use foresight to address their own cybersecurity challenges. ENISA is taking the first step by beginning to use these methods internally to provide more accurate and prescient information to our stakeholders.

1.1 OBJECTIVES AND SCOPE

To adequately address future cybersecurity threats and to shape a more secure society, ENISA aims to draw upon findings and research from the futures and foresight community to develop a process to apply foresight to cybersecurity. By fostering the ability to understand potential futures, ENISA will be able to better shape both itself and the European cybersecurity ecosystem to address and manage emerging and future challenges.

This project aims to deliver an exemplary structured foresight framework (comprised of a selected set of foresight methods applied to representative use cases) for generating trend

FORESIGHT CHALLENGES

outlooks, scenarios and perspectives on the future to help ENISA to identify and address emerging and future cybersecurity challenges.

The framework or sets of methods recommended must be suitable for the range of ENISA activities including strategic long-term planning, research agenda setting, threat landscape evaluation, and formation of future policy priorities. It is therefore required that the framework be flexible and easily adapted to each context and environment.

This report is not intended to be a comprehensive overview of all foresight methods available, but rather aims to highlight the most relevant methods – based on ubiquity or suitability to ENISA’s core foresight needs.

1.2 TARGET AUDIENCE

This report is targeted at stakeholders within the cybersecurity community (specifically ENISA internal and external stakeholders) but can very well be applied more broadly, as foresight methods are generally applicable across industries or topics. This report may be especially relevant for:

 Policymakers and national authorities with cybersecurity responsibilities  ENISA stakeholders, decision- and policymakers in the areas of ENISA’s portfolio  Cybersecurity researchers, practitioners, and educators  Relevant experts within European Institutions, Bodies and Agencies and their partners  Futurists or foresight consultants  Organizational leaders and corporate strategists  Forecasters and prediction market developers

1.3 STRUCTURE OF THE REPORT

The report reflects the progression and outcomes of the research study and is structured as follows.

Figure 2: Structure of Report

Chapter 2 // Stocktaking: This chapter describes the research methods used to create this report – a literature review and stakeholder interviews.

Chapter 3 // Foresight Methods & Frameworks: The methods collected in the stocktaking phase of the study are narrowed down. We categorize and define a selection of useful methods to grant the reader familiarity with foresight, its purposes and possible application contexts.

FORESIGHT CHALLENGES

Chapter 4 // Selection Criteria: To narrow down the plethora of methods available, we define selection criteria and organize identified methods according to key selection criteria.

Chapter 5 // Best Practices: Practical advice and recommendations gleaned from the stocktaking phase are presented in this chapter.

Chapter 6 // Application Use Cases: ENISA’s primary use cases for foresight are defined in this chapter. For each use case, we propose an appropriate framework of methods, tools, processes, and formats.

FORESIGHT CHALLENGES

2. STOCKTAKING

2.1 OVERVIEW

To develop this framework, ENISA conducted a thorough literature review to explore a broad range of information on foresight, with a focus on methods, tools and applications that could be relevant for ENISA.

These findings were augmented by interviews with experts in the fields of foresight and cybersecurity, members of the ENISA’s Ad-Hoc Working Group on Foresight on Emerging and Future Cybersecurity Challenges. The output of the research phase was the collection of definitions, key characteristics, and best practices for a select representative set of methods (relevant to ENISA’s specific operating environment).

2.2 STAKEHOLDER ANALYSIS

Experts interviewed for this project were primarily individuals in ENISA’s Ad-Hoc Working Group on Foresight (one additional academic foresight expert and practitioner was interviewed). All experts brought unique perspectives that shed light on the characteristics of various foresight methods and best practices for planning and conducting foresight exercises.

The experts interviewed as a part of this project represent a diverse group of individuals. We interviewed 16 people, who represent (in nationality) nine different Member States, geographically distributed across the EU. The expert group consisted of approximately 60% women and 40% men.

Figure 3: Geographical Distribution of Experts

FORESIGHT CHALLENGES

The expert group also contains a mixture of foresight experts and cybersecurity experts. The graph below illustrates how experts rated themselves on a slide scale when asked: “Does your expertise lie more in cybersecurity or foresight?” Figure 4: Expert Group Areas of Expertise

The experts work within a wide range of industries, but primarily in academia and consulting. Figure 5: Expert Industry Affiliation

FORESIGHT CHALLENGES

3. METHODS AND FRAMEWORKS APPLICABLE TO FORESIGHT FOR CYBERSECURITY

3.1 INTRODUCTION

Each foresight activity begins with the identification of scope, objectives, and stakeholders – this step is a critical success factor. The scoping and initiation process is described in more detail in later sections of the report. Depending on the aim of the foresight project, (and factors such as the point in time to be analysed (time horizon), field of application, scope of the project, available resources (human, time, financial), ability to shape future evolutions), a specific set of methods is selected to best fit the specified project. A foresight exercise requires thoughtful preparation, involvement of the stakeholders and participants, constant monitoring, skilful management, and continuous adaptation. This chapter categorizes methods based on their “intention,” future-handling approach, and overall aim. For a comprehensive description of the entire foresight process and overview of foresight methods, we refer the interested reader to the European Foresight Platform, a very useful resource and reference.

Foresight Intentions

Foresight activities usually involve three mutually dependent and essential intentions: diagnosis, prognosis, and prescription. Foresight activities usually include all three of these intentions at different points in the project.

This categorization helps to better identify the goal of each use of a method and supports the method selection process. It was created by the EU Foresight Platform.

FORESIGHT CHALLENGES

Table 1: Foresight Intentions

Foresight Description Intention

The aim is to evaluate the current context or state of affairs or subject of

Diagnosis

study, to recognize early signs of possible future changes.

The aim is to create or envision probable, possible and plausible future

Prognosis

states of a subject of study.

This component involves participants inventing possible strategies, Prescription roadmaps or policies that aim to either respond to possible futures, or actively shape the future towards a desired direction.

Future Handling

Based on the primary objectives of the foresight activity, the project or method’s approach can be either “responsive”, meaning to devise strategies to react to possible events, or “normative”, to design a future (that can be desirable or undesirable) and then take steps to impact that chosen future. This topic is a subcategorization of the prescriptive intention.

3.2 OVERVIEW OF SELECTED METHODS AND FRAMEWORKS

Both cybersecurity and foresight benefit from a diverse and interdisciplinary environment. For this reason, it is often wise to integrate frameworks from other fields. We believe that the guidelines, practices, approaches, methods and tools of both systems thinking and usercentred design can be key to establishing the right mindset when approaching foresighting in the field of cybersecurity.

User-centred design offers a set of guidelines and tools that focus on the human factor in business and technological implementations, helping to better define and design interactive systems and organizations . The framework makes extensive use of immersive analysis and empathy exercises, providing a window into the thoughts, aspirations, desires, needs and actions of the human actors.

The framework of systems thinking, on the other hand, allows us to “see the forest through the 17 82 trees.” This phrase distils the essence and objective of the framework: to enable its practitioners to identify, observe, analyse and shape systems, as well as the relationship dynamics between its elements.

Both frameworks may provide a foundational aspect of a foresight project and support the development of a point of view or mindset. Because the scope of these frameworks is so broad, we have not included them in the categorizations in section 3.2.1, nor going forward in this report. Nevertheless, they remain highly relevant aspects for any foresight practitioner seeking to implement the tools, methods and processes outlined in this report.

