Interview with Marc Ruef

swissVR Monitor: You have proven skills and expertise in the cyber field. How do you see companies’ cyber resilience having improved over the last few years?

Marc Ruef: Cyber resilience has improved markedly. Many companies now understand cyber security as a crucial aspect of corporate risk, and members of management teams are now much more likely to be discussing digital risks and regulatory requirements. However, cyber crime has also become more professional over that time: ransomware groups now operate like industrial service providers with specific roles, workloads and business models, so the race against the criminals continues.

swissVR Monitor: Our survey findings show that more than one company in three has been the victim of a damaging cyber attack. Where do you see the major vulnerabilities? And where do companies need to put most effort into making their systems more secure?

Marc Ruef: Theft of log-in credentials is still the greatest risk: successful attacks resulting from phishing, data theft and compromised user accounts can have a devastating impact on a company. And most recently, we have seen a ramping-up of the risk from third-party providers and supply chains. The increasing complexity and multifaceted nature of modern systems involve risks that are not always evident, so companies are therefore more likely to downplay their significance.

swissVR Monitor: Three years ago, around one company in four reported being the victim of a cyber attack. How do you explain the increase, given that businesses are now much more aware of cyber-related issues?

Marc Ruef: There’s no contradiction between a greater frequency of attacks and a better understanding of cyber risk. The complexity of systems and, hence, the extent of companies’ vulnerability to cyber attack has increased, so it hasn’t become any easier to protect systems. Meanwhile, cyber crime has become a business model and is constantly being refined. We are now seeing the first, but very serious, impacts of AI on cyber security, with both companies and criminals benefitting from the new opportunities AI brings.

swissVR Monitor: What measures do you think are most effective in preparing employees for cyber attacks?

Marc Ruef: Successful implementation of cyber security does not start with procuring expensive technology but rather with the company’s culture of security, which dictates its specific needs and its scope for action in this area. Staff training is crucial to reducing vulnerability to attack, and over recent decades, companies have had access to a range of technological means to deploy and optimise on an ongoing basis. These include traditional defences, such as firewalls, network segmentation, anti-virus programs and regular systems updates.

swissVR Monitor: Our latest survey shows that more than half of all companies do not have plans in place for restoring essential core IT process following a cyber attack without incurring unacceptable costs or damage. What should plans for such a scenario actually look like? And how should they be tested?

Marc Ruef: Caution and discipline are the key requirements for a secure company. Businesses need to take the time to prepare thoroughly for a crisis, identifying core processes that are at risk and measures to contain the impact of an attack and to restore systems. It is devastating when companies do not tackle this issue early enough: once the crisis has happened, they are in survival mode and simply do not have time to think carefully about the decisions they are making, let alone make plans.