An organisation can run tidy, well patched systems and still lose money, data and reputation, because the attack rarely targets the system any more. It targets the person sitting in front of it.

That was the thread running through Tomislav Vazdar’s appearance on Croatian Radiotelevision’s main evening news. Vazdar, founder and CEO of Riskoria, put it plainly. Awareness of cyber security really is rising, but in most organisations it wakes up only after something has already gone wrong.

Awareness arrives after the first hit

The shift of the past few years, Vazdar argued, has not come from the market. It has come from law. Croatia transposed the European framework into its Cybersecurity Act, and that forced companies to organise the work differently.

The list of duties is short but it changes daily practice. An organisation has to appoint someone accountable for cyber security, run risk assessments, submit to audit, report incidents, train its staff and talk about security with its own customers. A great deal that used to be discretionary is now an obligation, and one that somebody will ask you to evidence.

In practice that last word is where the time goes. A policy sitting in a drawer and a policy that leaves a record every month are two different things, and only the second one can be assessed. Incident deadlines are measured in hours: early warning within twenty four, formal notification within seventy two, final report within thirty days. An organisation that has not agreed in advance who calls whom will spend that first hour deciding. What the Croatian Cybersecurity Act actually requires is set out separately.

Ransomware and the cost that never appears on an invoice

For companies the dominant risk remains ransomware, the locking of machines and data for payment. Croatia has lived with it for roughly a decade, Vazdar noted, and the previous year brought a marked increase. He pointed to the attacks on Zagreb’s University Hospital Centre and on Split Airport, alongside other outages that drew less attention.

The cost he singled out as the largest appears on no invoice at all. It is reputation. No company can now afford to have its data leak, or to be shown to have guarded its information assets carelessly.

Healthcare makes the arithmetic unusually visible. When diagnostic imaging stops, it is not only the IT department that stops. The queue outside the door stops, a procedure is postponed, and somebody has to do by hand what the system used to do on its own. Recovery is therefore first a question of rehearsed work without the system, and only second a question of backups. What incident management looks like when the first hour is not spent negotiating is described elsewhere on this site.

The attack aimed at trust

For private individuals the picture is different and, in Vazdar’s assessment, worse. People are not attacked through systems. They are attacked through feelings. Someone reaches the person and persuades them to invest money, or to believe that another human being is genuinely interested in them. This has grown steadily over ten years, and artificial intelligence has lifted such fraud to a level where it is hard to tell apart from real communication.

“We always talk about protecting a company’s assets. But who protects our mind?” Vazdar asked. His answer was not a technical one. Fraud has matured into cross border organised crime and has therefore become a matter of national security, while regulation is still written mainly to protect companies. Protecting the citizen has been left to the citizen.

The same broadcast heard from Nikola Dujmović, chairman of the management board at Span, who observed that exposure to the digital world is inseparable from the duty to make that world safe; from Ira Winkler of CYE, who warned about fraud built on social engineering and about attackers who already hold some of your details and therefore sound credible; and from Antonija Vojnović of Span, who stressed that risk assessment is what determines what is worth protecting at all, and how much to spend on it.

The fifth domain and the people who are missing

Vazdar called cyber security a defence question above all, because states now treat cyberspace as the fifth domain of warfare. Hybrid conflict needs no weapons. Influencing an election through planted falsehoods, or striking critical infrastructure, is enough. That is why the law requires organisations to build a defensive capability and to be resilient enough to absorb a hit.

The other half of the answer is people, and here the picture is poorest. The education system does not produce enough specialists, and the debate usually stops at the individuals who must be formally appointed. The analysts and technicians who do the work every day are rarely mentioned. Vazdar estimated that the European Union is short of roughly a million people. Croatia has made progress and academic programmes exist, but their output does not match the need.

For most organisations the conclusion is not that another tool is required. It is knowing what you protect, who decides when the phone rings at three in the morning, and how you prove the control is genuinely operating. For an individual the conclusion is shorter still. A message that demands a fast decision and stirs a strong emotion is almost always an attempt at fraud, however convincing the voice on the other end may sound.

Source: HRT Magazin, How to protect yourself from cyber attacks?