Table of Contents
There is currently no shortage of examples of successful cyberattacks. One notable phenomenon is that the financial losses are rising. In the hack of the largest crypto exchange Binance, the total loss is estimated at 6.3 billion dollars. “Three billion are definitely gone,” reads the headline on the German news programme Tagesschau.
It has now emerged that the attack was planned over a period of months. Employees of the crypto exchange were lured into fake job interviews and asked to install software. According to the FBI, the North Korean group TraderTraitor is believed to be behind the breach; the group has previously been implicated in a heist at another crypto exchange.
Just how far AI-assisted deception in recruitment processes now reaches is shown by the article Beating 261 competitors: landing a new job with a false identity.
The physical world in the crosshairs
Spectacular cyber-attacks are increasingly being attributed to state actors or to actors acting on behalf of states. Joanna Swiatkowska, head of the European Cyber Security Organisation (ECSO), finds this deeply worrying.
“State actors and those working on their behalf are my greatest concern. Cyberspace is a very convenient place for such activities,” said Swiatkowska during the Cyber Thought Leaders Dialogue expert panel. This is because they are relatively easy to carry out and can be well concealed.
How Swiatkowska assesses the role of European providers is set out in the interview “Buy European”: Unlocking the Economic Potential of Europe’s Cybersecurity Sector.
Alongside the trend towards higher financial losses, another development is emerging: the targets of attacks are changing, with OT coming into focus. One example is the Europe-wide attacks on refrigeration systems in supermarkets, in some cases where the temperature was raised to 50 degrees Celsius.
These were caused by serious security flaws. The devices were left unprotected on the internet; some were operated using the factory settings and default passwords they were supplied with, whilst others had not received any updates.
(Editor’s note: What operators can use as guidance as early as the procurement stage is shown by the article CISA advises: 12 recommendations for selecting secure OT products.)
However, specialists anticipate a significant increase in attacks on OT devices such as refrigeration systems. Dirk Decker, Regional Director for Central Europe at OT security specialist Forescout, commented on this during it-sa: “We expect more attacks on the physical world, as they are usually quite devastating”.
In the case of the freezer attacks, the damage caused by spoiled food is estimated to run into the mid double-digit millions in France alone. It was only after several days of attacks across Europe that the remaining systems were finally disconnected from the internet.
Critical Infrastructure (CNI) under attack
But it did not stop there. The attacks have since even been extended to the refrigeration system of a French blood donation centre. The attackers are said to have raised the target temperature to over 100 degrees Celsius. However, this was noticed by a technician on duty and stopped.
By now, at the very latest, the attacks are targeting the CNI sector. This particularly vulnerable area has, however, been under attack for some time.
In the aforementioned expert panel discussion, the Estonian chair of the steering group of the IT coalition within the Ukraine Defence Contact Group, Heli Tiirmaa-Klaar, called for a strict move away from risky suppliers in light of the Ukraine conflict. She says: “CNI should rely exclusively on reliable components from reliable partners”.
In the face of hybrid warfare, IT security is becoming increasingly strategic. Her conclusion was therefore: “Our CNI systems will form the first line of defence”.
Which sectors are included and which protection obligations apply to them is brought together on the topic page Critical infrastructures (KRITIS) – importance and protection.
AI against AI: cyber defence for IT and OT under time and cost pressure
In response to attacks in the CNI sector, the German Federal Office for Information Security (BSI) has launched initial pilot projects on network sensor technology at CNI organisations, as mentioned during that expert panel discussion by Barbara Kluge, the permanent representative of the Head of the CI (Cyber and Information Security) Department at the Federal Ministry of the Interior and Homeland (BMI).
The concept of automated status monitoring – also known as the ‘IT heartbeat’ – demonstrates how this digital monitoring works. “The BSI receives regular signals regarding the IT availability of hospitals,” reported Kluge. This enables outages to be detected immediately.
In light of the recent attacks, experts are calling for a faster response to attacks. This is particularly true when attacks are AI-driven.
The demands are high: “The defence must be faster than the AI controlling the attack processes. The systems must be able to detect changes to the control system – and do so very quickly. This is only possible with AI,” explains Sven von Kreyfeld, System Engineer at Forescout.
To this end, the company relies on a platform that continuously monitors all managed OT components. Deep Packet Inspection (DPI) can be used to analyse over 350 industrial network protocols.
“The tool is deployed in a production environment, monitors communication between devices and detects process anomalies without this necessarily being triggered by malware,” says von Kreyfeld. “It can also detect cable breaks, as signals then cease to arrive, and even loose connections,” he adds.
