Report warns of deepfake attacks and cyber extortion

Security team overload continues to be a massive problem. Geopolitically motivated attacks and lateral movement on networks are on the rise. This is summarized in a new report published by VMWare, which warns of deepfake attacks and cyber extortion.

Deepfake attacks and cyber extortions are placing an increasing burden on security teams. (Image: VMWare)

Multi-cloud services provider VMware has released its eighth annual Global Incident Response Threat Report. This provides deep insight into the challenges security teams face in times of pandemics, burnout and geopolitically motivated cyberattacks. Sixty-five percent of security professionals say cyberattacks have increased since Russia's invasion of Ukraine, the report finds. The report also sheds light on new threats such as deepfake, attacks on APIs and cybercriminals targeting incident responders.

Bypass security controls with Deepfake

"Cybercriminals are now incorporating deepfakes into their attack methods to bypass security controls," said Gerd Pflüger, systems engineer for network and security virtualization at VMware. "Two-thirds of respondents to our report experienced malicious deepfakes being used as part of an attack. This represents a 13 percent increase over last year, with email being the most common transmission method. Cybercriminals are no longer just using synthetic video and audio for influence or disinformation campaigns. Their new goal is to use deepfake technology to compromise organizations and gain access to their environments."

(Graphic: VMWare)

Stress as a problem with security teams

In addition to the new risks, the report also points to other issues facing enterprise security teams:

  • Burnouts among cyber professionals remain a critical problem. Forty-seven percent of incident responders said they had suffered from burnout or extreme stress in the past 12 months. There is only a slight decrease here from last year's 51 percent. Of this group, 69 percent (down from 65 percent in 2021) of respondents have considered leaving their job because of it. However, companies are working to counteract this: more than two-thirds of respondents said their workplaces have implemented wellness programs to combat burnout.
  • Ransomware actors rely on cyber extortion strategies. The prevalence of ransomware attacks, often supported by the collaboration of cybercrime groups on the dark web, is still unchallenged. Fifty-seven percent of respondents have faced such attacks in the past 12 months. And two out of three respondents have encountered affiliate programs and/or partnerships between ransomware groups, as prominent cyber cartels continue to harm businesses through double coercion techniques, data auctions and extortion.
  • APIs are the new endpoint and represent the next frontier for attackers. As workloads and applications proliferate, 23 percent of attacks are directed at API security. The top types of API attacks include data spying (42 percent of respondents in the past year), SQL and API injection attacks (37 percent and 34 percent, respectively), and distributed denial of service attacks (33 percent). 
  • Lateral movements are the new battlefield. They were seen in 25 percent of all attacks, with cybercriminals using everything from script hosts (49 percent) and file stores (46 percent) to PowerShell (45 percent), business communications platforms (41 percent) and .NET (39 percent) to probe networks. An analysis of telemetry in VMware Contexa, a full-fidelity threat intelligence cloud integrated with VMware security products, found that in April and May 2022 alone, nearly half of the incursions contained a lateral movement event.

Successes in the fight against cybercrime

Despite the increasing threats detailed in the report, incident responders are demonstrating success, with 87 percent saying they are able to disrupt cybercriminals' activities sometimes (50 percent) or very often (37 percent). They are also using new techniques to do so. Three-quarters of respondents (75 percent) say they now use virtual patching as a contingency mechanism. In any case, the more overview defenders have of the ever-growing attack surface, the better equipped they are to weather the storm.

Source: VMWare

Smart maintenance

Smart maintenance as the key: The use of sensor-based and self-learning digital services in maintenance increases the resilience of manufacturing companies. This is the conclusion of a study conducted by scientists at the Fraunhofer Institute for Manufacturing Engineering and Automation IPA.

A short study shows how smart maintenance increases resilience. (Image: Fraunhofer IPA)

The interruptions to production during the Corona crisis, the blockade of the Suez Canal by the container ship "Ever Given" that lasted for days, the war in Ukraine and the global chip shortage have all shown that the economy must prepare itself for ever new disruptive factors. That means it must become resilient. Companies must be able to return to their original state as quickly as possible after the outbreak of a crisis, or - even better - emerge from it stronger.

