How to conduct a security analysis?

On April 1st 2019, a new Protective Security Act was introduced in Sweden. It applies to all activities that are important for Sweden’s security, for example various forms of critical infrastructure. The act entails new higher requirements regarding protective security work and is introduced in order to reduce vulnerabilities.

When starting to work with protective security, the first step is to carry out a protective security analysis. Such an analysis is the basis for all protective security work. You are obliged to make a protective security analysis if you conduct security-sensitive activities to investigate the need for protective security. How do you carry out a protective security analysis?

1. What is the goal of the business?

Make a business description where it is clear what responsibilities and processes that exist in the business. Also note any dependence on other functions, both internal and external.

2. Which are the protection values of the business?

Think about what the protection values of the business are, i.e. what are the most sensitive parts, the parts that can affect Sweden’s security if someone comes across them?

3. Which consequences can arise?

Make an impact assessment and assess where the limit for acceptance goes.

4. What is the threat?

Make a clear description of the threats and the opponent. What does the threat picture look like? What type of attacker could be considered a threat? Are there any known potential attackers and what is the threat associated with them?

5. Which vulnerabilities exist?

Perform a vulnerability analysis that shows vulnerabilities that are linked to the business’s protection values. These can be used by a potential attacker, and therefore it is important to know where they are.

6. Which protective measures should be chosen?

Finally, identified vulnerabilities should be linked to appropriate protection measures. The measures can be divided into three different areas: information security, physical security, and personnel security.

Protective security plan

Once you have completed your protective security analysis, a protective security plan must be drawn up based on your analysis, which deals with information security, physical security, and personnel security. The protection plan must clarify which protective security measures that must be taken.

How to work with your protective security is always based on the Protective Security Act. Under the Protective Security Act is the Protective Security Ordinance, which itself is followed by various regulations and guidelines. These regulations and guidelines thus apply to different sectors, which means specific rules for different organisations.

The Protective Security Ordinance states that if security-classified data is to be communicated to an information system outside the operator’s control, the data must be protected by cryptographic functions that are approved by the Swedish Armed Forces. VPN encryption is one such solution.