IT security in the economy

Industrial espionage, sabotage or data theft – increasing digitization poses a major security risk for the economy. Numerous companies are digitizing their entire value chain: from the business or design idea to the product and service to logistics. This increases the risk of falling victim to criminal attacks via the Internet. Particularly in small and medium-sized enterprises, there is a great need for action in the area of cyber security. Studies also show for larger companies and for individual areas of the economy, such as the financial sector, that a large number of companies are affected by cyber attacks.

The entire German economy must respond appropriately to this threat situation and specifically address the issue of information security. This can succeed particularly well if companies can use up-to-date and carefully compiled information to identify the ways in which cyberattacks occur and how to protect themselves effectively against them.

Largest study on cyberattacks

At L3S, the research group of Prof. Dr. Sascha Fahl is conducting a broad investigation on the topic of cyberattacks against companies together with the Kriminologisches Forschungsinstitut Niedersachsen e.V. (KFN) is conducting a broad-based study on the topic of cyberattacks against companies. It is intended to provide differentiated knowledge about the types of attacks and their frequencies. In addition, the researchers involved want to find out how widespread prevention measures and IT security standards are in companies. To ensure that the scientific findings derived from the study are successfully transferred into practice, the researchers are developing prevention strategies and concrete recommendations for action for companies.

One focus of the project is on the information security of small and medium-sized enterprises (SMEs). In particular, it addresses the question of which factors influence the probability of attack and IT security. These could be, for example, the number of employees, the financial situation, the work organization or the work processes. To this end, 5,000 companies were surveyed as part of the research project. The representative survey is currently one of the largest and most informative studies on the topic of cyberattacks against companies, which was conducted independently and according to scientific quality criteria and documented transparently.

40 percent of companies affected

According to the study, around 40 percent of the companies surveyed have been the victim of at least one cyber attack in the last twelve months. The extent to which companies are affected depends not only on the sector of the economy and the size of the company. The researchers found that the impact rates of small and medium-sized companies increase significantly in some cases if they have several locations in Germany or at least one additional location abroad, or if they export goods or services. The survey also looked at the consequences of the most serious cyber attack in each case. Direct costs were incurred by 70 percent of the companies, in particular for immediate measures for defense and reconnaissance, recovery or replacement, and external consulting.

Sensitize employees

Surprisingly, technical measures are already widespread. Therefore, many companies should now focus on integrating them even better into organizational workflows and processes and pay more attention to the interaction between people and technology. One key insight is that it is not enough to implement IT security measures. Rather, they must also be supported and implemented by employees within the company.

Read more in the executive summary of the research report HERE.

In addition, a long version is also available HERE.