This year, the global pandemic has radically shifted the way many of us work. This shift has brought with-it a new threat that does not directly affect computer systems, but rather us, the users of the systems.

In 2019, almost 200 million Ransomware attacks were registered. This number alone is already frightening. When seen in combination with the myriad of other threats that have been affecting our systems, it is almost mind boggling. This year, the global pandemic has radically shifted the way many of us work. This shift has brought with-it a new threat that does not directly affect computer systems, but rather us, the users of the systems.

As of the writing of this article, most of us are still working from home, a reality that has drastically modified the attack vectors in cyber space. Small and medium sized enterprises (SMEs) are now faced with a changed threat landscape. Thwarting these new threats often requires expensive and source consuming security solutions.

Solutions that will have a lasting impact on the IT threat landscape, as we are forced to find new ways to communicate with each other, new ways to work with our information technology, and new ways to protect our information.

Several threat vectors will now see an increased prominence, including any attacks directed towards workstations and personal communication devices, such as cell phones and tablets. The increasing importance of cloud solutions in this environment that shifts infrastructure into the cloud space, shifts threats into the same space, and initiates dangers resulting from misconfigurations and lack of visibility.

The way information and data are handled in a predominately home-office environment presents additional perils. The common “Bring Your Own Device” policy often leads to data stored on company cloud spaces finding its way into the private data storage of employees. This is turn can critically affect a company’s data security.

Secure connections to the different IT environments have become a baseline for securing data in transit. These connections are a good starting point in protecting the IT infrastructure and the data contained within, although they are often subject to common vulnerabilities and misconfigurations.

To address these novel threats, we must change the way we approach our risk mitigation measures. Many solutions, such as traditional Security Information and Event Management Systems (SIEMs), can be exceedingly costly and therefore not economically viable for many SMEs.

Suitable solutions can be made available by leveraging the changes in the work environment. This means that the use of cloud-based security systems must become as common place as the use of cloud infrastructure. The increasing relevance of cloud spaces brings with it a plethora of excellent features, like rapid scaling, that can greatly impact any potential response to identified risks.

One of the major factors in reducing risk to information on endpoint devices, whether it be laptops, tablets, or cell phone, has been and will continue to be active security monitoring. As common solutions have proven to be cost-prohibitive, a new approach to security monitoring must be considered.

Outsourcing security monitoring could facilitate a risk-based approach that identifies and addresses the most important information assets and their underlying vulnerabilities. The use of an external Security Operations Center (SOC) to monitor well-defined and specific VPN traffic, workstation security logs and data transfer events is a viable option to economically address some of the threats we are facing.

Our new reality has brought a new way of working and with-it new threats and significant challenges that will put many companies to the test. While there is no solution that offers complete protection, a risk-based approach that addresses company specific threats must become common practice.

Nikolaus Brandstetter, Head of Secure Networks, Communication and Cloud @ SGS Digital Trust Services

You may also like

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act
icon External Engagement

Contribution to the EU Commission Public Consultation on the revision of the Cybersecurity Act

The Charter of Trust welcomes the opportunity to participate in the European Commission’s public consultation on the revision of the Cybersecurity Act. As a coalition united by the goal of strengthening digital trust, we are pleased to share our consolidated response and recommendations.

We support Policy Option 2, which focuses on targeted regulatory measures that address key challenges without creating unnecessary complexity. In this context, we emphasize the need to enhance the role and resources of ENISA, to ensure effective implementation of both current legislation and the European Cybersecurity Certification Framework (ECCF).

Our recommendations aim to improve transparency, collaboration, and efficiency across the EU’s cybersecurity landscape. These include:

- Introducing clear timelines for the development of certification schemes.

- Enhancing stakeholder engagement throughout the process.

- Establishing more structured communication channels between ENISA, the Stakeholder Cybersecurity Certification Group (SCCG), and sectoral ISACs (Information Sharing and Analysis Centers).

We call for a stronger ECCF, one that is transparent, inclusive, and aligned with international standards to foster global interoperability and ease compliance for organizations across borders. Equally critical is the harmonization of certification practices across EU member states and the mutual recognition of certifications to minimize regulatory fragmentation.

The Charter of Trust advocates for technically robust, standards-based certification schemes, with well-defined roles and responsibilities. We also stress the need for clarity on the interplay between voluntary and mandatory certifications, particularly in relation to the upcoming Cyber Resilience Act (CRA).

To streamline compliance and reduce administrative burden, we propose a unified, risk-based incident reporting regime that consolidates requirements under regulations such as NIS2, CRA, GDPR, and DORA. This would not only simplify reporting for organizations but also enhance the EU’s overall cyber resilience. In addition, we recommend incorporating liability protections and grace periods for incident disclosure.

Finally, we urge the Commission to strengthen supply chain security by adopting a risk-based classification approach and establishing baseline cybersecurity requirements for ICT suppliers.

The Charter of Trust remains fully committed to supporting the European Commission in shaping a secure, resilient, and trusted digital future for Europe. We look forward to continued collaboration in building a cybersecurity framework that meets the needs of all stakeholders, today and in the years to come.
June 19, 2025
Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025