Cybercrime on the road to success

Why are there actually so many successful cyberattacks?

Have you ever asked yourself this question?Today, German companies are investing more than ever in IT security products and yet there are more and more successful cyberattacks with higher losses than just a few years ago.Yes, one reason for this could be that significantly more attacks are being reported and prosecuted. The new legal situation, such as the GDPR, the IT Security Act, etc., favours this point.

But still, that can't be everything, can it? No, it isn't either. There are still far too many companies that rely on decades-old guiding principles such as the security triad: firewall - email gateway - endpoint security.But dear readers, I'm sorry to tell you that this is no longer enough!There is never just one reason why companies can be exposed to a cyberattack. Over the coming weeks, I'll be explaining the different layers of the attack surface. Let's begin:

Mistaken risk assessment

One of the most important reasons for successful attacks is that companies incur an IT security debt that must be paid in the event of a major incident. This usually costs not only money, but above all reputation and even more dramatically business partners and customers!

Have you ever thought: "Actually, we're in a great position!"And now I ask you to ask yourself, when you last carried out a risk assessment. If you can't find an answer, then unfortunately it was too long ago. Because since then, and I can assure you of this, both the attackers' methods and their forms of attack have changed drastically and become more automated.

I know, comparisons are always a bit of a limp. But they are so beautifully illustrative, so I would like to present a comparison to you:

If you think about your flat or your house, you would probably never think,

combining a security door at the entrance with a curtain as a rear exit.
Let visitors you don't know roam the house alone and leave your valuables lying around unattended.
To entrust all keys, including those to your safe or cash box, to your domestic help.

Or?

Domain Controller and Active Directory

You can find all sorts of curiosities about these two terms in companies. For example, domain controllers that are linked to the Active Directory (AD) are not monitored at all. Or every employee is given access authorisation everywhere - for the sake of simplicity? In this way, it may not be noticed that a new super user suddenly exists or that there are users based there who have been earning their money at another company for a long time.

The topic of expansion should also not be neglected in this context: After years of growth, domain zones should be set up urgently, even if this means additional effort. Postponing such activities until next year or the year after can be negligent. By the way, growth can also be achieved through acquisitions. We know that this always looks great on the company presentation. But from an IT security point of view, the new colleagues should be regarded as external until their IT security equipment is also managed. If this is up to you, then you should ban the connection to the domain controller or the AD as quickly as possible.

And now?

We have just realised that there is potential for improvement in almost every company. And this is exactly where we come in: We are not just IT security consultants, but also actively take over the incident handling during a security incident. In the event of a major incident, we deploy an incident manager on site and help the employees in charge to quickly get the incident under control with professional recommendations for action and experienced malware analysts.The top priority is to return to normal operations safely and quickly!

If you have any questions, would like advice or would like to insure yourself with us in the event of an emergency, simply contact us.

Soon you will find out why email communication is the main attack vector for cyberattacks.