In view of the demon­stra­bly very high suc­cess rate of cyber­at­tacks, the IT secu­rity law requires that com­pa­nies that oper­ate crit­i­cal infra­struc­tures and there­fore have highly sen­si­tive data should have spe­cially pro­tected IT sys­tems in place.

This is because cyber crim­i­nals are increas­ingly gain­ing access to crit­i­cal sys­tems in order to encrypt highly sen­si­tive data by using installed mal­ware. They use it to demand ran­som money, com­mit theft of intel­lec­tual prop­erty or manip­u­late data.

If you go a step fur­ther in this sce­nario and look at the case where pro­duc­tion com­put­ers are manip­u­lated directly, this can trig­ger a chain reac­tion with seri­ous con­se­quences.  Attack­ers can demand con­sid­er­able sums of money and bring the pro­duc­tion facil­ity of the com­pany con­cerned to a com­plete standstill.

Since such sce­nar­ios never remain hid­den from the pub­lic for long, such a “spi­ral of con­cate­na­tions” can, among other things, cause seri­ous dam­age to the company’s image, scar­ing off poten­tial and exist­ing customers.