now he's working good morning to
everyone first i like to thank t welcome
2017 this year here in Santander and I
like you thank you for being here in
this no atmosphere I am mark Antonio
Cassano coordinator of in severe protect
your company security services devoted
to SMEs and organizations or
institutions to protect their
information here we're going to I'm
going to present the presentation
related to the risk subject to SMEs or
micro companies with a very simple
concept so we can see how cyber
criminals can deceive us and it's very
easy for them I will just make a very
simple demonstration so to show how
cyber criminals works first do you have
a credit card any of you do you have
just a simple credit card or debit card
just a banker god
this can you tell me your PIN code
please no don't tell me your PIN code
I'm sorry it was just a joke
I always thought with this anecdote
because you are the audience
I am the speaker and you trust me and
this can be used in Internet by
cybercriminals now please I wanted you
to show your smartphone I'm sure you all
have one and please show me your a
smartphone this is easy things will
become more complicated later please
show me your smartphone we're not going
to be hackers yet I just want you to
show me your smartphone now give your
smartphone to your neighbor to the
person that is sitting to your left and
you that are the threesome you can pass
your smartphone to the right you're
going to start filling somewhere somehow
Restless but you can be treated from
techno Edition later now try to unblock
your neighbors smartphone okay really
really quick how many have been able to
access this your neighbors a smartphone
one two okay now please give it back at
each owner
of all of us we small number of people
have succeeded we all know more about
cybersecurity to use it in our daily
life but in companies we don't use this
knowledge why we might think that this
is a totally different environment we
separate our professional from the
personal domains but we should add bells
when we are in a bar with our friends
and we carry out a small talk but we
never speak about cybersecurity how many
of you went adjust when to have a drink
and you see that your friends when they
are unblocking their smartphone they do
not have a passion and unblocking
partner how many of you have asked this
question of all of you very few so we
have to disseminate the concept of cyber
Security's of the dis present in all
environments and following my
presentation I like to speak about the
past 25 or 30 years ago this was the
type of criminal with this look with the
heart and he or she had to go to the
physical place she commits the crime
whether to a bank or jewelry shop and
those are their headlines it was a
robbery at a gas station they kidnapped
a person those were the type of common
crimes 25 or 30 years ago now we have a
new format of Agri criminal even though
the old ones are still present but now
we have cyber criminals they work in a
global context they work in Internet
and they do not need to be physically
present in any given place what is even
more worrying is that the needs the
tools he or she uses are very economical
a computer tablet the laptop you see
literally and then he or she will have
the possibility of anonymity that is
present in internet but Internet not
everything is taken for granted that we
have to say so things have changed now
there are more headlines related to
cyber attacks than to conventional
crimes and also all information related
to cyber security and the media will be
more and more interlinked when we see
the famous statements from political
leaders or well-known people that can
only blame their statements to the fact
that their account had been hacked we
have four main devices information
people computers and devices everything
was very controlled in the 80s we have
the coming of technologies and services
email for example all of a sudden in the
90s we see Internet and the
participation of third parties in
business from the year 2000 the social
media and smartphones all those
technologies are used by cyber criminals
to disseminate crimes from 2010 aware of
the cloud and in 2020 is not yet 2020
but we are still we are
speaking about the Internet of Things or
Internet of Things some may call it at
present usability dominates against the
security we see all those LED bulbs that
with Wi-Fi and a mobile application we
can change the intensity of the light
but we cannot evaluate whether this is a
secure feature for our office or not if
manufacturers have to implement security
including devices in the rooted in
passwords and settings then the users
will not buy it and this is the problem
we are facing right now hackers attacks
against companies what are cyber
criminals looking for they've been doing
it for many years so motivation is the
money and I don't know or I cannot say
it in millions of dollars or Euros
but is it around 0.8 percent of the
world GDP that's more than drug
trafficking and human trafficking
together you can imagine then the huge
amount of money involved and is not only
the economic profit but in order to get
did they do not have to do much in order
to produce one kilogram of drugs many
things have this around the process all
to move hundreds of people from one
place into another but to commit a cyber
crime there's not much they have to do
other exceptions in this environment
this question comes because many
companies many SMEs or micro company
says that or think that criminals only
attack large companies this is not true
or not always true
large companies have more technological
maturity to defend themselves from cyber
crimes but small companies do not have
this level of maturity and they are the
right place or is more advisable for
them to attack the large companies and
that's the big questions as my company
really need cyber security and the
answer is very simple at present or a
few years ago we could say that in our
business processes cybersecurity wasn't
a need we had a computer just to create
and print office documents we use the
postal service's and that was the end of
the story now all our company's
processes whether large or small will
always require internet connection the
use of the cloud you are very young and
probably do not use business services
but do you use any services without
internet for your personal or business
life you are connected to internet 24
hours a day we're all going to connect
to the net do we know about the risks to
