“Thinking IT Security Solutions Backwards from the Endpoint”

He is, in a manner of speaking, a modern-day Sherlock Holmes: After studying psychology, comparative literature and German studies, Patrick Kurtz turned his passion for combination, deduction and analysis into a profession. As a graduate of the nationwide unique IHK-certified training course for qualified detectives at the Security Academy Berlin, Kurtz today operates his own private detective agency at the Halle and Leipzig locations and, through cooperation partners, is represented in 21 further major German cities. In the field of business crime, alongside “classic” cases such as unfair competition, embezzlement, sick pay fraud or unauthorised secondary employment, the area of IT security is becoming increasingly important for Kurtz and his staff.

“Attacks are on the rise: ordinary criminals in search of financial gain, industrial spies looking for competitive advantages, and hackers hunting sensitive data have discovered cyberspace as a new sphere of activity in addition to the physical world,” explains Kurtz. “Unfortunately, many managing directors and managers still do not give sufficient attention to the subject of IT security, which can turn out to be a major mistake: just consider the degree of today’s interconnectedness and dependence on IT systems – even just with regard to administrative structures, not to mention direct value creation.” And particularly in small and medium-sized enterprises, which generally have no dedicated IT department – or at best an administrator – functionality is often given (too) much priority over security: “If something works, it is difficult to convey that it may still be vulnerable and that suitable precautions should be taken,” says IT forensic expert Tino Fleischhauer, who works with Kurtz. “Security often only becomes an issue when, as a result of poorly protected systems, damage has occurred and its consequences threaten the company’s very existence.”

A Question of Money

The criminalistics graduate and trained computer scientist has decades of consulting experience and knows that “for SMEs in particular, protecting IT systems is above all a question of money.” When it comes to investing in IT security solutions, Fleischhauer recommends “thinking the whole matter backwards from the endpoint” and calculating how expensive the “worst case” would be – namely the elimination of the damage and the restoration of full operational capability. Since the appropriate IT security structure for a business must always be tailored to the individual case, Fleischhauer advises the following general approach: “Together with an expert, one should conduct a risk analysis – that is, identify the core elements of the company’s operations that absolutely must be protected – and then design and implement suitable IT security measures.”

Easily Implementable “Essentials”

“IT security starts with ‘streamlining’ your system of all non-essential functions so as not to offer unnecessary points of attack or entry routes.” Professional firewalls including virus protection are, of course, indispensable, “although a business with an online shop will doubtless have different requirements than someone merely maintaining contact with field staff via a Virtual Private Network.” Another important point, according to Fleischhauer, is that one should never rely solely on the minimum level of security – for example, by simply accepting default settings without review. Put differently: “You can configure any system so ‘tight’ that it takes a long time to compromise it.”

The next aspect concerns employee access rights to company data: “Even in SMEs, the separation of business divisions should be reflected in the IT structure,” advises Fleischhauer. In plain terms: employees should receive access – via password login or, more modernly, magnetic card – only to the data needed for their work, “and not, for example, someone from engineering having access to the accounting department, or an intern copying the company’s entire know-how onto a USB stick.” Moreover, one must not overlook the fact that data can also be stolen physically, for example in the form of a hard drive. “For that reason alone, continual data backups and security copies stored on independent media are essential.”

Define Access Rights and Fields of Activity | Monitor Administrators

In addition, the gap between users and “experts” is widening, resulting in most access privileges being concentrated in the hands of the IT administrator – a position of absolute trust. It is therefore essential to exercise great care when hiring IT administrators and to check the candidate’s background thoroughly. “Furthermore, the employment contract should clearly and unambiguously define the scope and limits of the administrator’s field of activity. This may not prevent some admins from creating their own world within the system and installing ‘backdoors’ that might allow them access to sensitive data after leaving the company – voluntarily or otherwise – but it does provide clear legal leverage in cases of abuse,” adds Tino Fleischhauer.

Mitteldeutsche Wirtschaft

Author: Andreas Löffler
Magazine of the Chamber of Industry and Commerce Halle-Dessau
23rd Year, No. 5/2014

Franckestraße 5

06110 Halle (Saale)

Kurtz Detective Agency Halle (Saale)

Owner: Patrick Kurtz

Delitzscher Straße 73a

06116 Halle (Saale)

Tel.: +49 345 2194 0000

Mobile: +49 163 8033 967

E-Mail: kontakt@detektei-kurtz.de

Web: https://www.detektei-kurtz.de/en

Google: https://g.page/kurtz-detektei-halle-saale