Education and training are seen as essential for increasing knowledge and enhancing the capability of activities to manage serious IT incidents. For example, the strategy stresses the need for skilled personnel in the area of cyber security to overcome the lack of cutting-edge expertise in both the private and public sectors. It should thus be in the interest of all relevant stakeholders to find long-term solutions to satisfy the increasing needs for skilled labour. Furthermore, regular national and international training is a prerequisite for developing and evaluating structures to manage serious IT incidents and for identifying organisational, technical and administrative development needs. 

Measures include: 

• Prioritising training participation in cybersecurity training within relevant authorities and other organisations.
• Carrying out both cross-sectoral and technical cybersecurity training on a regular basis to enhance Sweden’s capability to manage the consequences of serious IT incidents. 
• Using training to validate policies, plans, procedures, equipment and agreements between organisations, training personnel on their roles and responsibilities, improving coordination and communication between organisations,  identifying resource deficiencies and  opportunities for improvement at both the individual and organisational levels. 

The national cybersecurity strategy is underpinned by the government maintaining the capability to manage serious IT incidents through coordinated training activities.

Roles and responsibilities: 

The Swedish Civil Contingencies Agency (MSB), in collaboration with other relevant authorities, maintains the capability for long-term planning and coordination of training activities to build expertise and guarantee a good capability to manage serious IT incidents in society. 

The Swedish Armed Forces maintains a corresponding capability within the scope of its responsibility. Cyber security training activities should encompass several types of training to achieve all levels and competencies that are needed to manage serious IT incidents. These training activities include everything from seminars to cross sectoral collaboration. Access to a virtual training environment significantly increases the opportunities for carrying out technical cyber security training. Such an environment makes it possible to practise the management of simulated technical problems under conditions that reflect realistic technical infrastructures and systems. This allows participants to test their processes and technical capability for managing incidents and to develop collaboration with other stakeholders at the same time. The planning for training activities should be long-term so that each individual element contributes to increasing or maintaining capability. Systematic experience management becomes an important part of implementing training results in existing plans, working methods and other activities. 

Where necessary, the training activities should also take into account other threats and risks that might have a close link to the area of cyber security. One example of this is disinformation and influence campaigns. The training scenario in the area of cyber security, including disinformation and influence campaigns, can help to increase society’s overall capability to resist these threats, both in the Swedish Armed Forces’ defence planning and total defence planning. Today, a large part of national and authority specific technical training is carried out with the support of FOI’s technical platform CRATE (Cyber range and training environment). 

• Luleå University of Technology – Master Programme in Information Security (Master Degree). Year established: 2007. Student Intake: 40. European Credit Transfer System: 120. Focus: System security, network security, component security, SW security. 
• Halmstad University - Master's Programme in Network Forensics. Year established: 2017. Student Intake: 40. European Credit Transfer System: 60. Focus: System security, network security, component security, SW security. 

Public-private partnerships are part of the measure aimed at enhancing collaboration and cybersecurity information sharing in a complex and multi-faceted cyber risk landscape. 

Collaboration on society’s cybersecurity key for creating good operational capability to manage serious disruptions and is often the basis for collaboration during serious incidents. This involves collaboration between different stakeholders in Sweden, such as central government authorities, municipalities and county councils, trade and industry and interest organisations, but also international collaboration.

There are several good examples of collaboration in the area of cyber security in Sweden. The Cooperation Group for Information Security (SAMFI) plays an important role through its work for secure information assets in society. SAMFI consists of several central government authorities that have particular tasks in the area of cyber security: the Swedish Civil Contingencies Agency (MSB), the Swedish Defence Materiel Administration, the National Defence Radio Establishment (FRA), the Swedish Armed Forces, the Swedish Police Authority, the Swedish Post and Telecom Authority (PTS) and the Swedish Security Service. MSB has administrative responsibility for the group. The collaborative forum, the National Cooperative Council against Serious IT Threats (NSIT), analyses and assesses threats and vulnerabilities regarding serious or qualified cyberattacks against the most security-sensitive national interests. NSIT consists of the Swedish Security Service, FRA and the Swedish Armed Forces through its Military Intelligence and Security Service (MUST). 