our company do we know do you know about
any risk information the loss of
information information is our main
asset if we lose our information our
business will be closed but we have many
different risks I will explain them
during my presentation we have various
infections vulnerabilities phishing
reputational loss because we had a data
leak or somebody stole our information
there are many different risks and the
fact of not knowing them is to risking
and when I speak about this emmys or
micro companies we can have hardware
problems Beauty miss years for example
the cleaning stuff that comes to our
office they carry out their cleaning but
then they disconnected the server or any
switch so we don't have access to
information or the access to information
is interrupted and everything related to
our business that goes through this
device will no longer be available I can
give you an example when I was ICT
consultant in a business Indian I am
from LAN by the way a cleaning lady went
into our office he was a legal firm she
went into an office where the server and
the rotor were located and she switched
everything off just to save the
electricity and the day after the
president asked what the hell did
happens we also have a risk
what insiders or former employees or
unhappy employees that want to damage
our business and we should be very aware
of this fact that there are many
different projects that through
psychological profiling they ask about
the labor prevention there are internet
applications where you give certain
answers and your employees might have
enough information about you through a
psychological profile we can see whether
somebody person insider profile or
unhappy employee profile so the business
owners can get to know this potential
behavior of course problems more often
problems are related to vulnerability
what don't we see about 2017 what was
the main problem but what happened in
May June can you remember those horrible
murder abilities if we make a summary of
wanna cry Microsoft released the patch
in March when a cry exploded in May two
months later how do I keep on going
without updating my systems for two
months about telefónica we should be
thankful the way they communicated
companies to do it as they did but this
was useful so that entrepreneurs were
more aware of became more aware of those
problems and also so that updating
policies might be designed differently
we also have a problem of vision we can
do how this is really easy virus malware
and identity replacement and ID stealing
that is so much related to facing we
have one of the most serious that are
industrial spine where we have a company
that can be our competitor wake up
designer a key product in the market and
our competitors can hire to the fact
that we have tailor-made cyber crime so
that they steal our information our
patent those attacks are quite
sophisticated they take few months the
cyber criminals but on many occasions
they are successful video with very
intense summary of what I said so that
you can see how a cyber criminal works
give us out
[Music]
another cuando tenía que esperan I
remember when I had to wait for my day's
work so the office was empty and I could
get in and steal computer equipment
money or companies informations since
international learning for my crimes is
dealing of a corporate information is
very easy so I asked for a rescue and
many companies do not even realize Who I
am
would you like to know our buttons in
Internet you will be surprised by all
the information available and how easy
it is to infect computers in those
companies that are not protected
sometimes I just need email with a virus
once infected I can send trojans carry
out financial transfers or get
information to resell it and when we
think how easy an anti-virus is I don't
have to make much effort I just have to
find somebody that my link this attached
execute a crack sort of the systems
department in a systems department that
does not have
an anti-virus system so my work is
easier when there is little awareness
about cybersecurity on many occasions
they install applications at the web
server and they expose them in Internet
without realizing they need of updating
them the need of patches the need of the
password or the directory with the
settings information with keys for
databases thanks to this sloppiness I
can get into their kitchen without them
realizing I like people asking me to spy
on their partners telephone lines or
information so I copy the information I
reveal the passwords in the caches when
is so it will be so easy for them just a
code access code when I go there I
install a hug Wi-Fi I start getting
information about employees and the
company and I can capture all the
information whether personal or
professional they don't know how
dangerous it is to connect to unknown
Wi-Fi network sometimes they might one
day they will realize and it will not
longer be able to do it
something else is when they ask me to
steal company's confidential information
to telephone an employee pretending I am
an IT technician and they give me the ID
and password and I'm in control of the
equipment while they have a coffee don't
they know that this information is
personal what about those that believe
that their name and date of birth is
difficult one thing some other people
think that just five consecutive letters
is and this is a good network they need
to note that they should use passwords
with symbols numbers capital letters etc
Internet is a grand place for us as
cyber criminals with companies that do
not care about their security or they do
not even think about the pliant measures
they can continue to do so we are
becoming really wealthy thanks to them
oh yeah
bobby's we stopped as you have seen in s
natural how how many things are possible
for cyber cyber criminals how do they do
it they used to attack pillars one
devoted to people this is the easiest we
are very vulnerable remember that the
weakest link is between the chair and
the screen or is just in front of the
screen about people they use social
engineering techniques so that cyber
criminal make us do an action and we
even feel good about it
the urgency of the actions that we as
users do not have time to think let us
think of a manager that is requesting
something how are we gonna say no to a
manager fishing which is just email
impersonation
so that is but in a personalized way so
that is more convincing and some other
techniques making us visit a website
implementation of malicious applications
