THIS CONTENT IS BROUGHT TO YOU BY NTNU Norwegian University of Science and Technology - read more
Why practicing how to respond to cyberattacks is more important than ever
A cyberattack on local government authorities can result in disruption to critical services such as healthcare, water supply, schools, and social services.
When employees in Østre Toten Municipality turned on their computers on 9 January 2021, they were met with a digital blackout.
Systems were down, data had been encrypted, and the municipality was effectively paralysed. Ransomware had crippled everything from medical records to payrolls and schools.
The chaos that followed revealed just how vulnerable the Norwegian municipal sector is when cyberattacks strike.
The attack served as an important reminder that all municipalities need to conduct cybersecurity exercises. These make employees better prepared, uncover vulnerabilities, and ensure that critical services can continue operating when a crisis strikes.
Half of Norway is unprepared
Norwegian municipalities play a key role in many of the services Norwegians use every day. Schools, healthcare, snow clearing, street cleaning, kindergartens, water supply, and elderly care are just a few examples.
At the same time, half of Norway’s municipalities report that they lack critical expertise in information security.
Researchers at NTNU have developed a new set of exercises to improve municipal preparedness.
“A digital crisis is never just about systems going down. It's about culture, roles, responsibilities, communication, and priorities,” says researcher Guro Bråten Olsborg.
Olsborg is one of the people behind a new study showing that municipalities learn the most from what researchers call sociotechnical exercises. These are exercises that put not only IT systems under pressure, but the entire organisation.
Having one of the best firewalls is not much help if people do not know who is in charge of what when a crisis hits.
What happened during cybersecurity training?
The researchers interviewed employees from four municipalities one year after they had participated in a realistic cybersecurity exercise at the Norwegian Cyber Range.
They wanted to find out what the participants gained over time, not just the day after.
The results were clear:
The municipalities had improved their routines by identifying what was lacking and adjusting their plans accordingly.
They also changed their work practices, and employees became more aware of who was responsible for what.
Many gained a whole new understanding of how their own work affects security. Some organisational structures were actually reorganised.
“We thought we knew what was important"
Two of the municipalities introduced new roles to ensure better coordination between IT and crisis management.
“We thought we knew what was important. But actually we didn’t,” says one of the study participants.
One of the clearest findings of the study is that the municipalities gained a more realistic understanding of which systems are actually critical.
Many people were surprised, because when they had to decide during an exercise which services should be restored first, the priorities became clear.
Is education, healthcare, or water supply at the top of the list? The consequences for residents quickly become apparent.
This leads to better prioritisation and more effective measures.
Why the exercises work
The study highlights several reasons why these kinds of exercises foster lasting learning.
The realistic pressure forces participants to act rather than simply discuss their way towards solutions.
Planned breaks along the way allow time for reflection and adjustment as the situation unfolds.
In addition, participants are taken completely out of their everyday working environment, contributing to stronger and more memorable learning experiences.
“When everything is happening around you in real time and you feel the pressure, the learning experience becomes more authentic,” says Olsborg.
The difference between control and chaos
Sociotechnical exercises point to a clear direction for municipalities all over Norway.
They provide a more realistic picture of how a digital crisis actually unfolds – not on paper, but in practice.
In these exercises, municipalities practise coordination, communication, and making tough decisions, while also experiencing the pace of cyber incidents, which often last for weeks.
“The exercises not only lead to better procedures, but also to a shift in mindset and a clearer understanding of responsibilities and organisation,” says Olsborg.
When cyber threats can force a municipality to revert back to using pen, paper, and fax machines overnight, as Østre Toten experienced, it is this shared understanding that can make all the difference between control and chaos.
Reference:
Olsborg et al. An empirical study of socio-technical information security exercises as a tool to foster organizational learning and information security readiness development in Norwegian municipalities, The 11th International Workshop on Socio-Technical Perspectives in IS (STPIS’25), 2025.
———
Read the Norwegian version of this article on forskning.no
More content from NTNU:
-
Flash flood in Nepal: Researchers are now investigating the role of climate change
-
Nylon masks can threaten your digital security
-
AI helps doctors detect intestinal disease
-
Why making lighter and better batteries takes time
-
Professor: Why we should expect cyberattacks during major events
-
Migraines leave traces throughout the body that researchers can now detect