FORESIGHT CHALLENGES 3.2.1 Method Categorisation

To better illustrate the range of methods, the relevant methods, frameworks, and tools have been grouped into six categories driven by the stocktaking phase of this project. Not all methods listed can be considered explicit to foresight – we have also included strategic planning methods and problem-solving techniques that are often integrated into foresight activities.

Likewise, cybersecurity analysis methods are also included here to provide an overview of relevant approaches for foresight in cybersecurity. These methods and techniques are not used in traditional foresight but may be applied if they support the objectives of the foresight activity. For that reason, a selection of methods is included in this report for future reference.

Figure 6: Selection of methods used in foresight

3.2.2 Environmental Scanning / Analysis Frameworks

Environmental analysis frameworks enable the user to systematically explore a chosen 20 21 environment, with the goal of detecting weak signals of incoming change that could significantly impact the future. These methods provide a structured and analytical view of the current situation in order to create common understanding. This category of methods usually draws upon the diagnostic intention.

There are different techniques to scan the environment including, for example:

 STEEP – framework to analyse Socio-cultural, Technological, Economic, Environmental and Political factors of a particular arena.

 PESTLE – framework to analyse Political, Economic, Socio-cultural, Technological, Legal and Environmental factors of a particular arena.

 SWOT – framework to identify and analyse the Strengths, Weaknesses, Opportunities, and Threats for a particular topic or entity.

FORESIGHT CHALLENGES

Each of the above frameworks enables the systematic evaluation of the characteristics, developments, and influences in the listed domains to get an understanding of the environment. There are also other variations of these frameworks that take other domains into account – the choice of method or domain should be based on an initial analysis of the given subject.

3.2.3 Trend Analysis

A trend is defined as a tendency of a development over time, or an emerging pattern of change that commonly influences large social groups. Trend analysis methods usually serve prognostic or diagnostic intentions.

Trends can be analysed in many ways – for instance, by means of literature reviews, bibliometrics, text-mining, patent analyses, and trend impact analyses, among others. These methods identify current or emerging trends and typically explore the cause, potential impact, probability, and speed of occurrence of those trends. Further methods used to analyse trends include:  Causal Layered Analysis – Supports the identification of driving forces by gaining insight into participants’ perceptions such as world views, values, and cultural norms

 Trend Radars – provides a cross-industry view of emerging and already existing trends within the target environment

 Trend Impact Analysis – analysis of the impact of one or more possible events on the extrapolation of a trend into the future.

 Horizon Scanning – Systematic monitoring of current trends as well as the identification of new, relevant developments in a particular area through a creative process of collective sense-making.

3.2.4 Expert Group Foresight

Expert group foresight covers a variety of methods, where a group (or a crowd) of participants provides input on the issue under study. The best-known members of the expert group foresight family are the Delphi method and expert panels. In both, experts share their insights about the future. The Delphi method however involves a more structured communication method to elicit answers from experts. Experts are usually involved to support a foresight project with its prognostic or prescriptive intentions.

Delphi is an explorative method based on a structured and iterative group communication between subject matter experts expressing judgements on the chosen topic. In the first sequence, various experts in a particular field are surveyed separately about a specific topic or question. Afterwards, their anonymized contributions are collected, and experts are asked to provide feedback to the collected insights. To reach a consensus, this process would be repeated multiple times. This approach helps to avoid groupthink and therefore tends to generate more creative ideas from a variety of perspectives. The entire process can be conducted remotely, which makes it easier to engage a more diverse expert group from all over the world. This method can be time-consuming, especially when there are multiple iterations. Japan’s National Institute of Science and Technology Policy (NISTEP) conducts foresight exercises approximately every five years, most of which rely on a large Delphi study with approximately 2000 participants.

FORESIGHT CHALLENGES

Other examples of expert group-based methods include:

 Aggregated Judgements / Group-based Forecast – logically combines multiple individual judgements into consistent and collective judgements.

 Key Technology Study (Technology Forecasting) – applies sets of criteria to critical technological developments in order to enable informed assessments

Note that there are also crowd or participatory foresight methods, in which inputs are solicited from non-experts.

3.2.5 Scenario Methods

Scenario methods are some of the most used and well-known prognostic methods in foresight. They are used as exploratory tools to think about possible, desired or undesired futures rather than to predict a single future in detail. These methods can also be used to simulate and test various solutions prior to determining an optimal strategy. Usually, more than one possible future is explored to support decision-making that avoids potential challenges and pitfalls.

Scenario generation is typically preceded by a diagnostic phase that allows for the informed consideration of key factors that can impact the future of the issue at hand. Thinking about multiple possible futures raises awareness of various factors that may affect the future; this knowledge enables the development of more flexible, future-proof, adaptive strategies.

Scenarios can be approached with various methods, for example:

 Gaming – devising games or roleplay scenarios to test possible strategies or solutions by identifying possible reactions to and consequences of their implementation.

 Visioning – looking to the ideal future to create a strategy to achieve specific goals.

 Cross Impact Analysis – evaluates the likelihood of specific future events occurring by assessing probability of other events occurring and then exploring their mutual relationship.

3.2.6 Morphological Analysis and Backcasting

This category covers methods that are not typically associated but share the same two characteristics - a prescriptive foresight intention and focus on event regression and system decomposition. Regression analysis in foresight follows a similar approach to statistical regression analysis. However, regression analysis in foresight works with qualitative data and subjective opinion, as opposed to quantitative methods to identify events and event triggers that may lead to a predicted future event. Decomposition, on the other hand, seeks to break down complex systems into smaller parts to facilitate analysis of its components, the dynamics governing the interaction of components and the effect they have on the system.

Morphological Analysis is a creative, heuristic, normative method that supports the exploration of complex problems and possible solutions using a multi-dimensional matrix. It is a time-consuming group exercise that requires facilitation.

Backcasting is another normative method that centres a selected scenario of a desirable (or undesirable) future. The participants then move backwards in time to identify the decisions or events that need to take place to transform that selected scenario into reality. Through

FORESIGHT CHALLENGES

backcasting, organizations can plan which actions they should take and evaluate potential consequences. It raises awareness of the fact that the future is determined by many factors and that different actions lead to various alternative outcomes.

Threatcasting is a multi-stage method that involves envisioning an unwanted future, then reconstructing steps and decisions that need to be taken to prevent that future from occurring. It was designed primarily for analysing military futures. Threatcasting combines many foresight methods including Delphi, science fiction prototyping, backcasting, and scenario modelling. This method has a defined time horizon – each activity is designed to look forward 10 years into the future.

Other methods included in this category are:

 Technology Sequence Analysis – generates probable timelines for technology releases by analysing estimates of the time required for intermediate technical steps

 Roadmapping – produces a document that defines the steps and milestones necessary to obtain a desired future

 Multi-criteria Analysis – compares possible identified solutions against a weighted set of assessment criteria.

 Synectics – promotes new and creative ways of thinking by, for example, imagining a chosen problem in an unusual, unconnected environment

3.2.7 Cybersecurity Analysis Methods

As a discipline, cybersecurity often assesses risk and potential future threats, incidents and crisis scenarios. These methods are all variations of risk assessment techniques. Each is slightly different in terms of focus (e.g., on the threat actor or on visualization) but all aim towards identifying and prioritizing risk and subsequently responding to that risk. The methods in this category can be used for diagnosis, prognosis, or prescription. Below are a few well-established methods for risk analysis and threat modelling.  Threat Agent Risk Assessment (TARA) – a threat-based risk assessment method used to identify, assess, and prioritise risks. It takes threat actors, their motivations, and possible methods into account.

 Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) – a comprehensive evaluation method to identify, rank, and manage cybersecurity risks.