and then the area of our systems or
architectures where we have information
related to stolen cards malware
vulnerabilities related to websites
errors of management is implemented
applications so what happens with all
those problems when we speak about the
business services in vision or
impersonation about the website contents
I'm going to show you some examples that
are a great impact and that happen every
day and now I will reproduce
a fishing to capture ID information so
this is those will be real stories that
in our national cyber crime aims the
incident get every day and this is Maria
in places spy fishing social engineering
and a defacement now Maria Hassan
employee Alexandra C receives an email
from ski monitor with a PDF file there
was a previous study of the information
Alexandra probably published in Facebook
but her son went on skin lessons and
hacker investigated on her life and
since her this file Alexandra will open
it up see the hacker will know
information so that Alexandra does not
have to make any action or confirm about
any change in the information in the
file then one of Rome IT department says
that the customers are saying that the
web site is changed
Maria is really concerned about this and
when she goes on access her website a
page with my world does not correspond
to the original website Google and the
browsers show us a warning message that
sometimes letters access the web or not
in this case
we could get to the websites but the
cybercriminal had uploaded uploaded
another application that sold falsify
product from the legitimate website this
is quite serious but there are even more
those that we have seen since the end of
last year and beginning of this year
what we call the CEO fraud or the whale
illness we have the fishing that affect
many people and the whaling that is the
big waves people that really are the
boss now what they do is the same as in
the previous example with Marian
Alexandra but they can access or contact
the people that have decision makers not
in the middle management but in the
higher ranks why they could manipulate
bank accounts they could do high amount
transfers please send me a balance of
our account or let us do a confidential
operation and please hold the
information and the lease is public so
they use social engineering in order to
convince the users and is easy to get
into it don't you think that managers
are not vulnerable there's something
that was said in the video which is to
be aware of this situation on many
occasions we don't have time to be
trained to learn about security and when
we are not aware of this problem it will
be easy for us to get into their hands
if we can define the year 2017 in cyber
security or in service
the attacks this year we can speak about
run somewhere on the last year's we
could also speak about the semies
ransomware this is what has been more
damaging to micro companies and SMEs why
once again my we're ciphers information
from your device and makes it no longer
accessible in our Institute we always
recommend not to accept these bribery
why because it will be never ending his
business line where cyber criminals have
a niche and if we pay from this
blackmail we will never be the end of
the study but what is better to lose
information or to pay 300 or 500 years
what would you do in this dilemma just
be honest you will pay but here we are
just a feeding on the problem over and
over and there are many companies that
pay due to this situation so what we
have to do is to prevent or mitigate the
possibilities are the likelihood to be
infected by those bugs now before
speaking about potential measure to
protect our jobs we're gonna see how
cyber criminals can get email address in
order to implement this in an how to
create a fishing system this is
something quite easy and in fact it
generates a great deal of profit I will
do it in a very simple manner we can
use false certificates and more
sophisticated means but I'm gonna use a
very simple one
no polymer reproducible at rallies they
this a monitor
bear with is the second word tried we're
going to try to play it on screen see
love it looks we must laugh
don't dismiss see what we get
that's all you perfect pallet let me try
to explain to you how they extract email
accounts this is one of the more
commonly used tools in order to spread
more work to do fishing another militia
some actions carried out by cyber
criminals all these applications that
I'm going to use and share with you are
available on the Internet really
available very public and youngsters
probably are very much familiar with
good what I'm going to do at this point
is try to compile email address it
address it so that I can send my
phishing attacks so I'm going to use my
company I don't want to attacked or sold
other companies if you give me your
authorization I can of course try to
attack yours but I'm going to use cyber
candidates and these tools they use is
indexed information is the information
indexed by Google okay I'm just a fun
for you to see so the search engines
have evolved full time and these are
tools that cyber criminals are using in
order to collect information in the past
we were talking about only public
information but now we're talking about
extracting information within documents
and now they can extract or collect data
from the made of data after your
documents and these are made of data
we're not experts let's say difficult to
erase this information now for example
our users state logging information the
software that we're using to edit the
document that can also be exposed to
vulnerabilities etc because in this
specific case if you take a look we have
a series of email addresses all of which
are public and if you test other domains
you'll see that it's very easy to do
it's very easy to find an email I'm
going to send this phishing to my
co-workers colleagues and I could use a
social engineering tool in order to
compile for conduct passwords for
example from an asset from a specific
side here I have my personal site it's
how you are l miss cocina Scott es /
Thea now this is a back-end series of
credentials you can administer your was
the website yeah so I'm going to send to
an employee that is managing the
information the URL of a malicious site
that I control in order to steal the
credentials from that that's what I'm
going to try to do so I use an
application I'm very quickly going to
parameterize the application that I want
to use I'm going to clone the site this
