IT security often neglected

From the study "Cybersecurity in figures". © G Data, Statista, brand eins

Almost one in five employees state that the company they work for does not deal sufficiently with the issue of IT security. This was the result of the latest "Cybersecurity in figures" survey by G Data CyberDefense, Statista and brand eins. Small and medium-sized companies are often under the misapprehension that they are of no interest to attackers. However, it is more lucrative for cyber criminals to attack many small companies with low security standards than to target one company with a high level of protection. Criminals are also focusing on supply chains, as they can reach a larger target via smaller suppliers.

Some companies ignore the dangers on the Internet and, in addition to fines for violating the law, also accept being an easy target for cyber criminals. Andreas Lüning, co-founder and CEO of G Data CyberDefense, comments: "Germany has already achieved a high degree of digitalization. This simplifies processes and shortens communication channels. However, companies of all sizes will only benefit from this if they protect their IT infrastructure sufficiently and see IT security not as an annoying accessory, but as the basis for their work." Many employees are aware of how important IT security is for their company and they support a higher standard of security. Even if the implementation of legal regulations is sometimes complex, 57.7% of respondents are in favor of IT security requirements and adhere to them. Only 8.9% do not consider legal regulations to be useful. If companies want to know how their IT security is doing, there is the option of a comprehensive analysis, a security assessment. This checks where vulnerabilities are located in order to close them before they can be exploited. "A key problem for IT security in Germany is and remains that companies do not take warnings about vulnerabilities or security risks seriously," says Lüning. "They continue to underestimate the real risk of a cyberattack and rely on the principle of hope. Those responsible must act now, because in view of the tense economic situation, no company can afford to lose sales or suffer operational downtime as a result of an IT security incident."

One major challenge affects small and medium-sized companies in particular: The lack of trained IT security specialists. The lack of know-how has a lasting effect on the level of IT security. Medium-sized companies cannot close this gap on their own. Managed security services and employees trained in cyber threats offer a way out of this dilemma. It is important that companies act now. After all, an attack on IT with potentially uncontrollable consequences can happen at any time.