The Government sees a need to develop and deepen collaboration between authorities to increase cybersecurity across Swedish society. Several new authorities will be assigned new tasks in the area of cybersecurity when the NIS Directive is implemented in Swedish legislation. It is important that collaboration is developed on the basis of a comprehensive perspective.

Public-private collaboration is a voluntary, agreed cooperation between public and private stakeholders. Cybersecurity has several examples of platforms for public-private collaboration. One of these is MSB’s establishment of a number of forums for information sharing (FIDI) in different sectors and areas: FIDI Telecom, Swedish CERT forum, FIDI Finance, FIDI Health and Social Care, FIDI Operations and FIDI Supervisory Control And Data Acquisition (SCADA). The area of electronic communications also has the National Telecommunications Coordination Group (NTSG). NTSG is a voluntary cooperation forum aimed at supporting the restoration of the national infrastructure for electronic communications during extraordinary events in society. There is a need to further develop information sharing regarding threats, risks and security measures in order to quickly adapt the protection of more stakeholders.

To support collaboration and partnerships, the Swedish government will work towards:

•  Enhancing collaboration between authorities that have specific tasks in the area of cybersecurity.
• Ensuring appropriate information sharing and collaboration between public and private stakeholders. 

The CYBERWISER.eu CyPR is all about boosting opportunities in the cybersecurity marketplace. 

This European Cybersecurity Professional Register is the place where professionals, juniors or seniors, can promote their specific skill sets and experiences in cybersecurity, courses taken and qualifications.

Organisations of any size or sector from SMEs to large companies and public institutions can find and contact the right skills and experiences they need to improve their IT security posture.

January 2021. 

The information contained here is based on desk research carried out by CYBERWISER.eu, including the ENISA interactive maps on national strategies and educational courses. 

CERT-SE (Swedish: www.cert.se/) is the national/governmental Computer Emergency Response Team. Established in 2003, it is responsible for coordinating incident response measures for both government institutions and private entities across all Swedish networks. It is also responsible for providing an Incident Reporting Platform for collecting cybersecurity incident data.

SUNET-CERT is the Swedish University Network Computer Emergency Response Team, supporting universities, colleges and other organisations connected to the SUNET network, including the coordination of incidents, IT security competences and co-operation with other national and international CERTs (Swedish: https://www.cert.sunet.se/; English: https://www.cert.sunet.se/english/index-eng.htm).

Linköping University has its own Incident Response Team: Li.U (https://old.liu.se/insidan/it/irt?l=en), handling issues and incidents within the institution.

Other CERTs/CSIRTs are listed on the Forum of Incident Response and Security Teams (FIRST) but do not have websites.

National incident management structure (NIMS): partial coverage. The Swedish Civil Contingencies Agency's Regulations on Government Agencies Information Security 2009 (pusuant to Regulation 2006:942) requires each agency to develop its own information security management systems, based on standards supported by the Swedish Standards Institute.

Sweden conducted the National Cyber Security Exercise “NISÖ” in 2012. Sweden also participated in the multi-national International Watch and Warning Network Exercise 2013 organised by the United States.

CERT-SE

Authorities are obliged to report an incident whereas other organisations may choose to report voluntarily. However, it is important to be aware of new obligations under the EU NIS Directive and GDPR applicable from 25 May 2018. 

Guidelines on reporting an incident: https://www.cert.se/it-incidentrapportering/om-it-incidentrapportering/.

Telephone: 010-240 40 40 | 08-678 57 99.

Email: cert@cert.se

The website of SUNET-CERT is currently being updated and does not include information about reporting a cyber incident (Swedish: https://www.cert.sunet.se/; English: https://www.cert.sunet.se/english/index-eng.htm).

Handelsbanken Security Incident Response Team (Handelsbanken SIRT)

Constituency: Finance Sector
Country coverage: most EU countries, UK and USA

Telephone: (+46) 8 701 8370
Telephone (emergency number): (+46) 8 701 8370
Email: sirt@handelsbanken.se
Please refer to https://www.first.org/members/teams/handelsbanken_sirt, for information about cryptography.

January 2021.

The information contained here is the result of desk research carried out by CYBERWISER.eu.