EN 
DE 
Dresden. The digitalization of companies is progressing, and companies want - and need - to remain competitive in order to be prepared for the future. The prerequisite for this is information security. In Germany, IT baseline protection has been in place for three decades. It provides companies with recommendations for action, methodical procedures, help for self-help and defines standards according to BSI. Organizations and facilities with so-called critical infrastructures (KRITIS) have the highest requirements. These KRITIS operators are subject to the KRITIS Regulation. This applies in particular to all utilities and waste disposal companies - for example hospitals, energy suppliers, transport and waste companies.
The complexity is immeasurable
This year, everyone is talking about NIS-2 among IT managers. This is the second EU directive on network and information securitywhich was adopted by the European Parliament on December 14, 2022. It is now to be transposed into national law by October 17, 2024. The requirement applies to companies with 50 or more employees and an annual turnover of more than ten million euros. As of the beginning of May, the draft law had 189 pages with over 60 paragraphs and countless sections.
The conclusion of the latest BSI 2023 report on the state of IT security in Germany is clear: the threat in cyberspace is higher than ever before. More than 2,000 vulnerabilities in software products per month and 250,000 new malware programs per day were identified in the reporting period.
This also means that every employee must be sensitized. It is no longer just a matter of installing a virus scanner or a firewall. Phishing and spam emails are becoming increasingly difficult to detect. A large number of users work with AI software, which is increasingly being misused by cyber criminals. Who can still tell the difference between a real person in a video conference and an artificial one? The situation is worrying and ignoring the problem is not an option, as it will affect everyone sooner or later.
Incident response teams help
So what should you do if an attack occurs? Is there an internal crisis team with IT experts and an emergency plan? Being able to act immediately and correctly in the event of an IT security incident and to manage the potential consequences is a clear business advantage. This is where Incident Response Teams (IRT) come into play: this is a group of IT experts who specialize in responding quickly and specifically to cyber attacks, system failures and data breaches.
Dr. Frank Karow has been Managing Director at SHD System House Dresden GmbH at the headquarters Dresden. He knows the needs of his long-standing customers very well. Karow has invested heavily in certifying his employees and in state-of-the-art technologies.
"SHD has been a partner to operators of critical infrastructures for many years. We support customers in setting up an information security management system (ISMS), in security certifications (such as ISO 27001) and in the implementation of cybersecurity measures. The current figures speak for such investments. However, I would advise SMEs not to invest in their own I.R.T.. It is too costly and requires years of experience with cyber emergencies." The search for such IT forensics experts is lengthy and cost-intensive. "You first have to find such people, get them interested in the region and offer them prospects. As an IT company with offers for I.R.T. specialists, we have a lot of experience with the TU Dresden, the BA Saxony and the University Mittweida Saxony has a very good foundation of young professionals," says Karow. In order to increase the overall level of IT security, prevention, detection and reaction are needed. Only these three components lead to cyber resilience in the company.
Christian Müller, a highly specialized cybersecurity expert with over 20 years of experience and with SHD since 2011, advises: "Cyber security is not a one-size-fits-all concept, but must be individually tailored to each company or authority. Our overall strategy, the Big Picture, provides a comprehensive overview of technical and organizational areas, including external services. This includes, for example, raising user awareness, penetration tests and the detection of attacks. In this way, we ensure that all aspects of IT security are covered."
The German Incident Response Team (DIRT.) is a nationwide initiative of the COMPASS Group for the management of IT cyber crises. It consists of over 50 BSI incident experts and 4,500 IT specialists in all areas. Thanks to regionally available mobile emergency data centers, the network of incident commanders and IT forensic experts can quickly provide on-site assistance with IT recovery. SHD is one of the seven founding members and is responsible for the entire Saxony and North/East region. The DIRT. emergency hotline covers the whole of Germany. The founding members have invested heavily and are technically at the highest level. Most of them have their own Security Operation Center (SOC).
"In the anniversary year of IT-Grundschutz, we are offering a particularly wide range of formats on the topic of cybercrime. We have just been on the road throughout Germany with our SHD Security Roadshow and have spoken to over 250 IT managers from leading companies. We offer practical webinars on IT topics several times a month. We also want to get young people interested in this. We are represented at trade fairs and are trainers for IT and cyber forensics," says Kerstin Zubke, press officer at SHD. And the company is certainly noticing a change in thinking: "In conclusion, I can say that the level of IT security at companies and authorities has improved many times over in recent years," says Dr. Frank Karow. (wis)