 Threat Modelling – a conceptual analysis technique used for identifying potential vulnerabilities and developing measures in the early stages of application or service development. There are many frameworks and methods for threat modelling, one such method is Attack Trees. Attack Trees support the formulation of trees of possible techniques that may help an attacker achieve their objectives.

FORESIGHT CHALLENGES

4. SELECTION CRITERIA

The first step of any foresight activity is scoping; during this phase the person or group responsible for the activity defines key objectives and reviews the context of the activity. Once completed, they may consider the following key criteria to narrow down the choice of foresight methods, tools, and/or frameworks.

 Target outcomes and deliverables – which methods, tools, and/or frameworks will most likely produce the required effects on stakeholders? Which will most likely produce the deliverables expected from the foresight activity?

 Foresight intention – Consider the foresight intentions described in 3.1 for each step of the planned activity. Is the objective to diagnose a current state, or to prognose or prescribe a future state? The selection of methods must be based on suitability to the underlying objectives of the foresight activity.

 Future handling approach – Should your activity be more responsive or normative? Is the objective to prepare to respond to events or shape futures?

 Time horizon – The time horizon is the point in the future that targeted by the foresight activity. Which methods, tools, and/or frameworks can be implemented to diagnose or prognose events, or prescribe handling options, for the fixed point in time which will be evaluated during the activity?

 Activity timeframe – Which methods can be completed within the timeline set for the execution of the foresight activity? Are there tools or frameworks that could support the on-track and timely execution of the activity?

 Required resources/skills – What access does the project have to administrative support, data available on the subject, expert participants, financial resources, etc.?

Multiple experts emphasized that the choice of method highly depends on the context of the exercise, including the following more abstract criteria:

 Clarity of desired outcomes – Any ambiguity towards desired outcomes must be clearly addressed before method selection. The methods that are applied must help produce outcomes that are useful and usable for the project’s key stakeholders.

 Participant Group – All methods must consider the unique characteristics of the participant group; they should enable maximum engagement, capacity for creative thinking, and transparent communication. If the participants are already known to the organizer, key factors to analyse include existing or expected group dynamics, personalities, roles, and areas of interest.

 Publicity – If one goal of the foresight activity is to generate publicity, scenario modelling techniques are usually favoured because they are the most attentiongrabbing and easiest to describe. However, the findings of the activity may be misrepresented by the press, which may undermine the diplomatic process or other relationships with stakeholders. These facets should be evaluated for each foresight activity.

FORESIGHT CHALLENGES

 Experience – Experts from the Working Group stated that when they use methods they are familiar with (as opposed to methods unfamiliar to them), the activities progress more smoothly and tend to generate more dynamism and interaction. Nonetheless, the benefits that the facilitator may gain from familiarity should be secondary to selecting methods that support the objectives of the exercise.

4.1 FORESIGHT METHOD COMPARISON

The following table presents a selection of methods, along with their selection criteria and core characteristics. The selection includes methods that are either commonly used, innovative, and/or especially useful to address ENISA’s foresight needs. In this table, we have categorized methods by the overarching categories described in the previous chapter, the foresight “intention” that the method would support, and a categorization of each method’s usual futurehandling approach (responsive or normative). Other factors included in the table are estimated time needed for each method, special resources required, and overall aim of the method.

FORESIGHT CHALLENGES

Table 2: Methods Analysis

Underlying Future- Time-horizon Objective of handling covered Activity approach Estimated time Special resources Category Method c Aim c ve m needed for required

o o ip er n method

FORESIGHT CHALLENGES

Underlying Future- Time-horizon Objective of handling covered Activity approach Estimated time Special resources Category Method Aim c c ve m needed for required

o o ip er n method

FORESIGHT CHALLENGES

Underlying Future- Time-horizon Objective of handling covered Activity approach Estimated time Special resources Category Method Aim c c ve m needed for required

o o ip er n method

FORESIGHT CHALLENGES

Underlying Future- Time-horizon Objective of handling covered Activity approach Estimated time Special resources Category Method Aim c c ve m needed for required

o o ip er n method

FORESIGHT CHALLENGES

Underlying Future- Time-horizon Objective of handling covered Activity approach Estimated time Special resources Category Method Aim c c ve m needed for required

o o ip er n method

FORESIGHT CHALLENGES 4.2 TOOLS

Not quite at the level of a method, tools are supporting frameworks or platforms that aid the application of foresight methods. This section provides a non-exhaustive overview of the types of tools available. While some are efforts to “digitalise” foresight, others simply enhance the inperson foresight experience. When selecting tools for a specific foresight activity, we recommend reviewing other possible sources as there are some tools designed for a specific audience or context.

Workshop Facilitation Tools

These tools and techniques are often used by workshop facilitators to ease communication in workshops or to elicit creative ideas from participants. Some well-known examples are:

 Brainstorming, where participants are encouraged to generate large amount of raw, spontaneous ideas, while getting inspired by the ideas of other participants, without being subjected to immediate judgement.  World Café, where a large group of participants can discuss various questions in a structured way, in rounds, within smaller groups, and note down their ideas on large sheet of paper for the remaining groups to see and serve as reference.  Mind mapping, a technique of graphic facilitation to help visually organize collected information.

There are now a few digital databases that provide information on foresight-relevant tools. One source for identifying additional foresight-relevant tools is the website Service Design Tools which describes and organizes tools based on the stage of the design process, stakeholders and participants, the aim of the activity, and desired visualization methods. Other resources include 65 66 67 the Futures Platform, the Governance Futures Toolkit, and Teach the Future (which aims to provide educators tools to integrate foresight into their curricula.)

Artificial Intelligence (AI)-Based Tools

AI-based tools may assist foresight activities like assessment of the current environment, trend analysis, or trend extrapolation. While not ubiquitous, these tools are now often integrated into the foresight process. AI software can be especially helpful for text-mining and analysing large datasets, for instance to identify terms and phrases possibly indicative of emerging or future trends or to support a literature review. Natural Language Processing is typically used for these activities. AI-based tools may also support the selection of scenarios.

Collaboration Tools & Foresight / Trend Databases

To better facilitate foresight exercises, many experts recommend the use of collaboration tools (such as digital whiteboards and note-taking apps), as well as research databases for desktop research and trend recognition. It is important to note that within the expert community existing radar databases and foresight information sources are not always trusted. These sources rarely publish details on the information gathering and preparation process, therefore the experts interviewed typically rely on their own research or primary sources to determine trend-related information.

FORESIGHT CHALLENGES

Conferencing Tools

Conferencing tools are often used to involve participants from various geographic regions. They are extremely helpful for bringing together a diverse group of participants. However, we hypothesize that there is also a downside to using these tools. Participants may be less able to fully devote their attention to online meetings (as opposed to in-person workshops) due to the reduced interactivity of remote workshops and the fact that some individuals may be tempted to multitask or to join other meetings. Additionally, there may be varying levels of digital literacy within a group – due to a lack of technical skills and familiarity, some participants may not be able to fully and confidently participate while using a conferencing tool.

FORESIGHT CHALLENGES

5. BEST PRACTICES

This chapter lays out best practices for planning and conducting foresight activities. The findings are primarily drawn from interviews but also include salient points from the literature review.

5.1 SUMMARY OF BEST PRACTICES

Scoping & Administration

Scoping is a critical step in the foresight process . Whenever possible, it is recommended to identify a foresight organizer that has experience running foresight workshops and projects. In the initial scoping phase, the organizer begins to define objectives, foresight intention, time horizon, future handling approach, timeframe, required resources, etc. It is important to ensure that the objectives can be reached with the provided budget and resources.

