The COVID-19 pandemic has accelerated the digitalization of the Swedish public sector, and to ensure the success of this ongoing process cybersecurity plays an integral part. While Sweden has come far in digitalization, the maturity of cybersecurity work across entities covers a wide range. One way of improving cybersecurity is through communication, thereby enhancing employee cyber situation awareness. In this paper, we conduct a census of Swedish public sector employee communication on cybersecurity at the beginning of the COVID-19 pandemic using questionnaires. The study shows that public sector entities find the same sources of information useful for their cybersecurity work. We find that nearly two thirds of administrative authorities and almost three quarters of municipalities are not yet at the implemented cybersecurity level. We also find that 71 % of municipalities have less than one dedicated staff for cybersecurity.

In recent years, the Swedish public sector has undergone rapid digitalization, while cybersecurity efforts have not kept even steps. This study investigates conditions for cybersecurity work at Swedish administrative authorities by examining organizational conditions at the authorities, what cybersecurity staff do to acquire the cyber situation awareness required for their role, as well as what experience cybersecurity staff have with incidents. In this study, 17 semi-structured interviews were held with respondents from Swedish administrative authorities. The results showed the diverse conditions for cybersecurity work that exist at the authorities and that a variety of roles are involved in that work. It was found that national-level support for cybersecurity was perceived as somewhat lacking. There were also challenges in getting access to information elements required for sufficient cyber situation awareness.

The conditions for cybersecurity work in the public sector are diverse. This study presents user-centered personas representative of the variety of Swedish administrative authority cybersecurity staff. These personas are intended to be used for communication and design purposes to improve cyber situation awareness support systems and facilitate crisis communication.

Empirical material from 17 semi-structured interviews with cybersecurity staff and data on administrative authority size, were used to create personas. The personas were validated using triangulation through three activities. Implications for practice are addressed by suggesting solutions for the personas' problems, and use cases for the persona card deck are presented and discussed. Using personas in this way captures diverse needs for cyber situation awareness for staff involved in upholding cybersecurity in public sector organizations.

The digitalization of our societies makes them increasingly vulnerable to emerging cyberthreats. These cyberthreats can manifest themselves in the form of organized, sophisticated, and persistent threat actors, as well as nonadversarial mistakes. Staff involved in responding to cyberthreats and handling incidents in organizations need cyber situation awareness. This paper presents a case study on what challenges members of staff involved in cybersecurity in a large, complex organization experience when developing cyber situation awareness while handling a remote code execution vulnerability in the form of Log4j. Two types of qualitative empirical material were used for the case study, data collected through semi-structured interviews with ten informants, and internal documentation. The empirical material was analyzed to create a timeline of events in the organization. The results show how information about the threat spread throughout the organization, the types of artifacts that served as common operational pictures, and the role played by information sharing in maintaining staff cyber situation awareness. Three major challenges to the organization were found: (i) information sharing among staff was not effortless, (ii) there was no organization-level common operational picture established, and (iii) inaccurate information was shared. This study adds a real-world contribution to the literature on organizational handling of cyberthreats.

Our digital societies are vulnerable to cyber crises. Without cyber-resilient organizations, vital societal functions may suffer incidents or loss of service. The diverse roles involved in cybersecurity decision-making require cyber situation awareness to uphold robust cybersecurity. Existing systems and processes supporting cyber situation awareness are not tailored to organizational needs, either at the role or the group level. This study explores the need for socio-technical system support, presenting common operational pictures supporting cyber situation awareness for staff handling cyberthreats. The participatory design method video prototyping was used to elicit needs from staff in a large, complex, public sector organization providing essential services. All participants have roles in cybersecurity crisis and incident management. Results from the video prototyping workshop suggest that cybersecurity staff need (i) a single support system for incident management, and (ii) a shared data repository underpinning (iii) role-specific common operational pictures. The envisioned system support provides traceability and accountability.