...that you are very satisfied.
In this presentation, I will tackle the main threats and risks affecting companies, especially smaller companies that may not have a technological or cyber security maturity, because they are SMEs or micro-companies.
Can you show me your debit or credit card?
This is just a test that I always do in my presentations.
Okay.
Anybody else?
Here.
Do you have one debit or credit card?
Thank you.
Okay.
Those three.
Okay.
Four.
Fantastic.
Angela, can I have your PIN code?
Yeah.
No, this is a trick.
Zecorino.
I will give them back.
Thank you for your willingness.
Edward and Steven.
Thank you.
Now, get out your smartphones, please.
And you pass it to your neighbor to your left.
You give them your smartphone.
I feel some nervousness, but in this venue, if you're interested, you might use or avail from our psychologist.
Now, unblock the smartphone that you have in your hands.
Just try to unlock it.
How many of you were successful?
A few.
Okay.
Yeah, that's good.
With this, please give back the smartphone to their original owners.
On some occasions, we know more about cybersecurity than we think.
Even though some of you have given me their credit card, it was canceled.
Yeah, that's the old trick.
I would like to start my presentation with those small tests and to say that cybersecurity should become something that we can disseminate as when we go to a bar and we chat about sports and the same about cybersecurity.
Probably those that have unlocked the mobile, it's been easy for those smartphones that do not have a pattern.
So, those that do not do it, you can tell them, why don't you lock your smartphones so that cybersecurity information is something that we convey, not only from our personal life, but also to the social life.
Why?
Because this behavior will convey to the rest of our daily activities.
So, we all have cybersecurity close to us.
I always remember criminals' profile 25 or 30 years ago.
Here you see an image where you see the typical muggler.
What happened at that time?
Criminals had to go to the venue where they had to commit the crime.
If they wanted to rob a bank, had to go to the bank, use the gun, or the jewelry shop, or kidnapping somebody, it had to do physically.
What were the headlines we had at that time?
They robbed 20 million to an entrepreneur.
They kidnapped a person.
What happens 30 years after?
The profile is quite different.
The term is changed.
There are common criminals, but now we have a new agent in this film, a new actor, the cyber criminal.
This person works in a more global context, in Internet.
It's the cyberspace.
He doesn't need to have a physical presence in a specific place to commit the crime that would be a cyber crime in this location.
So, in addition to all those things, cyber criminals do not need to use a real weapon.
They will only use their intelligence and some applications made for cyber crimes.
And what do we have here?
An informatic attack paralyzes Sony.
J.P.
Morgan suffered a cyber attack.
And in those days we will see how tabloids and cyber security have a common way this year.
What was the breaking news this year in cyber security?
It's been presented in all the news, everywhere.
WannaCry, of course.
WannaCry has helped us all to be more aware.
It's been present in the media.
And we have to protect ourselves.
Computing attacks to companies.
What is the motivation?
Yes, the money.
The main is the money.
To give you an idea, cyber crime at a world level represents 0.8% of the GDP.
This is much more than human trafficking and drug dealing together.
The difference is that to produce one kilogram of drugs, many things have to be done.
But for a cyber crime, I just need Internet, a brain and a computer.
Then I will show you how cyber criminals compile information using some Internet-based tools.
And I will show you how to design efficient really, really fast.
Are there any companies that are an exception?
Do we have any response?
There are many companies that think, small companies that think that they are not the target of cyber criminals.
But cyber criminals are looking for large companies.
This is a mistake.
Large companies with more technological maturity will have firewalls, controls and tools that will protect them from attacks.
But small companies, they are the core or the object of cyber criminals because they will be powerless against certain attacks.
So all companies, without exception, whether large or small, can be the target of cyber criminals.
Do you know any of the risks that can affect companies?
In addition to physical risks like floods or fires.
Can you speak about any risk?
No?
An information flow?
Yes.
Information leak?
Let us do a brief summary.
The first could be hardware problems due to inappropriate manipulation.
This sounds a bit bombastic, but it is just.