In this stage of the project, the objectives of the activity should be well-defined (e.g., desired outcome, target audience, time horizon, stakeholders, key deliverables, communication and dissemination, etc.). It is also helpful to define objectives for each method or workshop - e.g., define a question for each STEEP factor.

In order to ensure maximum engagement, consider participant availability and key organizational or environmental milestones. For example, it is best to not plan events around times when participants are likely to be away on holiday. Furthermore, if the results of the foresight activity need to be provided to a key decision-maker, ensure that the findings can be delivered prior to major strategic meetings or events.

Finally, given that many foresight activities are regularly repeated, it is important to review results throughout the foresight project and at its conclusion. This provides an opportunity to learn how to improve future foresight activities.

Method selection

Since foresight activities rarely have straightforward goals or standardised outcomes, methods cannot be applied “out-of-the-box”. Often, the methods to be used for an activity must be adapted to the goal and the scope of the activity, the context of the challenge, and even the participants involved. Foresight experts often see methods more as a frame of reference, which helps them to structure the activities.

Experts noted that creating a logical flow or frame for each foresight exercise, such as Design Thinking, helps to focus on outcomes and to deliver a clear and concise plan. The frame may take the form of a modular building block approach, in which a variety of smaller blocks, each with a different focus (and method) are selected.

The methods mentioned in the example frame below demonstrate the range of possible methods - from foresight-specific (threatcasting) to more generic (role play). Frames can be grounded in existing frameworks or be simple process flows, like this illustrative one:

FORESIGHT CHALLENGES

 understanding today (e.g., stakeholder or agent mapping/analysis, PESTLE ),  detecting and defining changes (e.g., weak signals, trend analysis),

Selecting a

 articulating visions and futures into a coherent scenario (e.g., through scenario modelling:

diverse

stories, visuals, roleplays) and  analysing this future (e.g., threatcasting, scenario analysis, SWOT) to prepare participant group recommendations. for foresight

activities actively

In a well-designed foresight project, methods are carefully selected to form a diverse composition

improves the

that best serves the objectives of the particular project and its participants. By using a frame, the

group’s capacity

objectives are well-defined, but the methods can be easily switched out as needed. The use of several methods allows for a range of topics to be addressed and increases the likelihood that each for creativity and participant will provide pertinent input, thus eliciting the best outcomes for a foresight project. ability to observe

all facets of a

Duration of foresight projects

topic.

The length of foresight activities is very versatile. They tend to span from four weeks up to one year and in some cases longer than a year. These longer-term activities are often used for continuous strategic planning but are less active and intense than shorter exercises. Long-term foresight is often assigned to a specific organizational role that is tasked with staying on top of new trends and deriving useful conclusions from that research. In these cases, work would also likely be divided into smaller, time-bound exercises.

For scenario modelling enthusiasts, there is a clear correlation between time invested and granularity (level of detail) of the scenarios. The main driver of this increase in granularity or quality of scenarios over time is introspective activity. Typically, a participant’s capacity to understand the underlying systemic structure and possible evolutions or emergences increases over time; therefore, participants must be given sufficient time for introspection in order to ensure high-quality results.

A high level of granularity is often difficult to achieve in foresight activities, particularly for public sector actors, as scoping is particularly challenging at a national or regional level. It is however possible to create valuable foresight results in a shorter time period. For example, in a crisis preparedness or response scenario, foresight can support a quick turnaround of actionable information; it will just not be as detailed as projects with more time and resources.

Participant Selection and Engagement

If possible, it is critical to ensure the involvement of the project’s key stakeholders (e.g., the Head of Strategy) throughout the entire foresight process, including in smaller workshops. Delivering reports and outcomes at the end of the exercise is not as impactful for the readers as direct participation. In such a case, the findings of the exercise are less likely to be acted upon.

To ensure high-quality, well-rounded outcomes, a diverse group of individuals should be selected for participation. Diversity in this context will depend on the topic being analysed but may cover expertise, political affiliation, national origin or nationality, race, social class, gender, organizational role, age, etc. Ideally, all affected populations should be involved and represented in a foresight exercise.

Beyond the diversity of the group, it is also recommended to evaluate group dynamics when selecting participants. Characteristics that may be important to consider are shyness, ability to tolerate imperfection or lack of clarity, ability to express oneself in a group, power dynamics, etc.

FORESIGHT CHALLENGES

Consideration of this factor helps to ensure that the exercise remains productive and maximizes the engagement of all participants.

It may furthermore be beneficial to include generalists with a broad range of expertise as participants, as they can more easily provide a variety of perspectives. Likewise, it is often very important to include a participant with a strong legal background that can support the group in understanding the present, and likely future, legal constraints.

Communication & Engagement

Prior to the exercise, participants should be provided information such as: the goals of the exercise, the purpose of foresight (both in general and for the specific situation), the major components of the chosen method(s), and background on the specific topic, including any commonly used terminology that is crucial to the project (e.g., cybersecurity terms). If possible, the participants should be involved at the beginning of the activity in order to actively participate in shaping the project.

When communicating with a group of participants with varying areas of expertise, it has proven helpful to focus on outcomes over approach. Foresight is very rarely a person’s full-time occupation, hence the need to provide the essential information without going into any unnecessary detail.

By giving participants a clear understanding of their role in the overall project, the exercise leaders are better able to manage any false assumptions and encourage a more unified participant group.

Time Horizon

Time horizon, the time frame a foresight activity aims to analyse, may be classified as short-term or emerging (0-5 years), mid-term (5-10 years), or long-term (10+ years). Definitions for time horizons do not always break down into these neat categories; we have adopted this categorization for the sake of clarity.

The choice of time horizon depends primarily on:  the specific use case (e.g., climate change vs new technology)  target objective (e.g., create a strategic plan, prepare response options)  industry (fast moving (tech) vs long-term thinking (infrastructure))  external factors (e.g., what is commonly reported on at your organization)  and organizational or regional culture (are the participants accustomed to future-oriented thinking?).

The choice of time horizon should be tailored to each individual activity; nonetheless there are some notable characteristics for each time horizon to take into consideration.

While working with short-term time horizons, exercise participants tend to envision the future much like a simple linear extension of the present, and often have a hard time stepping outside of their own cognitive biases to envision futures different from the present (or commonly held expectations of the future.)

Long-term horizons allow people to free up their minds, but the plausible futures are very complex and speculative, as many factors need to be evaluated and weighed against one another. There is also often a lack of reliable data sources to support the participants’ understanding of the distant future. Long-term time horizons are often used to move towards specific objectives – defining shortterm responses that are likely to result in the intended consequence.

FORESIGHT CHALLENGES

Mid-term perspectives seem to allow enough flexibility for participants to envision alternative futures that differ from the present, thus enabling the creation of creative strategies and near-term action plans.

5.2 SUMMARY OF CHALLENGES AND PITFALLS

Data Quality and Quantity

Accurate data may facilitate more reliable foresight results. Nonetheless, data is always backward-looking; any conclusions drawn from historical data should be evaluated for applicability to the future. In many cases there is a surplus of data, an analysis of which would overextend available resources and overwhelm the participants with data that is still, after all, from the past. Too much data may also restrict participants in their ability to participate creatively in the foresight workshops. Other times, the data is either insufficient, or what is available is unstructured, or potentially unreliable. In some technology-focused foresight activities, the participants’ ability to consider ongoing innovations is limited due to lack of available information (often driven by concerns of intellectual property theft.) While this is to be expected, it can also negatively impact the outcomes of an activity. Moreover, one expert in the Working Group outlined four types of counterfactual information that may affect data reliability: gossip or rumours, fake news, rewriting of historical events, and frozen conflicts. These in turn often affect foresight exercises by warping the quality of the information and render fact-based consensus unlikely.

