To maintain trust and benefit from the digital enterprise, small and medium-sized companies must become proactive and raise their game in cyber security.
“It is time to stop being naive when it comes
to cyber security.” These were the words spoken by Jim Hagemann Snabe, who was chairman
of A.P. Møller-Mærsk when the company suffered a debilitating cyberattack in
2017. Today, Mr. Snabe is also Chairman of the Supervisory Board of Siemens AG and
he warns that being ‘average’ with regard to cyber security is not good enough. Businesses that
fail to improve will get caught out, regardless of their size.
Cyberattacks on companies have been increasing
in number and sophistication, and this trend is expected to continue and even get
worse in the future. According to Germany’s Federal Ministry for Information
Security (BSI), some 70 percent of German companies experienced cyberattacks within
two years. The total costs amount to tens of billions of euros a year.
What’s more, around half of those cyberattacks
were successful. This means the attackers succeeded in gaining access to IT networks,
influencing the function of IT systems, for example, or manipulating company
websites. And one in two successful attacks led to costly shutdowns of
production or operations, in addition to the cost of investigating what happened,
repairing affected systems, and possible contractual penalties for delays.
A threat to all
The threat to cyber security affects all
companies, not just the big ones. In fact, small and medium-sized enterprises
(SMEs) are increasingly seen as ‘easy’ targets, lacking the resources and
expertise that large corporations can call on to defend themselves. And this
impression seems to be fully justified: A recent survey by Germany’s Mechanical
Engineering Industry Association (VDMA) found that 43 percent of responding
companies still lacked even the ability to detect if a cyberattack had taken
place.
In the rush to digitalize and reap the rewards of Industry 4.0, there is a danger that particularly smaller companies may overlook or underestimate the risks. Given the potentially immense cost of a security breech, SMEs cannot afford to be complacent. They must be proactive in preventing attacks in the first place, especially as increasing integration in production is likely to open up new vulnerabilities.
An important aspect of this is an open exchange of information, because as security threats evolve, measures must be kept up to date. Despite understandable embarrassment or concerns about a loss of prestige, security measures can be improved if companies are prepared to speak openly about problems they’ve encountered and how they dealt with them
One careless click may be all it takes
The best defense companies have is perhaps
awareness of the dangers, because the greatest vulnerability most companies
have is people – their own employees.
The BSI estimates the main cyber threat to
businesses now comes from what’s collectively called ‘social engineering and
phishing’. This refers to a scenario in which employees are tricked into
revealing passwords and other sensitive information.
We’re not talking about primitive spam mails
anymore – but detailed, customized reproductions of real websites and emails
that look and sound authentic. Only a high level of vigilance will detect that
these are fakes. While many may be inclined to dismiss this possibility, consider
that hacking into a network these days is difficult and risky – it is much
easier to fool an unsuspecting human being. And even sophisticated IT defenses
may be powerless against a careless employee.
Clearly then, alongside the technical defense
measures companies require, awareness raising and training must be a top
priority so that employees get better at recognizing potential dangers.
Get a head start
No industrial company, big or small, can afford
to ignore the cyber threat. While the larger corporations, not surprisingly,
tend to be further along in this regard, higher security standards are sure to trickle
down and spread throughout industries.
Compliance pressure will come not just from
stricter legal requirements, but increasingly from customer expectations. Having
raised their own security standards, the big industry players are pushing their
suppliers and service providers in the same direction.
This development potentially makes cyber security
a factor in competitiveness. On the other hand, budgetary constraints mean IT
departments must invest carefully and find solutions customized to individual
needs.
In the digital future that everyone is striving to be a part of, the trend is going toward greater integration, with more and more autonomous processes. But this can only happen if SMEs – and their customers – have full confidence in their cyber security.
Source for statistics: https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2018.pdf?__blob=publicationFile&v=6
Source for Snabe quote:
https://www.heise.de/newsticker/meldung/Nach-NotPetya-Angriff-Weltkonzern-Maersk-arbeitete-zehn-Tage-lang-analog-3952112.html