How smart maintenance contributes to resilience

One important area in which manufacturing companies must respond to disruptions is the Maintenance. Their task is to ensure the production capability of machines and plants and to restore it as quickly as possible. Researchers from the Sustainable Production and Quality department at Fraunhofer IPA have therefore surveyed the current situation of maintenance with regard to resilience and worked out in a study how smart maintenance can also contribute to resilience in the future.

 

Great openness to digital services

To this end, the scientists conducted an online survey last year. Representatives of 34 companies of various sizes and industries completed the questionnaire in full. Their responses indicate, for example, that the majority of respondents consider resilience to be an important factor in ensuring that manufacturing companies continue to operate successfully in the future.

97 percent of respondents see personnel as the most important success factor in maintenance. Almost all of the professionals who took part in the online survey can imagine working with assistance systems such as "remote service" in the future. Many do not see their jobs in danger if sensor-based and self-learning maintenance technology is used in the future. Rather, they assume that digital services will supplement the skills of personnel, but not replace them.

The short study "Smart Maintenance as a Resilience Factor" is available free of charge as a Download available. Source: Fraunhofer IPA

QM software developer ConSense announces virtual fall expo

ConSense EXPO is going into a new round: The German QM software developer announces another edition of its digital trade fair. The fall event will take place from September 20 to 23, 2022, for which all interested parties can now register free of charge.

Aachen, Germany-based QM software developer ConSense GmbH is launching another virtual trade show for the fall. (Image: ConSense GmbH)

Among the highlights of the ConSense EXPO is how the QM software developer from Aachen regularly counts the wide-ranging conference program. For the autumn edition, ConSense GmbH has again compiled many relevant topics from the QM world, presented by experts from well-known companies and institutions as well as the organizer. In his keynote, for example, Dr. Markus Reimer, business and quality expert, will address the topic "The digital challenge - what awaits us and why we can no longer wait". Dr. Benedikt Sommerhoff, DGQ expert for quality and innovation, promises suggestions for more efficiency in quality management in his presentation "Strategic leverage instead of operational bogging down - how the QM department can achieve more impact for quality". Dr. Bernhard Müller, consultant and auditor with a focus on food safety, will talk about the principles and procedure for setting up and developing an HACCP concept as well as hazard analysis and risk assessment in his presentation.

Events and presentations on various industry topics

In addition, the three-part lecture series "Introduction of a Management System" provides valuable practical suggestions on the structure and contents of a QM system or IMS. How to gain approval for the application is shown by the event "More acceptance for the QM system through internal marketing". These and many other live events on various industry topics are available to the public. Existing customers of ConSense GmbH can also expect an extra program of additional lecture topics, e.g. "ConSense PowerUser: Interactive session with tips and answers from ConSense professionals" or "Advantages and benefits of the system check for your existing ConSense management system". In addition, they can reserve exclusive slots for personal consulting sessions.

Modular management system, mobile use, modern hosting services

At numerous, virtual theme stands, experts from ConSense will provide targeted information on details of the various software solutions. Using live demos, visitors can experience the solutions for IMS, audit management and measures management in practice. To deepen their ConSense knowledge, trade fair visitors can also attend various on-demand webinars.

"That is by no means all: In addition, our trade fair guests can also expect a networking area for direct exchange, live chats for queries throughout the trade fair, and a search and puzzle competition with great prizes. The regular feedback to the ConSense EXPO shows us that we cover the need for information around accepted and living quality management and integrated management systems on different levels very well with our virtual event", says Dr. Iris Bruns from the management of ConSense GmbH.

Registration for the visit is now open at www.consense-gmbh.de/expo possible. The complete conference program and registration for the individual events are available at www.consense-gmbh.de/expo-konferenzen ready.

Green IT: Sustainable IT as the key to competitiveness

Considering the effects of the climate crisis, the sustainability factor is becoming a crucial issue for our society. However, sustainable corporate management is new territory for many organizations - yet it offers the opportunity to retain young talent, save budget and remain competitive in the long term. In addition to corporate culture, the focus is on IT, as this guest article explains.

