How companies can protect themselves from cyberattacks

Improve IT security with the right measures

The Allianz Risk Barometer 2021 clearly shows that the risk of cyberattacks is at the top of the list of business risks – and the trend is rising. This is because news of “successful” hacker attacks is making the rounds almost daily, and this is also increasingly affecting local companies and authorities. Whether it was the administration of the Rheingau town of Geisenheim, as in July 2021, or the district of Anhalt-Bitterfeld, the cyberattacks that took place usually serve a single purpose: extorting cyber ransom money. This raises one question above all: How can companies protect themselves effectively against this and work productively at the same time?

Digital transformation is taking place in nearly every sector and industry. Whether that’s manufacturing companies, healthcare or other core industries, without digital processes and workflows, the upcoming challenges of the 21st century will be nearly impossible to overcome. Moreover, an increasingly digital way of working offers competitive advantages that can set companies apart from the competition in the long term.

But, and this is the downside of many companies’ digital aspirations, the transformation from analog to digital is accompanied by various risks. Above all, these include opening up the entire IT infrastructure, as this is the only way to enable digital communication and data exchange. At the same time, the company’s productivity should not be unnecessarily restricted by overly restrictive security measures. This often represents an enormous balancing act for the companies themselves and the departments and employees involved individually.

And yet many companies still seem to be taking the easy way out, if one looks at the cyber incidents of recent weeks and months. They prove two things: First, the handling of possible cyberattacks is still too lax. And second, the existing technical and organizational defense mechanisms do not seem to be sufficient. In both cases, a rethink on the part of the executive boards and managing directors of many companies is a top priority. Otherwise, cyberattacks will continue to dominate the news.

The greatest cyber risks still threaten via e-mail

Even if word has already got around, the very greatest dangers are still threatened by the careless opening of harmless-seeming emails that make the recipient believe they offer added value or a reputable source. Whether it’s about protecting one’s own bank account or promising a super bargain from a frequently frequented online store – the cyber fraudsters’ bag of tricks is long and virtually inexhaustible.

The perfidious thing about it is that a simple mouse click can paralyze an entire company network by encrypting access data, employee access and valuable company data. This means that all users can no longer access their data. As in the case of attacked public authorities, this then goes so far that services such as the payment of unemployment or child benefits can no longer be provided. With all the negative side effects that this entails.

When extortion attempts result in monetary losses

Hackers are regularly successful with their extortion attempts – also known as ransomware attacks. This is because paying the often six-figure ransom sums is usually the only seemingly viable way to regain access to encrypted company data. The website ransomwhe.re impressively documents that this perfidious way of “procuring money” still works. Successful blackmail attempts are regularly published there. This is a warning to all those who still believe that cybersecurity is not an issue for them, or only a rudimentary one.

In order to disguise the identity of the blackmailers as much as possible, the ransom money is not transferred to a standard bank account of any savings bank, but via a multi-encrypted route, namely in the digital currency Bitcoin. This makes it virtually impossible to trace and recover the money.

Genuine protection of IT is made possible above all by holistic solutions

Anyone who believes that a one-time purchase of antivirus software is enough to keep the hackers of this world out of their network is unfortunately often mistaken. This is because the tools used by malware developers are at the cutting edge of technology, which means that they often know the vulnerabilities of companies much earlier than the companies themselves. Therefore, the continuous improvement of one’s own defense mechanisms is the top priority when it comes to the successful work of a company’s security officers.

This also applies to the tools used. After all, the well-known antivirus programs and similar tools have not been able to deter hacker groups like REvil and other ransomware criminals for a long time. This means that better, often even self-learning, protective measures are needed that can distinguish between a harmless email attachment and a possible ransomware attack.

We are talking about XDR solutions (eXtended Detection & Response), which are a further development of the classic EDR platforms (Endpoint Detection & Response). With XDR, not only individual components such as servers or notebooks are monitored, but the complete infrastructure, i.e., also IoT devices, cloud containers and others. In addition, these high-tech platforms increasingly rely on the power of artificial intelligence. This makes it even easier to identify and fend off potential attackers.

Eliminate known and lesser-known vulnerabilities with regular updates

Unfortunately, protecting incoming emails or monitoring network components alone is not enough. This is because new gateways regularly open up that are a welcome opportunity for hackers to penetrate the company network almost unnoticed. For example, file-sharing servers are regularly targeted by cyber extortionists. Because such a central computer, on which large amounts of data are stored, is a welcome and easy prey. But poorly programmed software such as printer drivers also harbor a considerable risk due to serious security vulnerabilities.

Such examples and others like them bring to light one important point in particular: systems will only ever function reliably if they are regularly and properly kept up to date. This is because every security gap, no matter how insignificant, is soon known to the hackers of this world and can be circumvented and exploited by them for their next cyberattack. Therefore, software updates should definitely be carried out regularly for the sake of security and also for the functionality of the respective device.

Social engineering: How people serve as a source of information for hackers

In addition to all the technical shortcomings that many corporate networks and infrastructures have, people as users also play a role in the security game that should not be underestimated. Hackers, for example, are increasingly focusing on the discipline of “social engineering”. In the age of LinkedIn and other social networks, for example, it is becoming increasingly easy to establish trust with selected individuals. This often leads to an unintentionally careless handing over of compromising data and information, which hackers use to get hold of needed access data.

Or, more simply, colleagues in the same company receive seemingly valid email messages with relevant information that results in the release of trusted data. This ultimately leads to a malware attack including an extortion attempt.

This makes it all the more important to regularly alert employees, as well as board members and other senior executives, to the potential dangers posed by their increased public profile. Training courses can help in this regard, as can the training offered by internal and external security officers.

The security approach of the future: Zero Trust

It is precisely the spying on relevant employees of a company via social networks or other channels that is moving more and more companies to think about completely new security concepts. The most interesting of these is called “Zero Trust.” As the name implies, this still fairly new security approach assumes that no user or device is inherently trusted anymore. This requires new control mechanisms that, for example, grant an employee guaranteed access to certain data and resources as soon as he or she wants to access them. A complete analysis of all IT relationships and the associated communication paths is important in advance. Only then can it be determined exactly who is allowed to access which devices and data – and who is not.

More security with the right tools and aids

In addition to the XDR solutions from major security providers such as Trend Micro, Cisco, SentinelOne and others mentioned above, as well as regular training for relevant employees and senior managers, there are other tools and aids that companies can use to equip themselves to defend against cyber attacks. These include:

• Proven BYOD(Bring Your Own Device) solutions such as Samsung Knox for protecting mobile devices of all kinds and JAMF for the secure use of Apple devices.
• Holistic security solutions for Industry 4.0 applications such as SIEM (Security Information and Event Management). This enables the best possible and fully integrated monitoring and protection of company IT with operational infrastructure such as warehouses and production facilities.
• Authentication solutions such as YubiKey for passwordless logon to devices and applications. More information on YubiKey is available in a guide in Reichelt Magazine.

Conclusion: put your security measures to the test

If the current security situation shows one thing, it’s that nothing seems secure anymore. Therefore, companies are urgently called upon to completely check the status quo of their security measures or have them checked. After all, simple anti-virus software packages or careful observation of suspicious e-mails are no longer enough. For example, hacker groups such as ATP39 and other dangerous organizations are often one step ahead of even the most experienced security solution providers. Therefore, the recommendation can only be: Think holistically and multi-layered and best get support from security experts who know their concerns and hardships.

Images: Adobe Stock (432901513, 33247978)