For example, the cleaning staff in our office, when cleaning an area, may disconnect the cable or switch off a plug.
Although we could have devices that, due to any accident, are manipulated.
Former employees or unhappy employees were using services or information and communication technologies every day in our business.
And it is very easy to take information using a USB, taking it to the cloud.
What happens with the so-called insiders or unhappy employees?
They can do what we say.
They can be very damaging to the company.
At present, there are many companies that are developing solutions to try to identify employees' profiles.
I thought there was a cat in the room.
It is probably the sound of a cat.
It was a cell phone.
To try to identify all these employees that have an insider profile, how do they reach this information?
Risk prevention applications through some targeted questions.
It's a baby, it's not a cat.
Okay, there's nothing I can do.
Okay, there are some other threats.
Vulnerabilities.
For example, WannaCry was a vulnerability.
In fact, more than vulnerability, it was a bad updating policy.
If you are interested in this subject, you probably read that the vulnerability found out in March before.
But Microsoft released a patch in March and WannaCry exploded on the 12th of May, two months later.
If everyone had applied systems updates, although it's not easy for large companies, but if all had updated their systems, probably today we wouldn't have heard about WannaCry or any other eternal blue of any of the WannaCry varieties.
So a good updating policy would solve this problem.
What about phishing?
You know what a phishing is.
It's an impersonation, an email that we get from our financial company, our utility.
Usually there are campaigns that are associated to a specific day, the income tax campaign or many others related to tax returns.
Then malware or viruses as WannaCry and identity impersonation.
Now we are famous people, popular people.
When they make an unlucky comment in the media, they say my account has been hacked.
That's their excuse.
And what other threats we have?
Targeted attacks or industrial spying.
This is very much related to insiders or APT attacks or threats, persistent threats.
What happens here?
Usually when the competitors know that other company has made any research that will be beneficial, sometimes and not all companies, they try to steal the idea through attacking the company's services, whether to contact internet email or any other.
This is quite common among governments.
You probably have news related to spying.
And this is one of the risks by companies.
Now we're going to see everything that the cyber criminal can do
.
I remember when I had to wait until the end of the day's work in order to get in to steal computer equipment, money and the company's information.
But since I went to internet for my criminal activities, to steal corporate information is easier so I can get a rescue.
And what is even better is that many companies do not even realize.
Would you like to know my ways in internet?
You would be surprised with the amount of information available and how easy it is to infect computers in some unprotected companies.
Sometimes I just have to send an email with infected file.
Once there, I can send trillions, do a financial transaction or steal information.
It will be easy if they just install an antivirus.
I don't really have to make such an effort.
I just have to find somebody that links in an inappropriate file executing a crack and the systems department does not install an antivirus.
Or they might enter their password in a false file that I've sent.
It's easy for me because information about cyber security is not very present in companies.
Sometimes they present their information in internet without updating their systems, changing their ID and changing their settings.
Thanks to this sloppiness, I can get into their kitchen without them even realizing.
I like commissions from people that want to spy mobile phones from their partners or the directives of a company.
Text the corporate email.
I just copy the information.
There is a store.
I revise the passwords and their personal photographs.
It will be simple if they just used an ID and just cipher the devices.
I use a pirate Wi-Fi to get connections from managers and employees so I can capture all the information, personal and professional.
I'm sure they do not know how dangerous it is to connect to unknown Wi-Fi networks.
Sometimes they might realize, but so far...
Another thing that I love is when they ask me to steal confidential info from companies.
I call and I pretend to be the IT technician.
And sometimes, if I find someone unwary, they give me their username and password.
Have they told them that keys and passwords are personable and non-transferable?
And people believe that their name followed by their date of birth is difficult to guess.
Others believe that six consecutive letters in the keyboard is a good keyword.
But I have tools to test thousands of keywords per second.
Should they know that, they would probably use long passwords with uppercase, lowercase, symbols and numbers.
And long passwords as well.
Internet is a wonderful world and universe for us cybercriminals.
