Editorial
Is it already in or what?
Do you remember Stuxnet? In 2010, the computer worm that was specially developed for Siemens Simatic S7 and was intended to sabotage the Iranian nuclear program caused quite a stir.
However, systems in Germany, Western Europe, the USA and Asia were also affected. Due to the extent of the attack and the high development costs, experts such as Yevgeny Kasperski assume that it was probably an attack by a state organization.
And the industry breathed a sigh of relief. Although people became aware of the threat posed by cyberattacks, the suspected political background gave rise to a feeling of security: "We are too small and unimportant for targeted cyberattacks" or "Hackers are not interested in German SMEs" was a common refrain.
But then came October 13, 2019: the safety specialist Pilz was targeted. Unknown persons installed a blackmail Trojan, i.e. ransomware, encrypted the data and demanded a ransom. The company refused to be blackmailed, took all computer systems offline as a precaution and blocked access to the company network.
The company's crisis communication deserves praise at this point: Pilz took an offensive approach to the issue of cyberattacks right from the start, informing customers and the public about the current state of affairs via various channels and at the same time drawing attention to the lack of support from the Federal Office for Information Security. Although Pilz has to report cyberattacks to the authority, the BSI failed to provide support right from the start. Thomas Pilz explained that the company did not belong to the category of companies that fall within the BSI's remit.
The open handling of the targeted cyberattack also raised the industry's awareness of cybersecurity and industrial security. This was also evident at the SPS - Smart Production Solutions trade fair at the end of November: the special areas "Automation meets IT" and "Industrial Security" were very popular. Visitors gathered specific information on preventive measures to protect against cyber attacks. This is because SMEs are slowly becoming aware that the key question is not "Will I ever be the target of a cyberattack?", but rather "When will I be the target of a cyberattack and what can I do about it?".
Incidentally, a recent study confirms that companies react too slowly to attacks on their IT infrastructure and even make it relatively easy for hackers to infect their systems. The same study also shows that the time before clever attackers can compromise other systems away from the entry point and cause damage can be less than an hour. Then the hacker is in and spreading. And how long does it take on average for German companies to respond adequately? A whopping 11 days! Read the full report on the topic here.











