In the interview with Ralf Luithle, Co-CEO of Luithle + Luithle

The second phase, "Protect," is characterized by an almost creative development of concepts. Possible risks must be considered in order to provide adequate protective measures for a wide range of scenarios. This ranges from obvious and probable threat scenarios to concepts for dealing with, for example, extreme weather.

The insights gained from the first two phases are incorporated into the design of the solution for “Detect”, “Respond” and “Recover”.

We have been very successful in this regard. To date, none of the customers who have followed our strategic recommendations have been successfully compromised. Our experience shows that effective protection is possible. Although this requires numerous measures.

Silicon Valley Europe: What does a well-thought-out emergency plan look like to enable quick and targeted response in the event of an attack?

Ralf Luithle: Even a well-thought-out emergency plan does not begin only after an attack has already occurred! Important business areas and their protection requirements must be documented in the plan, responsibilities and communication channels must be clearly defined, and recovery concepts must be implemented. Individual measures can address various emergency scenarios.

To ensure that an emergency plan meets the desired quality, it is important to draft it as precisely as possible together with your security specialists or your service provider. Both technical and organizational measures must always be considered!

Such emergency plans are not only extremely helpful but are also mandatory for some companies under the NIS2 Directive. If you have not yet given this any thought, I strongly recommend that you do so as soon as possible!

You can also download our sample emergency plan for ransomware here: Luithle + Luithle - Ransomware Notfallplan

Silicon Valley Europe: It is often said that humans are the biggest weakness in IT security. How do you see this, and how can companies raise employee awareness of this issue?

Ralf Luithle: I can partially agree with this. Even in technologically well-secured environments, there is a risk if just one employee clicks carelessly or reveals valuable information during a phone call. However, employees are not only a potentially weak link in the security chain. Often, they are the link that receives the least time and money invested to integrate it into the chain. First and foremost, it is therefore important to understand employees and to question the points that may lead to unsafe behavior.

We therefore regularly train our employees through our specialists and also offer such training courses on request for our customers. We also practice dealing with phishing in a fear-free environment. This ensures that employees never hesitate to communicate abnormalities or proactively address their own mistakes. To ensure that a company's security is also guaranteed at the process level, it is necessary to specifically establish a "security culture" at the highest management level. Unfortunately, responsibility and scope are often underestimated precisely here. In particular, management often tends to deliberately disregard guidelines and policies.

If you are further interested in this topic, I would be happy to refer you to the recording of my lecture on the influence of human factors: The failure of cyber resilience - Why human factors obscure the obvious.

Silicon Valley Europe: What role do regular training and awareness campaigns play in companies' security strategies?

Ralf Luithle:
As already mentioned, I consider regular training and clear awareness campaigns to be extremely relevant in IT security! Ultimately, they can make the necessary difference. Unfortunately, however, this is still not a matter of course in German companies:

We need to differentiate between the role that such training and campaigns play and the role they should play. A recently published study provides information on security training in Germany: of the more than 5,000 employees surveyed, only 36.2% state that they are regularly trained by the company. At least another 24.4% say they receive such training at irregular intervals. Particularly alarming: just over 1/5 of those surveyed state that they have never heard of such an offer in their company. In medium-sized companies (with a size of 100 to 249 employees), the proportion is even higher: a full 27.8% have never heard of such training![2]

Especially in combination with the fact that attackers are now targeting companies across all industries and of all sizes, this borders on a scandal!

In addition, this measure will become mandatory for some companies at the latest with the NIS2 Directive! But even the already established GDPR requires technical and organizational measures to protect personal data. Training and awareness measures that are intended to comply with the GDPR can be supplemented with additional content and thus take a more holistic approach to the topic of IT security.

Silicon Valley Europe: Are there technologies that can minimize human errors in IT security measures?

Ralf Luithle:
Yes, there are several options for this. In general, this can be described as a “Zero Trust philosophy.” This approach assumes that no device, user, or service is trustworthy without prior authentication and additional authorization. Here’s a handy example:

One technology that helps minimize human error is multi-factor authentication (MFA) applications. We know this from the TAN in online banking.

For cloud services, so-called “Passkeys” are significantly better suited than the familiar multi-factor authentication (MFA). Passkeys represent a new type of authentication that can replace traditional passwords. They not only provide an exceptionally secure method but also one that is particularly user-friendly. For the user, everything appears to run in the background. They are based on a public-private key pair combination. Passkeys are resistant to phishing and data leaks because they are stored locally on the user’s device and can only be used in conjunction with a specific device and a particular application.

Silicon Valley Europe: Your data centers and locations are certified according to ISO/IEC 27001. What does this certification mean in concrete terms, and what added value does it offer your customers?

Ralf Luithle:
The ISO/IEC 27001:2022 certification confirms that we have a comprehensive and effective Information Security Management System (ISMS) that meets the highest international standards.

In concrete terms, this means that we continuously examine whether the procedures we apply and the solutions we use can be improved through appropriate measures. For example, this could involve the assignment and regular review of user rights. Any identified potential or unacceptable risks are tracked and subjected to review. This ensures that the minimization of threats to our IT systems is continuously improved and that dangers remain theoretical.

For our customers, this means that we continuously question existing security measures in all areas of our company and implement corresponding improvements. This ensures that their data is reliably protected at all times.

At our company, information security is centrally considered in every business process.

Silicon Valley Europe: How complex is it to successfully implement and maintain an ISMS in a company on an ongoing basis?

Ralf Luithle:
An information security management system (ISMS) ideally encompasses all activities and processes of a company.

The first step is to develop a basic understanding and recognize that this is not about bureaucratic red tape, but rather a methodology for appropriately addressing threats. Following the motto “just start,” increasing added value is achieved through implementation in daily work and company structure.