Consistent data protection starts with monitoring

We also follow reports of cyber attacks and ransomware on authorities and companies every day. But what we don't understand: How can such incidents occur despite IT audits, external consultants and security concepts? Presumably because much of it was not implemented consistently and conscientiously due to time pressure or because it was not checked by an independent party.

Classic IT in micro and small companies usually has 3 problems, which can have a significant impact on ongoing operations and can subsequently become significantly more expensive than if handled proactively:

At the latest when an incident occurs, companies are susceptible to inflated prices and sparklers without knowing what service is actually being provided by the external service provider in question. They also like to relabel Open source solutions or the actual work is outsourced to low-wage countries without informing the customer in the interests of transparency.

Our recommendation: Define the scope of services precisely, check the general terms and conditions and pay particular attention to the issue of liability. If an external service provider takes care of your IT security, they should also be held liable for the respective scope - provided the incident can be proven to be attributable to them.

Independent - and ideally tamper-proof - monitoring makes sense, especially when it comes to the "liability issue". Monitoring also helps to demonstrate whether measures have been implemented and whether they actually made sense or not. As an example below you will find monitoring of SSH access without Crowdsec and with Crowdsec firewall bouncer.

As a consequence, in the chain of responsibility between the budget, actual implementation and review of the measures, if an incident occurs, the hot potato is passed on until there are no longer any consequences to fear. To the outside world, you are always a “victim of a cyber attack” because shifting responsibility to an intangible place is still the most elegant way from a PR and marketing perspective.

If you have now become a victim of classic ransomware, you can at least check based on the address of the Bitcoin wallet whether a Russian group is “actually” behind the extortion. In the best case scenario, in the event of a classic break-in, there is the IP address - provided the log files have not been deleted.

However, an IP address is comparable to a vehicle license plate: just because your video surveillance captured a vehicle with Russian license plates does not mean that the occupants are also Russian. So if the thieves have a certain level of intelligence, they will try to disguise their true origins as best as possible.

This is applied to IT with VPN over several servers without logging, e.g. Wireguard/OpenVPN implemented. Alternatively, there are of course enough VPN providers where the respective country can be easily selected. In private environments it is also often used to circumvent censorship and geo-blocking or to maintain privacy.