Summary

  • Lindeberg says old failure statistics are a poor guide when an attacker deliberately picks a target and its weakest dependency.
  • His practical test is blunt: identify the service that matters, disconnect real dependencies, and see whether it survives.

At RIPE 93 in Sofia, Netnod Chief Information Security Officer Fredrik Lindeberg gave resilience planning an uncomfortably physical test: unplug half the nodes. A backup diagram can look immaculate while nobody knows whether the remaining system can carry the service.

That gap matters because random failure and deliberate targeting are different problems. Historical rates can help estimate when a component might fail by chance. An adversary studies the system, chooses a target and looks for the weak point. Lindeberg’s “100%” formulation describes the chance that an actor with intent will try; it is not a claim that an attack will succeed. When a threat is selected rather than drawn from a random sample, last year’s quiet statistics stop being a comfortable excuse.

Sweden’s Security Service says cyberattacks target public and private entities, while attack methods keep changing and becoming more accessible. That is the backdrop for Lindeberg’s argument, not a prediction that any named network will be hit. His warning is operational: digital dependencies now sit inside physical services. A building door, a car, a hospital system or a phone call can depend on a remote service that its operator does not control.

Lindeberg has spent his career around those seams. Netnod’s profile says he manages the information-security system for its services and products. Before joining in 2021, he worked on systems integration and replacing dedicated communications networks in financial services; he also holds degrees in computer science and industrial engineering. He is not treating resilience as a policy document. He is asking whether the service survives when a component disappears.

The calendar is part of the design. In a conventional emergency, organizations may expect a warning period in which to add staff, capacity or equipment. Lindeberg says digital infrastructure may face pressure during “peacetime” and offers no reliable window to lay new fibre or install spare servers after escalation. If an extra path or server is part of the continuity plan, it has to exist before the alarm.

So start with the service, not the spreadsheet. What do customers expect to keep working, and for how long? Which people, suppliers, power feeds, fibre routes, hardware and control systems make that possible? Lindeberg recommends a controlled failure exercise: disconnect a dependency, reboot a server, or remove part of the node set. Then check the service itself. A written promise of redundancy is not a test result.

His official talk transcript describes the method, not a measured Netnod drill or a quantified incident. The evidence supports the argument and its proposed test; it supplies no pass rate.

The same distinction runs through compliance. The US Department of Justice’s corporate-compliance guidance asks whether a programme is well designed, adequately resourced and effective in practice. Lindeberg’s point is that operational survival needs the last question in the machine room: when a dependency vanishes, does the service still do its job?

The answer also reaches beyond one operator. A peer going offline can change the conditions for its neighbours, so Lindeberg urges organizations to rehearse together. Confidentiality and availability can pull architecture in different directions: many independent nodes can help availability, while tighter control may favour fewer nodes. Security, operations and service owners have to name that trade-off before an outage names it for them.

The RIPE 93 talk page and its official transcript, Netnod biography, Swedish Security Service assessment and DOJ guidance supply the source record.