is going to be the malicious equipment
that I'm going to use in this specific
case I need to know what the IP address
by the way that la la I'm going to
introduce the URL that I'm going to
clone
not gonna lovey-dovey clone it very
quickly as you can see and this side is
now perfectly designed to perpetrate I
send someone the URL directly in order
to access that side while he can suspect
so what I'm going to do instead
surrender my attack a bit more credible
so what I'm going to do is open a word
file a word document and I'm going to
select this on the link that addresses
me or redirect me to the malicious
server I can save this file in a PDF
format and once I have saved it I can
send this file to this person justice
Maria that sent Alejandra the employee
uninfected file now we're going to send
this document search engine and if you
take a look in this tag we have the
legitimate web site and in this other
tag we have the malicious server page
it's very hard to identify the
differences they're almost identical and
in this case for you to see more clearly
this I'm as you can see I'm accessing a
virtual machine which is the malicious
server from the victims computer and
under once the system is
ready I access the documents URL and I'm
unaware of that number and I introduce
the passwords user and password admin
admin access
that was something absolutely something
happened
this always happens
yes
I'm sorry for this please bear with me a
minute making a fool myself
we have a motion that is a store that
you're very much interested in this
right you even move faces 39 to 28
I'm going to use another one maybe I
have that good shape I'm going to use
Facebook for example maybe those chaps
in the back of the room are more
interested in Facebook
[Music]
I believe okay so this is my site by the
way you shouldn't do this with pages
that learn under your control in this
case I access the Facebook site and you
can see legible information but I'm
going to introduce the alleged
credentials of a given user and my
password as you can see this isn't
Facebook need to be aware of the fact
that a certificate isn't being used for
communications and when we access as you
will see we are redirected to Facebook
in this case as you can see here the
attack has been successful this says
that if the victim has clicked in order
to access that site it has introduced
the credentials in the server war that
employs stored and ism in this case the
malicious server I would be able to
compile that datum if this attacked
let's say it's transferred to thousands
of hundreds or thousands of who email
addresses let's think about potential
users of Facebook well in that case we
will be able to use a many many email
accounts in a malicious manner and as
they say on TV no don't do this at home
please and do it under your own
responsibility I'm just doing this for
educational purposes goodness
resume the presentation at this point
good companies and businesses understand
that ICT services can be outsourced and
this is quite common and nobody is
surprised by the fact that company is
outsource their ICT services because
they don't have and how staff to do this
and if we contact our ICT service and
ask them if they're aware of the need of
cybersecurity well of course they'll
answer yes they need to be familiar with
all the latest technologies but when we
sign an agreement with an ICT provider
we always need to have a contract
agreement that has clear terms and
conditions as to everything related to
ICT support that we want and also
everything pertaining to privacy
agreements how they're going to treat
and process and information and this is
very important and yesterday I visited
the Chamber of Commerce and I made a
presentation pretty much in line with
what I'm saying here today and I was
asking them about who was doing the
backup copies and they said the IT
service and I said how often do they do
the backups and they said well I really
don't know that's what this gent said
and that's really a problem because the
VR the interested party if we were the
costumer and we don't know when the
backups are going to be done well that
in itself is a problem we need to be
aware of that information we need to be
on top of it what happens when we end
for example a collaboration with the
provider this is what we call captive
customers because they have our data our
information they view manage
confidential information we don't know
whether they're going to try to attack
us or damages with this information so
it's very important that in our
agreements with them we have clear terms
and conditions as to how they're going
to save all info pertaining to your
company and how they're going to erase
it from their hardware once our
collaboration comes to an end probably
when you need on IT service to have
different actress implemented you will
need for all the remote access and you
need to automate all these processes in
the past I automated accesses in order
not to have to ask for access constantly
but you need to make sure that you
disable this feature if you change
provider and now we're going to move on
and I'm going to talk to you with
further detail about non-disclosure
agreements so that you understand all
the elements that need to be included in
disclosure agreements and need to be
delete taken on board
[Music]
since we set up our business we of
course signed many contracts with
providers and customers some were verbal
in nature or inaccurate in this area so
tell this led to loopholes so the Code
of Ethics is based on ethical values and
corporate responsibility and to ensure a
good name in our relationship with
customers and providers we started to
formalize all our agreements for example
we assigned agreements with legal
consultancy and with the consultancy
firm and all these providers have access
to highly sensitive information from our
business that's why we had to sign yes
sir yes non-disclosure agreements and
confidentiality agreements we also still
reached similar agreements with our
customers and we signed agreements for
non-disclosure purposes and of course we
need to protect information and respect
non-disclosure terms as employees we
have confidentiality or non-disclosure
agreements as well with our employees
let us give you some recommendations
regarding what you need to include an
non-disclosure agreements based on our
own experience the structure and
contents of non-disclosure agreements
may vary depending on each situation but
broadly speaking we need to cover the
