The threat in cyberspace is currently higher than ever before. Gang-based, organized cybercrime, the instrumentalization of artificial intelligence, increasing globalization and the associated digitalization, as well as global conflicts all contribute to making cybercrime one of the greatest threats of our time.
Malicious software or malware refers to various types of software that aim to damage computer systems, steal data or extort money from victims.
Examples include viruses, Trojans, spyware, ransomware and rootkits.
Cyber attacks are often carried out using malware. In a ransomware attack, for example, the hacker tries to persuade the user to perform an action such as clicking on a link. This executes the malware and the hacker can infiltrate the network, encrypt and steal data and sell on the darknet or delete it.
Malware is spread, for example, via infected email attachments (known as phishing) or can be hidden in free software downloads. Hackers also take advantage of vulnerabilities, known as exploits, in software or operating systems to install malware or gain unauthorized access to systems. Misconfigurations, programming errors or outdated software also contain such security vulnerabilities.
Just how versatile and fast-moving malware is can be seen from the following figure: 250,000 - this is the average number of new malware variants every day.
As a preventive measure, comprehensive vulnerability management is therefore essential: this is a continuous process that constantly identifies, evaluates, eliminates, monitors and reports on weak points in the system.
Complex IT environments, especially in hybrid or cloud infrastructures, the large number of vulnerabilities and the increasing lack of human resources in the IT sector require effective and automated processes to combat vulnerabilities.
You can imagine that it is impossible for administrators in an organization to check vulnerability databases 24/7 and analyze thousands of lines of log files in real time in addition to their daily workload.
SIEM (Security Information and Event Management) in particular implements security software that monitors events and security information in real time, proactively correlating log data from multiple sources to alert users to potential cyber threats and eliminate them.
Vulnerabilities are often published in databases such as the National Vulnerability Database (NVD) of the US National Institute of Standards and Technology (NIST) or the MITRE Corporation's CVE program. Software manufacturers, security researchers or users can report vulnerabilities here. These are validated and published by the relevant organization. Security software, such as tools for automated patch management, obtain information for detecting vulnerabilities from these databases. This enables proactive management of security patches to protect the IT infrastructure from threats.
There are also threat information services such as the German Warning and Information Service (WID), through which the Federal Administration's Computer Emergency Response Team (CERT) publishes the latest security information, patches and vulnerabilities in common IT products on a daily basis.