Because lots of people are unaware about the need to implement protective measures.
We are filling our pockets thanks to their attitude towards cybersecurity.
Well, this is a four-minute video.
It's very interesting.
There's a part of the video that talks about awareness.
Awareness among employees.
I'll be talking about this a bit later on.
Let's take a look at what cybercriminals do.
At INTIVE, we received many incidents related to cybersecurity.
And these can be summarized as follows with this that you can see on screen.
There are two ways of attacking.
On the one hand, we have vulnerabilities that affect people.
And on the other hand, those that affect the architectures or the system.
When we talk about people, we have a social architecture.
Basically, to ask you for your credit cards because you trust me.
You think I'm trustworthy.
But there are many bad guys out there.
You shouldn't have done what you did.
And then the urgent nature of requests.
So that the user has no time to think and try to discern what he or she should do.
Advice related to bank.
Tell us you introduced your credentials.
Log into the service.
Otherwise, you will lose extra 8 hours or 24 hours time.
Spare phishing or targeted attacks.
And we're going to show you a specific example that we saw at INTIVE.
And then we have the distribution or dissemination of malicious files.
And then we have systems.
In this regard, technology.
On the one hand, we have stolen card info, management of errors and applications that are not secure, and other elements that are more technical.
And then I want to go over how do these two types of vulnerabilities converge?
People and systems.
We have phishing and defacement, i.e.
modifications of websites.
Let's take a look at some specific examples.
The story of Maria that suffers spear phishing that leads to defacement and phishing.
How does this happen?
Alejandra, an employee of Maria's company, receives an email from Luis Lopez.
Because she has a son that takes ski lessons.
And this person is being a victim of spear phishing.
This person sends real information and sends her a PDF file attached informing on the new timetable of the ski school.
The cyber criminal, how did he get all this info?
How does he know that Alejandra's son takes ski lessons?
Well, through the social media, for example, that's a good source of info.
The cyber criminal has spied and peeped on her life.
She knows that she has a son that takes ski lessons, sends an attachment with a bug, executes it, and the computer is infected.
And that document probably has info that doesn't refer to the timetable of her son.
She will see that the timetable looks perfectly normal and won't even realize that she's being the victim of an attack.
And sometimes you ask companies, what happened?
Have you done anything?
And they say, no, no.
Users never do anything.
That's what they say.
But they did.
They opened it.
And some days later, the technical department, the IT department, called Maria to tell her that something was happening with the user interface.
Customers had problem accessing.
And search engines are able to distinguish whether a website has malware or whether it's clean.
I don't know if you're served or you conducted a search on Google and there's this alert saying malicious site.
When Maria accessed her website, that's the kind of message she received.
What had happened?
Well, in her web application, another web app had been installed that sold up fake sneakers.
How can this happen?
How do you believe this situation has been created?
We know that a file infected Alejandra, who's an employee.
But why has it modified the website?
How has it done so?
Any idea?
Alejandra probably is the person that administers the web.
The malicious file had a Trojan virus that collects info.
So when Alexandra accesses the back end of the web, she had to introduce a username and a password.
The Trojan collected that info and sent that to the cyber criminal.
The cyber criminal only had to access the management panel of the web and had it fully available for him.
What are the most severe?
Well, all incidents for a company can be severe and problematic, whatever translates into down times.
But there are some, for example, the CEO frauds or the senior management frauds are becoming more and more popular.
This is also called whaling.
Instead of fishing, whaling.
Why?
Because they try to deceive senior managers, bigwigs, so that they do bank transfers of high amounts of money.
How do they try to exploit these vulnerabilities?
By using social engineering techniques and trying to convince the employees that have these abilities in the company to do the actions they so wish.
Something else that is becoming more and more common, ransomware.
Through social engineering techniques, we receive emails with invoices, emails from telecom providers.
We execute the files, execute the macros and get infected.
Sometimes they use the vulnerabilities of operating systems, like WannaCry.
That's a turning point.
Because up until then, ransomware required the user to do something, to execute something.
