How can IT systems be made more secure?

"The security risks for IT systems are manifold," says Jörn Müller-Quade. The professor of IT security heads the research group "Cryptography and Security" at the Institute for Information Security and Reliability (KASTEL) at the Karlsruhe Institute of Technology (KIT), and is director at the Research Centre for Information Technology (FZI). "The most well known are certainly malware and classic hacker attacks. But many attacks go unnoticed, such as when systems are spied on and information about their vulnerability is collected." These no longer come only from computer obsessives who want to try out their skills. Other groups also use them for various purposes: For example, criminals encrypt computers with ransomware, only to release them again for a ransom. The military apparatuses of states try to weaken the infrastructure of their opponents via digital means. And the secret services also use special programs, for example, to learn more about the economies of friend and foe.

Yet the attackers seem to have a fundamental advantage. "There is indeed an asymmetry in IT security," explains Jörn Müller-Quade. "The defenders have to close all security gaps, while the attackers only have to find one that is open." The only exception to this rule, adds the expert on encryption, would apply to cryptography. "Here we know since the revelations of Edward Snowden that even the NSA cut its teeth on modern encryption methods." However, and this too is shown by the revelations, the secret service got hold of the desired data by other means. For Jörn Müller-Quade, it is therefore clear: "The biggest challenge we face is overall system security." So, it is of little use if the heavy steel door is firmly locked with five bolts, but the window is half open.

This challenge grows all the more as system boundaries fall with increasing speed. This is because today it is no longer only computers and telephones that are connected to each other via the network. Power stations and industrial plants, refrigerators and televisions, or smart home systems and electricity meters also exchange information with each other. "We should not network everything that can theoretically be networked," says the IT expert. "Because many people don't see the scalability of cyber attacks." What he means by this is easily explained with a trip to the classic gangster milieu: In the offline world, the number of burglaries scales with the number of burglars. Because even the fastest thief can only break into a certain number of buildings per night. "With cyber attacks, this is no longer the case," says Jörn Müller-Quade. "Here, there are hardly any resource limits for a capable attacker."

The perpetrator does not always have to provide the resources for an attack himself as he has often hijacked computer systems of unsuspecting users all over the world which are working for him. Attacks of this kind include overload attacks, known in technical jargon as distributed denial of service attacks.

You don't just catch flies with honey

"In such attacks, the attacker floods the victim's system with enormous data traffic," explains Christian Rossow. The professor of computer security heads the System Security Research Group at the Helmholtz Centre for Information Security (CISPA). "This usually exceeds the victim's processing capacities and paralyses its website, for example, because regular requests can hardly be answered." This is akin to sending someone thousands of insignificant letters a day. That would overload the person concerned. Often, the attackers use hundreds of computers around the world for this, which they have infected with a malware program beforehand. Without the owners noticing anything, their computers are thus turned into weapons.

"Such attacks are carried out on websites and online shops, for example," explains the expert. This causes not only damage to the image, but sometimes also serious loss of sales. This can be intended by a competitor as well as by activists or secret services. "But some of these attacks are also used to blackmail people, companies or organizations," he adds. "Then the attacker only stops after receiving a ransom." Quite often, online gamers are also affected by such attacks, for example, when an envious competitor wants them out of the game for a while. "With these attacks, however, it is also possible to directly attack critical infrastructures," says Christian Rossow. "For example, if several power plants are connected for remote control, a mass attack could cause severe disruptions."

The IT expert and his team have therefore made it their task to find such mass attacks on the internet. "We make ourselves into a honeypot," he says with a grin. "That means we pose as an abusable middle system." If the attacker bites, he uses Rossow's globally distributed network of rented servers for his attacks and the IT expert is right in the middle of it. "If the attack is launched using our systems, we are of course faced with a dilemma. On the one hand, we don't want to attract attention, but on the other hand, we don't want to actively participate in the attack. That's why we only send a few data packets to avert damage." But his team has a front row seat and can document the attacks live. And they find tens of thousands of them every day.

"This way we can quickly let the victims know so they can take countermeasures," he explains, "and we can help identify the attackers." To do this, Christian Rossow and his team have developed a special fingerprint method. They give each attacker a personal fingerprint and can thus find out where their network is located. "We work together with the state criminal investigation offices and with Europol to track down such attackers," says the IT specialist. "In the past, the attacks were completely anonymous, which made prosecution almost impossible. Meanwhile, the FBI is also very interested in our services."

For the researchers at CISPA, this is an active and exciting field of research. "Our fingerprint often helps, butnot always," says Christian Rossow. "That's why we are constantly looking for new ways to identify the perpetrators of such mass attacks."

Awareness is the key word

Whether mass attacks or targeted hacks, ignorance, carelessness or guilelessness on the part of IT users are often a decisive factor in the success of the attack. Social engineering is what IT experts call the attempts to obtain passwords and access to systems. "Leaving a manipulated USB stick in the company car park is a classic that probably still works today," says Jörn Müller-Quade. And of course, it includes all the phishing emails that try to trap users and make them give up their passwords. "Social engineering is a huge problem because we humans don't always have the right assessment. And that's exactly why Professor Melanie Volkamer and her research group Security Usability Society (SECUSO) at KIT are also researching awareness." In the past, the person in front of the computer was often considered a weak point. But that, assures the IT expert, is an old-fashioned view. "Rather, you have to sensitize people," he says. "You have to make them recognize irregularities and use their common sense." Forcing people to behave like machines is the wrong approach, he says. Hardly anyone can remember cryptic passwords. Well-designed password managers and two-factor authentication are not only easy to use here, but also increase security. "User blaming, i.e., simply blaming everything on the user, is no longer done today," adds Jörn Müller Quade. "Because people have come to the conclusion that poor usability is a design flaw and not the user's fault."