| Time and again, we hear about cyber-attacks on businesses and organizations. Even critical infrastructure is not secure to cybercriminals. At the turn of the year, a series of district clinics in Bavaria fell victim to hacker attacks. Data was specifically encrypted and stolen. The extent and duration of system restoration are often difficult to foresee. In addition to critical infrastructure, businesses are another popular target for hacker attacks. The ransomware group behind ‘Lockbit’ has been classified by the German Federal Office for Information Security (BSI) as the most dangerous cybercrime group in the world. The LockBit operator group offers their ransomware as a so-called Ransomware-as-a-Service (RaaS). They provide their ransomware to other cybercriminals (affiliates). These affiliates carry out attacks with the ransomware on businesses and demand ransom payments. For businesses, the role of the Information Security Officer (ISO) is becoming increasingly important. The ISO is responsible for all IT security matters within the company, including security-related incidents. One of their primary responsibilities includes overseeing and orchestrating the security process, alongside providing assistance in implementing an Information Security Management System (ISMS). Employees are often targeted by phishing emails, posing a high risk. The ISO coordinates and conducts employee training sessions to raise awareness and minimize the risk. An ISO requires sufficient resources and time for necessary training. There needs to be a direct reporting line to management so that decisions can be made quickly in difficult situations. Due to the high requirements, many companies outsource the task and appoint an external service provider as an ISO. Feel free to contact us if you are considering appointing an ISO. |