But with WannaCry, that wasn't the case.
It was able to scan or identify computers with that vulnerability and automatically disseminate it and spread something which is very, very negative.
And in CVE, in the National Cyber Security Institute, we try to help companies prevent and protect themselves from ransomware attacks.
But when we talk with companies, we see that there's a problem.
Should you be in a situation of having to pay 300 euros, 500, 1,000 to have the files deciphered or not paying for them while doing without them?
What would you choose?
Well, probably paying, right?
To be able to continue with your activities.
We always recommend not to pay.
I know it's hard.
It's hard, but if we continue paying, this kind of activity, this business line of cybercriminals will never come to an end.
We've identified samples of malware, cryptologic malware samples that don't have the functionality of returning the files to the original state.
So even if you pay, you don't have the guarantee that you will receive your files.
Before I move on, I would like to show you a demo as to how you can collect data, in this case email addresses, to make phishing.
And then I'll do phishing for you.
Okay, let me check the screen.
I'm going to try to locate all cybercamp email addresses to introduce them in my system.
Sorry.
So you can understand how easy it is for cybercriminals to do this.
The tools that I'm going to use are public, are free, and the search engines have functionalities.
Luckily for cybercriminals, it allows them to collect all information uploaded by companies.
Initially, Google Bing indexed web content, but now they index the content of the files that can be downloaded from the web.
And now they also index metadata inside documents that is more associated to the operating systems or the apps we use in our computer, in order to generate documents, a username, the version of the software we use, etc.
Cybercamp...
And...
It's hard to see.
Now the app is looking for all the public info regarding domain servers and email addresses.
In this case, I'm going to say cybercamp.
I finished already.
And here you can see all the public addresses.
This is on the Internet.
I already have some email addresses to which I can send a malicious file, basically do phishing.
Now I'm going to create phishing.
What do I need?
What does the cyber criminal need to do this server?
It can be his own server or a compromised server that hosts the info.
Then he needs a victim and then we will have to design his attack model or social engineering model.
There are many possibilities.
I'm going to include a document with a Facebook link, for example.
So you know how we can generate a malicious server.
It's going to be really, really fast.
Social engineering attack via web.
I'm going to clone the site.
In this case, it will be Facebook.
Malicious server.
So I introduce Facebook.
And I already have the server.
How can I carry out my social engineering attack?
Well, for example, through a document.
It can be a PDF or Word document that I can send to someone that I found on the Internet.
Or it can be a massive email.
Hello, please access this link to verify that you can publish on my Facebook.
If you are advanced users, you will realize that when I access this link.
Well, this is Facebook's website.
Visually, it's the same.
However, if you take a look at the address here.
And I'm doing this really fast.
I want this to make this more credible.
I could compromise an Internet server.
Introduce www.subdomainfacebook.compromiseddomain.com And since we read from left to right, when we say Facebook, people will feel safe.
This is a very simple and straightforward example.
A very basic one.
I'll put it here.
Now you see how we collect the credentials.
I'm going to invent an address and a password.
I want to hit enter.
And you take a look.
The application redirects the user to Facebook's real website.
And he may think that he hasn't introduced the website well.
But the flow continues.
If I
go to the application that I have in the compromised server where I steal the passwords, I can see that we have the user and the passwords of those that have fallen in this trap.
There are certificates to prevent this from happening.
I think in the case of Facebook, it's hard to do, but it can be done.
But in the case of conventional webpages, it's very easy to impersonate that to try to steal data.
And this is very easy to do, as you've seen.
I'm going to change screens again.
And for this reason, it's very important that we focus on the details.
Some people say everything is very complicated on the Internet.
When you cross the street, do you have difficulties?
No.
Why?
Because you're crossing a pedestrian crossing, a zebra crossing, you're respecting the red lights.
And the Internet is not that simple.
But this symbol works.
You're connected to a website.
You're connected to the URL.
You need to make sure that there's a certificate.
It's quite easy as well.
It's quite simple.
Companies need to subcontract ICTs and cybersecurity.
