Mobile-Menu

Security checks Cybersecurity in companies—Why it's time for a change

A guest post by Ben Fuhrmannek* | Translated by AI 5 min Reading Time

Related Vendors

FAULHABER Drive Systems
dataTec AG
Wuxi InfiMotion Technology Co., Ltd.

Cyber attacks are a constant threat to companies, yet security measures are often seen as a mere formality. With an average delay of 150 days in security patches and millions of attacks every month, it is high time for a change.

Companies must keep up with the rapid development of modern attack techniques and also identify potentially new vulnerabilities.(Image: freely licensed / Pixabay)
Companies must keep up with the rapid development of modern attack techniques and also identify potentially new vulnerabilities.
(Image: freely licensed / Pixabay)

The figure is alarming: 67 million cyber-attacks were recorded by Telekom on its honeypots within a month. This number illustrates how acute the threat situation is. But that's not the only problem. On average, it takes 150 days for security patches to be applied in companies. This means they remain unprotected against potential hacker attacks for almost half a year. It's time for German companies to focus more intensively on this issue. However, the way things are currently run is not working.

Security as a formality—Why that doesn't work

Current analyses of software security are often not systematic and targeted enough. The digital transformation and the increasing use of technology in business processes require a holistic and meaningful digitization with absolutely secure systems that companies and customers can trust. However, in practice, an unfavorable pattern repeatedly shows itself: Software is examined due to security issues, experts find vulnerabilities and write reports. After that, nothing usually happens. The effort is high, the benefit low. Security tests are still seen more as a formal necessity today and less as a practical tool. Critical questions in this context remain unanswered:

  • What are we even investigating and why?

  • What do we do with the results?

  • How do we manage to implement security checks continuously and with little effort?

Cybersecurity in companies: What do we need to test?

Companies are daily targets of cyber attacks. To effectively counter these threats, a systematic and targeted analysis of IT security is essential. Firms must keep up with the rapid development of modern attack techniques and also identify potentially new vulnerabilities. These include:

  • Outdated or unpatched systems

  • Weak access controls, such as poor passwords or lack of two-factor authentication (2FA)

  • Insecure configurations of systems and networks

  • Missing or incorrect data encryption

  • Vulnerabilities in web applications and lack of audits

  • Insufficient awareness of security issues and lack of employee training

  • Insecure network architecture, such as open Wi-Fi networks or privileged networks without appropriate access protection

  • Insufficient processes in the event of an attack

Ideally, the process begins with a comprehensive inventory of the entire IT infrastructure and software environment. All relevant systems, networks, and applications are captured and analyzed. Subsequently, a detailed review of the security architecture follows, including access controls, encryption methods, network configurations, and other security-relevant parameters. The investigation should include both automated tools and manual examinations by experienced security experts to uncover complex or previously overlooked vulnerabilities. Throughout the process, clear documentation of results and effective communication with all stakeholders are crucial to enable a quick response to identified risks. But what happens afterwards?

Out of the drawer: How can companies properly use the results?

After a security analysis, the report is already a detailed documentation with risk assessment and recommendations for addressing the vulnerabilities. This is usually the auditor's task. The key point after "out of the drawer" is, on one hand, to be able to comprehend and understand the identified vulnerabilities at all. In part, the attacks are technically complex, so that even experienced software developers need a moment to understand an attack scenario and the corresponding countermeasures. Once this step is accomplished, clear action plans should be developed to determine which vulnerabilities need to be addressed first and how this can be done most efficiently.

In addition, communicating the results to all relevant stakeholders is crucial. This includes not only the IT security team, but also developers, management, and possibly external service providers or auditors. The results should be presented in an understandable format that clearly conveys the urgency of the measures and the required resources. Regular updates and feedback on the progress of implementation are also important to ensure that security issues are continuously and effectively addressed.

How can it be implemented with little effort?

To implement security checks continuously and with minimal effort, companies should focus on automation and integration. Whether they rely on specialized service providers or implement their own strategy depends entirely on their expertise and capacities. In any case, three key strategies should be at the center:

  • Automated security tools: These enable regular scans and tests that run continuously and can quickly identify potential vulnerabilities.

    Subscribe to the newsletter now

    Don't Miss out on Our Best Content

    By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

    Unfold for details of your consent

  • DevSecOps approach: Integration of security checks into the development process from the beginning to address security aspects early on.

  • Management support: Provision of resources and training to ensure that security measures can be continuously improved and updated without disrupting ongoing business processes.

  • Bonus: Involve experts: Specialized service providers are generally a good idea here because they can combine the best practices of all client companies into a powerful security strategy. This saves trial-and-error scenarios and frees up capacities.

These measures help companies respond efficiently to security threats and protect their IT infrastructure in the long term. This is already well documented—for example, in Microsoft's Security Development Lifecycle (SDL). With a secure present, companies can then look to the future.

Essentials for secure software

To prepare for future threats and challenges, companies should pursue several key strategies:

  • Regular risk assessments and the application of threat modeling help to identify potential risks early and address them appropriately.

  • At the same time, compliance with all relevant regulations and best practices is crucial. Here, contracts with customers and service providers, data protection regulations, and last but not least, the company's reputation play a role.

  • The use of modern technologies such as artificial intelligence and automation helps companies efficiently identify and close security gaps.

  • Continuous training of employees in the field of IT security promotes a strong security awareness and ensures that security practices are firmly anchored in the company.

  • An open approach to security issues and the disclosure of security incidents are important to learn from mistakes and continuously improve the security strategy.

  • Regular security audits enable a systematic review of security measures and identify vulnerabilities before they can be exploited.

  • The development and implementation of an emergency plan ensures that the company is prepared for potential security incidents and can respond quickly.

  • Own research and development activities in the field of security, as well as the study of current research results, help companies develop innovative solutions and introduce new security technologies early.

By proactively implementing these measures or having them implemented by service providers, companies can secure their IT infrastructure robustly against future threats and promote a strong security culture within the organization. This is crucial not only to protect their own data and systems but also to strengthen the trust of customers and business partners in the company's security standards.

*Ben Fuhrmannek is the managing director of Sektion Eins and an IT security consultant at Taktsoft.

Related content