Participant Engagement

Regardless of how carefully participant groups are selected, there are often cases when chosen individuals do not fully participate in exercises or questionnaires. It is also difficult to get some participants to open up, think outside of the box, and embrace imperfection – all of which are critical for successful foresight activities. As mentioned above, however, these challenges may be minimized by clear presentation of the ultimate objectives and context of the exercise.

Cybersecurity-specific Challenges

Cybersecurity-specific foresight tends to focus heavily on specific technology and operational measures, limiting the ability to see strategically across the environment. Likewise, “gamechanging innovations” are rarely easy to predict, but pivotal for assessing emerging and future cybersecurity threats. This is further complicated by the often confidential nature of the cybersecurity industry; experts may face a conflict of interest when supporting foresight activities. The current shortage of cybersecurity professionals may also be a challenge when planning and performing a foresight activity.

FORESIGHT CHALLENGES

6. APPLICATION USE CASES

This section presents optional roadmaps for seven use cases identified by ENISA. The use cases represent a sample of how ENISA may apply foresight in the future. As mentioned in previous sections, the design of a foresight activity must reflect the reality of the contextual situation, resources, participants, etc. The processes proposed in this chapter are intended as a guide – in practice, the methods may need to be switched out or workshops added, for example.

The use cases approaches described in the following chapter include:

1. Identification of future and emerging 5. Evolution of operational cooperation challenges 6. Identification of future policy 2. Strategic decision-making development priorities

3. Evolution of threat landscape 7. Disruptive events

4. Needs and priorities for cybersecurity R&D

6.1 OPERATIONAL CONTEXT

To better understand how foresight would be applied within ENISA, we held a workshop to identify major functions that would benefit from foresight. As a result, we mapped out a high-level structure of how foresight findings would flow between key functions within ENISA. This helped to identify dependencies between the use cases.

Figure 7: Understanding of ENISA’s Operational Context

FORESIGHT CHALLENGES

While ENISA’s work is more of a continuous cycle, this depiction shows how the identification of emerging challenges and threats supports many activities such as strategy development, prioritizing research topics, and preparing recommendations for stakeholders. The use cases defined for each phase build upon one another, to maintain a continuous and sustainable information flow between organizational units and functions.

The use cases defined under each phase of the process are indicative - the activities and the deliverables are subject to ENISA’s standard operating model and procedures, as well as the CSA (Cybersecurity Act), the main regulation that defines the mandate of ENISA.

6.2 OVERARCHING COMPONENTS AND CONSIDERATIONS

We have highlighted here some components common to all use cases.

Inception Phase & Scoping: Each activity must begin with the identification of scope, objectives, and stakeholders – it is critical to the success of the activity.  Define the scope of the exercise (including contextual information such as the pertinent industry or EU scope).  Identify and involve all stakeholders as early in the process as is possible. Expert Working Groups take time to put together (estimated min. 2 months), and many internal stakeholders may need to participate in multiple foresight activities.

Engaging with Participants: As these use cases often take place over a year, there is a chance that the participants will lose focus and interest in the activity.  We recommend either maintaining frequent and regular contact with the participants or,  Present an overview of the project’s objectives and current findings before each part of the activity.

Tools: Some tools are needed for all use cases, such as:  Video conferencing software 73 74 75  Collaborative documentation tools (Confluence , Saga.so , Notion.so , etc.)

Resources: Where possible, the process recommended for each use case should build upon and make use of other foresight activities and reports.

FORESIGHT CHALLENGES 6.3 IDENTIFICATION OF FUTURE AND EMERGING CHALLENGES (1)

Each year ENISA works on reports identifying the future and emerging challenges relevant to their stakeholders. The reports themselves are used in many other aspects of ENISA’s operations, therefore they must be both credible and actionable.

Category Description

Produce an overview of emerging trends and challenges

Objective

that will impact security (report) Time Horizon 3 -5 years

Collaborating

ENISA Working Group & Broader Public

Stakeholders

Target Audience General public, policymakers, cybersecurity professionals Impact on Target Stay up to date on future and emerging challenges; think Audience critically about the future Level of Granularity General trends, directions, and topics.

Time to Conduct

1 year

Exercise

Dependencies Other ENISA activities rely on this study

FORESIGHT CHALLENGES 6.3.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

Collect information on emerging trends and challenges from a variety of sources including, for example, STEEP Analyse current relevant market research firms, think tanks, academic publications, foresight research, etc. The STEEP method PESTLE social, technological, should be applied to ensure the comprehensiveness of the research itself. Research and findings are to Literature Review 1 economic, environmental be shared amongst participants and experts for feedback. If ENISA is conducting its own data analysis, Trend Interpolation & and political events. Trend Intra- & Extrapolation may be used to project future outcomes based on historical data. This will be Extrapolation the most time-intensive step. Desk Research

Gather internal and external (expert) stakeholders to conduct a brainstorming workshop. In the workshop, Identify and document all participants will write down change events and systemic emergences that they have noticed or have 2 possible change events and studied for each category (STEEP). The group discusses the results, adds findings from the desk Brainstorming future states. research, and together creates a shortlist of trends to investigate further. The trends are divided amongst participants to collect further information.

To identify a driving force of change, analyse all the events which have been brainstormed in the previous Identify and document phase and locate causal dependencies amongst them. Relationships or dependencies between events driving forces of change for should not only have a cause-and-effect nature. The analysis should include the technologies, social Causal Layered 3 the predicted events in attitudes, political positions and actors or interest groups acting as facilitators or perpetrators of the events. Analysis (CLA) each PESTLE category. The workshop(s) should rely on an expert group composed of a diverse range of participants (e.g., cybersecurity professionals, economists, psychologists, sociologists, etc.).

Identify cybersecurity topics Based on the information generated during previous steps, experts participating in the workshop must related to drivers and identify cybersecurity related topics. This is performed by looking at the current environment, the predicted 4 Brainstorming change events in each evolutions or change events, driving forces for the changes, and possible end states through the lens of PESTLE category. cybersecurity.

Categorize and prioritize After gathering relevant cybersecurity topics in step 4, an internal working group of ENISA experts should topics and drivers based on review, complement and categorize the topics. The categorization narrows the focus of the ENISA team to 5 Participatory Design speed of evolution and only relevant topics. From there, the team may derive future activities such as further exploration, training impact on cybersecurity. exercises, policy recommendations, etc.

FORESIGHT CHALLENGES 6.4 STRATEGIC DECISION-MAKING DEVELOPMENT (2)

ENISA relies on solid, fact-based strategic decision-making to decide how to allocate resources, plan future activities, and identify areas of development. Foresight activities enable the leadership to design a strategy that can manage future challenges.

Category Description

Guide the strategic planning process to validate the assumptions and the level of ambition; review principles,

Objective

priorities and requirements for the Agency to realise its vision and fulfil its mission.

