– Like Sicra, we prefer to help organizations before something goes wrong. That is best for everyone involved, both from a societal and commercial perspective, says Hedvig Moe, Partner and Attorney at Thommessen.

As part of Sicra’s 10th anniversary, we interviewed Hedvig Moe about the future of cybersecurity. Moe began her legal career at Thommessen in 2000 before continuing her career at, among others, Økokrim and PST (the Norwegian Police Security Service), before returning to Thommessen in May 2023. Along the way, she has developed expertise in areas such as geopolitics, national security and foreign intelligence, political processes, and legislative work. At Thommessen, she leads the firm’s national security practice, where she provides legal and strategic advice in all areas where national security is relevant to businesses and public-sector organizations.

• Sicra 10 years: While you are reading this, data is being stolen in silence from thousands of Norwegian companies. Read how our partner Arctic Wolf uses AI in the fight against AI-powered cyberattacks.

• Sicra 10 years: Read our interview with Sicra CEO Gaute Lien about why security management is key to a resilient organization.

National security is becoming relevant to more organizations

– When I returned to Thommessen in 2023, we saw that national security would become increasingly relevant to more and more organizations. At the same time, there would be more new laws covering security, particularly digital security, an area Thommessen’s technology department was already working with. I found it very interesting to be part of developing a new service area where we incorporate national security considerations into technology issues to a greater extent than before, because our clients need it, Moe explains.

In hindsight, there is no doubt that Thommessen was right. New legislation is coming both from the EU and at the national level. NIS2, which concerns digital security and cybersecurity, is on its way. The same applies to the CER Directive, which concerns physical security and the protection of essential societal functions. In addition, “national security” applies to far more organizations than those we immediately associate with “critical infrastructure,” such as energy companies. Attorney Moe gives a few examples:

– If you want to assess whether an organization is relevant to national security, you can look at the data it holds and ask: Could it be of interest to intelligence services in other countries? Could China or Russia be interested in what the organization is doing? Is the data useful? Could the information be used to damage or sabotage something, either digitally or physically? Could information in the wrong hands be used to influence important decision-making processes? From this perspective, many organizations need to address digital security to an even greater extent than before. They cannot only consider criminal actors a threat, but also states that PST defines as high-risk countries. That means Russia, China, Iran, and North Korea, says Moe.

She adds that awareness of cybersecurity increased significantly after Russia’s full-scale invasion of Ukraine and the first Nord Stream incident.

– That was when many realized that they also need to protect themselves against state actors like these, Moe says.

– How do you work with Sicra on cybersecurity? Who does what?

– Cybersecurity is handled best when the legal, strategic, operational, and technical aspects work hand in hand. We make sure that organizations comply with the law and have the right agreements in place. We provide the legal assistance, while Sicra handles the operational and technical aspects. We try to be practical and risk-based. We are very focused on not taking too broad an approach, but instead addressing what actually needs to be done. Security work should be as simple as possible and precise enough to meet the organization’s needs. You need to spend enough resources on security, but not too many, says Moe.

Two areas of expertise – cyber due diligence

Where Thommessen handles the legal aspects and provides strategic advice, Sicra ensures that the operational and technical elements are in place. In practice, this means that Sicra’s experts carry out what can be described as cyber due diligence: a systematic review of the organization’s digital infrastructure, data flows, and vulnerabilities. Who has access to which data? Where is sensitive information stored? Which systems are exposed to the outside world? Correspondingly, Thommessen assesses whether agreements, procedures, and so on comply with the applicable regulations. Strategically, Thommessen also advises, for example, on how an organization’s management should respond to the current threat landscape and expectations that it contributes to protecting national security.

The review is essential because good security requires an understanding of what needs to be protected. Sicra knows the data, systems, and networks, and knows which measures actually reduce risk for the specific organization. It is this knowledge that allows the legal requirements identified by Thommessen to be translated into concrete technical solutions.

The result is that the organization gets two expert environments working from different directions toward the same goal: ensuring that legal requirements are met, data is protected, and the organization is prepared to withstand a cyberattack.

The future of cybersecurity: More regulation and three AI challenges

Looking ahead, Moe predicts that legislation concerning digital security will only become more extensive. NIS2, the EU directive on digital security, has entered into force in Europe and will be implemented in Norway. The CER Directive will likely extend the requirements further to more organizations than those currently subject to the Norwegian Security Act.

At the same time, Moe highlights three challenges related to artificial intelligence (AI):

1. Digital sovereignty. Do organizations have control over their AI services? What happens if, or rather when, export controls or geopolitical tensions cut off access to the organization’s AI services? Dependence on AI in core processes without a plan B is a new and underestimated vulnerability. Does the organization have the resources and expertise required to replace the AI services it depends on?
2. Internal use of AI. Employees are already sending sensitive data into various AI tools that make processes and tasks more efficient and effective. What control does the organization have over its use of AI? Is the data secure?
3. AI is a powerful tool in cyberattacks. AI makes cyberattacks more effective, precise, and difficult to detect. This requires security efforts to keep pace, including by having AI tools built into the organization’s defenses.

– AI must become part of the organization’s overall security work. If AI is treated as a separate area, there is a real risk that it will not be handled well enough, Moe warns.

Prevention pays off – the numbers are clear

A cyberattack is costly. It takes an average of 24 days to recover from a ransomware attack. That is five working weeks. And it is expensive. According to an IBM report, a cyberattack costs an average of more than NOK 53 million. That represents a major hit to the bottom line for most medium-sized organizations. On top of that come costs related to GDPR and other regulatory violations, lost customer contracts, reputational damage, and more.

– The ripple effects of a cyberattack can be considerable. Especially today, when we have such complex value chains and opaque digital structures, says Moe.

Thommessen is often contacted by organizations that have been affected by cyberattacks. They need help complying with regulations concerning notification of authorities, customers, partners, and others.

– If you are hit by a cyberattack, it costs a lot of money. In addition to handling the attack itself, a great deal of time and resources go into dealing with agreements and contracts related to compensation and insurance. On top of that come reputational and often ethical issues. And you do not know whether information has fallen into the wrong hands or how it is being used, says Moe.

– That is why we are most concerned with the somewhat less exciting part: trying to prevent organizations from being affected in the first place. That is what we work with Sicra to achieve. More and more organizations understand this, and their willingness to invest resources and money in preventive measures is increasing, concludes Moe.