Internet Security Days 2021

On 16 and 17 September 2021, the Internet Security Days were organised by eco and heise Events took place. We also took part in the virtual event.

A virtual event platform gave us the opportunity to take part in the presentations and exchange ideas with other participants and speakers. A fun treat was the networking break, where people could get together and network via a video chat platform.

Some of our employees also used this event for further training. There were exciting and informative presentations from the Federal Ministry for Information Security (BSI), the Federal Criminal Police Office and Fraunhofer SIT, among others. There was something for everyone on the agenda.

Our Director Security Consulting, Thomas Günther, presented on the topic:

IT security concept - hot or rubbish?

In everyday language, security is often seen as a question of YES or NO. In reality, safety always involves weighing up the benefits & risks and convenience & costs. An important realisation in this context is that there is no such thing as absolute security! The area of IT security in particular is accompanied by a flood of cybersecurity issues that harbour both opportunities and risks. In order to establish IT security in the company and make it "tangible", an IT security concept is indispensable.

What is the best way to go about creating an IT security concept?

What technical and organisational measures need to be defined?

Procedures in the event of data breaches, system failures, hacker attacks, virus attacks, phishing, etc.
Mechanisms for physical and logical access and access controls
Techniques for encryption
Training to sensitise employees (awarenesscampaigns)

The ISMS (Information Security Management System) is a strategic planning tool for IT security that covers all areas of the company. One part of the ISMS is the security processes. Every company pursues objectives and works under framework conditions that must be taken into account and which result in a security strategy. The information security guideline sets out how information security is to be operated within the company. In addition, a security organisation is defined and the IT security concept is developed. As a concrete tool for achieving IT security, the IT security concept is derived directly from a company's security strategy.

When creating an IT security concept, there is no need to reinvent the wheel. Orientation towards existing standards (e.g. from the BSI) is useful and necessary, but a good IT security concept must above all be tailored to the respective use case and the company's IT. Defining and writing down the IT security concept alone is not enough. It must be implemented in reality!

Hot or junk?

The IT security concept is not a topic that people like to call "hot" with conviction. However, it is certainly not "junk", because any company can be the target of a cyber attack and the IT security concept is an essential protection against this. In addition to the fact that a security incident can be really expensive, livelihoods are also at stake. In the cyberattack on the district of Bittersfeld in July 2021, only the district's digital infrastructure was affected and blocked (press release). Nevertheless, many people were affected in their daily lives.

We are happy to help you decide whether your IT security concept is "hot" or "rubbish". We can also help you create one if you don't currently have one. Please feel free to contact us.

Great organisation on the part of the organisers and an inquisitive audience!

Director Security Consulting