Deliverable Revision of ENISA strategy document(s)

Time Horizon 3-5 years

Collaborating ENISA Internal; ENISA Management Board and Advisory Stakeholders Group

Target Audience ENISA Stakeholders & Management Team

Impact on Target

Modify strategic decision-making actions

Audience

Level of Granularity High-level strategic guidance, directions, and priorities

Time to Conduct

1 year

Exercise

Dependencies All other use cases

FORESIGHT CHALLENGES 6.4.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

Using the Future & Emerging Challenges and Threat Landscape reports as a basis, initiate a focused desk Review and update relevant STEEP research phase structured by the STEEP analysis. During this phase, the emphasis would be identifying 1 research and current PESTLE any developments that have emerged since the workshops conducted as part of other use cases. environmental factors. Literature Review Research and findings are to be shared amongst participants and experts for feedback.

Scenario Planning: Based on the information collected in Step 1, identify possible futures that ENISA would be a part of. The focus should be on very disruptive or probable futures; this ensures that the Review the documentation resulting strategy is flexible enough to accommodate many possible outcomes. In this step, the and explore additional participants would create a rather long list of potential scenarios that would be shortlisted in the next step. Scenario Method 2 scenarios which may be Expert Workshop: Scenarios produced in the previous step should be reviewed with the expert group to Brainstorming desired, disruptive and/or identify clusters which warrant further exploration, based on their potential for disruption or likeliness of likely to happen. emergence. Within an internal ENISA group, a desired future should be selected that can guide strategic initiatives.

It is recommended that relevant scenarios or clusters be modelled at this point, exploring different aspects such as PESTLE or STEEP context and situation, day-to-day experience for actors living in the future

Model relevant scenarios of scenario, group or individual motivations, desires and needs, consumption habits, etc. The scenarios can 3 Scenario Method the future. be further explored with the expert group by engaging in iterative design practices through a series of

workshops, improving the level of granularity of the descriptions and the understanding the experts

develop on the future state.

Create a normative vision: Hold a workshop to identify ENISA’s ideal role in shaping the desired future(s). Scenario Method Define a normative vision of Using the modelled scenarios, identify the role that ENISA wants to play in each of the chosen futures. 4 Visioning ENISA for these futures. How does that look and how does it reflect to ENISA’s core values and mandate? What are ENISA’s Backcasting responsibilities in this alternate future?

In a workshop with internal stakeholders (and external consultants as needed), brainstorm possible Backcast initiatives required initiatives to reach the normative vision. For example, how would ENISA fulfil its mandate in such a future?

5 to reach the normative What steps would ENISA need to take now to help shape the situation towards the desired future? It is Backcasting vision. important to remember that the identified tasks and initiatives need to allow for the possibility that another,

more disruptive, future may arrive.

Define an evolution Prioritize and organize the initiatives needed to achieve and accommodate alternate futures. Based on the roadmap and complete the 6 roadmap identify common themes and guiding principles to support the strategy. Incorporate both Roadmapping strategy with guidelines and overarching themes and specific initiatives into the strategic document. principles.

FORESIGHT CHALLENGES 6.5 EVOLUTION OF THREAT LANDSCAPE (3)

Each year, ENISA publishes their analyses on the European threat landscape. This is an important aspect of much of ENISA’s work as the most prevalent threats may also drive the Agency’s priorities and strategy.

Category Description

Produce an overview and analysis on emerging threats and Objective drivers, to inform the general public and cybersecurity professionals. (report) Time Horizon 1-3 years

Collaborating

ENISA Working Group & other EU agencies

Stakeholders

Target Audience General public, policymakers, cybersecurity professionals Impact on Target Stay up to date on emerging threat landscape; begin Audience preparations and measures to address emerging threats Level of Granularity Specific cybersecurity threats and trends

Time to Conduct

6-9 months

Exercise

Dependencies

FORESIGHT CHALLENGES 6.5.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

Environmental Scanning: Initiate a short desk research phase focused on security event and incident reports, as well as cybersecurity threat analyses from the previous year. Research and findings are to be shared amongst participants and experts for feedback. Other tools such as data mining may be used to Analyse current Desk Research identify threat methods or attack vectors that are on the rise. 1 environment for existing PESTLE Expert Panel: Alongside the Context Gathering step, gather a diverse group of experts to provide input on threats and threat actors. Expert Panel potential threats. The Expert Panel (typically 12-20 people) may be divided into groups based on areas of expertise or focused on a particular threat category (e.g., ransomware attacks). This could be a longer phase (>3 months) or shorter, depending on the timeline of the project and resources available.

Expert Workshop: For the identification of the underlying causes of threats and motivations of threat Stakeholder Mapping actors, a diverse group of participants should be assembled, including profiles such as psychologists, Personas Identify drivers for actors 2 sociologists, economists, technology experts, cybersecurity enthusiasts, etc. The participants should use Empathy Map and threats. tools such as personas and empathy maps to understand the motivations of the threat actors, as well as Causal Layered their ultimate goals. Analysis

Combining desk research and workshop format (Trend Mapping), the participants would identify change Trend Analysis: Identify and Trend Mapping events that are impacting the major threats and threat actors. These should be distinct from threat events 3 document possible change Brainstorming (i.e., the rise of insider threat would not be a change event, rather that the COVID-19 pandemic weakened events and future states. Mind maps social ties within organizations).

Threat Identification and Comparison: This activity may then be extended by the Threat Agent Risk Assessment (TARA) method. The participants will compare their research and structure it into lists of TARA Identify and document threat actors, attacker objectives, and attack methods. This method offers a way of getting an overview of Thought 4 future threats. threat actors, their objectives, and attack methods and narrowing it down to the most high-risk or novel Experimenting threats. The TARA method is typically used to assess the major risks to an organization, country, etc. but it Desk Research may also be used to identify how new methods or change events may lead to novel threats.

Propose and document In a workshop with cybersecurity professionals, categorize and prioritize threats. Obtain feedback in 5 Participatory Design recommendations. iterative rounds.

FORESIGHT CHALLENGES 6.6 NEEDS AND PRIORITIES FOR CYBERSECURITY R&D (4)

ENISA provides a valuable service by identifying areas within the field of cybersecurity in need of development. This use case builds on the previous three to reach a greater degree of granularity. Research and development may also inform future strategic decision-making or may serve as inputs for environmental scanning.

Category Description

Analyse gap between existing research focus and required

Objective

future focus based on landscape evolution

Deliverable Gap analysis and recommendations

Time Horizon 1-5 years

Collaborating

Research community

Stakeholders

Research community, Competence Centre, European

Target Audience

Commission (EC)

Enables the ability to identify future research and innovation Impact on Target needs; contributes to the Competence Centre Strategic Audience Agenda and Work Program; Contributes to the EU Strategic Agenda on Research and Innovation

Level of Granularity Detailed – needs to produce concrete direction

Time to Conduct

6 months

Exercise

Identification of Future and Emerging Challenges; Evolution

Dependencies

of threat landscape

FORESIGHT CHALLENGES 6.6.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

STEEP Using the Future & Emerging Challenges Report as a basis, initiate a short desk research phase Trend Interpolation & structured by the STEEP analysis. During this phase the emphasis would be identifying any trends, threat Research & Environmental Extrapolation 1 actors, or technologies that were not covered in the Challenges Report. Research and findings are to be Scanning Bibliometrics shared amongst participants and experts for feedback. If ENISA is conducting its own data analysis, Trend Text Mining Interpolation & Extrapolation may be used to project future outcomes based on historical data. Literature Review

Gather internal and external (expert) stakeholders. In a workshop, all participants will write down change Scenario Method Identify and document events and systemic emergences that they have noticed or have studied for each category (STEEP). Expert Panel 2 possible change events and Afterwards they should: discuss results of the workshop, incorporate desk research findings, shortlist Brainstorming systemic emergences. trends to investigate, and delegate trend research to participants. Desk Research

Identify driving forces for Personas To identify a driving force of change, analyse the events brainstormed in the previous phase with a diverse 3 possible change events and Causal Layered expert group and locate causal dependencies amongst them. emergences. Analysis

Once the driving forces have been identified, the project team should define bipolar factors for each driver

(desk research or internal workshop.) A bipolar factor is a construct based on a driving force, stating an

Transform driving forces “either/or” outcome in the future. For example, if the driving force is “general social desire to optimize the

into bipolar factors and ownership of assets”, then the bipolar factor should focus on attitudes towards possession, with full or Scenario Method

4 combine to identify partial ownership or full usership (full transformation of social paradigm) as possible outcomes. Bipolar Factors

alternate futures. By defining a series of bipolar factors and using a combinatorial approach, a scenario modelling team can

create a set of scenarios, based on the “either/or” outcomes defined for each bipolar factor. For example, if

an exercise has defined two bipolar factors, a total of 4 scenarios would be created.

