Cybercrime: More Security for Companies

Whether external hacker attacks on medical practices or internally manipulated merchandise management systems in the retail sector: the number of cases of cyber attacks in Germany has been rising for years. According to the status report of the German Federal Office for Information Security (BSI), the threat in Germany was higher than ever last year.  

Small and medium-sized enterprises in particular are increasingly being targeted by criminals. According to a Bitkom study (industry association of the German information and telecommunications sector), almost 90 percent of the companies surveyed said they had been victims of cyber attacks in 2022. The economic damage in Germany amounted to around 203 billion euros – twice as high as in 2018/2019. Worldwide, the damage caused by cybercrime is estimated at six trillion dollars. According to experts, the sum will rise to more than ten trillion dollars by 2025 and would then be higher than the damage caused by the global drug trade.  

How can the steady increase in cybercrime be explained? Which cyber attacks occur most frequently and what consequences do they have for affected companies? And above all, what measures – such as cloud solutions – can companies use to protect themselves?

Cybercriminal attacks on companies: Why are the number of cases increasing?

The increase in the number of cybercriminal cases is due to several factors. On the one hand, crimes are increasingly shifting from the analogue to the digital space in the course of digitalisation. Both private individuals and companies are dependent on digital processes; more and more sensitive data is available online. This makes companies in particular attractive targets for cybercriminals. In addition, the Corona pandemic has drastically driven digitalisation and thus the increase in cybercrime – unplanned. Many companies were not yet prepared for the suddenly required digital processes. At the same time, the attackers have further developed and refined their methods. The cyber attacks are becoming more sophisticated, harder to detect and defend against. Due to the Russian attack war against Ukraine and the accompanying digital warfare, the danger posed by cybercrime is increasingly coming into the focus of politics, business and the public.

What types of cybercrime are there?

Data theft, identity theft or virus attacks are increasingly affecting small and medium-sized enterprises. The methods used by cybercriminals are becoming more and more complex and difficult to trace.

a) Phishing: One of the most common forms of cybercrime. Fraudsters send fake but deceptively real-looking messages (emails) with links or attachments to steal sensitive information such as passwords or credit card data.  

b) Malware: Malicious software in the form of viruses or ransomware. It is considered the greatest threat to businesses. The German Federal Office for Information Security (BSI) registers a large number of new malware variants every day. Ransomware, for example - also called extortion software or blackmail Trojans - can prevent access to data or entire computer systems.  

c) DDoS attacks: Distributed denial-of-service (DDoS) attacks aim to overload a company's IT infrastructure and block access to its services.

d) Man-in-the-middle attacks: In an MITM attack, the perpetrators intercept the communication between two parties. They interpose themselves as an unnoticed third party in order to tap or modify data or sensitive information.

What role do cloud solutions play in protecting against cyber attacks?

Small and medium-sized enterprises often do not have their own IT department or specialised IT security officers. Many SMEs also lack a mature security management. Often, access control, for example, is not professionally organised. Software-as-a-service solutions can help small and medium-sized enterprises in particular to protect themselves effectively against cybercrime. Cloud service providers usually have significantly higher security standards: Access is strictly protected; security management is well established. Finally, according to experts, it is not only the virtual hacker attacks that pose a great danger to companies. The so-called "open door" is still considered a security risk in terms of cybercrime. People gain access illegally or act as employees from the inside due to a lack of access control.

Especially with regard to the risk of denial-of-service attacks, outsourced solutions offer advantages because the software is centrally hosted by the provider. Admittedly, they can also fall victim to attacks from the network. But: they have the better infrastructure to react in the event of a DDoS attack, for example, to recognise it early and redirect it.

What consequences can cybercriminal attacks have for companies?

Almost 90 percent of German companies have been the victim of a cyber attack in the past year. The criminals' targets are wide-ranging. They reach from public institutions to e-commerce as well as the health and education sector to CRITIS. Damage to assets, property, reputation and people can be the result of cybercrime. According to a Statista survey (German online platform for statistics), costs for extortion with stolen or encrypted data accounted for around 10.7 billion euros in 2022. Especially for SMEs, cybercriminal attacks can quickly threaten their existence. It is not only the high costs for restoring data or programmes that damage companies. In particular, business interruptions of up to several days have serious consequences for small companies. At the same time, there is the threat of high fines if security gaps or inadequate security precautions have made a cyber attack possible. The General Data Protection Regulation (GDPR) provides for fines of up to ten million euros in cases of inadequate certification and monitoring obligations.

What measures can companies take to protect themselves against cybercrime?

There are often several factors that make cybercriminal attacks possible. It is usually a mixture of technical and organisational problems as well as human error. For companies, this means that there is no one solution to protect against cybercrime, but that different approaches need to be combined.

Awareness raising and training:
Companies should regularly inform their employees about the risks and latest developments in cybercrime. Training on topics such as phishing detection and secure password management can raise awareness of potential threats.

Network security:
Implementing firewalls, antivirus software and intrusion detection systems is essential to protect networks from unauthorised access.

Data encryption:
Sensitive data should always be stored in encrypted form to ensure that it is useless to attackers in the event of a data leak.

Access control:
Sensitive areas in the company should be protected by modern access control systems.  

Regular updates and patches:
Companies should ensure that their systems, applications and operating systems are always up to date. Regular updates and patches help to close known security gaps. Cloud solutions can offer advantages here.  

Security policies and access restrictions:
Companies should create clear security policies and limit access to sensitive data to authorised employees and appoint an IT security officer.  

The rising threat of cybercrime poses a significant risk in Germany. Companies need to take proactive measures to secure their systems, employees and data. Implementing a comprehensive security policy, access control and regular employee training can help minimise the risk of cyber attacks. The goal: to protect businesses from financial loss and image damage. In view of the constantly evolving threats, companies should consider cybercrime as a top priority and continuously invest in their security management. This is the only way they can ensure the integrity of their data and the stability of their business.