The threat from hackers is always changing in the same direction:
it is demonstrably increasing significantly every year. More and more organisations suffer cyber attacks. Entire companies cannot be reached for days or even weeks. Ransoms, e.g. to recover company data, are paid in the millions. The hackers don't care who gets hit, from large corporations and medium-sized companies to SMEs and critical infrastructures, such as hospitals and power plants.
Nevertheless, when new vulnerabilities arise, the organisations often do nothing. The "Hafnium" vulnerability at the beginning of 2021 was not immediately resolved in all organisations, as it should have been. Random checks of local companies with between 50 and 5,000 employees less than a week after the vulnerability was made public showed that over 50% of the companies had not yet applied the patch. Despite reports on all channels, including the daily news. The cycle of threats is turning. Although more people began working from home in 2020, they have not yet drawn greater attention from attackers. But that, too, is only a matter of time. Warnings have been issued here since the beginning of the pandemic.
When faced with the threat of hackers, many organisations are often like deer in headlights: paralysed. Lethargic. Either nothing is done or only fig leaf-like measures are adopted.
With such an abundance of information, many company managers often do not have an overview of which measures exist and which of them make sense. This is where the German IT Security Association (Bundesverband IT-Sicherheit e.V.) can help. (TeleTrusT) and its member companies can help, e.g. through events, publications and positions on IT security topics. The handout titled "State of the art in IT security" provides an excellent introduction. Among other things, it lists a measure that can help many companies: The simulated hacker attack - a penetration test.