The dilemma of a
cyber crisis:
Are you up to the challenge?
Dr. Klaus Schäfer, VP Technology – F24 Group
Cyber Attacks: Listed as top threat amongst potential business risks in 2022
Malware, DoS, Ransomware – Let’s take a fresh look at the well-known cyber threats and its arising challenges for cyber crisis management.
Today, digital assets have the greatest value. The entire world is becoming more digitalised, where sharing and storing information has never been easier. In response to this rapid connectivity, the cyber threat is also rising to new heights of frequency and sophistication. According to the latest Allianz Risk Barometer 2022, cyber threats are listed as the number one threat amongst potential business risks. It is no longer a question of whether an cyber attack will happen, but rather when.
Dr. Klaus Schäfer, Vice President of Technology at F24, answers the most important questions our team has received from customers on this topic.
What is the difference in communication between any other critical situation and a cyber crisis?
Klaus Schäfer: Cyber crisis comes with very special challenges that are likely to arise during other critical situations as well, however in this particular situation, it develops a special explosiveness. I would like to address four major issues here.
Firstly, in the event of an attack, the usual communication channels are quickly impaired or even inoperative. An on-site alarm system or an in-house alarm server may not work when needed. The SaaS solution, on the other hand, is hosted by the provider so it is ready when disaster strikes, even if the SaaS provider itself is under attack. This is because a good SaaS provider will have a fully capable system that absolutely ensures the necessary availability.
Furthermore, we need to ask ourselves: What damage can cyberattacks do and what data can potentially be stolen? There are a multitude of ways a cyberattack can hit an organisation and the impacts will vary depending on the nature and severity of the attack. Beneath the surface, these attacks can have a significant impact on business. But the damage they do is not widely known and are much more difficult to quantify.
How can we prepare for a cyber crisis and what is the best way?
Klaus Schäfer: As Benjamin Franklin is often credited as saying, “By failing to prepare, you are preparing to fail” (see Mayberry, 2016).
Good preparation is half the battle. You need to create awareness among all employees about the potential risks. Everyone can play an important part in keeping information safe. Therefore, it is important that everybody is sensitised and regularly trained regarding IT security issues. The advantages of regular practice for (cyber) crisis situations are clear: theoretical knowledge can be tested and trained. Lessons learnt from mistakes in training makes actions during a real scenario become smoother and faster.
Secondly, identify information process: first internally (employees, if necessary, investors), then externally (clients, distributors, press) and establish a cyber event crisis team, including representatives from executive management, IT, communications, legal and possibly third-party assistance.
Ideally, focus on implementing two-way communication with all relevant stakeholders. One-way communication is no option, especially when it comes to cyber crisis situations. Define your point of contact for further requests and by stakeholder if necessary.
Cyber Checklist: How to prepare for a cyber attack
Strengthen your cyber resilience with help from our checklist!
Find out how to prepare and handle communications effectively during a cyberattack with our cyber security checklist. This document covers the most important aspects before, during and after an incident.
How is the operation of F24 secured against cyberattacks? How is high availability ensured?
Klaus Schäfer: “FACT24 is explicitly designed for such cases and represents a kind of parallel world to our customers own IT infrastructure. In contrast to most other companies, this is our core business and in terms of security and availability we have to be up to date and working at the highest possible level. The time, personnel and financial resources this requires does not pay off for most companies. In this respect, we also rely on procedural and technical measures. Thus, we are not only technically up to date – keywords: security updates, firewalls and so on – but our employees are also educated and regularly trained outside of certification audits.
In addition, F24 and the majority of the its subsidiaries are ISO/IEC 27001 certified, which goes well beyond ISO27001 in terms of basic IT protection. Besides automated host agent based vulnerability scans, we also have our systems regularly subjected to professional black and white box penetration tests by a renowned company. Lastly, our systems are designed to be completely redundant. For example, if one of our data centres were affected by a DDoS attack, our customers would continue to use FACT24 to its fullest extent. That’s why we can give a contractual guarantee of 99.99% availability.”
Dr. Klaus Schäfer, VP Technology – F24
