\nIn today's digital economy, cyber defence measures are among the most critical tasks of decision-makers and managers. Threats are growing daily. Organisations of all sizes need to protect their digital assets. Cyber defences are no longer optional. They are a strategic necessity for every modern manager. The consequences of inaction can be devastating. Data loss costs millions. Reputational damage is often irreparable. This is why managers must act and systematically implement cyber defence measures.\n<\/p>\n
\nMany decision-makers underestimate the importance of cyber defence measures in the company. They often see security as a technical problem. But that is wrong. Cyber defence measures are management tasks. They require strategic planning and resource allocation.[1] Modern attacks hit companies with the aim of stealing data and expertise.[7] A systematic approach is required. Managers must set clear guidelines. They must define responsibilities. They must provide a budget. Cyber defence measures start with strategy. Then comes implementation[2].\n<\/p>\n
\nImplementation takes place on several levels. Technical systems are only one part. Employee training is equally important. Processes and guidelines must be documented. A Chief Information Security Officer (CISO) coordinates the measures.[2] This person bears responsibility. They advise the management. They regularly review the effectiveness. Good cyber defence measures require continuous adaptation. Threats are constantly changing. What protects today may not be enough tomorrow[4].\n<\/p>\n
\nCyberattacks don't happen sometime. They are happening now. German companies have suffered massive financial losses as a result of cyber attacks.[4] SMEs are particularly at risk. They often have fewer resources than large corporations. But they have attractive data. Criminals exploit this. An attack can paralyse a company. The emergency response becomes chaotic. Costs explode. Customers leave the company. Trust is gone. That's why prevention is so important[6].\n<\/p>\n
\nDecision-makers need to understand: Cyber defence measures are investments. They are not a cost centre. They protect company assets. They strengthen competitiveness. They increase the trust of customers and partners. A company that takes security seriously communicates reliability. That is a competitive advantage. This is particularly crucial in sensitive sectors such as the financial sector, healthcare or industry. 3]\n<\/p>\n
\nTechnical measures form the first line of defence. Firewalls control the flow of data. They block suspicious connections. Antivirus software recognises malware. Intrusion detection systems (IDS) monitor the network. These tools work together.[1] For example, a logistics company uses a multi-level firewall architecture. The external network is strictly separated from the internal network. Sensitive systems are located in additional security zones. This created several barriers against attackers.\n<\/p>\n
\nEncryption is essential. Data at rest must be encrypted. The same applies to data in transit.[1] A financial service provider uses end-to-end encryption. Even employees cannot view sensitive customer data in plain text. An energy company implemented multi-factor authentication (MFA). Users need a password and additional confirmation. A token, an app or a biometric procedure. This drastically reduces unauthorised access[2].\n<\/p>\n
\nRegular security audits are necessary. External specialists test the systems. They look for vulnerabilities. They document findings. The company receives clear recommendations for action. A manufacturing company carries out comprehensive annual audits. This allows gaps to be recognised and rectified at an early stage. A retail group uses regular vulnerability scanning. Automated tests check the IT infrastructure on a daily basis. Any vulnerabilities found are prioritised[1].\n<\/p>\n
\nPeople are the biggest vulnerability. This has been scientifically documented.[6][7] A phishing email looks legitimate. The employee clicks on the link. Malware is installed. The attacker has access. A fake phone call pretends to be IT support. A trusting employee shares their password. A USB stick is found in the corridor. An employee inserts it into the computer. Malware loads itself. All of this happens every day in companies. That's why training is essential[6].\n<\/p>\n
\nEffective training sensitises employees. They learn to recognise suspicious emails. They understand social engineering. They know how to handle sensitive data. A company in the banking sector organises monthly live training sessions. Employees learn to identify phishing attempts. An insurance company uses simulations. Fake phishing emails are sent out. Employees who click anyway receive immediate feedback and additional training. A technology company has established a security culture. Every employee understands that he or she is responsible for security. This is the best protection against cyber defence breaches[2].\n<\/p>\n
\nVarious frameworks help to structure cyber defence measures. The NIST cybersecurity framework originates from the USA. It offers five core functions: Identify, Protect, Detect, Respond, Recover.[4] This framework is used worldwide. It is systematic and practice-orientated. One mechanical engineering company uses NIST as a basis. All IT measures are assigned to these functions. This creates transparency. Everyone knows where there are gaps[4].\n<\/p>\n
\nISO 27001 is another important standard. It is an information security management system (ISMS)[1][2] ISO 27001 is an international certification. It increases credibility. Customers trust certified companies more.[1] A consulting company is certified to ISO 27001. This was strategically important. Large customers demand this certification. A media company uses ISO 27001 to systematically identify risks. The framework helps to set priorities. Limited resources are optimally utilised[2].\n<\/p>\n
\nThe Alliance for Cyber Security (ACS) is a German initiative. Business, science and administration work together. The BSI and the industry association Bitkom coordinate the work. Companies receive recommendations and support.[4] A trade association has joined the ACS. Smaller craft businesses receive advice free of charge. This means that even small companies can improve their cyber defence measures[4].\n<\/p>\n
\nDifferent industries have different requirements. The medical technology industry is subject to strict regulations. A failure can cost patient lives. The requirements for cyber defence measures are particularly high here.[8] A manufacturer of medical devices must guarantee that no manipulation is possible. A pacemaker must not be remote-controlled. A surgical robot must be reliable[8].\n<\/p>\n
\nThe financial sector is a prime target for cyber criminals. Money is the motive. An attack on the banking sector can cost millions. Regulation is strictest here. PCI DSS, GDPR and other standards apply.[1] A financial institution must demonstrate multi-layered security controls. The cyber security standards are extremely demanding. An online banking provider uses constant monitoring. Every transaction is analysed. Suspicious activity is blocked immediately[1].\n<\/p>\n
\nThe manufacturing industry has new problems. Industry 4.0 means networked machines. An attacker could stop production. Quality could be manipulated. A manufacturing company implemented cyber defence measures specifically for production facilities. Network segmentation separates office IT from production IT. This means that an office hack is not a production problem. Another manufacturing company uses secure industrial protocols. Older machines were equipped with security gateways. They enable monitoring without system access[2].\n<\/p>\n
\nAn attack is coming. It's not a question of \u201eif\u201c, but \u201ewhen\u201c. That's why every company needs an emergency plan. An incident response plan documents processes. It names responsible parties. It describes communication channels. Such a plan must be trained regularly[3].\n<\/p>\n
\nA large retail company suffered a ransomware attack. The plan would have helped. But: there was no plan. Everything was chaotic. The response was inefficient. Restoration took weeks. Millions were lost. The company learnt that cyber defence measures must include incident response. Another company had a detailed plan. When an attack came, everything went according to script. Systems were isolated. Backups were imported. The downtime was less than two hours. That makes the difference between a disaster and a controlled emergency[3][8].\n<\/p>\n
\nAn incident response plan should include\n<\/p>\n
\n- Immediate measures after attack detection
\n- Isolation of affected systems
\n- Notification of relevant parties
\n- Forensic investigation
\n- System recovery
\n- Communication with authorities and customers
\n- Follow-up and lessons learnt\n<\/p>\n
\nA telecommunications group tests its plan annually. With a real emergency response team. With real scenarios. With time measurement. So everyone is prepared. Fast reaction is possible. An insurance company has its plan as a living document. It is updated monthly. New threats are taken into account. New employees are trained. The plan is alive, not dusty[3].\n<\/p>\n
BEST PRACTICE at the customer (name hidden due to NDA contract)<\/b> A medium-sized production company had to contend with repeated phishing attacks. Criminals were trying to penetrate the networks. The old security culture was weak. Managers recognised this: Cyber defences are non-negotiable. The company implemented a comprehensive programme. A CISO was hired. An information security management system (ISMS) in accordance with ISO 27001 was set up. Training courses were held on a monthly basis. Technical measures such as multi-factor authentication and endpoint protection were introduced. Regular security audits by external experts were established. The result: successful phishing attacks fell by 95 per cent. An attack that did penetrate was immediately recognised and isolated. The incident response plan was tested in an emergency. It worked. The damage was minimal.<\/i><\/p>\nSecuring mobile devices and remote work<\/h2>\n
\nWorking from home is the norm. Employees work from anywhere. Mobile devices are constantly connected. This creates new risks. A laptop is used in a caf\u00e9. The WLAN is public. An attacker is on the same network. He can intercept data. A smartphone is lost. Unauthorised persons could access it. Cyber defence measures must include mobile devices[6].\n<\/p>\n
\nAn insurance company uses mobile device management (MDM). All devices are managed centrally. The administrator can lose remote access. Devices can be deleted. Apps are controlled. A consulting company encrypts all mobile devices. Even the screen content is protected. A continuous VPN is enforced. Public WLANs cannot be used directly[6].\n<\/p>\n
\nEmployees need to be trained. They should understand: A lost device is a security emergency. A call from someone claiming to be support could be a social engineering attack. Cloud services need to be configured securely. A technology company sensitises: Not every cloud tool is allowed. Only tested, secure solutions may be used. This prevents data leaks via uncontrolled services[6].\n<\/p>\n