following sections place and date
parties that take part the reason behind
this Agreement the service provided and
of course the confidentiality or
non-disclosure you cross or term then we
need to describe the activities
performed by each of the parties and the
reason we
the agreement or contract and we need to
specify the service that will be covered
by this agreement unless we will address
confidentiality or non-disclosure issues
and this agreement needs to include a
description regarding what we understand
by confidential information for example
procedures techniques designs of
blueprints diagrams models sewage the
supplier can access in order to provide
his service but this classification of
information will depend on the nature of
each business it's also necessary to
specify what we understand by
confidentiality for example acceptable
use of information duration of secrecy
Duty the security measures that need to
be implemented etc let me go back to the
previous example in the non-disclosure
agreement with her legal advisory firm
we for example established that
information can only be used for the
purposes of legal advisory and not for
commercial purposes these contract
requires them to ensure the
confidentiality and privacy of our
information and our company we
established that there's an obligation
of secrecy and/or professional secrecy
to me to be more exactly loped the
legislation enforces Spain specifies
this need for professional secrecy and
once this collaboration comes to an end
the and personal data from our business
needs to be destroyed in a safe and
secure manner and of course we need to
consider issues that go beyond technical
measures the non-disclosure agreements
allow us to regulate and govern service
provision improving the security of our
data whenever this data sexist by third
parties we need to regulate and govern
the service provision today in order to
prevent future problems don't leave this
on the wayside
see see see it's very important to sign
non-disclosure agreements because of
course if our information has been
compromised we would like to hold people
accountable this is like a contract we
cannot expect people to be held
accountable unless there is
non-disclosure agreement at this point I
want to talk to you about security of
steering plans what is this about well
this is the application or
implementation of the series policies
measures and best practices but we need
to adopt and our businesses there are
many methodologies many different
standards I as 27000 that regulate how
these date management systems need to be
designed but sometimes if our businesses
are small we don't need to apply these
standards that's why we have the
security plans which are the starting
point for the management of security and
SMEs and micro companies of what are the
steps that we need to take into
consideration well first we need to
conduct a preliminary analysis in order
to identify the risk level of the
company we need to know where we stand
that's not the case you won't be able to
be able to read articles in terms of
security and we need to define strategic
goals the company strategic objectives
theme strategy needs to be very much
aligned with the business to make sure
that we do things well we need to
identify the departments and processes
that are
going to be affected by the security
steering plan or master plan and of
course we will have to disseminate best
practices among employees in order to
implement our plan our master plans how
should i implement this well there's no
specific guideline it can be talk to men
with a set of recommendations for
example in the case of passwords make
sure you might apply your password every
90 days you make sure you follow this
structure make sure you have at least
nine characters we can have four or five
tips recommendations based on the
specific needs of the prisoners
dependents are depending on their
technology differences and the movie
analogical maturity of the company and
we can have an ongoing improvement cycle
with this six some phases you know what
the current situation is the
organization strategy two different
approaches classify and prioritize and
of course the management needs to
approve all this because without the
support of the management this won't be
able to be implemented and then
implement executed out on the field now
this master plan needs to be realistic
in order to be implemented sometimes we
aren't realistic we are overly ambitious
and this means that implementation is
very difficult and the monitoring and
auditing of this process is very very
difficult we don't want to crack nuts
using a sledgehammer here know when you
have a clear plan this is going to be
very important for the organization to
protect and ensure cybersecurity and
it's very important that this plan is
reviewed and we visited in a systematic
manner on a periodic basis there needs
to be an ongoing improvement plan in
order to review it why is it necessary
to review this fund
well because I'm changes can occur and
that can call for this review
for example our IT consultancy service
was out first but then one day we decide
to hire somebody to do this task
in-house so that means that the whole
situation changes something that needs
to be taken on board and we need to
review our plan at these Spanish
cybersecurity Institute they tell us yes
what you're saying is wonderful if your
reticle but I want hands on measures I
want to know what the security level of
my company is and the result of this
need we've developed in design
self-diagnosis service and in only five
minutes time you can assess the state of
play of your company in terms of
cybersecurity regarding people equipment
supports and now I'm going to simulate
this I'm going to simulate this tool I
will pretend that now I am an dependent
and the tool is just a questioner and
depending on the way we reply we will
get the level of risk of the
organization I'm gonna use for the
simulation email website and a server
three technologies that almost all
Assamese use once we select the
technologies there will be more
questions but I'm just going to simulate
that I am an SMS how do you update your
IT systems
what was it we have a problem with the
presentation I will be back
went see no not
I'm sorry
balli all right as I was in we select
the technologies email website our own
server and then we reply to the
questions how do you update your ID
systems you we do it ourselves just with
a friend we outsource them or we have an