But Forescout is not the only one using AI. Hardly any provider of security products now fails to utilise the advantages of artificial intelligence in cyber defence.
(Editor’s note: Why this race can barely be won with human reaction times any more is explored in the interview Artificial Intelligence in Cyber Defence: “AI versus AI is the New Reality”.)
Monitoring IT or OT infrastructure generates large volumes of data that need to be analysed. This analysis is often carried out using a SIEM (Security Information and Event Management) system. “But if that runs as a service in the cloud, it costs money,” explains Stefan Strobel, managing director and founder of the security specialist cirosec.
That is why clever developers have devised a solution: Security Data Pipeline Platforms (SDPP). “They collect security log data from end devices, firewalls and the like, and process it. The pipeline is situated before the cloud and filters out what is not strictly necessary for the SIEM,” explains Strobel.
The filtered-out data ends up in a separate storage location, where it is retained, for example, for forensic analysis. “The pipeline can also filter out data for service desks,” he adds. The savings achieved through SDPP can exceed 50 per cent.
What such AI-assisted pre-analysis looks like in the day-to-day work of a security operations centre was demonstrated by the session From Raw Alert to Finished Case: AI-Assisted Analysis of Security Alerts in the SOC at it-sa EXPO & Congress 2026.
Backups remain essential to cybersecurity, including for OT environments
A truism in the IT sector that is not always easy to implement in the OT sector: security begins with a functioning backup. This is partly because, in many cases, no additional software is permitted to be installed on the systems.
Why industrial systems generally follow different security rules than office networks is brought together on the topic page OT Security: Protecting Industrial Systems.
The Polish provider Xopero demonstrated a solution to this. It has developed an OT backup that works with a USB stick. The backup data can also be stored on the USB stick and later transferred to the cloud or backed up to on-premises storage such as NAS or SAN.
If the data is stored in the cloud, this solution enables very rapid recovery in the event of an emergency using specialised techniques. Xopero’s product can also back up data from cloud platforms such as Confluence, JIRA, Bitbucket, GitHub, GitLab or Microsoft 365.
Furthermore, “cross-recovery – that is, recovery to other platforms – is possible, which therefore allows a switch to a different platform, such as from Bitbucket to GitLab,” reports Karol Zielinski, Channel Manager at Xopero. The backups can be encrypted using a customer’s key.
Shorter certificate validity periods demand a proactive response
Patrick Schraut, Managing Director of Cybersecurity DACH at NTT DATA, draws attention to a massively underestimated problem: certificate management. TLS server certificates form the basis of secure web activities.
These digital certificates, also known as SSL certificates, are used for authentication – that is, to verify a server’s identity – and for encryption. Furthermore, they ensure that data cannot be tampered with unnoticed during transmission.
They therefore form the basis for a secure, encrypted and trustworthy connection between a client, such as a web browser, and a server.
Changes are afoot regarding the validity of these security seals, which could have drastic consequences. Whilst, until March this year, certificates were valid for up to 398 days – and thus for over a year – the validity period has already been halved and will continue to decrease.
“From 15 March 2027, it will be just 100 days, and from March 2029, as little as 47 days,” explains Schraut. This will have implications for certificate management, as many organisations still manage certificates manually.
“That will no longer be possible in future. Tools are needed for this, and they are available,” adds Schraut. However, at present, many still think they can sit this one out and wait and see.
“Anyone who fails to act in time risks systems no longer being able to communicate with one another,” he warns, adding: “Expired certificates are one of the most common causes of IT system failures.”
How the management of these validity periods can be automated was demonstrated by the session Never face expired certificates again! at it-sa EXPO & Congress.
Would you like to carry on the discussion about the trends outlined here with manufacturers, operators and security managers? In the it-sa 365 Community you will find expert articles, sessions and direct dialogue on OT security, CNI protection and AI-assisted defence all year round. Become a user!
Sources:
Tagesschau: “Three billion are definitely gone” (Link in German)
Tagesschau: FBI blames North Korea (Link in German)
CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto
Heise-Online: Cyberattacks on refrigeration systems: manufacturers under fire (Link in German)
The Guardian: Not cool: who hacked France’s supermarket fridges?
GlobalSign: Preparing for the 47-day validity period of SSL/TLS certificates – A Q&A guide for businesses
German Hospital Association: Sector-specific security standard ‘Medical Care’ (Link in German)
