Sind deutsche Unternehmen öfter im Visier von Cyberkriminellen als andere Länder? Warum dürfen sich Regierung und Wirtschaft nicht auf dem IT-Sicherheitsgesetz ausruhen? Und was bedeutet der Innovations- und Digitalisierungsprozess für die Rolle und Skills des CSO? Steven Wilson, Head of Business des European Cybercrime Centre (EC3) von Europol beantwortet uns diese und weitere Fragen in einem exklusiven Interview.
Sie wollen sich auf die stetig wachsenden Anforderungen an den CSO vorbereiten?
Bringen Sie sich bei der Handelsblatt Jahrestagung Cybersecurity im November in Berlin auf den erforderlichen Stand der Dinge!
Mr. Wilson, in the beginning of 2016 you became Head of EC3. What’s your personal résumé after the first couple of months in the new job? What are the main challenges?
Steven Wilson: It has been a challenging but hugely interesting 6 month period, getting to understand the different issues and capabilities of the member states has been a key aspect for me. We are fortunate at Europol to have Liaison officers from each member state as well as many other countries that we have working agreements with. I have met with all of the heads of these units and discussed in depth our support for their countries in all aspects of cybercrime.
In addition I have also met with the heads of each cybercrime unit and discussed mutual co-operation and operational priorities. It is very important to me that EC3 directly reflects the needs of the member states.
One of the key challenges is capacity building to ensure that all member states have a strong capacity to investigate and prevent cybercrime. In the current economic times, many states simply do not have the money to invest in costly cybercrime solutions. That is where EC3 can add significant value through identifying what is working best and co-developing solutions that can be applied across all nations. A good example of this is the “ freetool project” where EC3 have liaised with industry and academia to gain access to forensic investigation tools at no cost. These tools are made available to law enforcement on a central platform hosted by EC3.
Do you see differences in the level of cybercrime in the various European countries? Are some countries targeted more than others? How is Germany doing in that comparison?
Steven Wilson: Cybercriminals are often economically driven and we do see greater levels of attacks in more economically advantaged countries but the fact is that all countries are affected by cybercrime to an increasing level.
I have been particularly impressed by Germany’s response to cybercrime, we have very close liaison with the BKA and they have been at the forefront of some of the most impactive operations tackling high level cybercrime across the EU. They have invested in technical resources and have some of the highest regarded investigators in the EU at their disposal.
In addition a senior officer from the BKA chairs our joint Cybercrime Taskforce – JCAT, a group of cybercrime experts from member states and other significant countries who are based together at Europol. They act as the co-ordinators for international investigations and speed up highly complex enquiries that previously have either remained un-detected or taken years to resolve. Germany’s role in steering this group and focusing on the key threats is central to the EU’s fight against cybercrime.
In July 2015, Germany introduced the IT-Sicherheitsgesetz (IT-security-law). Critics point out that the law is going into the right direction, but is far from reaching the goal. A new amendment will come into effect in 2017. My question: In a dynamic and always changing field like Tech & IT, is it even possible for jurisdiction to set up suitable laws for a period of multiple years?
Steven Wilson: There is no legal solution that could hope to address how quickly technology advances but the hope is that by drafting carefully thought out laws, there is sufficient room for the interpretation of these laws to evolve as the technology changes. Where completely new technology emerges that represents a threat to society then that is when new laws need to be drafted. It is an important function of Europol to highlight these significant changes in the iOCTA (internet Organised Crime Threat Assessment) so as to inform the national debate and the European commission.
Every company is trying to innovate digitally, what does that mean for the CSO?
As technology advances companies will increasingly seek to take advantage of new platforms and opportunities. The CSO needs to be able to assess the risk/ benefit through adopting this technology. Increasingly the risk assessment must appear as a corporate risk and be visible to the Chief Executive and the board. Cybercrime represents a serious threat to businesses of all sizes and there needs to be a company wide recognition of this.
Looking into the years to come: What are new ideas/aspects that every CSO should integrate in his work from now on?
Steven Wilson: For me the CSO has got to embed cybersecurity as part of corporate culture, we have seen massive improvements over the years with the likes of health and safety as an example of where we can change corporate culture so with a concerted effort this can be done. It is not enough to invest in technology solutions as in many cases we see that the best technology solutions are overcome by human factors. We need to ensure that companies have a workforce who understand the threat and the basic steps required to protect against it. CSO’s should ensure that regular programmes educating staff on the threat are introduced and that testing of staff awareness is undertaken. We have seen companies that run a testing programme significantly improve their security performance.
Diskutieren Sie im November
mit Steven Wilson und weiteren Cybersecurity-Experten
bei #hbcyber in Berlin!