Cybersecurity is everyone's responsibility

Cyber security has long been seen as something technical, something for the IT department or experts in the background. But as society becomes increasingly digitalised, the playing field has changed. At the same time, the threat landscape is dynamic.

Cyber attacks are no longer science fiction or isolated incidents, but a reality that affects businesses, authorities and private individuals every day. When a municipality is affected, schools may be forced to change their operations and home care services may find it more difficult to provide support to their users. Disruptions in logistics systems affect both businesses and individuals. Cyber attacks have knock-on effects that spread like ripples on water, both quickly and widely.

AdobeStock

A new everyday skill

Ten years ago, cybersecurity was mostly seen as a technical issue. Today, we know that it concerns the resilience of society as a whole. Security is not just something for the IT department – it is an everyday skill that everyone needs, just like traffic rules for those who drive cars.

Needs vary: a pensioner who wants to keep in touch with their grandchildren faces different challenges than an IT manager, and a teenager who plays online games faces different risks than a teacher who handles student data. That's why cybersecurity must be based on how people actually use technology.

When security feels complicated, it is easy to take shortcuts – and that is where the risks arise. Smart solutions such as password managers make it easier to do the right thing, but technology alone is not enough.

Cyberlyftet is an open course that provides you with practical knowledge on how to handle emails, links, and other digital situations safely. It is the first line of defence against cyber attacks – and something everyone should be aware of in their daily lives.

Ecosystems where knowledge is shared in real time

What is the next major cyber threat? The truth is that threats evolve in step with technology. The Internet of Things means that more and more connected devices can be exploited as entry points for attacks. Cloud services collect enormous amounts of data in a few locations, making them attractive targets for various threat actors. The most significant threat right now comes from the increasing use of artificial intelligence to carry out cyber attacks, both in the form of realistic phishing attacks and credible deepfakes, as well as advanced attacks where AI exploits vulnerabilities in IT environments.

But development is not just moving in one direction. Cybercriminals share information, tools and methods with each other. They learn quickly and build networks. Therefore, those of us who defend society must do the same, but even better. By linking the public sector, business and academia, we can create an ecosystem for cyber security where knowledge is shared in real time. If a bank discovers a new type of attack, the information can be disseminated to other sectors, such as healthcare or transport, before the attack has a chance to strike there.

One such initiative is Cybernode, a collaboration between MSB (the Swedish Civil Contingencies Agency) and NCC-SE (the National Coordination Centre for Research and Innovation in Cybersecurity), where RISE has been commissioned by MSB and NCC-SE to continue building the Swedish cybersecurity competence community. This competence community is part of the European Cybersecurity Competence Centre, ECCC.

Sweden's cyber security capacity

RISE contributes to Sweden's cyber security by creating conditions for building long-term resilience:

• A neutral platform for collaboration
  Researchers, companies and authorities can meet, test solutions and build common standards. Through this role as a connecting platform, knowledge and experience can be shared across sector boundaries, strengthening the resilience of society as a whole.
• Environments where organisations can practise for real
  Just as fire drills teach us how to act when there is a fire, organisations need to be able to practise for cyber attacks before they happen. In the Cyber Range test bed, companies, authorities and organisations can be exposed to simulated attacks on their own systems – without any actual damage being done.
• Research that understands the entirety
  Scientific studies show that technical protection is only part of the solution. Training, behaviour and routines are just as important – an advanced security system is useless if users do not know how to use it. RISE research in cyber security covers both technology and human factors, and we work broadly, from industrial systems and vehicles to education, AI and digital services. For us, cyber security is as much about how people act as it is about the systems and tools used.
• Security built in from the start
  Through research and innovation, security can be built into systems and services from the outset. When an app automatically requires a strong password, when updates are made without the user having to take any action, or when a service warns of suspicious activity – that's security working in the background. Just like a seatbelt, simple and obvious.

Sweden has everything it needs to be a leader in cyber security. We have world-class technical expertise, a strong tradition of cooperation between the public sector, industry and academia, and a high level of trust between citizens and authorities.

To take the next step, we need to use this foundation to build even better protection, strengthen educational efforts and make cyber security a natural part of both everyday life and business. In this way, we can create a digital society that is not only secure, but also robust, innovative and competitive.

For a society that will last in the future

Cybersecurity is not a project that someone else will solve for us. It is a shared societal challenge and an opportunity. By taking responsibility, spreading knowledge and working together, we can build a digital society that will last, in everyday life, in crises and in the future.

When cybersecurity is a natural part of everyday life, when knowledge is shared openly and when organisations practise together, cybersecurity is no longer something we need to think about every day. It is simply there, like a seatbelt, like a lock on the door, like the infrastructure we take for granted.

Together, we can ensure that Sweden becomes a pioneer in cybersecurity. This will not only strengthen our defence against threats, but also our freedom to continue to develop, experiment and live in a connected society.