A solidly built wall can withstand attack for a long time, but when it falls, it falls hard. Bricks tumble, rebar sticks out, dust rises. From protection, it suddenly becomes something in the way, a broken obstacle that can even hurt you if you are not careful.

"Our whole society is now built around various forms of digital, networked information systems," says Carl Heath, senior researcher and focus leader for digital resilience at RISE.

"They started to develop in the 1990s, in the years after the fall of the Berlin Wall, when the security situation looked quite optimistic. But since February 2022, the situation is completely different. We need to evolve our way of thinking about security and think more about resilience in addition to robustness."

The blade of grass bends with the wind, but rises again

A resilient system is like a wall. It can withstand a lot, but if it falls, it falls hard, is useless, and is difficult to repair.

"A resilient system, on the other hand, should be able to withstand and recover from disruptions, crises and threats while maintaining its function, availability and integrity. It can be compared to a blade of grass that bends with the wind – no matter how hard the wind blows and storms, it will rise again."

And the importance of this becomes clear when Carl Heath starts to list all the interconnected information systems that a society today consists of and depends on: telecommunications, energy supply, traffic lights, or even something as simple as a single car. Digitalisation offers enormous opportunities to achieve the social, environmental and economic goals of our time, but it also makes us enormously vulnerable.

"In other words, when we talk about the security of information systems, we are talking about the resilience of society as a whole to attack. Everything from ransomware against individual companies to large-scale hybrid attacks by state actors."

In such a situation, a resilient system, unlike a robust system, will not break down and become unusable.

"Instead, it will adapt. It may have a built-in way of rerouting information so that key functions can still be used, but without moving into the damaged area so that it can be repaired. "

So what makes an information system resilient?  

The technology has to work, of course, but the more interconnected we become, the more obvious it becomes that it also has to be organised.

Carl Heath uses the energy system as an example: "It exists at several different organisational levels (from the Swedish national grid to the solar panels on your summer cottage, and from the national Svenska Kraftnät to a municipal energy company), all of which must be able to interact with each other in a secure way."

"The regulatory framework for these systems must allow them to talk to each other so that the information that needs to be shared can be shared, but also so that the information that should be kept secret remains secret. This is complex because it means that different actors with very different requirements have to work together, otherwise there will be gaps."

Achieving resilience requires a vision

But how do you get there? First, you need a vision, a picture of how this digital world built in peace can withstand serious threats, even war.  

"You have to ask yourself what you want to achieve, what levels are reasonable, what are our commitments. It is very important that these questions are part of the strategic development process."

Secondly, we need to know what systems we have today and what risks and threats they face. An important part of this is the exercise.

"We can identify different events and situations in theory, but to really understand them and know how to deal with them, we need to practice. Through practice we can also discover the risks and gaps we hadn't thought of before."

One such exercise is Nordic Pine, a NATO exercise on the sustainability of the Nordic energy sector, in which RISE is a key partner.

"RISE is made up of 3000 nerds who have cutting-edge expertise in a wide range of areas. We know about technology development and we can do exercises, we can contribute with a knowledge map and we can create meeting places. Building resilient information systems involves technology, organisation and people, and requires the ability to manage all three."

Cyber attacks are increasing. Hacker groups have become more targeted and sophisticated. Being aware of what the threats are and what can be done to protect important information is a national concern. This has been established by the Swedish Civil Contingencies Agency (MSB).  

Critical organisations must have effective protection against data breaches 

It is particularly important that socially critical operations, such as electricity supply, have effective protection against data breaches, as they must be able to maintain their services even in the event of attempted intrusions and attacks. Nätkraft Borås has recognised this.  

Almost two years ago, the company, which manages, operates and develops the electricity and fibre network in the city of Borås, began mapping its processes to identify vulnerabilities. In September 2023, they became the first in the industry to have their information security management system certified according to the ISO 27001 standard. The certification shows that Nätkraft Borås works to manage information securely, protect customer data and minimise the risks of integrity and security threats.  

Since there have been incidents at other municipal companies, the City of Borås has decided that we should have a systematic approach to information security. In addition, our fibre network operations will soon be affected by a new EU directive linked to this issue, and our electricity network already has the requirement," says Lars Hedendahl, CEO of Nätkraft Borås, and continues:  

"There is also a competitive perspective. If we can be early and work with information security in a good way, we should be more attractive to our customers and thus also more competitive.  

Nätkraft Borås was certified by RISE, which a month earlier became the first in Sweden to receive accreditation for the certification of management systems in socially critical operations in electricity, gas and water supply.

Certification is proof of systematic working methods 

But what does it mean to be certified according to ISO 27001? Camilla Rosswill, audit manager for management systems at RISE, explains that certification to this standard is proof that an organisation has a systematic approach and procedures for maintaining information security.  

"The advantage of introducing a systematic management system and taking guidance from the standard is that it raises the organisation's awareness. The standard requires organisations to identify, assess and treat risks," says Camilla Rosswill.  

