In 48 hours, a reliable management report on the security status of your IT infrastructure - in an interview with Lukas Baumann, Managing Director of LocateRisk based in Darmstadt
LocateRisk ensures greater efficiency, transparency, and comparability in IT security through automated, KPI-based IT risk analyses. Decision-makers from management and IT receive a clearly prepared report on the security status of their company-wide IT infrastructure within just 48 hours. Based on the score value, which is based on publicly available data from hundreds of sources, the current security status can be seen, and the effectiveness of implemented protective measures can be demonstrated through regular checks. The configuration-free, non-invasive examination of networks and systems specifically identifies deficiencies in the security status of the IT infrastructure. In an interview with Lukas Baumann, Managing Director of LocateRisk, we talk today about infections, vulnerable software solutions, vulnerabilities in firewall configurations, encryption errors, configuration errors, and data breaches—and what all of this has to do with working from home.
DIGITAL FUTUREmag: Your software is not only Made in Germany but also Made in Darmstadt, one of Germany’s best-known security software strongholds. What input or influence did the partners located here in Darmstadt have?
Lukas Baumann: The support from the local ecosystem, such as the Digital Hub and the StartupSecure start-up initiative funded by the Federal Ministry of Education and Research, was very helpful for us. The exchange with other security start-ups based here also gave us many good additional ideas.
DIGITAL FUTUREmag: Mr. Baumann, there are many software tools available for checking IT security. What makes your approach special?
Lukas Baumann: Conventional tools provide complex information for specialist users. With our analysis, we summarize the complex security situation of an entire company into understandable KPIs. All fully automated, without configuration, and with just one click. This is then compared with data from other companies. This creates a benchmark. I think this is somewhat unique.
DIGITAL FUTUREmag: You mention comparability and a benchmark here. Which data is used for the comparison?
Lukas Baumann: Our database includes analyses of over 30,000 companies and is based on measurable performance indicators for cybersecurity. This enables a basic comparison. However, what is particularly interesting is how a company’s IT security compares in the industry benchmark. Since our analysis system is non-invasive, customers can compare their security status with individually definable competitors. A good result proves that the evaluated company places great emphasis on IT security, which is a clear competitive advantage in the course of digitalization.
DIGITAL FUTUREmag: At it-sa, one of Europe’s largest trade fairs and conferences on IT security, you hardly meet any managing directors anymore. Decision-makers leave IT security to the experts and trust that they will do everything correctly. Often, however, it is forgotten that, in the final analysis, managing directors are held liable for the consequences. To what extent, therefore, are your reports also useful for managing directors without specialist knowledge in IT security?
Lukas Baumann: First of all, your assessment is completely correct. Managing directors leave IT security to the specialist users—provided they have any. Frequently, we find a responsibility gap where the issue is simply deferred to external service providers. The KPI-based analyses make the abstract IT security situation transparent, understandable, and trackable over time. Management can see at a glance how the company-wide or group-wide security situation looks. Following the motto: “If you can’t measure it, you can’t improve it.” — Peter Drucker. Based on these findings, well-founded decisions can be made regarding measures and budgets. Their success can be tracked via the score trend. In addition, the IT security of suppliers and subsidiaries can be measured and evaluated.
DIGITAL FUTUREmag: The pandemic forced many companies to move their employees to remote work. This creates new security gaps. Weaknesses in the IT infrastructure can lead to network infections, and software solutions become vulnerable. Which weaknesses in the IT infrastructure are currently particularly at risk due to the connection of employees working from home?
Lukas Baumann: Remote work leads to a connection between corporate networks and employees’ home networks. These, however, are usually not at the same security level. How often do employees at home install updates on smart TVs, printers, and routers? Are passwords sufficiently secure? Which devices are still in the home networks? Does the company even notice if data is being transmitted via employees’ internet connections? All these are questions that administrators must address today—because well-trained IT security personnel are scarce. Our solution helps enormously in maintaining an overview and assessing the security situation. All of this ultimately leads to good cyber hygiene.
DIGITAL FUTUREmag: You use the term cyber hygiene here. What does that mean? Could you explain it in more detail to our readers?
Lukas Baumann: We repeatedly identify orphaned systems in companies. If cybercriminals find a way into the network via these old systems—most of which lack updates—the attack is an easy win. Continuous asset management is the foundation for good cyber hygiene. Cyber hygiene is, so to speak, the basis of any IT infrastructure and the measures based on it. Going into all the details would certainly go too far. Basic principles of cyber hygiene include password policies with multi-factor authentication and finely granulated user rights, asset management that facilitates regular software updates, and an IT security management system including its continuous monitoring. Backups and their restoration should also be tested.
DIGITAL FUTUREmag: As an IT specialist, you have a deeper insight into the threat situation, particularly in medium-sized companies. How do you personally assess the development of the IT security situation in the coming months?
Lukas Baumann: Unchanged high—hopefully, IT security will now receive more attention in management due to increasing digitalization. We repeatedly encounter IT managers whose budgets are completely exhausted. Management needs to realize that good IT security requires proactive investments. Reacting after the fact will be much more expensive—it’s almost like with COVID-19.
DIGITAL FUTUREmag: In conclusion, please give us your top three recommendations for action for top management when it comes to IT security.
Lukas Baumann: 1. Obtain a measurable and understandable overview of your security situation, which also includes the security situation of your suppliers.
2. Create and monitor IT security management processes in your company.
3. Consider the current events when it comes to your IT security. Attackers are extremely dynamic/disruptive.
DIGITAL FUTUREmag: Thank you very much for this insightful and informative conversation. We wish your company continued success in achieving your goals.
Lukas Baumann: Thank you very much from our side. To improve the security situation, we are conducting a study on IT security in Germany, where participants receive a free IT security analysis. You can’t get an easier insight into your security situation than this. Your readers can participate in the study here: