Cyber security for entrepreneurs in 5 steps

The days when a company could be protected solely by a security service and entry controls are long gone. The perceived security that such physical security measures exude harbors more dangers than are visible at first glance. They give one the feeling of control and are sometimes the reason why people are so reluctant to invest in cyber security. Yet cyber security is becoming an increasingly important challenge for entrepreneurs.

More points of attack due to advancing digitization

The advancing digitalization in all corporate sectors and industries has led to an ever larger attack surface for criminal attackers, and not just since the Corona pandemic.

Applications are being outsourced to the cloud, employees are working from their home offices, and almost every device with a power plug wants access to our wi-fi. The networking of all services with each other not only simplifies our lives, it also makes a hacker’s job easier. The more services and applications we make available outside the company, the larger the attack surface becomes.

Whereas companies used to be isolated and behind a physically well-protected wall, today almost without exception all companies are connected to the Internet in one way or another. Not only that, but more and more external service providers, such as suppliers, are being integrated directly into the company’s network and processes in order to work even faster and more efficiently. This makes compliance and control of security measures all the more difficult.

So it is not surprising that advancing digitization has also led to attackers becoming more professional. And not only that. Due to the large and lucrative attack surface, a parallel economy of its own has developed that delivers illegal but high-quality work. These criminals offer their professional services on the dark net, such as malware-as-a-service and customer hotlines that help a company get the cryptocurrency it needs.

A holistic approach is essential

A comprehensive concept is needed to face the new threats. All sides should be considered in order to find a holistic approach to cyber security. If you concentrate too much on one single measure, other measures will quickly fall by the wayside and while you barricade the front door, the door to the backyard is wide open.

Successful cyber security deals with the technical and organizational protection of information and data in the company. Technical protection includes, for example, the introduction of firewalls and other security systems. Quasi the digital equivalent of a security lock and a fence. Organizationally, the company is protected by policies, trained employees and secure processes. However, these organizational measures are usually pushed to the back. Be it for cost reasons or the assumption that you yourself will not be attacked.

But this assumption is fatal. The recent past shows that it is no longer just the very large companies that are the target of attacks. Due to the automation of attacks and the wide distribution of infected documents, small companies and medium-sized businesses are also being hit time and again. The widespread distribution and easy access to attack tools of all kinds ensures that some groups are also satisfied with quite low ransom demands, which nevertheless leaves an enormous damage to the affected companies.

Do not leave employees out

When considering cyber security as a comprehensive concept, the company’s employees must not be left out. They are often the first line of defense against an imminent cyber attack, which makes them a central element of cyber security.

Well-trained and vigilant employees can detect and defend against a cyber attack at an early stage. How important this point is and that it is often neglected is shown by the increasing number of attacks with forged communication (phishing). This continues to increase due to the wide distribution of employees in the home office.

Read also: Cybersecurity in home office times: 5 tips for secure network(s)

Protection against cyber attacks costs

Like protection against physical attacks on the company, protection against digital attacks on the company also costs resources. But if you compare the costs of a functioning cyber security strategy with the costs of an actual attack, they are rather low. It usually only becomes expensive when an attack occurs.

An attack by encryption Trojans (ransomware) on a company involves more costs than is usually assumed. Often, the entire infrastructure must be rebuilt to eliminate artifacts of the attack in the system. After an attack, most companies are willing to invest more in their cyber security. However, it would be better to make these investments before the first attack.

Cyber security is not a one-time investment

When people talk about cyber security concepts, they tend to forget that this one project, this one test is not a one-time thing. Cyber security is a dynamic process. Just as the digital attack surface of companies changes regularly, cyber security must also react dynamically and agilely. As a result, processes and policies change just as technical systems get updates.

If you forget to update a system, new gaps are quickly open to attackers. If you forget to update the cyber security process, then the company is just as vulnerable as if the firewall was last maintained ten years ago.

Cyber security for entrepreneurs explained in 5 points:

1. Advancing digitalization also ensures more and more professional cyber attacks.
2. Successful cyber security requires a holistic approach from concept to implementation.
3. Successful cyber security costs time, money and is not a one-time investment.
4. Employee training and awareness and organizational security measures are just as important as technical measures.
5. Cyber security is a matter for the boss and must be addressed and implemented at every level down.

Benjamin Greis

Benjamin Greis is CEO & Co-Founder of RedFox InfoSec, a cyber security consultantcy located in Constance, Germany. With his start-up team, he helps small and medium-sized enterprises to set up and manage their IT security effectively and efficiently. His main goal is to leave no one behind when it comes to cyber security in times of increasing digitalization. A key aspect of this is a close contact with all relevant parties.