How to protect yourself efficiently against cyber attacks
Password attacks, phishing, and ransomware are just a few examples of how cybercrime threatens the economy. Almost half of the companies in Germany have already fallen victim to cyber attacks, and the number is rising.
Last year, cybercrime reached a new peak in Germany and around the globe. With more and more people working from home, hackers have more potential targets, who launched multiple phishing campaigns on the topic of COVID-19 at the outset of the pandemic. Their latest strategy is ransomware. It allows hackers to spend days on their potential victims' systems to obtain as many rights as possible without them noticing. Afterwards, they attack by encrypting specific data and demanding a high ransom for their release.
Criminals use so-called toolkits from the darknet to systematically spy on weaknesses in corporate systems and take control. Most recently, users of the Microsoft Exchange Server registered more than 50,000 attacks back in April, since there was a massive security gap.
How can companies protect themselves against cybercrime?
Attacks by means of ransomware, phishing and the like cause companies considerable damage. They do not only entail ransom demands and the theft of sensitive data, but also costs for restoring the IT, business disruptions, and damages to connected devices.
In the following, we have listed measures that will help you protect your company against cybercrime.
- Raise awareness of cybercrime
Establish a realistic risk awareness of the threat posed by cybercrime. Every company can be of interest to hackers regardless of its size. Besides improving your IT security, you should raise awareness of the issue among your employees and provide them with regular trainings.
- Establish safety barriers
Assign an individual ID with a user name and secure password to every user with access to the system. This lets you trace the use of data and applications at any time. Our tip: there's no need for strong passwords to be difficult or contain a lot of special characters. You should rather choose four random and familiar words, which you will be able to remember by means of a story.
You should only grant administrator privileges to employees who absolutely need them. This minimizes the risk of a cyber attack from within.
You should secure servers with a multi-factor authentication and configure a secure data encryption for your mobile devices as well.
If your employees are working from home, we recommend to access company-internal networks and servers only via a secure VPN connection.
- Guarantee constant data security
It's best to store important documents directly on the company server. If this isn't possible, you should transfer the data from the local storage to the server at least once a week. You should also regularly test whether created backups are actually working. We also recommend that you store backups physically separated from the secured system.
- Avoid security gaps
Regular updates of virus scanners, applications, and other software on the mobile devices of your employees significantly reduce the risk of cybercrime. If you become aware of security gaps of the used software, you should immediately check whether your own system is affected, and close the gaps quickly.
- Special measures for home office
Personal life and business should be kept separate as far as possible in the home office as well. Caution your employees to not use private applications like e-mail services on their working devices, especially if the VPN connection is active. Computer viruses pose a considerable risk here.
The password for the private WLAN router should be changed at all costs and contain at least 18 characters. To play it safe, you can use a professional password generator.
Watch out for phishing e-mails: check e-mails with attachments or links very thoroughly. If you don't know the sender, you should neither open attachments nor click on links. In case of doubt, contact your IT service.
- Prepare an emergency plan
Prepare for a potential cyber attack early on by developing an emergency plan. It should contain all measures to be taken after an attack. This includes:
- Determining which data have been stolen
- Changing all passwords
- Taking additional protective measures, e.g. two-factor authentication
- Notifying customers of the attack and the exact data loss
- Having the system checked to find the cause
- Be aware of official reporting requirements in the event that personal data has been stolen.
In any case, coordinate with your ERP provider what to do in the event of a cyber attack. They can advise you already in advance and make sure that your ERP system is quickly back on track in case of an emergency.
Whom can I contact in case of a cyber attack?
If you have fallen victim to cybercrime, you shouldn't lose any time. Ideally, you follow through with your individual emergency plan to have your company back on track as quickly as possible. Ask your ERP provider to support you in restoring your ERP system.
After you have taken immediate action, you should also file charges. In Germany, for example, this falls within the jurisdiction of the central point of contact for cybercrime of your State Criminal Police Office and the Federal Criminal Police Office. If you require further (technical) support, contact the German Federal Office for Information Security (BSI).