Philippe Picalek of Cloudera says that in addition to corporate culture, IT is in focus when it comes to sustainability. (Image: pixabay, geralt)

While the digitization of processes saves resources in individual companies, global digital transformation leads to a global exponential resource use. There is a simple reason for this: Increasing virtual workflows are generating ever greater volumes of data that are stored in data centers - which, depending on their size and constitution, produce more or less CO2 emissions. Studies show that data center operations already account for 2 percent of the world's energy

It is all the more tragic when data is stored but neither analyzed nor used for the company's success. A "loose - loose" situation arises. The choice of storage location for data, the form of the data and the right data platform are therefore a decisive step both for corporate success and for preserving the environment. This lends immense importance to green IT, i.e., environmentally compatible information and communications technology (ICT) services and products and sustainable use.

Initiatives, measures and certifications

Measures such as the German government's Green IT initiative or the European Ecodesign Directive have succeeded in keeping electricity consumption by IT in Germany at least relatively constant since 2017 - around two percent of the country's electricity consumption. But blockchain technology or artificial intelligence (AI) are driving up the energy demand of data centers. According to a Study by The Shift Project of 2019, however, emissions from the digital economy could already account for eight percent of total CO2 emissions in the next five years. 

To counteract such scenarios, companies need to pay attention to their carbon footprint - especially in data centers. For example, a lot of energy can be saved in the cooling of servers, because lighting and outdoor cooling can be automated and the location of the servers also plays a role - as far apart as possible and in a cool place. Overall, a power consumption effectiveness of 1.2 or less should be targeted. In addition, many processes and applications can now be moved to the cloud. The energy supply for cloud systems tends to be lower due to the size scaling. In principle, companies can also pay attention to energy efficiency certifications when purchasing. Organizations such as TCO Certified or Energy Star, for example, test and certify factories and devices with regard to their efficiency and sustainable practices. 

What role does Green IT play in companies?

According to a Study by Capgemini However, green IT currently plays only a minor role in most companies - only one in five companies with a sustainability strategy takes the climate contribution of IT into account. This is due in part to a lack of expertise, according to a total of 53 percent of respondents. And only 43 percent of executives know the amount of CO2 emissions their IT generates. Only 18 percent have a comprehensive strategy with timelines and concretely defined goals; only 6 percent are already implementing sustainable IT. And this will not change in the next few years: only 22 percent of companies plan to reduce their CO2 footprint by more than a quarter through sustainable IT. And this despite the fact that Data centers worldwide are estimated to consume about 3 percent of electricity and are responsible for about 2 percent of total greenhouse gas emissions.

Sustainable data use determines competitiveness and staff attrition

Companies have recognized the relevance of sustainable business decisions based on data. According to a Study by Cloudera more than one-fifth (21 percent) of decision-makers in German companies are already putting greater investment in environmental, social and governance (ESG) ahead of developing new products and services (18 percent) or maintaining or increasing their profits (19 percent). This is not entirely altruistic, however, because in addition to the ecological necessity, the economic benefits of sustainable IT cannot be dismissed - both in terms of the bottom line and through social reputation, brand image and customer loyalty. 

The Cloudera study shows this in detail: when asked what the impact would be if their company did not start using data to make more sustainable business decisions over the next 3 years, nearly half of business decision makers (47 percent) said they expected growth to decline. Other consequences include increased pressure on the board and loss of business. Most interestingly, 27 percent of decision makers believe that employees will leave the company - a crucial criterion in times of skills shortages.

To the author:
Philippe Picalek, Regional Vice President Switzerland at Cloudera, a cloud service provider. The Cloudera Enterprise Data Cloud processes all data, regardless of where it is stored - from the edge to AI applications. 

Innovative products through cooperation at eye level

Digital transformation is giving rise to new products, services and business models. A new white paper from the Fraunhofer Institute for Manufacturing Engineering and Automation IPA describes a novel form of peer-to-peer cooperation between multiple companies focused on a specific visionary value proposition: the structure-business ecosystem.

Structure-Business-Ecosystem: Together towards a customer-centric, cross-industry value proposition. (Image: Fraunhofer IPA)

Digitization is fundamentally changing the economy. Because it networks products and services, new business and organizational models are emerging. But they
is also changing user behavior and customers' understanding of benefits (perceived added value). Customers want new, usually more comprehensive solutions. Companies have to respond to the rapid change in order not to end up on the sidelines. They are forced to offer services outside their core business. Often, services from outside the industry must be included in a competitive, customer-oriented system offering.

