Awareness of cybersecurity is still not sufficient, but regulations help

When discussing digital transformation, we cannot overlook the issue of cybersecurity. How aware is the Croatian real sector of the dangers lurking behind screens was the topic of the last roundtable at yesterday’s Lider G.R.I.D. forum, and the conclusion was that awareness of cybersecurity is growing, although there is still work to be done, with the NIS2 directive (i.e., the new Cybersecurity Act) and the DORA regulation (Digital Resilience Act) helping in raising awareness.

Bojan Ždrnja, Chief Technology Officer at Infigo, pointed out that his team dealing with cybersecurity incidents has practically not had a free weekend since November last year.

– Regulations raise awareness, but I would still say that awareness of the importance of cybersecurity is not at the levels it should be – said Ždrnja.

—

Bojan Ždrnja

photo Boris Ščitar

—

A similar impression is shared by Zlatan Morić, Director of the Cybersecurity Department at Algebra University, who emphasized that he does not know a manager who views cybersecurity as a necessity; rather, everyone sees it as a cost.

– The focus of the new Cybersecurity Act is risk analysis. In Croatia, I see a significant challenge because to analyze risks, one needs to know how to manage assets, and 99 percent of companies do not know what assets they have. How can one conduct a risk analysis on something they do not even know they have in the company? Incidents most often occur on systems that the company does not even need but remain powered on, are not properly maintained, and that is enough for hackers to breach the system and access data – explained Morić.

—

Zlatan Morić

photo Boris Ščitar

—

It is getting better, but too slowly

There are positive changes, Ždrnja added.

– Ninety percent of our clients come from the financial industry, which is regulated and must take care of cybersecurity. In the last five to six years, I can say that this structure is changing; there is more understanding from other sectors, probably due to incidents that have occurred and regulations. It is getting better, but too slowly – believes Ždrnja.

That the private sector must be more attuned to cybersecurity was stated by Robert Preskar, Director of Security Solutions at ASEE, who distinguishes between the awareness of small and large companies.

– More exposed companies are indeed more aware of attacks and are working on remediation and prevention, while the SME sector still does not pay enough attention to it and probably will not until it becomes a real threat – added Preskar, noting that the weakest link is currently people, or ‘disregard for common sense’ in everyday work and behavior.

—

Robert Preskar

photo Boris Ščitar

—

Cybersecurity budgets are usually small before an incident, after which they grow, says Preskar. Unfortunately, as Ždrnja noted, there are cases where a large amount of money is ‘poured’ into some technology that is good to have, but it is not all about the technology itself.

– The key thing is strategy, risk assessment, deciding where to invest and how much to achieve the appropriate level of security. Besides technology, human resources are what we need to invest in, and we are lagging behind others in that – added Ždrnja.

Lack of experts

Algebra educates cybersecurity experts, but generally, we lack people in IT, said Morić, explaining why fewer IT professionals choose a career in cybersecurity.

– People do not go into cybersecurity for the money but because they want new things and challenges, and the effort required is greater than that of programmers and system engineers. This is the main reason why we, but also the whole world, do not have enough cybersecurity experts – explained Morić.

At the end of the roundtable, moderated by Lider journalist Ksenija Puškarić, participants agreed that today hackers attack companies that are the easiest targets, which is why companies are obliged to work on raising employee awareness, and this should be part of their security policy.

—

Robert Preskar, Zlatan Morić, Bojan Ždrnja, Ksenija Puškarić

photo Boris Ščitar

—