IT security is corporate security and comes first

In well over 20 years in the security business, we have been able to gain a lot of experience and have always kept an eye on current trends and issues affecting our customers. The customers with the longest affiliation to IOK have been with us for over 20 years and we accompany them with their worries and needs and issues relating to IT and now also IT security. And our experience on the one hand and then listening to a manufacturer on the other are a guarantee that we can build a good recipe to be able to react to new requirements in the future. I believe that this is a very important and stable triangle where all three parties - customer, manufacturer and managed service provider - really need to work together well and over a very long period of time so that all three parties involved are in agreement.

Customers usually approach us with some kind of active situation that they want us to support. Then we often start with a holistic audit of the environment. When we visit the customer, we pay attention to: Where is the server room? Is the door locked? Who has access to the network distributors?

Can I simply plug my notebook into a network socket or WLAN and immediately access the heart of the company, the data? It starts with such banal topics and then we go relatively deep into the technologies that we can offer our customers as a service provider in the audit. We are an infrastructure provider and can help a customer build a solid foundation, right down to the application level. We don't provide industry software, but everything around it so that this software can work well and stably for the company. And we will take a close look at the subject areas that we need for this. We take a look: How is the system doing? How is the network doing? Is there a patch strategy or not?

And then very specifically: What is the security situation? By security, I mean the classic approaches of endpoint security, antivirus protection, a firewall, is there an email security functionality and strategy? And once we have collected this information, we paint a picture in the background and then deliver this picture to the customer in the form of a report. And then to the decision-maker and to IT. In both languages, because an experienced East Westphalian managing director is addressed and spoken to differently than an IT specialist. And that's why both should understand how we assess the situation.

And then we come up with really specific recommendations for action to improve the status quo of the situation in a maturity model and we try to take the customer with us and go at the customer's pace so that the customer doesn't feel overwhelmed, but feels comfortable.

Zero Trust is a very exciting topic and I believe that it is one that will be very much with us over the next few years. ZTNA is not a product, but a philosophy. It's a process of how I deal with access, authorizations, etc. And when it comes to the question: Who needs ZTNA? If you want to answer that honestly, you have to say that everyone who wants access to resources needs it. And then it doesn't matter whether these are internal resources on one side or external resources on another side, in a data center at a hyperscaler or at a service provider. And that's why every customer has to deal with this issue.

The question is whether the customer stands still and only has their classic VPN activated, or whether they want to go on the ZTNA journey. And I believe that this will probably move us in a similar way to how the cloud brought us into an uncertain future 15 years ago. And today, it's impossible to imagine life without it.

We came from the classic best-of-breed approach and had addressed our focus topics of firewall, antivirus, and email security in greater depth depending on the customer situation and the customer's wishes, and built and operated them for the customer. The whole thing no longer really fitted in with the times because we realized that we had to become much more agile. We have to be able to react to a wide range of customer requirements. We have to try to make the complexity that this entire IT world entails much simpler, because security has become much more important today. And in current discussions with customers, we often talk about security first and then about the rest of the infrastructure.

I believe that in five years' time we will only be talking about corporate security. And when we feel that corporate security is on the right track, we'll move on to other topics. First security and then my supposedly productive work. And this change that's happening has forced us to rethink and change the way we do things. Because if we live from selling servers, storage, and network systems and operating them for our customers today, we will no longer be able to do so tomorrow if we don't focus on security. That was a paradigm shift that we first had to make internally.

When we have IT departments on board and discuss factual issues, we get technical again relatively quickly and have different approaches regarding how deeply we integrate into the existing processes and IT department. This is a very difficult topic because the administrators may feel like they are being sidelined.
You have to take the administrators with you on this journey so they understand that it's not about cutting anyone out but rather about strengthening their role and not losing focus on what’s important. After all, IT administrators are there to maintain the company's value chain, not to hunt for threats. That responsibility should be handled by the experts who are dedicated to it.

I believe that the pressure on all parties involved in this three-way constellation of customer, manufacturer, and MSP is increasing. You have to react faster, and the consequences of reacting incorrectly or not reacting quickly are becoming more serious. We can see this in the cyberattacks currently affecting the region. It feels like the scale is getting bigger and bigger. Companies are having to shut down their production for several weeks.

Public institutions are no longer accessible and can no longer operate effectively. People are experiencing real distress, both personally and professionally. The understanding and technical know-how will likely decrease more and more. We need to translate the technical aspects of manufacturing into a language that companies can understand. That is probably our biggest challenge for the future.