The scenarios should then be reviewed with the expert group to identify clusters that warrant further

exploration based on their potential for disruption or likeliness of emergence. Model the relevant scenarios

Identify, explore and model or clusters, exploring different aspects the environmental context and situation, day-to-day experience for 5 Scenario Method highly relevant scenarios. actors living in the future scenario, group or individual motivations, desires and needs, consumption habits,

etc. The scenarios can be further explored through iterative design workshops that increase the level of

granularity of the descriptions and experts’ understandings of the future.

Identify relevant Part of the scenario modelling exercise should also focus on the cybersecurity aspects governing the cybersecurity topics and 6 future state. Topics such as technologies, threats, threat actors, etc. should be regularly explored. Existing Threat Modelling drivers in most relevant threat landscapes (see Use Case 3) can be used as input. scenarios.

FORESIGHT CHALLENGES

Prioritize topics and drivers ENISA stakeholders should then review the modelled scenarios to canvas for relevant topics from a 7 based on cross-scenario cybersecurity point of view. The analysis can be performed by identifying topics which have a high Scenario (2x2) Matrix frequency. frequency and impact across several scenarios.

Review ENISA strategy and research topics currently in focus. Analyse gap between relevant topics Review current research 8 identified in the future scenario which might warrant further research focus and current topics being and identify gaps. researched.

Propose new research Construct recommendations to expand research and innovation agenda. The findings may be reported to

9

topics. research partners across disciplines.

FORESIGHT CHALLENGES 6.7 EVOLUTION OF OPERATIONAL COOPERATION (5)

Operational cooperation is one the ENISA strategic objectives: by coordinating both the secretariat of the EU CyCLONe and the EU CSIRTs Network, ENISA aims to synchronise technical and operational levels as well as all EU actors in order to collaborate and respond to large scale incidents and crises. The evolution of operational cooperation must consider a variety of factors that are constantly shifting. Integrating foresight into this process will help to understand the possible futures of operational cooperation.

Category Description

Produce analysis and recommendations on cooperation

Objective

mechanisms and relationships

Report on the evolution of operational cooperation bi-

Deliverable

annually.

Time Horizon 1-3 years

Collaborating

Blueprint Actors

Stakeholders

Target Audience Blueprint Actors

Understand relevant driving factors for a specific threat or

Impact on Target

crisis, as well as the possible cooperation mechanisms to

Audience

improve cybersecurity response

Level of Granularity High-level

Time to Conduct

1 year

Exercise

Dependencies Evolution of Threat Landscape

FORESIGHT CHALLENGES 6.7.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

Using the Future & Emerging Challenges and Threat Landscape reports as a basis, initiate a desk

Analyse and document research phase structured by the STEEP analysis and focused on the factors relevant for operational PESTLE 1 threat landscape, attack cooperation. During this phase the emphasis would be on identifying any trends, threat actors, or STEEP trends, etc. technologies that have emerged since the workshops conducted as part of use cases 1 and 3. Research Trend Maps and findings are to be shared amongst participants and experts for feedback.

Analyse and document existing cooperation mechanisms and structures, as well as notable events that Stakeholder Maps Analyse existing demonstrated a successful or failed cooperative activity (desk research). In a stakeholder workshop, Mind Maps 2 cooperation structures and compare findings and categorize them into structural or thematic components. Interviews with individuals Personas resilience levels. with operational responsibility may also provide valuable insight (if time and resources allow).

Identify and document gaps Based on the findings from the previous steps, identify gaps in the operational cooperation infrastructure. in existing cooperation Risk Assessment 3 These may be prioritised by using a risk assessment method or in a separate workshop with a diverse relationships and World Cafe group of individuals associated with the Blueprint Actors. mechanisms.

Propose and document Taking the findings from the previous two steps, conduct a workshop (or a series of workshops) with Brainstorming cooperation relationships 4 experts to identify mechanisms to strengthen operational cooperation. Findings may then be iteratively Thought Experimenting and mechanisms required revised within an internal/Blueprint Actor feedback loop. World Cafe to increase resilience.

FORESIGHT CHALLENGES 6.8 IDENTIFICATION OF FUTURE POLICY PRIORITIES (6)

As a trusted advisor of policymakers, ENISA provides overviews of emerging challenges that may warrant a policy response.

Category Description

Produce an overview and analysis on emerging and future Objective topics and drivers, to inform policy making entities and actors.

Deliverable Opinion / High-level overview of emerging and future topics

Time Horizon 3-5 years

Collaborating

Policy Observatory Expert Group

Stakeholders

Target Audience Policymakers

Impact on Target Be informed of emerging and future trends that warrant Audience assessment in terms of relevant policy interventions

General trends and directions, generic topics. Emerging and future topics to be analysed from a policy perspective,

Level of Granularity

with additional information from the Research and Innovation Team where needed.

Time to Conduct

1 year

Exercise

Identification of Future and Emerging Challenges; Evolution

Dependencies

of threat landscape

FORESIGHT CHALLENGES 6.8.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

Using the Future & Emerging Challenges and Threat Landscape reports as a basis, initiate a desk research phase structured by the STEEP analysis. During this phase the emphasis would be identifying any trends, threat actors, or technologies that have emerged since the workshops conducted as parts of Review and update relevant use cases 1 and 3. Research and findings are to be shared amongst participants and experts for STEEP 1 research and current feedback. PESTLE environmental factors. Desk Research Alongside the Context Gathering step, gather a diverse group of experts to provide input on both the existing policy landscape and the identified future challenges and threats. The Expert Panel may be divided into groups - based on areas of expertise or focused on a particular topic or factor within STEEP.

Gather internal and external (expert) stakeholders to conduct a brainstorming workshop. In the workshop, Identify and document participants will write down possible change events and systemic emergences that they have noticed or 2 possible change events and Expert Panel have studied for each STEEP category. Afterwards they should: discuss results of the workshop, future states. incorporate desk research findings, shortlist trends to investigate, and divide up trend research tasks.

Identify and document To identify a driving force of change, analyse all events collected in the previous phase and locate causal Brainstorming 3 driver(s) of change for dependencies amongst them. The workshop(s) should rely on a diverse expert group. World Cafe predicted events.

Desk Research Identify topics related to After identifying driving factors, select topics that are particularly salient to policymakers. These topics may 4 Causal Layered drivers and change events. be derived from any step of the foresight process. Analysis

Analyse topics and identify gaps in regulation or policy. Core stakeholders will collect the findings from the previous phases and identify possible gaps in the policy 5 Propose areas of focus and landscape or provide guidance on key factors to consider in the policymaking process. These conclusions Participatory Design recommendations for policy need to be validated in feedback loops with experts and internal stakeholders. development.

