Cybersecurity in enterprises
New challenges with the NIS2 directive and the CRIF alert
As connectivity and digitization increase, businesses are increasingly exposed to cyber threats that can compromise sensitive data and the integrity of critical infrastructure. These revolutions have radically transformed the way businesses operate, making cybersecurity a top priority. Two recent events-the introduction of the NIS2 directive and the CRIF alert on the growing number of attacks-highlight the urgency of adopting more effective security measures.
The CRIF alert: a snapshot of the current landscape
A recent study by CRIF revealed that the first half of 2024 saw a 10 percent increase in cyber attacks compared to the previous year. This figure confirms a worrying trend, with businesses increasingly exposed to growing threats. Among the most frequent attacks are phishing, ransomware, and data theft. These attacks not only compromise information security but can also cripple a company’s operations for days. The exponential growth of threats makes it clear that companies need to take more advanced and proactive security measures to protect their critical infrastructure.
What is the NIS2 directive?
The Network and Information Systems Directive (NIS2) is the new European cybersecurity legislation that came into effect in 2024. It is an update of the previous NIS directive, introduced in 2016, which aimed to improve the security of networks and information systems within the European Union.
Differences between NIS and NIS2 and new features introduced
Unlike the first version, NIS2 introduces more stringent requirements and a broader scope. The main goal is to increase the cyber resilience of companies operating in critical sectors, such as energy, transportation, finance, and digital infrastructure. While NIS covered a limited number of sectors, NIS2 extends its application to a wider range of organizations, including SMEs operating in areas considered vital to the economy and society. One of the most significant aspects of NIS2 is the extension of security regulations to more sectors, now including medium-sized companies that were not previously subject to such regulations. Companies must adopt more robust security measures. These include requirements to implement risk management procedures, improve incident response capability and ensure business continuity. Another important change is the requirement to quickly report to the relevant agencies any security incidents that may affect the continuity of essential services. This is to ensure a rapid and coordinated response to threats.
Why NIS2 is important for businesses
Implementing the measures in NIS2 enables companies to significantly reduce the risk of cyber attacks and the resulting economic and reputational consequences. Complying with it is key to avoiding administrative and criminal penalties while ensuring compliance with European regulations, which are becoming increasingly stringent. A company that demonstrates effective management of its cybersecurity not only avoids economic damage, but also strengthens the trust of customers and partners, improving its competitiveness in the marketplace.
How companies can adapt to NIS2
The first step in complying with NIS2 is to conduct a thorough assessment of the risks to which the organization is exposed, taking into account the evolving threat landscape. Companies must define a cybersecurity strategy that includes policies, procedures and technologies to protect data and infrastructure. Investing in staff training is critical. Employees must be able to recognize and report potential threats and adopt secure behaviors to protect corporate information.
Cybersecurity challenges for businesses today
Cyber threats are evolving at an incredible rate. Cyber attacks are no longer limited to classic viruses or malware; we are talking about advanced ransomware, large-scale DDoS attacks, highly customized phishing, and even exploits that exploit zero-day vulnerabilities that have not yet been identified by software vendors. Hackers and criminal organizations are increasingly sophisticated, using techniques such as artificial intelligence and machine learning to penetrate enterprise systems and evade traditional security controls. This increase in complexity requires companies to stay constantly up-to-date on new attack techniques and take a flexible approach to defense. It is not enough to apply the same security solutions as a few years ago; one must evolve with the threat.
The complexity of critical infrastructure protection
Many companies depend heavily on critical infrastructure, such as energy systems, transportation, telecommunications networks, and health care systems. Protecting these infrastructures is particularly complex because an attack on a single vulnerability can have devastating consequences for the entire company, or even an entire industry. One of the main challenges companies face is the shortage of specialized cybersecurity expertise. While demand for experts is growing, supply is failing to keep pace, creating a skills gap that many companies struggle to fill. In addition to this, cybersecurity management requires significant investment in financial and human resources, resources that small and medium-sized enterprises (SMEs) often cannot afford to devote fully to cybersecurity. Compliance with regulations, such as NIS2, adds an additional layer of complexity for companies. Rapidly evolving data protection and cybersecurity laws mean that companies must constantly update their procedures, and complying with new regulations requires careful planning, in-house training and upgrading technical infrastructure.
How companies should work internally to ensure cybersecurity
In addition to complying with European regulations such as the NIS2 directive, companies need to take a systematic and holistic approach to cybersecurity. This involves creating a security culture within the organization and implementing risk management practices that involve all levels of the company, from top management down to the last employee. Here are some of the key actions that companies should take internally to improve their cybersecurity:
- Creating a culture of safety
- Define clear roles and responsibilities
- Implement structured risk management
Cyber risk management is an ongoing process that requires the identification and analysis of vulnerabilities. Companies must:
- Conduct periodic risk assessments
- prioritize vulnerabilities
- Adopt effective security policies
Another crucial step is the establishment and enforcement of corporate security policies governing the use of internal tools and systems. These policies should cover:
- password management
- access control
- Regular backups and recovery plans
- threat monitoring and response
It is critical for companies to have a real-time monitoring system for networks and IT infrastructure to quickly detect any anomalies. This includes:
- Intrusion detection systems (IDS) and intrusion prevention systems (IPS)
- incident response plans
- Collaboration with outside experts
In addition to working internally, companies should collaborate with external cybersecurity experts for periodic assessments and advanced implementations. Expert advice can provide additional assurance that the measures taken are effective and state-of-the-art.
Conclusion
Cybersecurity is a top priority for companies in every industry. Addressing growing challenges requires a comprehensive approach that combines advanced technologies, continuous training, and a security culture shared by all employees. Only through a structured and proactive strategy can data be protected and business continuity ensured in an environment increasingly exposed to cyber threats.
This post is also available in: Italian
