NCSC director: Sweden has the most vulnerable connected devices in the Nordics

During Tuesday's press conference on cyber security - in light of recent cyber attacks - John Billow, director of the National Cyber ​​Security Center, stated that there are "fundamental vulnerabilities" in our digital society that can be exploited.

More specifically, it concerns connected devices that control and monitor physical processes and machines in industry and other infrastructure, so-called cyber-physical systems and operational technology (OT).

- It is when such systems are connected to the internet, often for accessibility and flexibility reasons, that it becomes possible to attack them as well, says John Billow.

Sweden stands out

The latest example of this is the attack on fridges and freezers in France, Sweden, Finland and other European countries. Where the majority of the affected cooling systems according to the NCSC were from the same manufacturer, and many times older systems with insufficient protection.

The National Cyber ​​Security Center has carried out "an extensive mapping work" and identified "up to three thousand" units of various types in Sweden that are exposed to the internet, in everything from grocery shopping, transport and logistics to water treatment, energy and industrial operations.

- And Sweden stands out. We have a greater number of exposed and vulnerable connected devices than, for example, our Nordic neighbours, says Bilow.

But you don't know what causes it.

- Now we're a bigger country, so that's one thing, but it doesn't explain the whole picture, so we don't have a good explanation right now.

"The consequences can be great"

After the refrigerator and freezer attacks in France, NCSC contacted operations in Sweden where exposed units were found.

However, not everyone had time to heed the warnings before Swedish grocery stores, restaurants and picking warehouses were also affected at the beginning of November. Others still haven't acted.

- Actually, the threshold is not that high to fix this, but the consequences can be very big, so it is clear that it is serious, says John Billow.

- We urge businesses to clearly inventory connected devices and then limit exposure through security measures.