Informations- och cybersäkerhet : En analys av nationella policys och lärosätens styrdokument

Sammanfattning

The number of cyberattacks against government agencies and the public sector has increased significantly with the digital development of society. That includes increased digital dependence and a changed security policy situation. With this context, cybersecurity and information security have become central issues for the Swedish public administration, including the education sector. The purpose of this study is to analyze how information and cybersecurity have been problematized in Swedish national policy documents and policy documents at Swedish universities. The aim of this thesis is to increase the understanding of policy documents and their impact on public administration. The study is theoretically grounded in Carol Lee Bacchi's approach “What's the Problem Represented to be”? (WPR). Through a qualitative policy analysis and document analysis, the study aims to critically examine and problematize the articulated conception of information and cybersecurity in policy documents, such as national strategies, regulations and legislation. As well as the internal governing documents of public sector universities. The study seeks to highlight assumptions, representations and priorities which shape the structure of policy documents. Through the WPR approach, the thesis aims to identify problem representations, narratives and underlying assumptions in policy documents. The results of the study show three main problem representations. The first is inadequate governance, which involves unclear definition and distribution of information security roles as well as responsibilities within the organisation. The second concerns insufficient competence in information and cybersecurity and its impact on the effectiveness of information security management. Lastly, the third involves inadequate security controls and protective measures against cyberattack including information manipulation. These three problem representations affect the implementation of effective security controls to address risks such as cyberattacks, among the perception and understanding of information and cybersecurity within the public sector. This is a two-year master’s thesis in Archival Science/Library and Information Science/Museum and Cultural Heritage Studies.