History shows us that proprietary, manufacturer-specific data protocols are the most vulnerable to cyberattacks, as only a relatively small group works on them, unlike standardized protocols. To achieve greater security against future network attacks, communication protocols classified as standards and freely available in the form of RFCs (Request for Comments), for example, should be implemented in products from the outset. This is because such protocols have been thoroughly reviewed by numerous experts, and security has been considered from the very beginning of their development. Therefore, they offer the highest possible level of security and are beneficial not only to products but also, ultimately, to businesses and their processes.
Furthermore, companies need to be transparent about cybersecurity issues. In such cases, discretion is undoubtedly necessary at first. After all, market partners, particularly customers, shouldn't feel betrayed. At the same time, however, this period of discretion should also be used to develop potential patches to address security vulnerabilities. External communication with all stakeholders should also be prepared and coordinated. Finally, the vulnerability should be reported, coordinated, and accompanied by security patches.
Evasive policies lead nowhere
This approach creates difficulties for many companies, especially in the industrial sector. The reason can be attributed to the fact that cybersecurity only recently gained importance, resulting in a lack of capacity to manage cybersecurity issues, or insufficient capacity altogether. Companies often bury their heads in the sand, believing that discussing the topic would only lead to more problems. However, this attitude can backfire if external specialists discover the vulnerability, whether accidentally or deliberately, and then disclose it publicly. The problems will then become public knowledge, significantly damaging the company's image.
Conversely, companies that proactively address vulnerabilities can gain credibility. Given the complexity of many products, it's clear that problems cannot be completely eliminated, despite exhaustive pre-release testing.
It is far more important to address these problems quickly, keeping the customer in mind; in other words, it is more important to demonstrate that the company is competent and in control of the situation.
Closing the door to the digital barn
: What more can be done about cybersecurity? For medium-sized companies, in particular, this question presents a difficult obstacle to overcome. After all, taking the necessary steps and developing the required skills costs money. However, it's not necessary to implement a comprehensive solution from the outset for complete protection against all possible network attacks. Cybersecurity is more of an ongoing process. First, potential threats must be identified. In Germany, for example, many medium-sized companies (some of the best in their respective sectors) leave their doors wide open, like a large digital barn, when it comes to protecting their technological know-how. Once the most serious weaknesses have been identified, some initial steps should be taken to implement cybersecurity. Furthermore, a continuous improvement process should be implemented, similar to quality management, where the level of security is gradually increased.
On the other hand, it would also be very helpful to create a platform where both the government and the business community can discuss cybersecurity together. This approach will only work if all stakeholders actively participate. Experience shows that when this doesn't happen, parallel platforms can emerge, leading to rivalries that benefit no one. Secondly, there must be a clear division of responsibilities between the government and the business community. One example is the National Institute of Standards and Technology (NIST), which is part of the U.S. Department of Commerce. NIST publicly announces the creation of new cryptographic algorithms, which are then developed by the business community. In other words, this government agency offers specific incentives to companies to find innovative solutions and thereby automatically develop their cybersecurity expertise. Germany should adopt this approach to be able to protect itself effectively against cyber threats.
Conclusion:
Due to the ever-increasing interconnectivity of processes, cybersecurity is becoming a decisive factor for achieving economic success. Therefore, companies must take action before it is too late by developing secure products, communicating issues openly, and firmly integrating cybersecurity into a corporate culture that strives for continuous improvement. Furthermore, the government and the business community have a responsibility to provide standardized solutions, as this is the only way for all market participants to benefit equally.
