In the interview with Mario Kalde and Phillip Hallmann, CEOs of AROUND IT-Security GmbH

In today's digital era, data protection in cities and municipalities is of paramount importance. Alarming is the fact that, for example, nine out of ten medium-sized companies in Germany fall victim to hackers. However, there are also experts who understand the mindset of these criminals and how easily they can carry out successful attacks via the internet. Through their expertise, Mario Kalde and Phillip Hallmann ensure that municipalities do not become part of such statistics. AROUND IT-Security GmbH places great emphasis on clear and understandable cost structures without hidden fees, so that customers from the public administration know exactly what they are getting for their money. In the DFmag interview, the two specialists explain what transparent investments to expect, which state-of-the-art technology and proactive approaches they use to sustainably protect e-government against web-based threats at all times.

DIGITAL FUTUREmag: Mr. Hallmann, what current developments and trends do you observe in the field of cybersecurity for municipalities?

Phillip Hallmann: Recently, a worrying trend has emerged: zero-day attacks and supply chain attacks are continuously increasing. These targeted cyberattacks exploit vulnerabilities that are not yet publicly known and for which there are consequently no defense measures or patches available. At the same time, the risk from supply chain attacks is increasing, in which hackers infiltrate systems by exploiting vulnerabilities throughout the supply chain, from software suppliers to hardware manufacturers. For municipalities, this means that they must not only focus on internal security measures but also on the security of their external partners. The rising number of these attacks underscores the need for municipalities to constantly review and adapt their cybersecurity measures to ensure the protection of their data and infrastructure.

DIGITAL FUTUREmag: How frequently and in what ways are government offices and authorities actually targeted by online attacks?

Phillip Hallmann: According to the 2022 BW Crime Statistics, there was a worrying increase in cybercrime of +3.7% compared to the previous year, amounting to around 11,000 cases. These alarming figures highlight the urgency of addressing this issue. Particularly concerning is the increased threat from Russia, especially since the war of aggression against Ukraine. A commonly used method by cybercriminals is ransomware, also known as extortion software. In this type of attack, files are encrypted and (apparently) released again in exchange for ransom.

Ransomware attacks are often received via dangerous attachments or file downloads. However, what is particularly alarming is the fact that social engineering attacks on municipalities are remarkably successful. The click rates are disproportionately high compared to medium-sized companies. This highlights the urgent need for education and training to protect municipalities from phishing attacks. In fact, 90% of attacks are only successful because people are manipulated or tricked into taking action. Unfortunately, many municipalities have recently fallen victim to social engineering attacks. Here are some examples:

- On 09.07.2021, the district of Anhalt-Bitterfeld declared a state of disaster due to a severe cyberattack.
- In Ludwigshafen am Rhein, data was encrypted (ransomware) at the end of October 2022.
- In Potsdam, data was also encrypted (ransomware) on 29.12.2022.
- Ludwigsburg was deliberately attacked by an employee via an infected email on 10.05.2023.
- In Burladingen, data was encrypted by ransomware on 13.07.2022.

It is crucial that we are aware of this threat and take proactive measures to protect our communities and citizens.

DIGITAL FUTUREmag: What potential impacts can hacker attacks have on public administration, both in terms of data protection and daily operations?

Phillip Hallmann: The impact of cyberattacks on various municipalities was extremely severe and required significant effort to restore and improve security. This had the following consequences, among others:In the district of Anhalt-Bitterfeld, important services for citizens were unavailable or only partially available for more than 207 days. The restoration of data and the reactivation of the IT network are expected to take an entire year and cost approximately 2 million euros. In Ludwigshafen am Rhein, more than 14,000 people were affected, whose data was published on the darknet. The city had to introduce new IT systems with 24-hour monitoring and raise awareness among its employees about the increased threat. The direct costs of this cyberattack amounted to 1.7 million euros, and it took several months to resolve the attack. In Potsdam, it took about a month for the municipality to regain unrestricted access to its data and programs. Ludwigsburg was completely offline for two days but was able to restore most services on 21.05.2023. In Burladingen, employees were forced to take compulsory leave, and tasks were processed in the conventional way using paper. It took about two weeks to resolve the situation. Such examples show that cyberattacks not only represent significant financial burdens but also require a massive amount of time and resources for recovery and security improvements. Prevention and training are crucial to prevent such incidents in the future and protect municipalities from the severe impacts of cyberattacks.

