The Cyber Security Competence Center (CSCC): A review of the imH conference "Forum IT: Cybersecurity & Hacker Attacks"
On September 6 and 7, experts, decision makers and enthusiasts from the world of cybersecurity came together in the Austrian capital Vienna to exchange views on the latest findings and developments as well as the current threat situation. In cooperation with VOICE - Bundesverband der IT-Anwender e.V. we presented the Cyber Security Competence Center (CSCC) in Austria. In this blog post, we take a closer look at the current service portfolio and highlight the initiatives to strengthen cybersecurity in Germany, Austria and Switzerland.
Relevance of cybersecurity
Threats to the IT landscape and hacker attacks are an international phenomenon and do not stop at national borders. Similar to Germany, the Austrian Federal Chancellery has also emphasized in its Cybersecurity 2021 report that strengthening Austria's digital resilience and ensuring cybersecurity in the digital world are of key importance.
But that does not change the security situation. It remains tense. The alarming scale of cyberattacks is illustrated by figures: in 2022, cyberattacks caused damage of 202.7 billion euros in Germany alone. Even more worrying is that two-thirds of the companies surveyed expect to fall victim to a cyberattack in the next 12 months. Yet less than half of these companies believe they are well equipped to fend off such attacks, as the German Federal Criminal Police Office reveals in its Bundeslagebild Cybercrime 2022.
An additional pressure factor in the current situation is the Russian war of aggression, which not only has geopolitical implications but also intensifies the threat situation for public organizations, NGOs and media houses. The CSCC community in VOICE has seen a significant increase in scanning activity since February 2022, indicating increased efforts by state and criminal actors.
A troubling trend in the world of cyberattacks is the compromise of organizations via supply chain attacks and file transfer systems. This was particularly highlighted by attacks such as the Cl0p ransomware against GoAnywhere MFT and MOVEit Transfer. Another recent issue is the Chinese Storm-0558 hacker group, which spied on U.S. government mailboxes using a stolen MSA key. These incidents highlight the adaptability and sophistication of attackers.
Cyber Security Competence Center
Das VOICE Cyber Security Competence Center (CSCC) bildet ein Gegengewicht gegen die sich rasant verschärfende Bedrohungslage. Regelmäßige und frühzeitige Informationen zu aufkommenden Bedrohungen sind von unschätzbarem Wert, und genau das bietet das CSCC den teilnehmenden Unternehmen. Unsere Expert:innen sichten und analysieren aktuelle, sich entwickelnde Bedrohungen und Schwachstellen sowie ihrer Verbreitungen im Business-Kontext. Sie geben klare Handlungsempfehlungen zu Gegenmaßnahmen. Die teilweise komplexen Sachverhalte werden mit mehreren Quellen recherchiert, ebenengerecht aufbereitet und in einem wöchentlichen Lagebericht präsentiert. Hochkritische Schwachstellen werden durch die Versendung von Ad-Hoc Meldungen, auch bekannt als FLASH-Berichte, unverzüglich nach deren Bekanntwerden an die CSCC-Community kommuniziert.
Ein weiterer Eckpfeiler der CSCC-Community innerhalb von VOICE ist der aktive und vertrauliche Austausch zwischen IT-Sicherheitsbeauftragten der Unternehmen. Ein gesicherter Kommunikationsraum ermöglicht es den Teilnehmern, ihr Wissen zu teilen und gemeinsam Lösungen für Sicherheitsprobleme zu entwickeln. Die dadurch entstehenden Synergieeffekte zwischen den beteiligten Unternehmen sind von unschätzbarem Nutzen. Der gemeinsame Austausch von Erfahrungen mit spezifischen Maßnahmen zur Abwehr von Bedrohungen und deren Wirksamkeit führt zu einer kontinuierlichen Verbesserung der eigenen Cybersicherheit. Schließlich ermöglicht der kurzfristige Zugriff auf das Wissen von Expert:innen mit langjähriger Erfahrung eine schnelle und effektive Reaktion auf komplexe Sicherheitsprobleme.
Das CSCC gibt es auch als Video und Podcast. Die Medienformate komprimieren die wichtigsten und kritischsten Meldungen zu einem leicht verdaulichen Format, das alle zwei Wochen als On-Demand-Option verfügbar ist. In diesem etwa 30-minütigen Content haben Teilnehmer:innen die Möglichkeit, sich über die neuesten Entwicklungen in der Cybersicherheit auf dem Laufenden zu halten, ohne viel Zeit investieren zu müssen.
Cyber Security Competence Center
The VOICE Cyber Security Competence Center (CSCC) provides a counterbalance to the rapidly escalating threat environment. Regular and early information on emerging threats is invaluable, and that is exactly what the CSCC provides to participating companies. Our experts sift through and analyze current, evolving threats and vulnerabilities and how they are spreading in the business context. They provide clear recommendations for countermeasures. The sometimes complex issues are researched using multiple sources, prepared in a level-appropriate manner and presented in a weekly situation report. Highly critical vulnerabilities are communicated to the CSCC community by sending ad-hoc messages, also known as FLASH reports, immediately after they become known.
Another cornerstone of the CSCC community within VOICE is the active and confidential exchange between corporate IT security officers. A secure communication space enables participants to share their knowledge and jointly develop solutions to security problems. The resulting synergy effects between the participating companies are invaluable. Sharing experiences with specific measures to defend against threats and their effectiveness leads to continuous improvement of one's own cybersecurity. Finally, short-term access to the knowledge of experts with many years of experience enables a fast and effective response to complex security problems.
The CSCC is also available as a video and podcast. These media formats compress the most important and critical messages into an easily digestible format that is available as an on-demand option every two weeks. In this approximately 30-minute content, subscribers have the opportunity to keep up with the latest developments in cybersecurity without having to invest a lot of time.
Cyber Security Self Assessment
Finally, we would like to introduce the Cyber Security Self Assessment (CSSA). The service aims to evaluate your organization's cybersecurity and determine its maturity level based on the NIST Framework. During a workshop, we work with you to define the scope of the self-assessment and provide support in handling the questionnaire we provide. After completion of the evaluation, we thoroughly analyze the results and present them to you in a second workshop. In doing so, you will gain insights into the current maturity level of cybersecurity in your company as well as your risk profile. Finally, we prepare a comprehensive report summarizing the results, the maturity assessment and your risk profile. In this context, we offer concrete measures and practical recommendations for action to strengthen your cybersecurity. The CSSA service provides you with a valuable opportunity to review your cybersecurity practices, identify vulnerabilities, and initiate targeted steps for improvement.
Conclusion
If you would now like to become a member of the CSCC community as well, we are happy to provide you with the opportunity to participate on a trial basis. Alternatively, we would be happy to provide you with an exemplary webcast or exchange ideas on how to conduct a CSSA. Contact us to learn more and benefit from the advantages of the Cyber Security Competence Center. Your cyber security is important to us!
Author: Henri Fild