An introduction to Swedish Police cybersecurity

Johan Bencker

SOC Manager

Swedish Police

Suresh Ramasuppu

Senior Cyber Security Specialist

Swedish Police

The Swedish Police Authority’s cybersecurity strategy has three main properties – mitigate, detect and respond. To increase visibility, reduce time from detection to response and improve their threat hunting capability they built an Elasticsearch cluster with load balancing and message queueing layers. They are now able to search raw log data for threat hunting, build advanced detection rules and apply machine learning to improve anomaly detection — increasing their capacity to receive events per second (EPS) by tenfold.