“The Swisscom security experts react immediately when an attack occurs”

Guido Kölliker is the Chief Information Security Officer at SGKB, making him responsible for information security at eastern Switzerland's leading financial institute. In early 2017, he analysed the cyber risks to which the bank is exposed. “Unfortunately, we realised that there were no suitable countermeasures available to us to prevent ransomware attacks,” he recalls. “That made us feel terrible. An attack like this can cause damage amounting to millions.” Kölliker consulted the experts from Swisscom for advice, as Swisscom was responsible for operating the file servers at SGKB. “Our expectations of an effective system to protect us from ransomware were clear: First of all, lightning-fast identification of an attack. And secondly, an immediate reaction involving countermeasures.” Donat Kaeser, Product Manager for Storage, Backup & Archive Services at Swisscom, mentions a third, equally important, criterion: “An effective backup and restore concept is also indispensable. We recommend backing up data five times a day using snapshot technology. In the event of an attack – which can never be completely ruled out – work on restoring needs to start immediately. However, this also involves a problem: After an incident, the data are restored to the version that existed before the attack. And in many cases, a number of hours can pass in between. In the meantime, however, the more than 1,000 employees of SGKB have been hard at work, with all this work being put into their files. This work would be lost if all the files were simply restored without any differentiation. The best remedy for this is ‘Differential Restore’, which only overwrites the files affected.”