How have the methods of attack changed? In what ways are attacks carried out today?
Alexander Gronwald: Cybercriminals are increasingly networked these days and work in a highly professional manner. In most cases, the attacks are carried out on a broad front – with the aim of identifying vulnerabilities and security gaps in the IT infrastructure of companies. One common tactic, for example, is to gain access to company networks via phishing emails. These fake e-mails are intended to convince unknowing employees to pass on sensitive login data; they also encourage the infiltration of malware by clicking on contaminated links sent along with the e-mail. The actual cyberattack usually takes place later. In this way, malware can sit unnoticed in the system for months – with fatal consequences for the affected company.
Johannes Mattes: Cybercrime has become an international business in which attackers go about their tasks as if they were doing a day job. They develop attack strategies that are easily scalable and can be used on a large scale against different victims. A successful attack on corporate networks usually involves multiple actors, each with a special focus. This is evident, for example, in ransomware attacks, where the goal is to encrypt corporate data and then extort a ransom for its release. In this context, for instance, one actor creates the malware, the other breaks into the corporate network, and a third party carries out the extortion.
Alexander Gronwald, www.tvconsult.com
Which areas of the company are particularly vulnerable? And how do attackers abuse these vulnerabilities?
Alexander Gronwald: The most significant attack surface remains the company’s own workforce. If employees are not or only insufficiently informed about risks from the cyberworld and thus not empowered to defend themselves, cybercriminals have an easy game. Attackers use various gateways for unauthorized system access, such as the aforementioned phishing mails, USB sticks contaminated with malware and put into circulation, or fictitious remote access. In this case, attackers pretend to be internal IT service employees in order to support colleagues in the home office. In reality, however, confidential data is stolen and used for criminal purposes.
Johannes Mattes: It should also be kept in mind that cybercriminals can gain access via the supply chain: In supply chain attacks, suppliers with an even lower security level are compromised in a first step in order to gain access to the network of the actual target. In many cases, it therefore makes sense to optimize IT security across companies.
Further, outdated IT systems or software solutions are vulnerabilities that have caused considerable financial damage in the past. In the spring of 2021, for example, a vulnerability in Exchange servers caused a stir. Immediately after the vulnerabilities became known, large-scale scans could be observed on the Internet. They were used by attackers to search for vulnerable Exchange servers of companies. Due to the high prevalence of vulnerable servers on the one hand and the ease of taking advantage using exploit kits on the other, the German Federal Office for Information Security (BSI) classified the situation as extremely critical. In this context, professional patch management proves to be important.
Johannes Mattes, www.byght.io
How well prepared are medium-sized companies for the increasing threat situation?
Johannes Mattes: When we talk to medium-sized companies, we often hear statements like: “Hackers are not likely to attack us. After all, what could they possibly want from us?” This assumption is dangerous, as the statistics speak for themselves: all sizes of companies are affected by cyberattacks. Since security precautions are often inadequate in SMEs, attackers frequently have a particularly easy game.Alexander Gronwald: Many medium-sized companies are hardly or insufficiently prepared for the increasing threat situation. The biggest challenges in this context include a long time until an attack is detected, a lack of specialist expertise in the area of cybersecurity and the absence of a concrete emergency plan. Often, the level of awareness among employees is quite low, as well.