Competition from lateral entrants

Mechanical engineering is also feeling the effects of the digital transformation process. Not only are the conventional value chains being
The companies are also facing competition from unexpected sources, from lateral entrants. One way out is cooperation between several companies that have different focuses or even cover different industries. Together, they are able to bring completely new products and services to the market. To offer a system portfolio for individual cell therapies, a company that manufactures machines for the pharmaceutical industry could join forces with various partners: for example, with specialists in cell diagnostics, with experts in regulatory affairs in the medical field, or with manufacturers of pharmaceuticals and with experts in analytics solutions based on artificial intelligence. In this way, an innovative product is created from the different competencies.

Cooperation requires new corporate culture

The white paper summarizes the results of a study on the topic of business ecosystems with 16 mechanical engineers and the findings of the dissertation by Richard E. Geitner
for the design of structural BES together. It is shown why the formation of a structural BES, especially in connection with a consistent customer orientation of companies, is a strategic option of a highly flexible value creation system for innovative cross-industry value and system offerings. The opportunities and specific characteristics of this form of cooperation are addressed.

It also outlines the basic procedure for designing a corresponding cooperation. However, structural BES requires a new corporate culture.
So far, cooperations have mostly been structured vertically: One company sets the direction, the others contribute. The new type of collaboration is based on equality. Each participant makes a substantial contribution to the joint product - and all participants benefit.

Despite risks: Advantages outweigh

Of course, cooperation at eye level also involves risks. Entrepreneurs must overcome their mistrust of other companies. They must not be afraid of their know-how falling into the wrong hands or of being taken advantage of by supposed partners. Overall, however, the advantages outweigh the risks. Not only can they offer innovative products and respond very flexibly to changing customer requirements. Investments are also cut in half - or even eliminated altogether if the partner already has the necessary know-how. The mechanical engineering companies that took part in the study also see these advantages. More than 90 percent of them consider joint offerings to be "increasingly relevant".

Source: Fraunhofer Institute for Manufacturing Engineering and Automation IPA

Graubündner Kantonalbank rated "AA" for sustainability

The international rating agency MSCI has raised the ESG rating of Graubündner Kantonalbank from "BBB" to "AA". According to MSCI, this makes GKB one of the leading banks with an "AA" or "AAA" rating. In addition, GKB is now a partner of the Swiss Climate Foundation and is involved in its advisory board.

GKB's commitment is newly rated "AA" by the rating agency MSCI. (Image: GKB)

With an "AA" rating, Graubündner Kantonalbank GKB receives the second highest sustainability rating from MSCI. The sustainability ratings of agencies such as MSCI aim to measure a company's handling of financially relevant ESG risks and opportunities. The rating takes into account social criteria, governance criteria and environmental aspects.

Sustainability: Commitment and transparency

Sustainability is firmly anchored in GKB's strategy, the bank says. "I am all the more pleased that our commitment and performance are now rated AA," says its CEO Daniel Fust. "For years, we have been committed to sustainable development in the canton as well as in our investment and financing business. With our new GRI sustainability report, we communicate our activities transparently and comprehensibly." The rating agency MSCI also confirms that Graubündner Kantonalbank meets the highest requirements in the areas of money laundering, corruption and data protection. MSCI also highlights GKB's activities in the area of talent development and employee training, according to the Graubündner Kantonalbank press release.

Graubündner Kantonalbank is committed to the Swiss Climate Foundation

Graubündner Kantonalbank is now supporting the Swiss Climate Foundation. "For effective climate protection, we need to pool our resources and promote innovation beyond the cantonal borders. This is exactly what we achieve as a partner of the Swiss Climate Foundation," says Daniel Fust. The foundation's funding flows into the development of innovative technologies to protect the climate, including in the building sector and agriculture, or into projects in the area of circular economy.

