"Security means to reduce vulnerability"
Increasingly powerful cybertacks hit clinics, companies and authorities daily. Linus Neumann of the non-governmental Chaos Computer Club knows what helps.
Interview: Klaus Lüber Mr Neumann, how do you rate the current threat posed by cyberattacks against Germany?
Companies, hospitals and local authorities experience ransomware and blackmail on a daily basis. The real problem isn’t an all-powerful enemy but our own vulnerability and lack of resilience. Until this changes, the cybercrime business will continue to grow. The good news is that solid IT skills can resolve most of the problems.
What do you mean by that?
Security isn’t a state, it’s a process: IT infrastructure can never be seen as “finished” - it has to be continually maintained and improved. Sooner or later it will fail, and you need to be prepared for that eventuality - which is exactly what is meant by resilience. What is more, most attackers aren’t in fact particularly skilled. They simply take advantage of widespread - and therefore widely known - errors. We need to finally learn lessons from this.
What has changed most in the last two to three years: the tools or the objectives of attackers, or the way they are organised?
The method remains the same but is being increasingly perfected. Attackers encrypt systems to disrupt operations. They delete backups so that the systems can’t be restored, download data and threaten to make the information public. That’s how they extort a ransom. Because this method works almost everywhere, the criminals are becoming increasingly specialised and commercial.
What is changing as a result of artificial intelligence?
AI is helping attackers and defenders alike. It makes technical vulnerabilities much easier to detect now - but unfortunately also makes it easier to exploit them. To defend systems, updates can - and must - be used to ensure the security of technology. AI makes it easier for attackers to get into cybercrime in the first place. Social engineering - which involves exploiting human vulnerabilities - has also become easier, better and therefore more successful thanks to AI.
Germany plans to allow “active cyber defence” in future. What do you think about this?
Security is achieved by reducing vulnerabilities, not by threatening counterattacks against criminals who have far less to lose. We should invest in defence and resilience, not in attack.
Linus Neumann is spokesperson of the Chaos Computer Club, Europe’s largest association of hackers. He’s what is known as a white hat hacker - an IT security expert who identifies security holes in order to plug them before criminals can exploit them.
