Interview on the subject of IT protection for companies 

Where do you see the greatest dangers in the topic of security in data management? 

“I see the great­est dan­ger in the fact that man­age­ment and employ­ees still assume that secu­ri­ty pro­grams installed once and a one-time note on the sub­ject of han­dling e‑mails will suf­fice for­ev­er to ensure that data, IT infra­struc­tures and doc­u­ments are secure with­in the com­pa­ny. But that’s not true. Every­one knows that their smart­phone needs an update every few months. And that’s very impor­tant to all of us to keep our per­son­al data pro­tect­ed. I don’t under­stand why com­pa­nies that han­dle third-par­ty data still look the oth­er way so often. And this isn’t just about out­side dan­gers, there are dan­gers lurk­ing inside as well.” 

What do you mean? 

“Well, data does­n’t just need to be secure when it’s trans­mit­ted, it also needs to be secure when it’s man­aged. Unmain­tained and out­dat­ed servers or IT infra­struc­tures that have grown in an unor­ga­nized man­ner not only pose func­tion­al prob­lems in issues such as syn­chro­niza­tion, log­ging and com­pli­ance, but also in terms of sys­tem sta­bil­i­ty. Unfor­tu­nate­ly, some com­pa­nies do not react until the worst has already hap­pened, i.e. the inci­dent has already occurred and the sys­tems have collapsed.

I can’t under­stand this, because much high­er finan­cial loss­es are to be expect­ed here than if infra­struc­tures and secu­ri­ty are con­tin­u­ous­ly main­tained. Because in addi­tion to hav­ing to res­cue the entire sys­tem in such a case, not to men­tion the data, the com­pa­ny is par­a­lyzed and no work can be done. After all, in some indus­tries, just a few min­utes of down­time can mean mil­lions of dol­lars in lost rev­enue — not to men­tion image problems.” 

So is it enough to keep the infrastructure up to date to guarantee security? 

“No, that alone is not enough. IT secu­ri­ty is always a com­bi­na­tion of tech­nol­o­gy and man­u­al atten­tion. The best secu­ri­ty sys­tem is of no use if the spam email is clicked on any­way. How­ev­er, wise­ly timed secu­ri­ty patch­es, for exam­ple, help pro­tect against new types of virus­es, Tro­jans and oth­er hack­ing methods.” 

So how can you tell when a security update is necessary? 

“Unfor­tu­nate­ly, you can’t give a blan­ket answer to this ques­tion. Because the world of hack­ers is act­ing ever faster and more sophis­ti­cat­ed. It is not easy for peo­ple who are not famil­iar with IT to assess when a mea­sure should be tak­en. How­ev­er, hir­ing an exter­nal ser­vice provider to take care of such mon­i­tor­ing costs lit­tle on aver­age each month, if you think about it: One inci­dent in a medi­um-sized com­pa­ny can com­plete­ly endan­ger its exis­tence and that of its employ­ees. Exter­nal ser­vice providers offer a 24-hour ser­vice with appro­pri­ate mon­i­tor­ing, i.e. the sys­tems are mon­i­tored with spe­cial­ized tech­nol­o­gy and com­pe­tent know-how. Adjust­ments always take place in con­sid­er­a­tion of the cur­rent DSGVO stan­dards and tech­niques. IT secu­ri­ty is a tool­box that can only be han­dled prop­er­ly by pro­fes­sion­al providers.” 

You mentioned “manual attention” before, what do you mean by that? 

“Well, this con­cerns man­age­ment lev­els and employ­ees in a com­pa­ny — in oth­er words, peo­ple. Basi­cal­ly, they should know about cur­rent dan­gers and be able to rec­og­nize them con­crete­ly. For exam­ple, we offer a spe­cial train­ing and test­ing pro­gram called Aware­ness Plus. Par­tic­i­pants are giv­en an overview of what fake mail tem­plates can look like — indus­try-spe­cif­ic. Be it for pub­lic author­i­ties, med­ical prac­tices and clin­ics or con­sumer goods man­u­fac­tur­ers. The types of pre­sen­ta­tion dif­fer great­ly here. In addi­tion, as part of Aware­ness Plus, we ana­lyze sen­si­tive areas with­in a com­pa­ny where there may be a need for addi­tion­al train­ing, and then pro­vide sup­port here as well.

With the pro­gram, we make employ­ees and man­age­ment lev­els aware of the lat­est forms of fish­ing e‑mails, trends and devel­op­ments in cyber­crime, so that they can keep a watch­ful eye on data man­age­ment in their day-to-day work. This impor­tant build­ing block in IT secu­ri­ty makes sense and is afford­able for every com­pa­ny. Here we’re talk­ing about a com­mit­ment of five euros per user per month com­pared to the finan­cial dam­age if an inci­dent occurs or data is stolen.” 

Do you have another SOS tip on what to do in the event of a hack? 

“Turn­ing off the com­put­er or unplug­ging it is one option, but it does­n’t help. Unfor­tu­nate­ly, this is often a knee-jerk reac­tion by users in the hope that noth­ing else will hap­pen. But the Tro­jan or worm eats its way through the sys­tem at the back end. The fatal thing: In this case, it is not pos­si­ble for us to trace the course of the inci­dent at a glance. How­ev­er, this would be nec­es­sary to find the vul­ner­a­bil­i­ty. Instead of sim­ply switch­ing off, please take your cur­rent IT emer­gency plan to hand and pro­ceed accord­ing to these pro­ce­dures. The most effec­tive and quick­est action here is tak­en by an expe­ri­enced pro­fes­sion­al, because he knows every move that is nec­es­sary at such a moment off the top of his head.”