Spending on IT security in Germany is expected to break the 10 billion euro mark this year. There is a good reason for this: cyberattacks are one of the greatest threats to the German economy. Technological advances such as AI further exacerbate the risk. We speak to Robert Felber, CISO at Hochbahn AG and a former iteratec employee, about the interplay between corporate culture and IT security, AI and other trends.
You advise many companies on their IT security. Where do you and your team typically start with projects?
These days, nobody needs to be told that IT security is important. Everyone knows that. The question is no longer whether something needs to be done, but what each individual can contribute. Our consultancy therefore often begins with the corporate culture itself. After all, IT security is no longer just a matter for a specialised security team, but the responsibility of every employee in a company. The hidden hope that there is a security team out there to sort everything out is no longer tenable in the face of attack scenarios that are becoming increasingly personalised and complex.
This already suggests that the field of IT security has changed significantly. Can you explain that in more detail?
Just a few years ago, IT security was primarily driven by the idea of securing the organisation’s external perimeter. This meant that the focus was on securing the outer edge of the organisation, for example with firewalls and VPNs. Within the organisation, however, everyone was free to carry on as usual.
The rise of the cloud alone has turned this on its head. Today, you can think of the firewall as a piece of cheese full of holes, as companies offer far more services and interfaces that allow customers to access the company’s data. There is no longer an effective protective barrier with which companies can isolate themselves.
In the field of information security, the focus was on defining regulations and rules. Whilst this is important, it primarily resulted in a proverbial mountain of printed paper. Operational efficiency, particularly in IT application development, was limited. Anyone who checked the developed code for IT security would have spotted many vulnerabilities and gaps that could be exploited all too easily.
Instead, more effective IT security must be ensured at the code, application and system levels – and this is where topics such as AppSec, DevSecOps, threat modelling and penetration testing come into play. However, monitoring and security automation are also essential building blocks.
Looking ahead: how will IT security continue to evolve?
Artificial intelligence is changing everything. Alongside the risks, AI offers enormous opportunities to improve our security architectures. We have always faced an asymmetrical battle in which attackers need only exploit a single flaw, whilst we, as defenders, must be aware of and manage all risks and vulnerabilities. With AI, this risk is now multiplied. Cybercriminals can use tools to detect vulnerabilities in systems and develop malicious code much more effectively. At the same time, they need to be less and less skilled at coding to successfully attack organisations. On the dark web, this has led to the establishment of specific business models and services, resulting in the emergence of a veritable shadow economy. It is a lucrative business model that attracts plenty of people with criminal intent.
At the same time, AI can also help to protect us by analysing large volumes of data and automating security processes. We are currently working on an AI-supported approach to better integrate vulnerability management into IT development projects, with the aim of making vulnerability prioritisation and recommendations for corrective measures more efficient within the development process.
Another exciting development in this context is the approach of a data-driven security architecture, which, through the use of artificial intelligence (AI) and advanced monitoring tools, has the potential to change the existing rules of the game. These systems make it possible to detect anomalies more quickly before they become genuine threats, aided by deliberately introduced vulnerabilities. In this way, potential attackers can be exposed at the slightest misstep. This shifts the balance: instead of attackers merely having to find a single vulnerability to potentially cause damage, they must act with ever-greater caution. For defenders, a single valid anomaly or data point is sufficient to detect cybercriminals at an early stage and initiate countermeasures. This development promises to tip the asymmetry in cyber warfare in our favour and gives IT security the opportunity to act preventatively, rather than merely reacting to a constant stream of new attack scenarios.
Another important aspect is the protection of the AI systems themselves. We will increasingly integrate AI into our systems and must ensure that these systems cannot be attacked or manipulated. This means that organisations must effectively protect their own data. It is up to each individual company to decide how much in terms of resources, expertise and budget it wishes to invest in order to protect itself and manage its own risk appetite.
With AI, disinformation campaigns and deepfakes are also becoming an increasingly serious problem. What role does IT security play in the battle for control over the truth?
At its core, IT security is about trust and safeguarding the authenticity, integrity, confidentiality and availability of information. The challenges posed by AI raise the fundamental question: what is truly true? After all, AI can manipulate voices, texts and images, and even call a person’s entire identity into question. The central task of IT security is now to create and strengthen systems that make it possible to verify whether a source is trustworthy.
Legislators have also recognised the societal risk associated with this and are currently enacting numerous regulations, be it NIS2, DORA, the EU Data Act or the AI Act. The AI Act is an example of how regulations are intended to ensure that AI systems are not manipulated, particularly when they are based on trained models whose behaviour is difficult to predict. NIS2, on the other hand, requires organisations to demonstrate that their own measures are effective in achieving protection objectives. When it comes to information security, it is therefore no longer enough simply to set out requirements and define processes; rather, it is also essential to ensure that the effectiveness of these measures can be verified. This represents a significant change for the compliance function.
What role, then, do people still play in ensuring IT security?
Most security breaches can be traced back to human error. The solution to this is precisely to train all staff to act as a so-called ‘human firewall’, so that every individual helps to fend off attacks. An example: a colleague reported to us that his LinkedIn profile had been cloned. This could be the start of a targeted attack if, for example, the cloned profile messages the user’s contacts and the message contains links hiding malware. This example makes it clear that everyone must be vigilant and that security awareness is a key component.
However, there is also criticism of this approach. If nobody dares to click on anything anymore, the likelihood of something happening does indeed diminish. At the same time, this hinders communication and the enjoyment of work.
In my ideal world, it must be possible to click on a phishing email without the company suffering serious damage as a result. To achieve this, the IT department must have set up its systems accordingly. The aim must therefore be to ensure that people are well-informed, but that mistakes do not have major consequences! Keyword: cyber resilience
Can you give an example of this?
The theft of login credentials, particularly through phishing and social engineering attacks, now poses a significant threat. If you mistake a fake website for a legitimate one and enter your details there, cybercriminals gain access to the underlying IT systems. One way to counter this in future is to do away with passwords altogether, for example by using passkeys, a password-free login method. Then the whole phishing attack comes to nothing. This technology isn’t yet widely used, but it’s gaining momentum.
A second common scenario is that you pick up malware whilst downloading a file. This raises the question of how well your device is secured and how easily the malware can spread unchecked. Amongst other things, this requires effective monitoring.
What are the key areas where companies can improve?
When I look at this from an organisational perspective, I still see a great need in many companies to make their security risks transparent across all levels of decision-making. Risks arise frequently enough, only to be passed from department to department because nobody wants to take responsibility for them, or because they are accepted to an excessive degree in some cases. This makes the risk unmanageable. Furthermore, the areas of information security (InfoSec), IT security (SecOps) and application security (AppSec, DevSecOps) are still frequently viewed in isolation. It would be important here to break down silos and consider these areas holistically.
From a technical perspective, I focus primarily on the issue of effectiveness: in other words, how do I determine whether the measures I have put in place actually work at the end of the day? To achieve this, security must, for example, be factored into software development from the outset, and systems and applications must be reviewed on an ongoing basis, whether through threat modelling, dedicated penetration tests or red teaming. Scalable measures, such as automated testing, also help in this regard.
Thank you for your time and for this fascinating interview!
Robert Felber – Robert was CISO and Head of Security Consulting at iteratec GmbH; he is now CISO at Hamburger Hochbahn AG. As a long-standing security expert with a background in software development, he has helped organisations to design their agile development processes securely. His focus has been on DevSecOps, information security and continuous security testing.
Do you have any questions or need assistance?
You can find out more about the IT security options available to your business on our website. Feel free to contact us or arrange an appointment.
