La cybersécurité pour les entrepreneurs en 5 points

The days when a business could be protected only by a security service and entrance controls are long gone. The sense of security provided by these physical security measures is more dangerous than it first appears. They provide a sense of control and are sometimes the source of reluctance to invest in cybersecurity. Yet cybersecurity is becoming an increasingly important challenge for entrepreneurs.

More points of attack thanks to increasing digitization

The increasing digitization in all areas and sectors of the company leads, and not only since the Corona pandemic, to an ever larger attack surface for criminal hackers.

Applications are transferred to the cloud, employees work from home and almost every device with an electrical outlet wants access to our Wi-Fi network. Interconnecting all services not only simplifies our lives, it also facilitates the work of a hacker. The more services and applications we make available outside the company, the more the attack surface increases.

Where businesses were once siloed and protected by a physical wall, today almost all, without exception, are connected in some way to the Internet. Not only that, but more and more external service providers, such as contractors, are directly integrated into the company’s network and processes so that they can work even faster and more efficiently. This makes it all the more difficult to comply with and monitor security measures.

It is therefore not surprising that the advance of digitalization also leads to the professionalization of attackers. And that’s not all. Thanks to the large and lucrative attack surface, a clean shadow economy has developed, providing work that is certainly illegal, but of high quality. These criminals offer their professional services on the Dark Net, such as malware as a service and customer hotlines that help a company obtain the cryptocurrency it needs.

A comprehensive approach is essential

A comprehensive approach is needed to deal with new dangers. All aspects should be considered in order to find a comprehensive approach to cybersecurity. If one focuses too much on a single measure during implementation, the other measures are quickly abandoned and, while the front door is barricaded, the door to the backyard is thrown wide open.

Successful cybersecurity deals with the technical and organizational protection of information and data in the company. Technical protection includes, for example, the introduction of firewalls and other security systems. It’s sort of the digital equivalent of a security lock and fence. Organizationally, the company is protected by guidelines, trained employees and secure processes. However, these organizational measures are generally relegated to the background. Whether for cost reasons or on the assumption that you yourself will not be attacked.

However, this assumption is fatal. The recent past shows that the attacks no longer only target very large companies. Due to the automation of attacks and the widespread distribution of infected documents, small and medium-sized businesses are also increasingly affected. The wide distribution and easy access to attack tools of all kinds means that some groups are content with quite modest ransom demands, which nevertheless leaves enormous harm to the companies involved.

Don’t leave employees behind

If we consider cybersecurity as a global concept, the employees of the company should not be left out. They are often the first defense against an impending cyber attack, making them a central element of cybersecurity.

Well-trained and vigilant employees can detect and counter a cyber-attack at an early stage. The importance of this point and the fact that it is often overlooked shows the increasing number of attacks by falsified communication ( phishing ). This phenomenon continues to increase due to the wide distribution of employees in home offices.

Protection against cyberattacks has a cost

Just like protecting against physical attacks on the business, protecting against digital attacks on the business also costs resources. But if we compare the costs of an effective cybersecurity strategy to the costs of an actual attack, these are rather low. It’s usually just an expensive attack.

Attacking a business with an encryption Trojan ( ransomware ) entails higher costs than is generally thought. Often, the entire infrastructure must be rebuilt to eliminate attack artifacts in the system. After an attack, most companies are ready to invest more in their cybersecurity. However, it would be better to make these investments before the first attack.

Cybersecurity is not a one-time investment

When we talk about cybersecurity concepts, we often forget that this project or this test is not a one-time investment. Cybersecurity is a dynamic process. Just as the digital attack surface of enterprises changes regularly, cybersecurity must react in a dynamic and agile way. So processes and guidelines change just as technical systems receive updates.

If you forget to update a system, new vulnerabilities are quickly opened up to hackers. If one forgets to update the cybersecurity process, the business is just as vulnerable as if the firewall had last been maintained ten years ago.

Cybersecurity explained to entrepreneurs in five points

1. Increasing digitization also leads to more and more professional cyber attacks.
2. Successful cybersecurity requires a comprehensive approach, from concept to implementation.
3. Successful cybersecurity costs time and money and is not a one-time investment.
4. Staff training and awareness as well as organizational security measures are just as important as technical measures.
5. Cybersecurity is the boss’s business and must be addressed and implemented at all levels, down.

Benjamin Greis

Benjamin Greis is CEO & Co-Founder of RedFox InfoSec, a cyber security consultantcy located in Constance, Germany. With his start-up team, he helps small and medium-sized enterprises to set up and manage their IT security effectively and efficiently. His main goal is to leave no one behind when it comes to cyber security in times of increasing digitalization. A key aspect of this is a close contact with all relevant parties.