Cyber Security / IT-Security
Cyber Security has been increasingly THE leading risks for businesses around the globe. There is hardly any business that is not dependent on information and communication technologies: neither in high-volume industrial manufacturing environment, where IoT (Internet of Things) digitization is becoming more and more the new standard, nor in health care where digitized patient data are prerequisite for surgeries and proper therapy treatment.
Based on findings from the Allianz Global Risk Barometer 2022, which is based on 2,650 risk management experts from 89 countries and territories, own analysis show that during the last 7 years, cyber incidents have increased by annually 4% (CAGR), followed by natural catastrophies (3% CAGR) (Vieweg, S. (2022): Resilience Best Practice.
“It is not the question whether a cyber attack will happen. The key question is on the impact such an attack will have upon an organization. Preventive measures are crucial on the latency of reaction and recovery. Such latency is merely defining the effectiveness of any organizational resilience and its way to recover.” (Vieweg, S. (2022): Resilience best practice.)
Cyber risk is a very broad field, though reasonable frameworks and recommended procedures exist., e.g. from ISO 2700x, NIST, and many other frameworks. The challenge, though is to pick and implement measures in a consistent and effective way. Here, many organizations struggle, as own cyber case research demonstrates.
There is a long list of cyber threats, with a clear pattern of focus on most effective ones. ENISA, the European Union’s Agency for Cybersecurity, sees the Cyber Threat Landscape (CTL) in decreasing priorities:
- Ransomware
- Malware
- Cryptojacking
- E-mail related Threats
- Threat against data
- Threats against availability and integrity
- Disinformation – misinformation
- Non-malicious threats
- Supply-chain attacks
An ever more “industrialization” and professionalization of cyber attacks has to be acknowledged: The damage is increasing (e.g. the year ending June 2022, the novel LEDS matrix (Lock-Encrypt-Delete-Steal) uses consequently capabilities of ransomeware attacks, resulting in somewhat 10 terabytes of stolen data per month. The full vulnerability becomes obvious, as more than 95% of the incidents do not have a known attack vector (i.e., the way how unauthorized network access to launch cyber attack is being achieved).
Although with the Russian invasion in the Ukraine and the reservists mobilization, a slight decline in specific attacks could be observed in some areas, the cyber risk increase is prevailing.
Hence, it is paramount that managers understand their organization’s vulnerability as a first step and then to take perventive measures that fit to the risk appetite of the organization: don’t forget, there will never be a 100% risk-free situation. Building a Information Security Management System (ISMS) with proper structure AND operationalization will help minimzing such residual risk.
Unlike many trainings aiming for specific certifications in a dedicated area, we offer holistic trainings on Cyber Security / IT Security for managers to enable understanding and taking the effective measures for their organization. This is particularily important in Cyber Security, because:
As member of the world leading independent audit institution ISACA and FAIR Institute on quantitative risk measurement, we offer – based on best expertise – diligent assessment of our clients organizational risk pattern and help them on a relentless cyber security journey.
How does this work out for me?
In a direct (remote and free of charge) INITIATION SESSION we will discuss your objectives, scope, and context.
Depending on your needs and your own capabilities, we will provide you a support concept that fit neatly into your approach. It may comprise just specific change management interventions or up to full implementation of organizational cyber security implementation which typically comprises
- Baselining of specific issues (e.g., how well are IT-Security policies implemented) right up to a full IT audit
- Identifying improvement measures (may include trainings, coachings)
- Implementing improvement measures
- Coaching
- Effectiveness check
For higher efficiency, we suggest an agile working mode with biweekly client-participating reviews on predefined deliverables and flexible agile contract. This enables quick feedback and adjustments as necessary.
In other words, the typical approach is
- Scaled to your real needs
- Delivering tangible results continuously
- Low risk, as the agile contract ensures required skill capacity and allows for adjustments as required.
Book Complementary Fact Finding
