In the interview with Alexander Dörsam, CTO of antago GmbH

The European Systemic Risk Board (ESRB) estimates the global costs of cyberattacks on the financial sector to range between 45 and 654 billion US dollars. Juniper Research predicts that in 2023, over 146 billion US dollars’ worth of data records will be stolen due to internet security breaches. Shocking and alarming figures. Such large sums are the result of numerous small and large-scale heists carried out by internationally operating cybercriminals. Protection against these attacks, which are currently divided into individual work packages and meticulously planned, is provided by antago GmbH, based in Bensheim near Darmstadt. The company has long held a top position in the consulting landscape for penetration testing, incident response, forensics, and crisis simulations.

For over 10 years, this IT company—with a hacker background and a young, dynamic team of experts—has been delivering high-quality consulting and analysis in the field of information security, drawing on experience from countless, sometimes highly sensitive projects. Today, we speak with its technical lead, Alexander Dörsam, about the importance of crisis simulation training, Active Directory audits, or red teaming, and what it means to make a DAX corporation’s CEO aware that “the shop is in danger.”

DIGITAL FUTUREmag: Mr. Dörsam, thank you for taking the time to talk to us about your work, your goals, and of course your offerings in an increasingly threatened IT environment. Before we begin, we’d like to know how you assess the current threat landscape for businesses.

Alexander Dörsam: The threat landscape is immense. Highly skilled attacks against companies are continuously being carried out for various motivations. At the same time, we’ve seen a significant opening up of corporate IT in recent years to enable home office concepts. This means we now have both a truly high level of sophistication on the attackers’ side and a more exposed corporate IT environment. This inevitably leads to an increasing frequency of successful attacks. In many cases, these attacks are also extremely damaging to the victims, as the attackers often gain access to the highest permission levels within the IT environments.

DIGITAL FUTUREmag: At the beginning, we cited specific figures estimating the global costs of cyberattacks—initially focusing solely on the financial sector. Even these amounts are considerable. How are such values composed, and what methods do attackers typically use?

Alexander Dörsam: The greatest costs usually consist of operational downtime and the ransom itself. All too often, we see companies becoming unable to operate overnight, isolated from their customers, with operations coming to a complete and sustained standstill. The process is often quite similar. It begins with the initial phase of compromise or infection, which grants the attacker access to the victim’s system. This is followed by the escalation phase, during which the attacker’s privileges are typically expanded dramatically. Once this phase is complete, there is usually a handover. Here, attackers sell such access to other hackers so that they can leverage the victim’s elevated privileges to execute their own business models—such as encrypting data and extorting ransom payments.

DIGITAL FUTUREmag: Cybercrime has become its own industry. What changes over the past few years have made this development possible?

Alexander Dörsam: In my view, this development has multiple roots. On the one hand, the use of pseudonymized currencies has made it possible for “anyone” to carry out extortion with relatively low risk for the perpetrator. Added to this are services between hackers, such as Ransomware-as-a-Service or Access-as-a-Service, where attackers sell malware or access to companies to other criminals. Furthermore, knowledge about digital attacks has become far more widespread, making it much easier to train oneself as a hacker. In recent years, it has also become apparent that some hacker groups are not only tolerated by certain states but are likely even supported by them. At the same time, many companies have failed to keep pace with implementing defensive measures and therefore present a very large attack surface.

DIGITAL FUTUREmag: Let’s turn to the companies that are often the focus of such attackers. Let’s start with preparation. What are the most important recommendations you can share with us based on your experience?

Alexander Dörsam: First and foremost, IT security should be given appropriate attention. In my view, there is almost no company whose revenue does not depend almost 100 percent on IT. Therefore, IT needs the corresponding resources to fulfill its obligations. All too often, however, in-house IT is severely understaffed and has limited financial means. Without addressing this deficit, adequate IT security is impossible. Once a company has overcome this hurdle, we always recommend sticking to the basics and ensuring that the digital foundation is sound. All too often, companies instead deploy supposedly modern and simplifying tools that introduce additional abstraction layers and are then compromised using “old” attack methods that these tools fail to detect.

DIGITAL FUTUREmag: As part of the preparations, audits are also included. What is the purpose of these audits, and which ones particularly contribute to IT security or the validation of IT compliance?

