Ralph Noll, Partner Cyber Risk at Deloitte Germany, Paul Sester, Information Security Manager at HORNBACH Baumarkt AG and Marc Wilczek, Managing Director at IT security service provider Link11, spoke in a digital panel discussion about IT security from networked value chains. Daniel Wolfinger from the Central Cybercrime Contact Point at the LKA Rhineland-Palatinate also had the opportunity to speak about the attackers, their motives and their approach. The discussion was moderated by Daniel Schleidt, business editor at the Frankfurter Allgemeine Zeitung.
How digitization is redefining value creation
Until a few years ago, real estate, production facilities and the vehicle fleet were almost exclusively included in a company’s balance sheet as material assets. With the advancement of digitization, the value of companies is increasingly measured in terms of goods that are physically intangible: this can be data, digital know-how and networking or online services is how Ralph Noll describes the development. These factors all contribute significantly to added value in the company and thus represent digital company values. The generation and processing of data in particular is becoming increasingly important. Data is no longer exchanged between people and machines alone; the flow of data has expanded to include machine-to-machine communication. This is already standard in the area of networked production, telematics and the Internet of Things. Ralph Noll calls it “Connected everything”. Data streams are also increasingly flowing beyond the boundaries of the company network: into the cloud, to service providers, to partners and suppliers. And this is exactly where the problem lies: the further the data flows out of the company, the more it is beyond the company’s sphere of influence, the more external risks can stop the data streams and bring the business processes to a standstill.
Cyber attackers are targeting digital assets
Cyber threats, i.e. attacks from the Internet, are one of the greatest risks for companies and their digital value chains. Well-organized and increasingly professional perpetrators are particularly at risk, reports Daniel Wolfinger, who is in contact with the attacked companies and administrations on the part of the investigative authorities. The perpetrators look specifically to see if companies can be blackmailed, where business processes can be disrupted and data stolen. In addition to ransomware, DDoS attacks should be mentioned in particular. Like almost no other form of attack, they bring the data streams to a standstill and stop all business operations. That can go to the existence of a company. For Marc Wilczek it is therefore not surprising that DDoS attacks are currently experiencing a boom in view of this destructive potential: within two years the number of attacks has grown by around 150 percent. The development curve also points steeply upwards in terms of the clout and complexity of the attacks. Attacks of several 100 Gbps and large-scale attack waves that quickly add up to the terabit range are now the norm, says Marc Wilczek.
Dynamic instead of static: managing cyber security in the company and with partners
To ensure that everything remains in the flow of data in the face of these threats, companies must face the risks and take measures to manage risk and strengthen IT security. The hardware store chain HORNBACH has taken this route, which sees IT security as an ongoing task that has to be refined over and over again. With the 2020 lockdowns during the corona pandemic, the business importance of the web shop grew suddenly. The protection requirements in the area of DDoS, for example, have been adjusted accordingly, Paul Sester cites as an example. The company takes ensuring business continuity very seriously and protects itself against a large number of attack vectors that could be dangerous for the company’s business operations. It also applies the high requirements for IT security to its partners and demands, for example, certifications according to ISO or TISAX (Trusted Information Security Assessment Exchange) or specifies the IT security standards contractually. At HORNBACH, however, they are also aware of the limitations, for example when working with large international cloud providers who do not allow their general terms and conditions to be negotiated.
The most important building blocks for protecting against cyber risks
But where do you start with safeguarding digital value chains if you have not yet dealt with it in depth? In principle, every company is well advised to determine its own critical assets as a first step. According to Marc Wilczek, one should orient oneself on the question of where the impact of a successful attack would be greatest. Once the weak points have been identified, appropriate protective measures can be taken in a second step. Ralph Noll, who believes prevention is the best way to go, also sees it that way. He also recommends regular exercises, such as those that are mandatory for fire protection. He hopes that regulations familiar from the finance and automotive sectors will also find application in other industries. Paul Sester makes it clear that information security is a continuous process that is not limited to technical protection. Training and raising the awareness of managers and employees across all departments, for example as part of awareness campaigns, should also be tackled. Because one thing is certain: Cyber threats will no longer disappear from the Internet. According to Daniel Wolfinger, damaging and blackmailing companies is simply too lucrative for cyber criminals. From the point of view of the perpetrators, the income generated by successful attacks by far justifies the risk.