Pernilla Rönn urges organizations to test cybersecurity in practice

Cybersecurity policies matter, but organizations also need to check that their procedures work in practice. Pernilla Rönn, a cybersecurity expert at HiQ, says October’s cybersecurity month can help build engagement, but security work needs to continue throughout the year.

New Swedish regulations were established on October 1. They cover areas including security measures, management training, security audits and security scanning. Rönn says organizations differ widely in their maturity and operational capacity. Some municipalities have made limited progress, while public agencies and companies that have faced stricter requirements for longer are further ahead, she told Techtidningen.

She highlights supplier oversight as a weak point. Organizations need to check that security requirements are followed and passed along through the supply chain. Buying managed security or SOC services does not remove an organization’s responsibility for incident response. Rönn recommends joint plans and exercises with suppliers.

She also warns that written policies may not reflect actual practices, while undocumented operational knowledge can disappear when employees leave. HiQ conducts penetration tests that assume an attacker has breached an organization’s outer defenses; exposed credentials or plaintext passwords can help an attacker take over its IT environment.

Exercises can start with staff reviewing an incident response plan, then progress to tabletop sessions with management and tests of how decisions move from the help desk to crisis leadership. More mature organizations can use simulated attacks. Rönn recommends recurring exercises and training across the year, with October as a chance to plan and secure support for the next year’s work.