Cybercrime

What is cybercrime?

Cybercrime encompasses all illegal activities carried out via digital systems such as computers, networks and the internet. These crimes are aimed at making financial gains, stealing data, compromising systems or disrupting networks. Cybercrime is extremely diverse and ranges from simple scams, such as phishing emails, to complex attacks on infrastructures, such as ransomware or targeted APTs (Advanced Persistent Threats).

How does cybercrime work?

Cybercriminals use a variety of attack techniques that exploit technical vulnerabilities or human error. The most common methods include

• Malware infections: Malware such as Trojans or ransomware is infiltrated in order to steal data or lock systems.
• Phishing: Criminals pretend to be legitimate sources in order to capture sensitive information such as login data.
• Zero-day attacks: Exploitation of vulnerabilities in software before the manufacturer can provide a patch.
• Social engineering: Deception of employees in order to gain access to internal systems or information.
• DDoS (Distributed Denial of Service): Overloading of networks by a large number of requests in order to paralyze systems.

Cybercriminals are often part of well-organized groups that use specialized techniques such as spear phishing, ransomware-as-a-service or even state-sponsored attacks.

What types of cybercrime are there?

Cybercrime can be divided into different categories:

1. Ransomware: Attacks in which data is encrypted and a ransom is demanded for decryption.
2. Phishing and spear phishing: The attempt to obtain sensitive information through fake e-mails or websites.
3. Data leaks and data theft: Unauthorized access to personal or business-critical data.
4. APT (Advanced Persistent Threats): Long-term, targeted attacks on critical infrastructures or companies, often by state actors.
5. DDoS attacks: Overloading servers in order to disrupt their operation.
6. Financial fraud: compromising payment flows, e.g. through banking Trojans.

How has cybercrime developed in recent years?

Cybercrime has grown exponentially due to the digitalization of processes, the proliferation of cloud services and the increasing use of networked devices. Ransomware attacks in particular have increased as they are highly profitable and often target companies and critical infrastructures. The use of Ransomware-as-a-Service (RaaS) enables even less tech-savvy criminals to carry out highly effective attacks. In addition, attacks have increasingly shifted to the supply chain as companies become more dependent on third-party vendors. Attacks such as the SolarWinds hack or the compromise of software updates show how vulnerable complex networks have become. The professionalization of cybercrime also goes hand in hand with increasing concealment through anonymization services such as the darknet and cryptocurrencies.

How can you protect yourself against cybercrime?

It is essential for IT decision-makers to implement a multi-layered security strategy. Important measures include:

1. Zero trust security model: only grant access rights after thorough verification and minimize trust in internal networks.
2. Security guidelines and training: Raising employee awareness through training on phishing and social engineering.
3. Regular security updates: Systems and applications should be continuously patched to eliminate vulnerabilities.
4. Two-factor authentication (2FA): Introduction of 2FA to secure login processes.
5. Backups: Regular backups of the most important data and systems, ideally offline or in separate networks, so that data can be restored in the event of a ransomware attack.
6. Intrusion Detection Systems (IDS): Implementation of systems to detect and prevent intrusion attempts.

A risk-based security strategy helps to deploy resources effectively and protect the most critical assets.

How do you recognize cybercrime?

IT decision-makers should look out for the following signs:

• Unusual network traffic: Sudden spikes in bandwidth usage or connections to suspicious IP addresses.
• Unauthorized access attempts: Increased number of failed login attempts or accesses outside normal working hours.
• Slowed system performance: Sudden drops in performance may indicate DDoS attacks or malware infections.
• Suspicious emails: Increased phishing attempts or emails based on fake domains.
• Unknown software: New, unwanted programs or tools on devices in the network.

Early detection is crucial. Tools such as SIEM (Security Information and Event Management) help to analyze and correlate security events.

Which tools protect against cybercrime?

IT decision-makers should invest in the following security tools:

1. Endpoint Detection and Response (EDR): EDR solutions detect and respond to threats at the endpoints (e.g. computers, mobile devices).
2. Next-generation firewalls (NGFWs): Provide in-depth protection through packet filtering and attack detection.
3. Intrusion Detection/Prevention Systems (IDS/IPS): Monitor network traffic for suspicious activity and block attacks in real time.
4. Antimalware and antivirus software: Detect and neutralize malicious software.
5. Data encryption: Encryption of sensitive data protects against theft, even if data leaks occur.
6. VPN and SD-WAN: Protect remote connections and segment networks to control access to critical systems.

How do I secure my personal data on the Internet?

For companies and IT decision-makers, protecting personal data means using encrypted connections (TLS/SSL), enforcing strong passwords and implementing identity and access management (IAM). Regular data deletion policies are also important to minimize the amount of sensitive information stored.

What are the legal consequences of cybercrime?

Cybercrime can have serious legal consequences for the perpetrators. In many countries, such offenses are punishable by prison sentences and heavy fines. Companies can also be held liable if they demonstrably fail to comply with security guidelines laid down in data protection laws such as the GDPR (General Data Protection Regulation). Contractual penalties or reputational damage are also common consequences.

What laws are there against cybercrime?

In Germany, the Criminal Code (StGB) in particular regulates cybercrime in sections 202a (spying on data) and 303a (data alteration). Internationally, directives such as the GDPR, the EU’s Cybersecurity Act and the Computer Fraud and Abuse Act (CFAA) in the USA apply. The implementation of these laws varies from country to country, but all aim to minimize the misuse of data and networks and facilitate prosecutions.

What to do if you have become a victim of cybercrime?

1. Limit damage: Immediately disconnect systems from the network to prevent the spread of malware.
2. Alert the incident response team: Internal or external IT forensics teams must analyze the incident.
3. Preservation of evidence: Logs and affected systems should be backed up before changes are made.
4. Inform law enforcement: Depending on the incident, the police and data protection authorities may need to be involved.
5. Inform customers: In the event of data breaches, timely notification of data subjects and authorities is mandatory (according to GDPR).

Who is responsible for cybercrime?

The perpetrators behind cybercrime are diverse. They range from individual perpetrators to organized crime and state-supported groups that specifically pursue economic or political goals. The complexity of modern attack campaigns often points to large, well-financed organizations with specialized resources. Examples include APT (Advanced Persistent Threat) groups, which are often linked to state actors.

How can a company protect itself against cybercrime?

Companies should implement a multi-layered security strategy. This includes

1. Network segmentation: Separation of critical systems to minimize the risk of an attack spreading laterally.
2. Penetration tests: Regular simulation of attacks to uncover vulnerabilities.
3. Safety audits: Conducting regular audits by internal and external experts to ensure compliance with safety standards.
4. Redundant systems and backups: Ensure that operations can be resumed quickly in the event of a successful attack.
5. Cybersecurity insurance: Protection against financial losses due to cyber attacks.

What to do if a company has been hacked?

1. Incident response: Immediate initiation of an incident response plan. Isolate systems to limit the damage.
2. Forensic analysis: Investigation of the attack to find the cause and determine the extent of the damage.
3. Repair and recovery: Ensure that all vulnerabilities are fixed and backups are used for recovery.
4. Communication: Transparent communication with all parties involved, including customers, suppliers and authorities.
5. Long-term prevention: Implementation of improved security measures to prevent future attacks.

How much does it cost to protect yourself against cybercrime?

The costs vary greatly and depend on the size and risk profile of the company. Companies need to invest in security software, employee training, contingency plans and backup solutions. Large companies often spend millions, while smaller companies can start with a budget in the lower five-figure range. The cost of cyber insurance is also rising as ransomware attacks increase.

Zurück zur Übersicht des Glossars