Comment by Dirk Arendt, Head of Government, Public & Healthcare at Trend Micro Germany
After a serious cyber attack, the district of Anhalt-Bitterfeld has declared a disaster situation. A disaster emergency due to a cyber attack – a unique occurrence in Germany so far. The digital meets real life. As symbolic as this step may seem with regard to the state of digitalisation and IT security in public administration, it is ultimately only right, pragmatic and consistent. After all, it allows the authorities to more easily access additional resources to get the situation back under control as quickly as possible.
As a result of the attack, the administration of the district with about 157,000 inhabitants is practically at a standstill for a fortnight. Among other things, no notices can be issued and no more social and maintenance benefits can be paid out. Many citizens are suffering directly from the short-term consequences. But the medium and long-term effects may be even more devastating: if such elementary basic tasks can no longer be fulfilled, this calls into question the fundamental efficiency of the state. The events thus have the potential to severely affect the confidence of citizens. Will this ultimately affect the further progress of digitalisation?
Lessons from the attack
Of course, it is still far too early to speculate on concrete causes and responsibilities. Nevertheless, the current attacks bring to our attention some problem areas that we urgently need to address:
First, attacks on digital infrastructures increasingly impact the physical world. Whether hospitals, petrol pipelines or public authorities are attacked – due to the increasing interconnectedness of all areas of life, we could all become victims of cyberattacks even more frequently in the future. This makes it all the more important that we as a state and society face up to this challenge.
Secondly, it has become clear that, in the case of digital as well as physical disasters, good preparation is essential. Only if there are plans for an emergency can the damage be minimised and repaired as quickly as possible. In cyber space, this includes the necessary tools to quickly detect and respond to attacks. We need to invest more in these infrastructures. The bright spot is that unlike many other disasters, cyber attacks are not acts of God. We have real opportunities to prevent such incidents if we really want to.
Thirdly, municipal institutions in particular still represent a weak point in the fabric of digital administration. While there is increased investment in digital infrastructures at federal and state level and especially in securing them, for example through the creation of CERTs, municipalities and districts are often still lagging behind. Yet these authorities are particularly present in people’s everyday lives and system failures quickly have immediate consequences for individuals. Of course, municipalities only have limited financial and human resources. But there are solutions for this too – for example, IT security services can also be obtained as a “managed service” from highly qualified and specialised partners. This allows for professional cyber defence even with small budgets.
Getting security right at last
After such attacks, some may reflexively blame “digitalisation” and question whether it really makes sense to push it further. I would like to strongly disagree with this: In the future, we will no longer be able to do without digital processes. But it is time to finally get it right, to invest in good solutions and to think about security as an important cross-cutting issue right from the start.