Cybersecurity and sociotechnical systems

Astrid Hellström Ryckert has transitioned from a traditional systems scientist to viewing IT issues from a broad societal perspective. This path was paved through the master's program in Innovation, Defence, and Security, and an internship at the European Parliament focusing on cybersecurity.

After completing her bachelor's in systems science at Uppsala University, Astrid Hellström Ryckert wanted to delve deeper into cybersecurity.

"I was drawn to the master's program in Innovation, Security, and Defence because it's not just IT, and it aligns perfectly with the broadening interests I have."

"In systems development, you can easily get stuck behind a screen coding, whereas I'm interested in cybersecurity on a broader and higher societal level. For instance, I wrote my bachelor's thesis on cybersecurity in Swedish hospitals. And if you're interested in the civilian defence of systems like electrical systems, infrastructure, and public transport, then the Swedish Defence University is perfect."

She describes the Swedish Defence University as quite different from, for example, Uppsala, a large university and where she had previously studied.

"It's such a difference to attend a school where everyone greets each other and knows each other! It's not just more personal. Academically, it means there are opportunities to tailor the program based on the students, so that students can specialize within their areas of interest. I extended my study period to take an independent internship, and had supervisors who supported me throughout my specialized program."

"The Swedish Defence University really is a meeting place"

"I've been introduced to cybersecurity education, forums, and think tanks – and met so many people interested in the same field as me. It's so exciting."

Now, Astrid Hellström Ryckert has obtained a position as a research assistant. This involves organizing educational days and lectures on cybersecurity for the government, various authorities, and people in managerial positions.

"That's an opportunity you might not get at any other educational institution. It has led to me having a vast network within my field," she says.

A program that combines technology and social sciences

"I really believe there's a need for individuals who understand both the technical and social science aspects. Through this dual understanding, we can focus on the socio-technical system and integrate social, organizational, and technical elements into a functioning whole."

What was the interdisciplinary nature like in practice?

"My class consisted of political scientists, social scientists, war scientists, systems scientists, computer scientists, and engineers. Those of us from engineering and technical backgrounds entered the defense sector and gained a much broader societal perspective than we had before. The system boundaries are pushed outward for the technicians, and inward for the social scientists," she explains.

The opportunity to specialize through elective courses means that it's possible to build a unique education.

"Those of us leaving the master's program will be able to serve multiple purposes based on the niche we've carved out for ourselves."

Was there anything that surprised you during the course?

"Yes, it was much less technical than I expected. But over time, I understood the rationale behind the courses. Like the one on public procurement – I didn't think I would find it so useful. But I have used it in practice at the European Parliament."

More personal educational institution

According to Astrid, it was clear that the Swedish Defence University is a smaller and more personal educational institution, not a large university.

"So take advantage of the opportunities that a smaller, more personal educational institution offers, and explore the possibility to shape the program as you want. Maybe you want to bring in courses from other universities? At the Swedish Defence University, teachers and program coordinators really care that you follow your own path and do what you want."

You arranged a semester-long internship at the European Parliament. Tell us about that!

"Getting technical knowledge in a large and intergovernmental organization like the European Parliament feels like the perfect combination of my technical interest and the master program's security focus. At the same time, being one of the largest legislative bodies in the world makes it particularly interesting to study from a security perspective. The complexity requires an understanding of the entire socio-technical system."

Internship at the European Parliament's DG INLO

Astrid Hellström Ryckert did her internship at the Directorate General for Infrastructure and Logistics (DG INLO), which is responsible for all the European Parliament's buildings within the EU.

"It involves the technical and administrative management of, for example, fire systems, air conditioning, heating and cooling systems, energy systems, security systems, and plumbing. But also physical components like elevators, doors, and escalators, which are also controlled via IT systems and are part of the overall security of the buildings. Today, physical components in office buildings are often connected to an IT network, the Internet of Things (IoT). This adds a level of security consideration closely related to the main subject of the master's program: defense systems. And this is something I'm very interested in."

She had tasks at many different system levels: vulnerability management, network configuration, security documentation, collaboration and communication, risk assessment, security policies and procedures, and security auditing and compliance.

"I was part of the cybersecurity team and helped my supervisor, who is responsible for information security. We managed everything from human aspects like educating staff in cybersecurity to deeply technical tasks like configuring networks and hardening systems."

Exceptionally high threat level at the European Parliament

Astrid explains that even though the systems used by DG INLO are not directly exposed to the public, the threat level is exceptionally high. External influence must always be taken into account.

"For example, a power outage in a substation in Brussels might be deliberately caused by an adversary to disrupt the function of EU institutions. The EU also has a responsibility that concerns the union's credibility. A cyberattack that leads to data breaches or operational downtime can in turn lead to lost trust among member countries and the public. Therefore, vulnerability analyses are crucial, even in small and seemingly insignificant systems."

Insights from the internship

"At first, I was surprised by how many people worked in cybersecurity without a technical background. It's easy to focus on technical security for systems and overlook the social, organizational, and human aspects. So, I'm taking that with me."

She further explains:

"You can develop the most robust systems, which still won't be secure if people lack security awareness or if there's a workplace culture where security isn't a priority. This ties into one of the core concepts in the field of defense systems, namely 'capability.' We simply can't create 'capability' without considering the human and organizational side."

"It's my conviction that socio-technical systems are even more crucial now, in the early years of generative AI. Understanding the human role in technology, the impact of technology on people, and seeing them as an integrated unit is the foundation for developing and maintaining secure systems."

Focusing on a career in cybersecurity

Astrid Hellström Ryckert plans to write her master's thesis in collaboration with an American university that specializes in cybersecurity.

"That's one of the contacts I've made through my job as a research assistant."

"After that, I'm interested in a technical trainee program to deepen my knowledge, since there wasn't much technical focus during the master's program. Right now, I'm looking at technical trainee positions in the defense sector, but I'm considering a wide range of options."

"And further down the line, I look forward to working in cybersecurity at an agency or a cross-sectoral organization between private and public. My interest in the broader societal perspective has been further reinforced during the master's program. I'm focused on societal benefit, and that will be reflected in my future choices."

More about the International Master's Programme in Innovation, Defence and Security