IT expert SM is usually outsource this
service then do you have any protection
system in your computers do you use it
usually companies always say they have
antivirus since though in other devices
so we will respond or equipment's of an
antivirus have you recently trained your
employees in cyber security
the majority of SMEs in our experience
do not provide training but when we ask
those questions they almost always say
that they've given the employees
information to read do you have access
control to your venue not access is free
we use cards or physical security
systems we have a cover
God usually is just keys and they have
security systems they have a system to
manage the passwords usually the answer
is no but users choose a password with
some given criteria how do you get rid
of the systems that you no longer use is
usually to keep it hardcopy and the rest
they just go to to the bin we as a with
what do you do with your hard disk when
you sell them they
really no do you are you present in the
social media that you should have an
account but because there are have a
community manager they usually manage
their accounts themselves company B
without an email until it becomes a
problem they all answer less than four
hours when you ask them about the
contingency plan then they don't really
have an answer they say well they might
prolong this time how often do you
update your email server companies do
not know o type of email service you use
sometimes they keep their emails more
email system ID systems who eliminate
the email accounts usually the outsource
company how long can your company be
with an interrupted website the same as
with email less than four hours how then
do you make backups of your website
contents either never or they do not
know if you see to the right there's a
bar that one we answer the questions we
have information about the level of risk
who can access the website content some
authorized users how often do you update
the dual that updates your website they
usually do not know it they ask the IT
systems department
when you ask them about security
features they say yes but no question
how often how long can your company
survive with the systems down they say
if the accident happens at 12:00 at
night by 5:00 they should be up and
running how often they do not know
whether they make remote connections to
their systems and employees can access
internal applications from a remote
screen is using who can administer
internal applications some authorized
users where are the servers and duties
of the organization located usually in
an office space with limited access do
you have a contingency plan in case
there is an accident so that your
business can no longer be running backs
up are usually the most common system
but they know about them that they
haven't checked whether they are always
in place they usually say yes the last
question do you have contacts with your
IT suppliers they think they do in 95%
of the answers and depending on the
answers the company's level of risk in
this case is 78.4% therefore very high
what we do
to mitigate this problem when we see the
score of these self-diagnosis we offer
basic mitigation measures that companies
can implement them in their environments
mitigation measures related to people
processes and technologies once they are
aware of the level of risk they are able
to implement security measures and
security guiding plan or any other need
disculpa la Fiera a lamprey a la
pantalla ah no me no vesicle a
presentation
to
the typical topic Oh Casa del delito
mother no more Ont pero si si well a
difficulties of broadcasting life well
we are back we know how to measure the
level of risk of our organization this
was the starting point now we're going
to talk what are the protection measures
for our job at present when we go to
certain place and we ask is difficult to
is very where to see the posses monitors
but if we open up a drawer or keyboard
we see that we still use this way of
protecting our password so it's very
important to start from the job station
this is the place where we carry out our
activities and we should protect them we
shouldn't show our passwords they should
be visible not accessible we need to use
a password manager as kiba's is a free
system that will cipher our password so
nobody will be able to know them do not
let mobile devices whether a smartphones
or USB is accessible many of you know
about situations on how do we get
information from a smart phone
even though protected by a pin code
sensitive or confidential information
should never be visible and the dustbin
should never have sensitive documents
confidential information should be
destroyed
what about password you all know that
the password should have more than nine
characters at least the capital letters
no keys and numbers but you know that
the fact of having a robust password if
we are victims of officials is not going
to protect us the cyber criminal will
get to know the password so what do we
have to do as much as possible in
addition to using those robusta
passwords we need to use all the
services that use dual authentication
systems secure applications in our
business environment we need to use
secure applications what do I mean by
this official applications not using
pirate applications where there are
crackers or other problems that are
usually negative many in many companies
IT services or your friends not to blame
anybody they probably are willing to
install a pirate office and here we are
endangering our PC applications have to
be updated we cannot use applications
without security patches unofficial
applications cannot be updated that
could prevent any sort of computing
problem portable information USBs
hard disk and smartphones we have all
lost USBs and we
happens information loaded in the USB
the testing that we work in a healthcare
company with highly sensitive data
confidential information protected by
the law if we lose this data a year made
public and the Spanish Agency of data
protection gets to know it we will be
suctioned therefore when or fined so
whenever we handle confidential
information we should do it in a coded
or cipher way with using Benna crypt
there are free systems that allow us to
cipher information in a simple way
guaranteeing its security and it's
rather easy
I need my customers information to be
protected first we have to identify
information unclassified whether is
confidential information is we kept
ciphered in a safety box if it's
