On the night of 20 January 2024, the hacker group Akira, with suspected links to Russia, carries out what is known as a ransomware attack targeting the Finnish IT provider Tietoevry. The attack involves rounding data in the system and then encrypting it. Only by paying the hacker group huge amounts of money can the data be restored. The attack disabled supporting IT systems in municipalities, regions and certain companies, as well as the payroll system of 120 Swedish government agencies.
Cyberattacks can be part of so-called hybrid warfare, a tactic used to destabilise surrounding countries. The more society comes to rely on digital infrastructure, the more common this will become.
Complex problem
Banks, railways, electricity networks, telecommunications, medical records systems, government agencies and companies – everything and everyone are connected to the internet. This is efficient and convenient for individuals as well as for companies and government agencies. Also, the development of different types of software has enabled progress in a variety of scientific fields. But being connected comes at a price.
“If you want convenience and accessibility at the touch of a button, some cybersecurity risks is the price you may have to pay. It’s a very complex problem that can have very big consequences,” says Elisa Bertino, professor of Computer Science at Purdue University in the USA.
She has devoted her entire research career to finding new methods to stay ahead of hackers trying to break into computer systems. Elisa Bertino is currently a distinguished guest professor at the Department of Computer and Information Science (IDA) at LiU.
Both beneficial and a risk
She was invited by Simin Nadjm-Tehrani, professor of Computer Science at IDA, who conducts research on cyber security and artificial intelligence. We will get back to that combination soon. Simin Nadjm-Tehrani believes that even if the risks increase, digitalisation is largely beneficial for society.
“Most younger people probably don’t remember when people paid their bills by filling in forms at the kitchen table and sending them to the bank in envelopes, for example. This was something we spent a lot of time on, but it’s not needed now. We’ve quickly become accustomed to the convenience of this and probably can’t go back,” says Simin Nadjm-Tehrani.
She believes that the development of digital tools is constantly being driven forward. But this development must take place with consideration, something that has not always been the case.
An example of this is an incident at Lantmäteriet (the National Land Survey of Sweden) that was discovered earlier this year. They have records of all buildings in Sweden. Some of the buildings are security restricted and even secret. However, the National Land Survey system was developed with the idea that as many people as possible would have access to the information to facilitate the construction and purchase of properties, among other things. This also meant that classified information on some buildings could be retrieved through the normal open interfaces.
“Some of the things we see today have to do with the fact that we are living in a different geopolitical reality. 10 or 15 years ago, many computer programs and systems in Sweden were developed at a time of trust. At the same time, the pursuit of efficiency has dominated working life. Things are to be done faster and cheaper but not necessarily better. If things are done fast, important parts may be missed,” says Simin Nadjm-Tehrani.
A new threat
In recent years, artificial intelligence has also emerged as a new threat to cyber security. Various types of fraud to access sensitive data have become easier and there are AI programs that fully autonomously look for flaws in security systems. That said, if used properly, AI can be an effective tool for protecting data.
Simin Nadjm-Tehrani and Elisa Bertino are working together to develop AI that can detect hacker attacks and take action even before any damage is done. If they can make it work, cyber security would be not only more efficient but also potentially cheaper.
Cyber security is expensive. But the realisation that cyber security is the new cornerstone of a functioning society has meant that investments in research have skyrocketed in recent years.
“When I started in the early eighties, only a few researchers, and really no one else, cared. Almost every university now has large cyber security research centres with a lot of funding,” says Elisa Bertino.
These investments have enabled great progress, but the hackers are not far behind. She believes that if you want total security, your system must be completely isolated. It must not be connected to other systems or the Internet. Elisa Bertino does not see this as a realistic way forward, but sees greater user awareness as the most important thing.
“We need to educate society on cyber security, on a broad front. In many attacks users are the weak link, and hackers have become extremely sophisticated. At the same time, we can’t claim that a system is 100 per cent secure, although we need to ensure that critical systems, such as nuclear power plants, have extremely strong protection.”