Lars Hedendahl:

"We cannot say that we are completely protected because we work according to ISO 27001. It's more about the fact that we have a process for handling different types of crisis situations, such as an intrusion, and in that situation we try to minimise the damage and make the best of the situation. "

The most important part is getting people on board

Part of the work to strengthen information security is to build solutions, physical and digital, that protect the information. For example, this can involve creating backup files that reduce the vulnerability to attacks where hackers lock data and demand a ransom, known as ransomware attacks. Another example is a strong password policy. However, perhaps the most important part of the work is getting people on board.  

"We who work here should know what to do when something happens. It's not just a few people who have been involved, but everyone to a greater or lesser extent. Of course, the easiest thing to do would be to have an information security officer who managed everything, but then you don't build resilience over time. If that person leaves, the systematisation and our protection disappears," explains Lars Hedendahl.  

The management system for information security helps Nätkraft Borås to maintain a stable delivery in all situations.

"Our fibre operations form the basis for a large part of communication in Borås, and no one can do without electricity today. Perhaps communication and electricity are the most critical aspects of society? Disruptions can have serious consequences. That is why it is so important that we maintain operations," says Lars Hedendahl.

Certification is audited and leads to continuous development 

The certification was a milestone for Nätkraft Borås – but the work has really only just begun.  

"A major advantage of being certified is the systematic review. We come and carry out an audit every year to check that the management system continues to fulfil the requirements, and the business itself must carry out internal audits. You can't sit back," says Camilla Rosswill.

"The world is changing. Tomorrow, new threats may have emerged. Therefore, we need to evaluate our methods and see if there is something better. This is a long-term endeavour," says Lars Hedendahl.

It's hard to forget the news from March 2020. How the virus spread to more and more countries, how more and more people fell ill, how the first cases were finally detected in Sweden. But the coverage also included the shock of the shortage of essential medical supplies, how the surge in consumption depleted stocks. Face masks and protective aprons were running out, and critical medicines were being rationed. Things didn't get any better as one border after another closed, cutting off vital global logistics chains and bringing in substandard products. In the end, laid-off Volvo workers, for example, made makeshift visors out of plastic film so that the health system would at least have something. One of many examples of how Swedish companies have reorganised their operations to provide essential products.

Regulatory reform to strengthen Sweden's resilience

This was certainly not an optimal situation, and in October 2022, a reform of civil defence and crisis preparedness authorities came into force. It aims to strengthen the country's resilience in peacetime crisis situations, heightened preparedness and ultimately war, and the reform designates sixty government agencies as 'preparedness authorities'. They are particularly important to society's civil preparedness and must be able to withstand threats and risks, prevent vulnerabilities, manage peacetime crisis situations and fulfil their roles in a heightened state of alert.

One of the areas these authorities need to review is the availability of critical products and materials.

"It is extremely difficult to supply a society if you are not prepared for the fact that imports can sometimes be negatively affected," says Benny Lyvén, Business Developer at RISE.

The department he works in deals with issues related to the supply of resources, materials and products.

"We work with prevention and help companies and public authorities with proposed solutions for production, materials and production conversion," says Christina Jönsson, SVP at RISE.

Assessing which products are important for operations

Together with the Swedish authorities, RISE is evaluating, for example, which products are important for a company to be able to operate during a crisis, and how these products can be secured even if there is a sudden loss of imports.

"For Sweden as a country to be able to cope with this, innovation and new solutions are needed, and this is something we all need to work on more," says Benny Lyvén.

"Also, in a crisis we need someone who can test products. If, in an emergency, you are making new products with new materials with very little experience, you run the risk of creating a crisis in the crisis if you do not test before you launch. Otherwise, you run the risk of filling the system with inferior products that only create worse problems.

Authorities and RISE can work together to develop support and tools to get a process up and running, even if the authority does the inventory and needs assessment itself. RISE helps with the next step: to see how a particular product on that list can be secured.

"For example, we can analyse existing value chains and suggest alternative variants, investigate whether there are existing domestic products that can meet the same needs, or whether it is possible to start domestic production or secure the supply of materials for products," says Christina Jönsson.

Can assess which parameters are critical in a crisis

RISE's testing facilities and knowledge of most industries are therefore an asset to authorities who need to ensure that a replacement for an existing product is developed quickly.

"We have extensive experience of testing and trials, but we also do a lot of work evaluating which parameters within a specification need to be maintained in a crisis, and which requirements can be ignored and still have a sufficiently good product," says Christina Jönsson.

During the pandemic, this became a crucial aid for many authorities and industries, and now RISE is working with the Swedish Civil Contingencies Agency, among others, to help more parts of society prepare for this type of event.

"By applying the knowledge and infrastructure we already have in a new way, we can help the Swedish authorities in the event of a crisis, while at the same time contributing to increased learning through the process itself, so that they themselves gain more knowledge about how such processes can work," says Christina Jönsson.