DIGITAL FUTUREmag: Keyword Awareness: How can organizations best raise and train staff awareness of data protection within their workflows?

Mario Kalde: We have had very positive experiences with getting staff “on board” by first showing them what’s going on out there and how cyberattacks actually play out from the attacker-victim perspective. We then run workshops to teach employees how to actively recognize and prevent phishing attacks. Using simulated phishing attacks and targeted training content, we continuously train participants and turn them into a kind of human firewall. This also helps protect them in their private lives.

DIGITAL FUTUREmag: What specific preventive measures and precautions should decision-makers in the public sector—CTOs, CDOs, digitalization officers, or mayors—take, and where does your strategic and technological approach set you apart for the benefit of your clients?

Mario Kalde: First, it’s essential to start with the basics. One key question every decision-maker should ask is: Is the latest software—such as browsers or application servers—up to date across my organization? Many institutions invest heavily in software licenses, but it’s important to check whether these investments are being used efficiently and whether all systems are securely configured. Our experience shows that there is often a significant need for action here. Another critical point is data backup: Where exactly are the essential data stored? How quickly can critical business processes be restored in an emergency? Many organizations lack concrete, practiced emergency plans for such scenarios. Our unique approach is to shift perspectives. We actively adopt the mindset of a potential attacker to identify vulnerabilities. After that, we work closely with our customers to address these weaknesses. However, if vulnerabilities are already known and systems are misconfigured, it may be more effective to take the defender’s perspective—as an IT administrator—and implement corrective measures directly.

DIGITAL FUTUREmag: How can municipalities ensure that their IT infrastructure and systems are regularly checked for vulnerabilities and updated?

Mario Kalde: To ensure a robust and secure IT infrastructure in municipalities, I recommend conducting regular simulated attacks (penetration tests) with varying scopes. It’s also essential to ensure that critical updates and patches are installed without delay. Even with an infrastructure of 2,000 endpoints, it’s possible to implement ad hoc patching with just about one hour of effort per month.

One of the most effective measures in the modern IT landscape is automation. Third-party patch management solutions, for example via RMM systems, can significantly contribute to efficiency. However, it is important to emphasize that solid patch management is the first step. Only by critically reviewing this management can gaps be identified and addressed accordingly. This should always be prioritized before taking further measures. A simulated internal attack can also provide valuable insights by uncovering not only obvious but also hidden vulnerabilities that are often overlooked. As far as vulnerability management is concerned, the initial setup may seem straightforward. However, it often turns out that operational challenges arise. There is often a lack of technical know-how, especially when it comes to securely configuring specialized applications. Therefore, it is essential to first clarify the basics and conduct regular penetration tests, with a focus on actively remediating identified vulnerabilities.

DIGITAL FUTUREmag: What specific support should external service providers and professional solution providers offer in this context?

Mario Kalde: Rather than primarily focusing on software sales, external service providers should increasingly concentrate on enhancing their customers' IT security levels. No software solution can cover all security gaps. Many systems, such as Windows, already provide extensive basic security. Therefore, service providers should be able to recommend and implement specialized tools that effectively defend against individual attack vectors.

DIGITAL FUTUREmag: You were honored with the renowned Gründer.de Award 2023 for your outstanding entrepreneurial achievements. Naturally, we are interested to know: What exactly led to this recognition?

Mario Kalde: We are fortunate to have built solid relationships with renowned customers from the business and public sectors in a short time. This organic growth serves as both confirmation and motivation for us. Our main goal has always been to enhance our customers' security levels by optimally utilizing existing technologies. This was recognized here, and the foundation is quite simple: honest and transparent collaboration with our customers.

DIGITAL FUTUREmag: Let's take a look into the crystal ball. What future innovations and challenges can be expected in the field of cybersecurity for municipalities?

Phillip Hallmann: The digital transformation of municipalities will undoubtedly continue to advance, revolutionizing the connection between citizens and their administrations. We can expect exciting innovations such as intelligent infrastructures, networked services, and perhaps even the use of AI in public administration. However, these advancements also bring new challenges. The growing networking means a larger attack surface for cybercriminals. Additionally, the increasing complexity of technologies will require continuous further education and sensitization of employees. Another point is the protection of personal data, which becomes increasingly critical with the expanded use of cloud technologies and IoT devices. We must therefore prepare for a continuous race between technological progress and securing these technologies.

DIGITAL FUTUREmag: Many thanks for these truly exciting insights into your offering. We wish you continued success.

Thank you very much from our side as well, and best regards!