internal information we need to apply
the appropriate measures and if it's not
confidential then we don't have to apply
anything so first we should classify the
information according to this
classification we will implement a
certain to keep it whether through users
access if this ID or a physical system
limiting the access by lock always
knowing who can access in relation to
IDs we should implement login or
register measures to see when somebody
has logged in or modified or change
anything so we provide an extra feature
to the security so from the next
with a specific date that makes the
updating compulsory and we should
destroy the information accordingly if
it's a hard copy with conventional
systems but if we use and if we use
physical copies there are companies we
can always destroy this information
manually but there are professional
companies that destroy information there
are also tools for normal uses as the
one or other applications that allow to
do it in the office personal data
protection this is something that all
companies are really scare about they
don't know they are complying or not and
the accidents are quite powerful and
many we use customers employees and
providers information we have to be
dated and from margin next year it will
be compulsory the Data Protection Agency
would safeguard know compliance and if
we have any doubt and we need some
clarification we just have to contact
them they usually give prompts replace
to our queries in our business we can
never also we should never request data
that are not going to be used this is
something that is subject to sanctions
and if we have a website with
information we should provide
information about our rights access
ratification cancellation or opposition
we should apply the necessary measures
who is the responsible of data files etc
we should always see the personal data
protection the fact of complying with
the regulation will generate trust to
our customers without the exception when
this example is you go and access a
website
and if they have trust the stamp you can
trust the page this is not always the
case um use the certification in a non
legitimate manner but if you know for
sure that the website is complying with
the regulation this will offer a greater
level of trust
teleworking this is something and there
is more present in the work and family
conciliation we need the same masters as
in our office we need to work in a
secure system with antivirus an updated
system we should only use the device for
work and whenever possible it should be
used only for work histological prices
allow us to have now different devices
for different purposes and we sometimes
use mobile devices the smartphone or
their tablets to access our jobs if our
company had many employees using this
type of portable tools remotely we could
estimate the implementation of a mobile
device management MDM there is quite
economical teleworking or working from
home from our personal pieces those that
we also use for Leisha the same we need
the guarantee that working on a safe PC
is not enough with an antivirus we need
to use it with limited rivet ID who uses
your computer at home without an
administration
you don't use it with the administration
admin only - this is quite an
interesting measure if we access it with
the admin and is infected it will be the
end but if we access it we limited
privilege it will only affect part of
the information even though it might be
equally malicious virus in some
occasions and we know that this happens
in companies we know that we have an
insurance that will cover for the
problems as when we buy an automobile we
know that we have to get out of the car
dealers with an insurance but sometimes
this also happens and this is more often
the case from this year onward
what do we do in those situations what
are the measures how do we sort it out
the first we can pray we can pray to
Santa's Saint do this but we hadn't
implemented any technological measures
candles may not work my grandmother when
she lost anything she prayed to Saint
and Anthony and there was somebody that
would always find what was lost but here
if we hadn't protected our system
there's nothing we could do so grant a
failed but if we have a plan B that is
just the handling of
but today is still the very same simple
and economical way full systems recovery
please to that we may not have the most
advanced technology to girl out the
backup but if we have the weekly backup
of the company's information we might
have only lose one week and we can
continue with our life if we don't have
backups our life will be more
complicated something that we should
take into account in relation to backups
is to make sure that they can be
restored there had been cases when
having a problem and somebody would like
to restore all those full restoration of
the backup and files are either
corrupted or not able to be opened so we
should check that our backups can be
restored we know what a contingency plan
is backups can be within these plans a
contingency plan is something that will
allow us to continue our business if our
office fire we need to have the
possibility for this information using
these premises to move it somewhere else
and even the owner provisionally manner
to go on working otherwise our business
will be interrupted and we will no
longer be able to make money and that's
different to have a business
continuation or not and the Windsors on
fire was just a good example some of the
companies that work there disclosed what
else should we take into account risk
management to identify the assets and
potential threats if we have a server in
room connected to the power we can think
that if we reduce a UPS system if there
is an looked
they cut which is not always the case
but is possible then the server should
rebuild or if in the middle of an
operation of copier access in a
transaction the server may broke and
they might damage the ongoing activity
there are many different examples floods
unauthorized and country of the office
so we should evaluate the risk in a very
simple way is the potential impact on in
euros multiplied per day likelihood to
happen to try to implement oxygen
devices in novice to mitigate a fire is
absurd this very expensive system for
very low risk a possibility of another
impact might be high and then after this
evaluation we should adopt the necessary
measures several we know is connected
the net we connect the server to the UPS
and we continue working with something