FORESIGHT CHALLENGES 6.9 DISRUPTIVE EVENTS (7)

As demonstrated by the COVID-19 pandemic, transformational events or situations can occur suddenly and without warning. In those cases, it is prudent to have a structured process with which to generate possible outcomes. This supports decision-makers and brings additional clarity to entities that may need to support in such a crisis situation. Examples of these events could include, for example, mass ransomware incidents (like NotPetya) or wide-reaching APTs (advanced persistent threats).

Category Description

Envision possible future states following a large disruptive

Objective

event.

Scenarios describing possible future states (Lines to Take

Deliverable

or LTTs)

Time Horizon 2 – 4 weeks

Collaborating ENISA Internal; Key Member States Stakeholders; Stakeholders Cybersecurity Experts

Target Audience ENISA Stakeholders & Management Team

Provide an overview of the impact of disruptive events and

Impact on Target

outlook of possible future states in order to inform

Audience

organizational response and capabilities allocation.

Key driving factors and forces, emerging events, possible

Level of Granularity

alternate future states

Time to Conduct

A few days

Exercise

Dependencies None

FORESIGHT CHALLENGES 6.9.1 Foresight Approach

Recommended # Process Step Detailed Description Methods & Tools

1 Define scope of analysis Review disruptive chain of events and identify main (visible) triggering event.

Analyse the main disruptive event and identify early signals, main actors and STEEP impacts on current Stakeholder Map 2 Sensemaking of event environment (only what can be seen right now) STEEP

LEGO Serious Play Identify emergences and Identify emerging events and event chains, stakeholder and actor reactions and strategies to cope with – Application 3 event dependencies disruptive event. Identify at least three possible reactions per stakeholder or main actor. technique 6: Playing Emergence

Identify and name scenarios through combination of identified chains of events and main actor 4 Scenario identification reactions/strategies. Select chains of events that are plausible, possible and probable and combine Scenario Method stakeholder or actor reactions to generate a long list of scenarios.

Discard implausible scenarios and evaluate the probability and possibility of remaining scenarios using a 5 Scenario prioritization 2-by-2 matrix two-by-two matrix.

Review highly possible and probable scenarios and explore internal dynamics of each. Define scenario stories - detail context, stakeholder or actor actions, STEEP aspects and other relevant aspects required by ENISA management. Model the relevant scenarios or clusters, exploring different aspects the environmental context and Scenario stories 6 Scenario deep dive situation, day-to-day experience for actors living in the future scenario, group or individual motivations, STEEP desires and needs, consumption habits, etc. The scenarios can be further explored through iterative design workshops that increase the level of granularity of the descriptions and experts’ understandings of the future.

FORESIGHT CHALLENGES

7. CONCLUSIONS & NEXT STEPS

7.1 CONCLUSIONS

Foresight can be an asset to the cybersecurity community

Cybersecurity often looks towards future short-term threats, yet there is a need for cybersecurity professionals and policymakers to maintain pace with attackers. Foresight is a good tool for supporting longer term strategic thinking on how to improve the state of cybersecurity and overall resilience. ENISA is taking an important strategic step to better integrate foresight into cybersecurity practices.

Foresight is flexible and must be adapted for each activity

At the beginning of each foresight project, the methods and tools used should be thoughtfully chosen and/or augmented to best suit each unique context and group. Even ongoing activities may be updated with lessons learned. For example, if after one workshop the objectives were not achieved the format of the following workshop should be adapted to suit the context and participants. The recommendations in this report are not prescriptive and should be adapted as needed.

Where possible, engage one or more foresight experts for critical activities

Experts have the experience to select methods that best fit the group, but they also have more knowledge of the more indefinite aspects of foresight – attitudes, framing, ethics, etc.

Foresight is an opportunity to improve understanding and communication

When stakeholders are involved in a foresight process, they obtain a wealth of information and also face the challenge of how to transport ideas and possibilities in an easily comprehensible way. This is an excellent exercise to develop staff members and leadership alike.

7.2 NEXT STEPS FOR ENISA

Design and Resource Allocation

The most pivotal step will be to design the foresight activities themselves – including participants, timelines, etc. The more aligned the activities are to the organization in the design phase, the less likely that significant changes will be needed after testing the foresight activity approaches. It is also notable that resource allocation is critical for determining basic elements of planned activities - the number of participants, timeline, and if a foresight professional can be brought in to lead the activity.

Test and Adapt

To fully utilize the potential of foresight at ENISA, it needs to be tested in a variety of teams, settings, and contexts. Testing enables ENISA to align the foresight approach to our specific needs, thus easing the process of integrating foresight into operational work. Foresight needs to be integrated integrated into processes in order to figure out the best set up and timeline for the organization. In doing so, ENISA may create a culture of foresight which in turn increases the quality of foresight outputs.

Collaborate with Key Stakeholders

ENISA’s foresight activities may be enhanced by drawing upon the expertise of and collaborating with other European (or MS) agencies and institutions that conduct foresight.

Support Build Up of Foresight Capability

FORESIGHT CHALLENGES

Foresight can be useful in many contexts and would be an asset for strategic cybersecurity planning for EU Member States. ENISA’s lessons learnt and new expertise could be useful to get national foresight programs off the ground.

FORESIGHT CHALLENGES

A ANNEX: GLOSSARY

Design Thinking A user-centric problem-solving approach

Foresight Foresight is a systematic, participatory, future intelligence-gathering and medium-to-long-term vision-building process aimed at enabling present-day decisions and mobilizing joint actions

Framework A set of principles and processes containing method with tools, aimed at solving complex challenges

Granularity The level of detail or quality of something

Method A multi-step procedure aimed at solving a specific challenge

Organizational The capacity of performing activities or executing processes to achieve Capability organizational goals

Time Horizon A fixed point in time in the future which a foresight activity aims to analyse

Tool A predefined template to structure information

FORESIGHT CHALLENGES

B ANNEX: INTERVIEW GUIDELINE

Introduction

1. Please describe your current role and summarize your experience with foresighting methods. 2. Please summarize your experience with cybersecurity. We would be interested to know if you have applied foresight methods for cybersecurity topics.

Foresighting methods and Evaluation

3. In what context do you apply foresighting within your profession? 4. For which time horizon do you typically use foresighting for? 5. Which foresight methods do you use? 6. How do the methods you mentioned relate to the foresighting needs of your profession? 7. What are the criteria you apply to select a foresighting method in the context of your profession?

Foresighting Activities Example

8. Please describe a typical foresighting activity for you – who is involved, how long is the process, diversity of groups a. How long does it take to deliver results based on the foresighting activities that you mentioned? b. Do you use any specific technology-based tools or databases to support your foresighting activities? c. How much time do you need to invest in order to achieve the expected granularity / quality? (Are some methods more efficient than others?)

Lessons Learned

9. What are some lessons learned you have gathered about conducting foresighting activities? a. What challenges have you encountered with the methods you mentioned or have used in the past? b. What challenges have you encountered with running foresighting exercises (e.g., participant interaction)? c. What are specific pitfalls you find when foresighting for short-, mid- and long-term timeframes? d. Have any tools (especially for remotely run foresighting activities) proved helpful? e. Is there any terminology you use that has been beneficial for introducing methods to nonexpert groups? f. If you use foresighting for cybersecurity, did you find any specific challenges or lessons learned for this activity?

- -N -EN -178 -21 -06 TP

ABOUT ENIS A

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN 978-92-9204-546-3 doi: 10.2824/187824