Alexander Dörsam: Audits serve various purposes. Often, audits are seen merely as a controlling tool, indicating whether the status quo is “good” or “bad.” The true added value of audits only becomes apparent when the customer interprets them as a shortcut. A high-quality audit not only reveals the current state but also outlines the next steps and how these can be efficiently implemented. While an audit should highlight deficiencies, its actual purpose is to empower the customer to rectify them. The quality of service providers often varies significantly in this regard. For example, the goal is not for an audit to result in the purchase of a different firewall. Instead, it’s about identifying conceptual weaknesses and addressing them with minimal effort.

DIGITAL FUTUREmag: According to a Microsoft statistic, 95 percent of all companies and 88 percent of the Fortune 1000 use the Active Directory directory service.(1) This makes it a popular target for hackers. Why is that?

Alexander Dörsam: The Active Directory serves as the central brain of any Windows-based environment. Whoever controls the Active Directory typically has power over all of the company’s systems. This makes it an extremely lucrative target for attackers. At the same time, the level of knowledge regarding the defense of an Active Directory is extremely low. For the past three years, there have been hardly any attacks that did not involve the Active Directory, and most attacks could have been prevented with appropriate preparation without requiring utopian levels of effort. Additionally, Microsoft and, among others, the BSI point out that an Active Directory is virtually impossible to restore. This is due to the various ways an attacker can permanently embed themselves within a domain structure. This means that in the event of a compromise, theoretically only a complete rebuild is possible, which would terrify almost any administrator. In reality, we are often forced to find a middle ground. However, the Active Directory remains the riskiest IT asset of a company, as everything else depends on it.

DIGITAL FUTUREmag: In your portfolio, you also offer Red Teaming. What does this entail, and what is the process like?

Alexander Dörsam: In the lifecycle of IT security, there are various modules. The classic penetration test is a tool for prevention and is typically used early on to identify vulnerabilities. Once a certain level of maturity is reached—or if management has a particularly poor understanding of IT security—it makes sense to take the next step and become more invasive.

Red teaming is usually a highly formal process in which we implement an attack scenario in the customer’s real IT environment. We typically start from a client PC and attempt to obtain the permissions of a domain administrator during the course of the project. This gives the customer the chance to check the realistic escalation in their own network on the one hand and to question their own monitoring on the other.

Often, our clients observe their systems and log files during a red teaming exercise to find out whether our attack is detected, i.e., recognized. It is therefore a great tool for demonstrating actual vulnerability and checking the performance of your own monitoring and detection methods. Essentially, it provides a good opportunity to prepare for an emergency and close any monitoring gaps.

DIGITAL FUTUREmag: So, crisis simulation and the associated training seem essential to really prepare a team for an emergency. Where do the limits of your consulting services lie, and where does the company itself need to take appropriate responsibility?

Alexander Dörsam: Fundamentally, responsibility always remains with the customer. It is important that the customer is aware of the significance of the work and the deployment of necessary resources. This means that the customer must diligently follow up on the vulnerabilities identified and take appropriate action. Ultimately, the process of penetration testing, red teaming, or incident response can always be outsourced, but the monitoring and the starting signal must come from the customer. To be able to give this starting signal, a predictable and monitored IT environment is required. To achieve this, it is important to know the existing risks, isolate them as best as possible, and monitor remaining communication and activity for anomalies.

DIGITAL FUTUREmag: Is IT security without gaps even possible, or is that an unattainable dream?

Alexander Dörsam: I consider an IT infrastructure completely without gaps to be a pipe dream. The goal should rather be to achieve “appropriate” IT security for the matter at hand, and I definitely believe this is possible. That is the motivation behind our daily work.

DIGITAL FUTUREmag: Mr. Dörsam, let’s take a look into the future. How will IT security develop, and who will be ahead in three to five years—cybercriminals with increasingly refined division of labor, or companies that have learned to properly assess risks and protect themselves effectively against them?

Alexander Dörsam: This is almost a philosophical question, which I can only speculate about. Over the past decades, companies—especially small and medium-sized ones—have massively underestimated the problem. Unfortunately, looking in the rearview mirror offers little hope for quick insight. It would be nice if companies were simply more aware of the dangers. But the number of companies that are appropriately addressing their IT security is now increasing. At the same time, the trend is moving toward the cloud, which shifts some protective obligations and measures to the manufacturers. Here, it is already clear that providers have learned a lot and, in my view, the vast majority are fulfilling their responsibilities well. However, looking ahead just three to five years, I still see criminals ahead, as today’s Active Directory attacks are carried out using attack techniques that are certainly already 10 to 15 years old.

DIGITAL FUTUREmag: Thank you very much for the insight into the diverse ways to optimize your own data security and your personal assessments.