Cybersecurity: Not just a topic for IT

As long as Covid19 exists, numerous professionals will continue to stay in the home office. Yet one looming danger should not be forgotten: Cyberattacks! Therefore, Bianca Sum, head of the ZD.B topic platform Cybersecurity, reveals in the following interview valuable tips on how to protect yourself from IT attacks in the digital world of work.

Bianca, what cyber attack points are there in a company?

Bianca Sum: First of all, any device that is connected to the Internet or internal networks is basically vulnerable. This starts in the office with computers, laptops, printers and ends with networked production equipment in a factory. An important aspect is now also IoT devices, i.e. devices from the Internet of Things. This can be a light bulb, a camera or even a robotic arm. Each of these points of attack is ideally protected with specific IT measures.

Is hardware also vulnerable?

Bianca Sum: Yes, the classic is a USB stick infected with malware that is placed in the company parking lot by someone with bad intentions. In the worst case, it says "important project" or "pay slips" on the stick to increase the incentive for someone to actually plug it into a device. Of course, it can also happen that someone accidentally plugs a malware-infected USB stick into their device during external appointments or events. In addition, there are real hacking tools, some of which can be easily ordered on the Internet. This can be, for example, a small adapter that you plug between the keyboard and PC to record all keystrokes. Caution is advised everywhere!

What are the first steps to protect his company?

Bianca Sum: A first step would be to assign secure and, above all, different passwords for access to devices and programs. The rule of thumb here is: the longer, the better. I like to recommend password sets, e.g. "Maria Müller has an ultra-secure password for her company laptop". You should also always keep all the programs you use up to date and install updates. Another tip is to be prepared for an emergency. So make sure that someone can help you - for example, specialists in your own IT department or external experts.

By Covid19 are currently many employees in the home office. What is there to consider here?

Bianca Sum: It is more difficult to take precautions with uniform IT security standards when employees use their private devices instead of company laptops. Binding rules should be communicated in both cases:

• All programs used must be kept up to date.
• It is mandatory to use strong passwords.
• The preset router password must be renewed.
• Access to company data may only be made via extra-secured connections (e.g. VPN client).
• The laptop should always be locked when leaving the workplace.
• The company must regularly inform its employees about dangerous phishing emails.

In addition, employees make sure at best that their home office can be locked and conversations cannot be overheard through open windows.

Have there already been cyberattacks in Germany that have caused great damage?

Bianca Sum: Yes, unfortunately many. A lot of things you often do not get with, because for companies with such attacks is always associated with a possible image damage.

For example, there was recently an attack on a hospital in Düsseldorf. There, servers were encrypted by malware, causing the hospital to be logged out of emergency services. As a result, ambulances could no longer reach the emergency rooms, which is why a seriously ill woman had to be taken to a clinic further away. Unfortunately, she died there, possibly also because the treatment was simply given too late. Fortunately, this does not happen often, but it does happen.

What actually happens more often are the phishing attacks mentioned. In Munich, for example, there was a bakery whose employee was asked to transfer $1.9 million to Hong Kong in what was supposed to be a confidential transaction. Unfortunately, the employee did just that, and in the end the bakery had to argue with the bank about who had to take responsibility for the transfer. And the employee unfortunately lost her job as well.

Bianca, tell us in conclusion briefly how you as the Center Digitalization.Bavaria support companies and their employees regarding cybersecurity.

Bianca Sum: Yes, gladly. There are just in Bavaria many companies and research institutions that have specialized in the field of IT security. Of course, companies can benefit enormously from their expertise. That's why we network the experts, to enable knowledge transfer and also to drive research and development of new security solutions. In addition ...:

• we support research projects or invite experts to events and workshops to discuss current topics in IT security.
• we provide free information material on various security topics on our website.

Our goal is to raise awareness among companies and their employees, as well as society at large, that without a reasonable level of IT security there will be no successful digitization - without fueling panic about cyberattacks!


The interview was conducted by Dr. Kord Pannkoke, Head of Business Development at Bayern Innovativ GmbH.

Listen to the full interview as a podcast: