The security research centre SBA Research is Austria's largest research organization dedicated exclusively to the topic of cybersecurity. In his talk, Stefan Jakoubi will discuss why cybersecurity is more than just a technical issue and why it must be part of a company's strategic management. He will provide exciting insights into his work with clients from different industries and share the latest trends with us. We have already asked him for a short interview in advance.

Stefan Jakoubi, as a CISO, consultant and business manager, you have a unique perspective on cybersecurity. What do you currently see as the biggest challenges for companies and how has the threat landscape changed in recent years? 

From my perspective, the degree of networking, the dependence on IT systems, the speed of developments and the sheer volume of data have changed the most. 

The biggest concern for me is the so-called ‘technical debt’. Companies cannot keep up with their basic tasks like cyber hygiene. Instead, new systems and use cases are constantly being added and imposed on an often very fragile basis. In times of a shortage of skilled experts in the IT (security) sector and a tight financial situation, this is unfortunately not a good combination.

Which methods of attack are you most concerned about?

The supply chain and the topic of supply chain security has certainly not been looked at with an open mind in recent years and has been successfully exploited as an attack vector on several occasions. This is also reflected in the strengthening of this topic in international standards such as ISO/IEC 27001 or in regulations such as NIS-2 or the Cyber Resilience Act (CRA).

The most recent cyberattack on Marks & Spencer had massive economic consequences and led to a class action lawsuit. Marks & Spencer had to temporarily shut down its online business, resulting in the loss of hundreds of thousands of dollars. What can we learn from this and how can companies better ensure business continuity in such cases?

The best plan needs to be practised. I have heard Marks & Spencer was keeping plans on file but they were not tested or not sufficiently tested. It is important to note that while the impact was technical (encryption by ransomware), the entry vector was via social engineering. We can learn once again that the human factor - despite all the countless technical security measures - is the key factor in a company's cyber resilience.

What measures should a company take immediately after a cyber attack to minimize the damage and restore customer confidence?

Damage can only be minimized through appropriate emergency plans and trained personnel. In the best-case scenario, I have the expertise in-house, otherwise I should have outsourced an appropriate service (incident response retainer).

It has often been shown that companies that have communicated quite openly about a cyberattack have experienced a significantly lower loss of trust. An incident can happen in any company - there is no such thing as 100% cyber security. But showing that you were able to cope well with such a crisis is evidence of good leadership.

Do you believe that such large-scale attacks will occur more frequently in the future? What do companies need to do to protect themselves in the long term?

Cyber security is a top management issue, because in our digital and networked world the dependency is so enormous - I would say almost regardless of the industry. However, this is not yet the case everywhere; it is often only seen as a cost center or a necessary evil. A dedicated security organization and a corresponding management system are needed to anchor cyber security in the long term and sustainably. In the cyber security sector, this is referred to as an information security management system, which can be set up and certified on the basis of the international standard ISO/IEC 27001. I look forward to discussing this topic in more detail with interested parties at the Expert Talk.

The Expert Talk with Stefan Jakoubi will take place on Thursday 12 June 205 from 18:30 to 20:00 in the SR Executive Learning Space, opens an external URL in a new window at TU Wien Campus Karlsplatz. Expert Talk in English, questions and discussion also available in German, please register here for free participation.