Graubündner Kantonalbank and 27 other companies from the service sector are supporting the investments of the Swiss Climate Foundation. "By joining the Swiss Climate Foundation, Graubündner Kantonalbank is sending a clear signal that climate protection does not end at the cantonal border. Climate change is an immense challenge that we can only master with combined forces and forward-looking solutions and technologies," says Vincent Eckert, Managing Director of the Swiss Climate Foundation. Since its establishment in 2009, the foundation has supported around 2100 SMEs in Switzerland and Liechtenstein with over 33 million Swiss francs.

Source: GKB

SAQ personal certificate for PR professionals

PR Suisse, the professional association for PR and communications professionals, in collaboration with the Swiss Association for Quality (SAQ), is introducing a personal certification for professionals in the fields of PR and communications.

There is an SAQ personal certificate for PR and communications professionals. (Image: PR Suisse)

The Swiss Public Relations Association (PR Suisse) has been the national professional association of communications and PR professionals since 1953. As the industry association for communications professionals in companies, agencies, organizations and administration, PR Suisse today has around 1,500 members. The association promotes the reputation of the profession and supports the exchange of knowledge and experience between its members. PR Suisse guarantees qualitatively impeccable training and further education and ensures the examination system. This includes issuing the personal certificate "Certified PR and Communication Expert SAQ" as proof of professional activity in the field of PR and communication.

SAQ personal certificate

The "Certified PR and Communication Expert SAQ" certification is aimed at people who are working full-time in the field of public relations/communication at the time of the certification application. It is based on the learning topics and competence requirements of the higher professional examination "Communications Manager with Federal Diploma".

The personal certificate is intended to provide expert status and thus contribute to labor market readiness. It should also serve as a basis for assessment and decision-making for employers and customers. The certification is based on the international standard for personal certification SN EN ISO/IEC 17024 and is carried out under the supervision of the neutral and independent certification organization Swiss Association for Quality (SAQ).

Connection of recognized diplomas

The certificate combines recognized diplomas in PR and communications with professional experience to create a quality standard for the entire industry. It makes theoretical knowledge and practical skills visible, transparent and internationally comparable, says PR Suisse. Recertification ensures that certificate holders continue their education and keep their knowledge up to date. The initial certification costs 290 Swiss francs.

Source: Advertising Week. Further information: PR Suisse

Quantum cryptography: hacker attack pointless

Researchers at Ludwig Maximilian University in Munich and the University of Singapore have experimentally realized an advanced form of quantum cryptography for the first time. This will one day enable quantum networks in which absolutely secure communication should be possible between distant locations.

Different quantum states of atoms in the service of security: quantum cryptography makes hacker attacks impossible. (Image: Unsplash.com)

The Internet is teeming with highly sensitive information. Sophisticated encryption techniques usually ensure that such content cannot be intercepted and read. But in the future, powerful quantum computers in particular could crack the keys, sometimes in a matter of seconds.

Method from the 1990s

Quantum mechanical key exchange - known in technical jargon as "quantum key distribution (QKD)" - is tap-proof against attacks on the connection lines. QKD is thus immune even to quantum computers, but not to attacks or tampering with the devices themselves. The devices could issue a key that the manufacturer had already stored beforehand and possibly passed on to a hacker. The so-called "Device independent QKD", or DIQKD for short, now also checks the security of the devices. Theoretically, this method has been known since the 1990s, but now an international group of researchers led by LMU physicist Harald Weinfurter (https://xqp.physik.uni-muenchen.de/people/professor/weinfurter/index.html) and Charles Lim from the National University of Singapore (NUS) was realized experimentally for the first time.

Measuring quantum states of atoms

In the present experiment, the physicists used two entangled rubidium atoms located in two laboratories 400 meters apart on the LMU campus to exchange keys. The two sites are connected by a 700-meter fiber-optic cable that runs under the plaza in front of the university's main building. To exchange a key, the two parties measure the quantum states of their atoms. This is done randomly in two and four directions, respectively. If the directions match, the measurement results are identical due to entanglement and can be used to generate a secret key.

Tap-proof connections thanks to quantum cryptography

With the other measurement results, a so-called Bell's inequality can be evaluated. John Bell developed this inequality to test whether nature can be described with hidden variables. In the DIQKD, this test is now used to ensure that "there is no tampering with the instruments, i.e., hidden measurement results have not been stored in the instruments in advance," Weinfurter said. The NUS protocol now uses two measurement settings. "This makes it much more difficult to eavesdrop on information. So more noise can be tolerated and secret keys can be generated even with higher noise," says Charles Lim.

"With our method, we can now securely generate secret keys even with uncharacterized and potentially untrusted devices," Weinfurter explains. "Our work lays the foundation for future quantum networks in which absolutely secure communication is possible between distant locations," says Charles Lim.

Develop inter- and multinational teams

In the course of globalization, work teams are becoming more international. In addition, collaboration and communication are becoming increasingly digitalized. This has consequences for team development.

Leading multinational teams is challenging. Yet culturally mixed teams perform better than you might think. (Image: Unsplash.com)

Just a few years ago, people primarily spoke of an intercultural or multicultural team when people from different cultures worked in a department of a company. Today, however, team members often live and work all over the world. In addition, fixed (work) teams have often been replaced by loose collaborations and temporary project groups. According to the statements of the Cross-cultural trainer Ulrike Fröhlich from Weil am Rhein, Germany has also changed the requirements in the area of team development. Whereas in the past, development measures were primarily required for fixed teams at one location, today the participants often work in different countries. So instead of cross-cultural training designed to make their German-speaking employees fit for business with Japan, for example, companies are planning (online) training "in which Japanese, Koreans and Americans participate in addition to Germans, Swiss and Austrians," reports the owner of the consulting firm Understanding Japan. Increasingly, "cooperation partners such as customers, suppliers or external service providers" are also taking part in the training courses.

Multinational teams: unfamiliar work for many

Cross-border, largely digital collaboration also causes problems. Some team members feel overwhelmed by this type of cooperation, in which people rarely, if ever, meet in person, reports Sabine Machwürth, co-owner of the consulting firm Machwürth Team International (MTI), Visselhövede (here is an older article from this company). And rightly so, "because when people from different cultures, who also live in different countries, work together, the need for coordination increases. It also increases the likelihood of misunderstandings."

This sometimes creates the impression that multicultural teams are per se more inefficient. According to Canadian organizational psychologist Nancy J. Adler, this is not the case. Her studies have shown: Culturally mixed teams have the potential to perform better than those in which all participants have the same cultural background; moreover, the different perspectives and approaches often result in better solutions.

Potential of teams often not exploited

However, this potential is often not called upon. For this to happen, patience is initially required, explains Sabine Machwürth, because: "It takes some time for a newly formed team to cooperate well." An initial phase of euphoria is usually followed by a phase of disillusionment - the so-called storming phase. Without external help, inter- and multinational teams often find it difficult to get out of this phase and into the third team development phase, known as norming.

The friction in the storming phase results from different ideas of how work should be done. For example, questions such as

  • "In what order should tasks be completed?",
  • "Who informs whom and when?",
  • "How are decisions made and communicated?" and
  • "How do we handle mistakes or problems?"

is answered very differently in the various cultures. If a team is unclear about this, there is often a great deal of uncertainty and mutual disappointment. According to Ulrike Fröhlich, this is particularly true for teams "in which people from cultures that tend to shy away from conflict, such as Japan, are expected to cooperate with people who tend to enjoy conflict, such as Germany.

Increase team spirit and performance

Below are some tips from Ulrike Fröhlich and Sabine Machwürth on what team leaders and members should consider and do to ensure that inter- or multinational teams ultimately reach the Performing phase, where they deliver top performance.

  1. Be curious and get to know each other personally. Talk to your cooperation partners about private topics as well. Finding common ground helps build trust, and trust is the basis for good cooperation.
  2. Talk about the differences in the way of working. It is important to explore and appreciate the other person's way of working. For example, as a team leader, conduct short workshops on "Getting to know and appreciate other ways of working."
  3. Note: There is no one, correct way of working. People who work successfully internationally usually not only accept that tasks can be solved differently, they also integrate elements of this into their working style. This makes them more cooperative and behaviorally flexible.
  4. Be open to new approaches and problem solving. See the encounter with what is new to you as an opportunity to leave the beaten track.
  5. Explore how to communicate well in a group setting. Communication in particular is sometimes very different in different cultures. Germans, for example, are known for addressing sensitive issues directly, while East Asians, for example, tend to approach them in a roundabout way. For this reason, everyone in the team should know what needs to be observed in the respective other culture, for example, when delegating tasks, giving feedback, and classifying information.

Author: Freelance journalist Ronja Siemens, Freiburg i. Br., specializes in professional and career topics.

New standard work on the implementation of sustainable transformation processes

Following the success of the industry standard work "The Purchasing Chessboard", the global management consultancy Kearney focuses on the holistic development and implementation of a sustainability strategy with "The Sustainability Chessboard - Step by Step to a New Leadership Culture".

With "The Sustainability Chessboard - Step by Step to a New Leadership Culture", the management consultancy Kearney presents a new standard work on the implementation of sustainable transformation processes. (Image: Kearney)

What used to be "nice to have" is now an indispensable part of entrepreneurial activity: a sustainable, circular and responsible corporate strategy. Current climate protection strategies such as the European Green Deal, the social debate on global warming, and changing market demand as a result of growing consumer awareness have once again fueled this trend and are creating pressure for action at management levels. The problem: Many companies are struggling to decide at what level and to what extent they should get involved.

Universal approach for companies of any size

With the new book "Das Nachhaltigkeitsschachbrett - Zug um Zug zu einer neuen Führungskultur" (Süddeutscher Verlag) by authors Dr. Martin Eisenhut, DDr. Michael F. Strohmer, Angela Hultberg, Dr. Marc Lakner and Dr. Sebastian O. Schömann, the global management consultancy Kearney has created what it says is a new standard work to fill this gap. "In the future, sustainability will be as important to companies as financial performance," says one of the authors, Dr. Martin Eisenhut, Partner and Managing Director Germany, Austria and Switzerland.

The Sustainability Chessboard is a universal, practical approach that is intuitive and easy to apply and guides companies through the transformation process, regardless of size and industry. For beginners, it provides guidance on what is achievable and where to start. Advanced users will find suggestions on how to deepen and broaden their efforts, and pioneers can use it to take the next big step and conquer uncharted territory.

4 strategies, 16 approaches and 64 levers for more sustainability

The checkerboard model is based on two dimensions: It combines the degree of sustainability ambition with the organizational maturity level of the company. The field is divided into four strategies: "Ensuring sustainability compliance," "Using sustainability data," "Creating value through sustainability" and "Innovation leadership in sustainability. These four strategies can be divided into 16 approaches and - based on the squares of a chessboard - into 64 levers that help companies locate themselves. In this way, companies can make their organization, technology and corporate culture fit for the future in a very practical way.

"Chess players must be able to plan ahead, assess strategic options and pursue their goal undeterred despite obstacles and opposing attacks," says Eisenhut. They need to know exactly what tools are available to them and how to best use them. "The Sustainability Chessboard helps companies align their capabilities and goals with the needs of the market, investors, talent and regulators, and create value from that."

The book is available here: www.de.kearney.com/nachhaltigkeitsschachbrett

Cyber skills shortage threatens corporate security

A survey by Tata Consultancy Services shows: To keep up with cybercriminals, companies do not need more budget, but employees with relevant IT security expertise, i.e. cyber specialists.

Digitalization is increasing demands on IT security - but there is a cyber skills shortage. (Image: Unsplash.com)

It is a well-known fact that the threat of cyber attacks is increasing with increasing digitization. This is why IT security experts are in particularly high demand: According to the Risk & Cybersecurity Study 2022 by IT consulting firm Tata Consultancy Services (TCS), companies see the biggest challenge in the area of cybersecurity not in budget, but in the shortage of cyber specialists. According to the study, half (49 percent) of EU and UK companies plan to hire professionals with cybersecurity skills in the future. In North America, as many as two-thirds (65 percent) intend to look for talent in the future.

For the study, 607 companies from Europe and North America with annual revenues of at least $ 1 billion were surveyed. The interviews were conducted with executives responsible for cybersecurity at their companies. These included chief risk officers (CROs) and chief information security officers (CISOs) from the financial sector, utilities, media and information services, and mechanical and plant engineering. 

Cyber skills shortage among top hurdles for enterprise IT security

Chief risk officers (CROs) and chief information security officers (CISOs) report in the survey that they have already had difficulty attracting (44 percent) and retaining (42 percent) talent with cyber risk and security skills in the past year.

Here's how large companies in Europe and North America plan to hire new cyber professionals. (Graphic: TCS)

The second biggest hurdle cited by the CROs and CISOs was the requirements of the work environment, such as the home office and the associated risks. For example, employees had to be given numerous remote accesses to their employer's systems and databases at short notice due to the pandemic and the resulting move to the home office. This opens up new points of attack for cyber criminals. Assessing the various security risks and quantifying their costs is the third biggest challenge for the respondents.

Cybersecurity is not a budget issue

Only in tenth place in the ranking come any budget restrictions. The fact that the latter are affecting fewer and fewer companies is demonstrated by the high level of willingness to invest: 52 percent of European companies and 62 percent of North American companies stated that they had increased their budgets for IT security since last year.
"Keeping up with the most advanced tactics of cybercriminals is not so much a question of financial resources. Rather, the challenge is finding and retaining the right professionals with the required expertise," says Santha Subramoni, Global Head of Cybersecurity Services at Tata Consultancy Services.

How companies ensure they have a recruiting edge

While one measure alone cannot solve the cyber skills shortage. "However, companies can help close the skills gap by using external service providers for hard-to-fill tasks such as 24/7 network monitoring, while at the same time promoting talent internally," says the TCS security expert. In addition, the study shows that the more frequently the board of directors addresses the issue of cybersecurity, the more successful the company is in finding and retaining relevant experts.

Another finding: The study identifies a link between employee retention and the way a company stores its information. Companies that rely on cloud solutions have a slight advantage in recruiting cyber talent over companies that prefer on-premise solutions or traditional data centers to the cloud. In fact, cloud platforms give companies a five-point advantage in recruiting and retaining cyber experts. "Given the increasing complexity of cybersecurity, the talent gap is also widening," adds Rainer Zahradnik, Country Manager TCS Switzerland. "Sustained executive attention, financial sponsorship and process changes within the company will be critical to recruiting and retaining top talent."

Source and further information: www.tcs.com/risk-cybersecurity

CWT signs ECPAT Code of Conduct for the Protection of Children

Ahead of the World Day Against Human Trafficking, CWT, a B2B travel management platform, has signed the Code of Conduct for the Protection of Children from Sexual Exploitation in Travel and Tourism (called "The Code").

CWT's Lauren Aste signs the ECPAT Code of Conduct. (Image: CWT)

Signed by business travel services provider CWT (Carlson Wagonlit Travel), the ECPAT Code of Conduct (called "The Code") is a partnership initiative between the travel and tourism industry and ECPAT, a global nonprofit organization dedicated to protecting children from human trafficking, sexual exploitation and online abuse. By joining the Code, travel and tourism companies gain access to tools and resources that they can use in their daily work.

Tourists against human trafficking

CWT says it is an active and longtime supporter in the fight against human trafficking and is committed to The Code's efforts to raise awareness externally, engage employees internally, develop more effective policies, research and develop tools to combat human trafficking and sexual exploitation of children. "Every child in the world has the right to grow up free from the fear of exploitation and to live a dignified and safe life. It is vitally important that we all remain vigilant, and I hope companies like ours can help make that a reality," said Lauren Aste, CWT's Executive Vice President & Chief Legal Officer. "Signing ECPAT's Code demonstrates CWT's continued commitment and leadership to the safety of children everywhere."

ECPAT Code of Conduct with six criteria

The ECPAT organization is thrilled that CWT remains a loyal ambassador and partner of the Code, supporting its child protection programs in meaningful ways. "We thank CWT for its continued leadership in the anti-trafficking movement," said Yvonne Chen, director of private sector engagement at ECPAT-USA.

By signing the Code, CWT has committed to comply with the Code's six criteria. These include establishing policies and procedures, training employees, implementing contractual clauses, providing information to travelers, and collaborating with stakeholders on prevention, as well as reporting annually on all related activities.

Source: CWT