Digitalisation offers tremendous opportunities for business, the public sector and people’s everyday lives. But with opportunities come risks. As digitalisation has increased, so too has the risk of cyberattacks. Unfortunately, awareness of cybersecurity has not kept pace with these developments, and while Sweden is second in the world and first in Europe in terms of digitalisation, we are only 32nd when it comes to our commitment to cybersecurity.
– “Cybersecurity needs to be the first thing we consider when working with digitalisation,” says Shahid Raza, Director of Cybersecurity at RISE.
A general check list for cybersecurity for digitalisation projects is difficult to produce, as cybersecurity measures vary depending on the type of project involved. But Shahid still wants to highlight a number of aspects of cybersecurity that are worth thinking about.
– “The first thing most people might think of is network security, making sure that there is no unauthorised access to the network and filtering out unauthorised access and malicious content.”
If something still manages to penetrate the network in the form of malware (malicious software), procedures need to be put in place to prevent this type of attack happening again. This can be done by establishing procedures for monitoring IT systems and networks.
–´“Companies also need to establish procedures for incident management,” continues Shahid. “What do we do if someone is actually affected by, for example, malicious software? Is the solution to try to rescue an infected computer, or should we simply toss it and get a new one?”
Focus on people
Perhaps the most important element of work on cybersecurity involves neither technology nor networks, but rather people.
– “People are almost always the weakest link in all security systems. Educating users and making them risk-conscious is in many cases a key activity in organisations’ cybersecurity work,” says Shahid.
Another phenomenon that affects security is the ability to work remotely or from home.
– “That a computer is secure when it is in the company’s office is one thing, but how secure is it if an employee takes it home with them? In these situations, companies need to consider what devices can be permitted to leave the office or not and develop appropriate policies.”
Security settings for routers or similar hardware are also something that needs to be looked at. Often, a router’s default settings are set to a minimum level, which greatly increases its vulnerability. That risk can be significantly reduced by configuring the security settings for maximum security.
Keep track of your USB drives
In May 2016, researchers at the University of Illinois conducted an experiment where they planted nearly 300 infected USB drives around the university campus. More than half were connected within ten hours, and 45 per cent of those who connected the drives also went on to access links that introduced even more malware.
– “Companies need a policy for how they handle external devices that are plugged into their computers. They also need to make sure that all devices to be used are scanned for malware,” says Shahid.
Finally, Shahid would like to share some tips about managing user identities and guarding critical assets against malicious insiders.
– “Even if an employee is removed from the company’s internal systems in connection with the termination of employment, it does not necessarily mean that the process is complete. Companies also need to keep track of what other services the user has been given access to through their company details, for example cloud file storage services. There is also reason to look at what rights an employee has to view things that happened before their employment started. Should everything be available or not?”
