Data management in Luxembourg is outdated, says cyber-expert

First Published in the Luxembourg Times

With outdated systems, Luxembourg falls behind modernised cloud and security softwares despite thorough regulations. A lack of cloud solutions and cyber security specialists might be to blame, says a cyber-expert.

“As we take on more clients, one of the things we have discovered in Luxembourg is that the software and cyber security updates that firms should be doing are not being done well,” George Ralph Global Managing Director and Chief Risk Officer at Richard Fleischman and Associates (RFA) said.

According to Ralph, such software in the Grand Duchy are not adequately updated because offices of private equity firms and hedge funds are usually small satellite offices of companies with bigger headquarters somewhere else.

RFA, an IT, financial cloud and cyber-security provider set to expand its services in Luxembourg, will have to adapt to the Grand Duchy’s particular requirement of keeping data in the country, a condition other EU countries such as Spain and France do not have to follow.

“Because of the data controls in Luxembourg, a lot of firms have a small server in their office whereas the rest of their organisation might have a public cloud set up,” Ralph said.

“What I’ve noticed is that the internal IT teams are focused on the big IT infrastructure that is servicing the world and they forget about that server sitting in Luxembourg which is required to keep the data there,” he added.

In order to comply with Luxembourg’s requirement, RFA is building private clouds to keep data centres in the Grand Duchy up to date and secured.

As a result, RFA insists firms will not need to have servers in the office, but rather have data running in RFA’s cloud while remaining in Luxembourg, and therefore, complying with the data requirement to remain in the country.

But another factor is to be considered when a company decides to invest in new cyber security and file storing technology. With the Russian invasion of Ukraine adding an additional strain on businesses in Luxembourg, firms are now obliged to ensure that they are adhering to sanctions and are compliant with the legal demands the EU has set into place.

EU countries advised against using certain Russian technology, such as Kaspersky, a Russian antivirus software, over fears a Russian cybersecurity firm could be used to facilitate cyberattacks in Europe by the Russian government.

“A key current concern is how Russian cyberattacks could spill onto regulated Luxembourg firms,” Ralph said.

Consequently, companies are having to manage cybersecurity solution allowing them to manage their own risks, whilst also having a strategy in place in order to be able to respond quickly to a cyber-attack.

In fact, the current geopolitical situation has tormented many cyber experts, especially because of the fact that EU countries rely on software and security products mainly produced in the US and in China.

Pascal Steichen, the president for the European Cybersecurity Competence Centre said that Europe relies more on technology produced abroad than any other continent .

Not only has the Grand Duchy experienced an increase in hackers attempting to access personal and banking details in the past year , but the European Court of Auditors reported in March that significant cybersecurity incidents in EU bodies increased more than tenfold between 2018 and 2021.

Moreover, challenges around data management, costs and cloud complexity are still an issue that should imperatively be solved for financial services companies in Luxembourg, despite cloud technology raising productivity and improving cyber-security, the RAF’s managing director explained.

Nevertheless, there is a wide range of public, private and hybrid cloud set-ups that are used by companies in Luxembourg, such as Microsoft Azure and Amazon Web Services, which, according to Ralph, are large cloud suppliers.

Volker Müller, associate professor in computer science at the University of Luxembourg, revealed that his students who did internships at certain firms, noticed an appropriate use of systems.

“Some companies in Luxembourg really use sophisticated and very modern approaches for cloud applications and cloud-based software development, but I do not have a general view for the complete business landscape in Luxembourg,” Müller said.

Additionally, other businesses do not use cloud systems at all, but do spend money on adequate security tools.

“We have invested a lot lately in our cyber security IT,” Stéphanie Noel, CEO of Victor Buck Services, said.

The Grand Duchy is making advances to protect itself technologically, with more research and interest inquantum computing being achieved, a form of computation deemed as the most secure way of communicating and protect from malicious intent .