there is very much in vogue now cyber
insurance on cyber risk insurance
policies this has been the case in
United States for more than 20 years but
in Spain only for the last two years it
works as any other insurance if there
are things that have a very high
technological cost or we do not have the
capacity on interest we can also solve
this with the insurance and there are
companies that when we contract those
services they also offer additional
services obg adequacy
a security audits and those are added
values to make our company more secure
in this case all those measures that
have been introduced into our
presentation if we offer cyber security
but we're really offering his trust and
trust will generate business if you have
a website that is totally secure that
manages the data personal data
information appropriately
I believe the monitor will switch off in
one minute that's a message on the
screen
so if we have a secure website then our
customers will highly value it and they
will use it how can in theory our
Institute help we've been working for
several years and investing efforts that
companies through our website might get
all essential services
to have their own system their own
security system to implement
cybersecurity this is just a summary we
have the basic information kit were we
rise the cybersecurity awareness of
companies with an implementation plan on
many occasions we don't know how to
implement this plan we include the plan
that is deployed in different months
then we have a self-diagnose tool that
you've seen then security policies
around 19 if I remember correctly
related to passwords to Wi-Fi access
very simple with very specific points of
reference then we have the MLC for
businesses self employees we usefully
organized three and four calls every
year interactive sectarian pathways with
interactive videos devoted to the ten
main industrial sectors industry offices
health care where are their characters
Miguel the so called Miguel and Laura
through videos and questioners and
interactive play they speak about
security according to the different
industrial sectors than would have a
serious game that is a video game but it
teaches about cybersecurity
I don't know I'm quite old even I look
younger but Carmen Sandiego is it ring a
bell Carmen San do to you
it was a game that taught geography it
was for youngsters and it's quite
similar it tries to teach on
cybersecurity contact point for
companies where you can send your doubts
or queries only related to cybersecurity
you cannot ask how do I contact TV will
be exact or but you and ask questions
about run some web those are free
services because this is the public
Spanish public administration and the
ransomware service where we can decipher
almost 90% of crypto infections and a
cybersecurity catalog where we have more
than 5000 solutions and services related
to cybersecurity if any of you need to
know about a company that carries out
the security audits you can access this
catalog and you can choose and filter by
geographical areas you have multiple
ways to get to the right company that
will offer you the right service you
have information in this section protect
your company from entry way and if you
have any question down to query I'll be
happy to answer them
now I believe and I mean they are seeing
the intima Cassie Cassie what us good
morning
see
for an SME or a micro company with
limited budgets imagine that they can't
outsource computing security services
how safe and secure can Google or
Dropbox be in order to handle documents
among them confidential documents that's
a good question and as for the data that
you can upload in order to work in a
collaborative manner our recommendation
is that all those documents that are
uploaded to the cloud need to be
encrypted or coded if they are indeed
confidential documents if for example
you're high schoolers right yeah our
confidential information has to do with
the exams basically but let's imagine
that you have a student with PDA and
let's make use that you although the
students record all that information
needs to be duly protected so my
recommendation to you is to upload coded
or encrypted information can we do that
can we encrypt using a free software no
you have some tools like Bravo serv
aircraft that allow you to encrypt the
info before you upload it and if you do
so you're protecting yourself from
providers or suppliers we know that 100%
security doesn't exist but basically
you're shielding your information and
preventing others from accessing unless
they have the key words so Google
couldn't be held accountable right while
you would need to revise Google
agreements but since this is a free
service they cannot be held accountable
for the data contained in those
documents so that the security is
transferred to the provider but if
someone does phishing and extracts the
passwords
I'm afraid Google has nothing to do
someone has stolen the passwords and
Google cannot be held accountable
good morning you've been talking about
protection measures you have been to
mention of one for example using an a
symmetrical encrypted email can can it
be a good protective measure
well emails emails when created weren't
implemented with security measures
because back then it wasn't considered
to be necessary but unfortunately the
email protocol hasn't been encrypted the
protocol itself hasn't been encrypted so
what can we use so that that service
email service is secure well to use a
symmetrical encryption keys in order to
protect our email messages and we can
use certificates to sign our emails
those measures have a bit of a
complexity and this is like what should
I use whatsapp telegram or sign oh how
can I make a choice you'll probably go
for the easier option if you tell the
user I'm going to give you my public key
word because I'm going to send you my
encrypted
my message is encrypted you need to
download a plug-in and you need to
integrate my password so that you can
read the encrypted messages and
sometimes this processes are considered
to be overly complex and that's a
problem it's an obstacle to
implementation and we need to ensure
easier options
but of course security comes with
complexity and I like to tell you that
we are currently developing some
guidelines for the use of PGP precisely
and we will polish these guidelines and
the upcoming months any further
questions or queries well if that's not
the case I hope you have found my
workshop of interest and I like to thank
you all for attending