Deutsch
Three quarters of all German companies were victims of cyber attacks on their IT systems last year. What are the current threats to your company network and what can you do about them?
Company networks play a central role in today’s companies. A lot of damage can be done very quickly – whether due to cyber attacks or the theft of sensitive data. Almost no company was unaffected by this in recent years. In a survey by the German Bitkom Association about IT security in companies, around 75 per cent of respondents admitted to being affected by data theft, industrial espionage or sabotage – at least once in the last 12 months. Another 13 per cent believe they were “probably affected”. Verifiable damage was experienced by 70 per cent of the companies responding to the survey.
Attacks on companies
The most common attack vectors are attacks on passwords, malware infections, phishing attempts, exploiting vulnerabilities in the software used, DDoS attacks (Distributed Denial-of-Service), man-in-the-middle attacks and spoofing. Here attackers primarily focus on communication systems, such as e-mails, but also on financial data, staff and customers, market analyses and patents. According to Bitkom, the total damage due to attacks on companies in Germany runs to more than 100 billion euros annually.
Findings by the Bitkom Association show that internal security measures play the largest role in defending against these types of cyber attacks. 54 per cent of the survey respondents said that it was their own security systems which first alerted them to malicious activities. Information provided by their own staff and the use of internal detection teams were also helpful. Nevertheless, many companies believe their situation in the future will be difficult. 82 per cent assume that the number of cyber attacks on their company will continue to increase.
Which threats are most significant in 2021?
From an IT security point of view, last year went out with a bang. Unknown attackers succeeded in penetrating the IT systems at SolarWinds and manipulating the update server. The company is specialised in solutions for managing and monitoring networks. The software is used by companies and government authorities throughout the world. The patches delivered by the server contained malicious code enabling the attackers to steal data, install backdoors and to embed themselves more deeply in the user’s IT environment.
The results of an investigation into the SolarWinds hack, launched by US President Joe Biden, are yet to come. But the effects on companies and the protection of their company networks are already huge today. At last it became clear that companies believing themselves to be too insignificant, too unknown or too small could still become the target of a cyber attack – just because they are part of a supply chain. Thorsten Krüger, from Thales, the French technology concern, warns that the extent and the sophistication behind the attacks are alarming and bode ill for the future. He says companies should therefore also pay attention to how their supply chains – from software development through to the actual delivery processes themselves – are organised in terms of IT security.
In addition to attacks on the supply chain, company networks are exposed to many other types of threat. On behalf of Trend Micro, the IT security company, the Ponemon Institute uses its Cyber Risk Index (CRI) to provide an overview. This value is based on a numerical scale of -10 to +10, where -10 represents the highest level of risk. At the end of 2020 the global CRI was -0.41, corresponding to an elevated level of risk.
The companies surveyed by the Ponemon Institute named the following cyber threats most frequently:
- Phishing and social engineering
- Clickjacking
- Ransomware
- Fileless attacks
- Botnets
- Man-in-the-Middle attacks
Respondents to the survey worried most about the following negative effects of the cyber attacks:
- Loss of customer data
- Unauthorised access to their intellectual property and financial data
- Loss of customers
- Stolen or damaged systems and equipment
The largest security risks in IT infrastructure are:
- Poor organisational structure and excessive complexity
- Negligent staff
- Security vulnerabilities in the cloud computer infrastructure used
- Lack of qualified personnel
- Attacks by insiders
At the end of last year, the CRI for Germany was 1.02. This value corresponds to a moderate risk. However, the index for Europe as a whole was -0.13, an elevated level of risk. Globally, the USA is at the greatest risk of cyber attacks, with a value of -1.07. Individual companies can also calculate their CIS. Trend Micro has developed a free, easy-to-use CIS calculator.
Network Security in Germany
“When compared internationally, German companies are well prepared to deal with cyber attacks and data losses,” said Richard Werner, a business consultant at Trend Micro. Their relatively good situation is in part due to the strict requirements resulting from the General Data Protection Regulation and IT security legislation. “The numbers also show that the risk of cyber attacks continues to be large, and attackers regularly succeed in penetrating systems,” continues Werner. Among other things, the security experts advise companies to invest in systems for detecting and combating attacks (detection and response). In a series of blog articles over the coming weeks and months, we’ll be looking at which solutions and products manufacturers such as Juniper Networks, Cisco, Fortinet and Palo Alto Networks offer for increasing the security of your network.
Questions?
Just ask!
I am Robert Kamm from the HCD sales team. I will be happy to advise you or assist you with any questions. You can phone me on +49 89 215 36 92-0 or reach me using our contact form.
Contact us