Managing critical incidents in the cyber domain

Geneva Centre for Security Policy (GCSP)

Managing critical incidents in the cyber domain is episode 6 in the new GCSP Podcast Series. Dr Paul Vallet interviews Ms Sarah Backman, Cyber Security Consultant with Secana. Dr Paul Vallet: Welcome to the Geneva Centre for Security Policy, weekly podcast. I'm your host, Dr Paul Vallet Associate Fellow with the GCSP’s Global Fellowship Initiative. For the next few weeks, I'm talking with subject matter experts to explain issues regarding peace, security, and international cooperation. Thank you for tuning in. For several years, even in this socially distance period and in a virtual format now, the GCSP has hosted a fascinating recurrent competition, the Cyber 9/12 Strategy Challenge in partnership with The Atlantic Council at which competing young teams of various institutions and universities are tasked with responding to an ongoing scenario of a security crises originating from a breach in cyber security. It's this time of the year and to discuss such competitions, their challenges and perhaps the useful lessons that come out of the competing teams and their talents, we're joined today on the podcast by Ms Sarah Backman. Ms Backman is a doctoral candidate in International Relations at Stockholm University, focusing her research on cyber crisis management. As a practitioner in the field, she's also consultant in strategic security risk and crisis management for Secana in Stockholm, as well as lecturing to the Swedish Defense University and offering several publications on cyber crisis management, she has acted as a judge for four editions of the Cyber 9/12 and is returning this year. So welcome to the podcast, Sarah, and thank you very much. Ms Sarah Backman: Thank you so much, Paul. Dr Paul Vallet: So, my first question to you is perhaps a little bit personal, looking at your background, and so on. But I was wondering when and how did you develop an interest in cyber security crisis management, and in particular, in participating in simulation exercises, and perhaps you can tell me whether there are also similar types of exercises to nine, Cyber 9/12 that you know, of, that you participate in for the industry or in the academic setting? Ms Sarah Backman: Yeah, so, it was back in 2014, I think early 2014. And it was really quite random. But I was looking for an internship and then I got an internship at a cyber security firm, a very small one. And that was really lucky for me because I got to work with the CEO of that firm, which is one of Sweden's most prominent cyber security experts. And pretty quickly, I realised, you know, I have a background in security studies and political science. And pretty soon I realised that this field of cyber security is not all about the technical stuff. But there are a lot to do when it comes to the perspectives from a security studies political science perspective too. And then I continued to study security studies and crisis management. Meanwhile, I worked as a consultant. So that is basically what I've been doing since then. So, I have my PhD project and I also work with large scale cyber crisis management exercises as a consultant. And, for me, I just think that based on what I've seen, but also based on research, we know how much value exercises can have, in the absence of real experience of crisis. And that, especially if you have simulation exercises, people actually do feel and act a lot like it would be a real crisis. And research tells us that when you experience a situation, a real crisis, or situations similar to real crisis, that creates sort of mental slides or a mental library that you can access in a real crisis, and it really helps responders. So, yeah, I just love to combine, working with something that I really believe in, which is exercises. And also combining that with the academic part of it.