Norwegian Labour and Welfare Administration (NAV) has over the past few years been through an extensive digital transformation journey that fundamentally changed who develop and deliver digital services and has influenced everything to how we work to the technology decisions we make. This journey will continue and we must adapt our approach to security accordingly.

As our attack surfaces grows with every new service, and our supply chain is growing longer and longer the threat landscape is becoming more and more complex. We experience an increase of digital threats and they can not be handled only by those who are operating the applications. Digital security concerns all roles and has to be implemented across the organization.

In this presentation we will shed some light on how NAV systematically works to enhance it's digital security from the very start of how the organization is structured with Security Champions in all teams, to planning/design/implementation of new systems, to how we secure the runtime and infrastructure that powers it all and how we proactively prevent and train on security related events.