Code on a screen

What is IT security?

IT security encompasses all the planning, measures, and controls used to protect IT. There are three classic goals of IT protection: To sustainably maintain the confidentiality of information, the integrity of information and systems, as well as the availability of information and systems.

01

A definition of IT security

IT security has to do with guaranteeing the security of all information techniques and technologies (IT) used, i.e., all hardware and software systems and all computer and network systems. The primary objective of these techniques is to ensure the security of information processing and communication, which requires the proper hardware operation processes as well as software and program system processes. The implementation of such security concepts in the business sector is not voluntary: Under current legislation, German companies are legally required to invest in the development and implementation of IT security concepts, in other words, IT compliance.

In addition to voluntary guidelines and relevant security standards such as ISO 27001, COBIT (Control Objectives for Information and Related Technology), and ITIL (Information Technology Infrastructure Library), laws, standards, and guidelines ensure that companies are as fully aware as possible of their actions and liabilities in the area of information security.

Laws on data protection and information security pursue the goal of creating reliable protection for company information in terms of availability, confidentiality, integrity, and authenticity. Compliance with these regulations is a mandatory prerequisite for companies to remain compliant with the rules. One such law is the German IT Security Act, which came into force on July 25, 2015.

/

02

Why is IT security so important?

Our everyday world is networked through and through – things such as Industry 4.0 in the business sector and smart home concepts in the private sector have long become indispensable. Therefore, it is hardly surprising that the business sector and, of course, consumers have extremely high expectations of the confidentiality of telecommunications. Every second of every day, countless volumes of information are being sent and received at lightning speed via the most diverse IT channels and nodes, just like synapses in the brain. It is hard to imagine what would happen if highly sensitive data such as internal company information or home access codes came into the crosshairs of hackers – a horror scenario for every company and individual. For this reason, it is essential, especially as a company, to protect yourself against external IT threats.

03

Which attack methods and risks pose a threat to IT security?

Assuming that a company falls victim to a security problem in its IT, what are the immediate consequences?

IT application processes can be severely disrupted and may not run properly due to faulty hardware components such as processors and memory. This can also be caused by errors in system software or in applications due to logical and syntax errors. Errors in network systems caused by hardware components, e.g., cables or routers, or by the network software also frequently occur. If such a scenario occurs, it is quite possible that essential business processes will no longer work properly, resulting in considerable financial and structural damage and a loss of image for the company.

However, targeted cyberattacks are far more fatal than faulty software or hardware. Hackers make it their business to infiltrate foreign endpoints, clouds, and operating systems and steal sensitive data and, for example, blackmail those affected by it (ransomware). The past few years have shown that cybercriminals are becoming more and more cunning and are constantly developing new avenues of attack. Most of them are now professionally organized and work with state-of-the-art technology. Common methods of attack used by such hackers are:

Botnets

Cybercriminals like to incorporate foreign computer systems into botnets – this is an aggregation of compromised PCs and other networked devices that they can control remotely like robots and misuse for their purposes. This requires infecting the endpoints with malware. A common application for botnets is use in Distributed Denial-of-Service attacks (DDoS).

Advanced Persistent Threats (APTs)

These are targeted cyberattacks directed at selected victims or groups of victims using extremely advanced, technically sophisticated methods. Attackers gain permanent access to a network and then gradually (often without the victim even noticing) extend this access to other systems. To achieve this, cybercriminals usually plant specially programmed malware.

Malware

The term malware includes all types of computer programs that perform unwanted or harmful actions in a system, for example, viruses, worms, and Trojans such as Emotet. Depending on the malware, networks and operating systems may be completely paralyzed.

Ransomware

Ransomware is harmful software that encrypts a system and only allows access to the data once the victim has paid a ransom. This form of malware has been particularly popular for several years. Well-known examples are the crypto Trojans WannaCry and Petya. Common methods of distributing ransomware are spam emails, phishing, and drive-by exploits. The latter specifically exploit vulnerabilities in browsers, browser plug-ins, and operating systems.

Spam and Phishing

Spam refers to unsolicited email and is a popular means of spreading malware. Phishing emails, however, are a special type of spam that induces the user to perform a certain action – for example, to disclose login credentials or even bank details or to install malware.

Cables connected to a server

04

What is the current level of threat to IT security for companies?

The risk of a company becoming a victim of cybercrime is extremely high, if not pervasive. One hundred percent security is more or less an illusion in the digital world. That is exactly why IT security is not just a technical problem; it should be considered part of every company’s risk management and treated accordingly. This is also why it can be seen from the growing trend in IT that many companies are investing a lot of money to protect against cyberattacks – but there is often uncertainty about the right approach to IT security. Which providers of protection programs can be trusted, and who can deliver on what they promise? There is a wide range of choices, and it is constantly growing.

Hardware

An appropriate, ideally well-designed IT security concept against the most common attacks can be achieved if all the competencies of a company's information and communication technology are properly used according to the state of the art and if the employees are fully involved in the protection. Protection against state-sponsored attackers or those involved in organized crime is extremely complex. This requires that the company’s management be fully informed of the threats posed by IT crime and the options for protective measures and be prepared to invest time, money, and human resources in these measures.

Help is provided by specialized service providers with experience and tailor-made solutions. An extensive preliminary analysis of the system and training of the employees involved is essential.

05

How can companies increase their IT security?

What are the main approaches companies take to improve their IT security?

Awareness

This is actually self-explanatory – IT security and information security are by no means just a question of technology. The greatest weakness in this construct is, in fact, humans. Cybercriminals exploit ignorance and uncertainty in dealing with IT, for example, by using social engineering or phishing scams to gain access to networks and systems. This is why it is important to train employees and raise awareness of IT risks and IT security. Online training courses with interactive exercises are recommended. Employees can take these courses on their own at any time and receive direct feedback through the interactive component for a quick learning effect.

Security as a Service (SaaS)

This is an outsourcing model in which security management is completely entrusted to an external service provider. The service provider provides the required security applications and takes over the configuration and operation of the tools for companies.

Security by design

A bundle of processes that originally came from software development and view IT protection as a holistic concept. Components of this are concept creation, functioning information management, security in the development process, and, once again, extensive training for employees dealing with the issue.

Security Appliances

As previously mentioned, there is a large selection of security solutions such as firewalls, virus and malware scanners, content filters, and intrusion detection systems; they are available in a variety of price ranges and performance classes. There is also a choice between specialized devices and UTM (Unified Thread Management) appliances. The latter combine multiple functions into a single appliance, making them more suitable for small to medium-sized businesses.

Code on a screen

06

What you need to know about IT security

The most dangerous vulnerability in IT is incomplete and poorly thought-out IT security. However, the frequently heard statement that there is no such thing as one hundred percent security also applies to IT. Nevertheless, IT security must be designed to be as comprehensive as possible and in accordance with regulatory requirements.

The Myra Security-as-a-Service platform supports you in building a holistic security concept. Myra monitors, analyses, and filters harmful Internet traffic before virtual attacks cause any real damage. Our certified Security-as-a-Service platform protects your digital business processes from a wide range of risks such as DDoS attacks, botnets, and attacks on databases.