In the interview with Jürgen Ruf, CEO and co-founder of MTG AG

MTG AG was founded in 1995 and is one of the leading specialists for sophisticated encryption technologies “Made in Germany”. The company simplifies and centralizes the management of cryptographic keys and identities while taking industry-specific requirements into account. The MTG software meets the highest cryptographic and operational standards in accordance with NIST and BSI. The company’s development guidelines include secure coding constructs, automated code analysis, and penetration testing. MTG is already working on solutions in the field of post-quantum cryptography (PQC) to protect its customers against future threats posed by quantum computers.

In an exclusive interview with Jürgen Ruf, CEO and co-founder of MTG AG, conducted by Silicon Valley Europe, we explore the company’s many years of experience in the field of IT security. Ruf emphasizes that, in particular, SMEs must now increasingly focus on IT security to protect themselves against growing threats. Rapid technological developments are leading to constantly increasing, new requirements for IT security, such as NIS2, DORA, and the EU Cyber Resilience Act. Companies face the challenge of keeping pace with these rapid changes while also protecting their systems and data. However, implementing enhanced security measures is not without its problems, as it is often associated with high costs, specific expertise, complex implementations, and increased training requirements for employees.

Silicon Valley Europe: Mr. Ruf, what specific challenges do you see for SMEs in the field of IT security?

Jürgen Ruf: Dealing with modern IT security and the resulting requirements is challenging and usually requires in-depth knowledge and expertise. SMEs are often constrained by limited resources and budgets, which makes it difficult for them to implement a comprehensive IT security solution. In addition, they often lack skilled workers and experts in the field of IT security. They also have to deal with complex regulatory requirements.

Silicon Valley Europe: What simple measures can SMEs take to improve their IT security?

Jürgen Ruf: An important step is the implementation of standard security measures such as firewall configuration, regular employee training on security topics, regular software updates and patches, as well as the use of two-factor authentication. In addition, they should also regularly conduct security checks and examine their systems for vulnerabilities. Regular backups should also be performed, and a comprehensive IT security strategy should be developed.

Silicon Valley Europe: Let’s now take a look at the legal requirements. Could you give us a brief overview of the most important legal requirements such as NIS2, DORA, and EU CRA?

Jürgen Ruf: Of course. NIS2 is an EU regulation that governs the IT security of critical infrastructures. DORA is an EU regulation that governs the cybersecurity of public and private organizations in the financial and insurance sectors. The EU Cyber Resilience Act (CRA) is a new regulation aimed at improving the cybersecurity of digital products and services in the European Union. For companies in Germany, this means they must meet the new requirements to ensure the security of their digital products and services.

Silicon Valley Europe: How can companies best prepare for these legal requirements?

Jürgen Ruf: Companies should first conduct a comprehensive inventory of their IT infrastructure and processes to identify vulnerabilities. They should then take specific measures to address these vulnerabilities and ensure compliance with legal requirements. This can be achieved through the implementation of security standards, regular employee training, and the use of technologies such as PKI and KMS. It is also advisable to conduct regular audits and penetration tests to verify the effectiveness of security measures.

Silicon Valley Europe: What trends and developments do you see in the field of authentication and encryption?

Jürgen Ruf: In the field of authentication and encryption, we are seeing a trend toward multi-factor authentication methods and procedures that offer higher security than traditional password-based systems. In addition, encrypted communication channels and end-to-end encryption are gaining in importance, particularly in industries with high data protection requirements. The development and implementation of post-quantum cryptography is also becoming increasingly important in order to address future threats posed by quantum computers. For companies, the automated management of various keys is therefore becoming increasingly important; certificate and key life cycle management are currently on the rise.

Silicon Valley Europe: How do Public Key Infrastructures (PKI) and Key Management Systems (KMS) differ in their application?

Jürgen Ruf: PKI and KMS are both essential components of modern IT security architectures, but they differ in their application. PKI enables the management and use of digital certificates and key pairs for secure communication and authentication. It is particularly useful for ensuring the identity of users and devices. KMS, on the other hand, focuses on the secure management of cryptographic keys, including the generation, storage, distribution, and destruction of these keys. Both systems complement each other and contribute together to increasing IT security.

Silicon Valley Europe: How can cloud solutions help compensate for the shortage of IT security personnel?

Jürgen Ruf: Cloud solutions offer a scalable and cost-efficient way to outsource security functions and thus compensate for the shortage of IT security personnel. By using cloud services, companies can draw on the expertise and resources of specialized providers who implement and manage advanced security measures. In addition, cloud solutions enable rapid adaptation to new threats and technological developments without companies having to invest in their own, often expensive IT infrastructure.

Silicon Valley Europe: MTG AG is very well positioned in the field of post-quantum cryptography (PQC). What risks do you see in the use of cloud solutions, and how is MTG preparing for the threats posed by quantum computers?

Jürgen Ruf: In light of the threats posed by quantum computers, MTG is developing post-quantum cryptography solutions that are resistant to the computing power of quantum computers. This includes the implementation of hybrid methods that combine classical and post-quantum cryptographic algorithms to ensure a seamless transition phase. When using cloud solutions, risks such as dependency on third-party providers, potential data leaks, and compliance with data protection regulations exist. These can be managed through careful research and certification of cloud providers.

Silicon Valley Europe: Could you explain what hybrid methods in post-quantum cryptography are and what advantages they offer?

Jürgen Ruf: Hybrid methods in post-quantum cryptography combine traditional cryptographic algorithms with new, post-quantum-secure algorithms. These approaches offer the advantage of introducing an additional security layer that is resistant to both current and future threats posed by quantum computers. Another advantage is interoperability with existing systems, enabling gradual and low-risk implementation. Companies can thus future-proof their security infrastructure without having to completely replace existing systems.

Silicon Valley Europe: What new technologies and trends do you see in the field of IT security and encryption?

Jürgen Ruf: We are currently observing several exciting developments in the field of IT security and encryption. These include the increasing integration of artificial intelligence and machine learning for threat detection and defense, the further development of zero-trust architectures, and the increased use of PKI and blockchain technologies to secure transactions and identities. In addition, post-quantum cryptography is gaining in importance to ensure security against future threats posed by quantum computers. These technologies promise to take IT security to a new level and better protect companies against increasingly complex cyber threats.

Silicon Valley Europe: Thank you for this extremely exciting and informative conversation.

...