Well, for a long time, many companies have subcontracted or outsourced IT.
Sometimes they have in-house IT technicians.
But when we call our cybersecurity provider and we ask them if they implement cybersecurity measures in the email server and the website and the servers in the office, he'll probably answer yes.
But do we really know if that's the case?
Well, many times we aren't aware of that.
We ask, but sometimes they don't know how to answer.
Sometimes they say that they have something in place, but they don't know how it is or how it works.
All that information needs to be collected in a document, in a contract with a supplier in terms of a service level agreement and a non-disclosure agreement.
We will have to make sure that all this is covered by these contracts, because if there is an incident that affects our company and that involves the supplier, we need to hold him accountable.
However, if there is no agreement or contract, we won't be able to hold him accountable.
So in those contracts, we need to include all the terms and conditions we see fit, we deem necessary.
And many times the company itself isn't aware of the problems or about how they can identify cybersecurity needs.
I'm going to show you a video on non-disclosure agreements and the contents that all these non-disclosure agreements shouldn't necessarily have.
Let's see if we can watch this video.
Since we set up our company, we have signed many agreements and contracts with suppliers and customers.
Some were a bit inaccurate, and in some cases the agreements were verbal, meaning that we had some problems that could have led to very serious consequences.
Our profession has a code of conduct based on ethical values and corporate responsibility.
And to ensure the good reputation vis-à-vis our customers and providers, we started to formalize our agreements.
We signed agreements with a legal consultancy that helps out with legal issues and with a consultancy firm that is in charge of all payroll-related issues.
Both of these companies have access to confidential data from our companies.
That's why we had to sign confidentiality or non-disclosure agreements with these two companies.
We also signed agreements or contracts with our customers.
They provide us with data regarding their investment processes so that they would have the guarantee that we would protect their info-respecting privacy.
And we, as employees, have signed non-disclosure agreements.
In order not to disclose company or corporate data or information, here are some recommendations as to what you should include in all non-disclosure agreements.
The structure and contents of a non-disclosure agreement can vary.
But, generally speaking, the following sections should be covered.
Place and date, intervening parties, activities or functions performed, reason behind this agreement, service, and confidentiality or privacy clause.
And then we need to describe what each of the parties does and the reason why this agreement is signed.
This is also very important to explicit the service covered by the agreement unless we will cover privacy issues.
The NDA should include a description of what we understand by confidential information.
For example, this can refer to procedures, techniques, blueprints, designs, diagrams, models, mock-ups to which the supplier or provider has access to provide his service.
But this classification of information will depend on each company's activities.
It is necessary for us to specify what this NDA is about.
We will have to specify what we understand by acceptable use of info, duration of duty of secrecy, measures to ensure the security of info.
In the confidentiality agreement that we signed with our legal advisory firm, we established that they can only use our data for the purposes of legal consultancy and not for other purposes.
The consultancy firm, on its hand, should inform also its employees about the need to respect the privacy of our data.
Then it's very important to talk about professional secrecy that needs to be maintained after the end of the service.
The consultancy firm needs to put in place all the privacy measures required as established by the legislation in force.
At the end of the service, the consultancy firm needs to return all the info or destroy it in a safe manner.
In order to ensure a good security level in an organization, we need to consider aspects that go beyond technical issues.
The NDAs allow us to govern service provision by improving the security of our info when accessed by third parties.
We need to regulate service provision today to prevent problems in the future.
Don't leave this behind.
As you can see, it's not just about technical measures that are, of course, very important.
These measures need to be implemented, but also contractual or regulatory measures.
Probably many of you, if you're entrepreneurs or have done your research to know how to implement a cybersecurity policy in your companies, have found out or have encountered standards like ISO 17000 in order to implement security systems.
The problem is that sometimes these standards are not applicable to our company because our company is smaller.
They require such a sophisticated approach to security.
In that case, we have the so-called security master plans, or PDS in Spanish, that allow us to protect our company's systems in an easy way, depending on the technological maturity of our company.
What's the starting point for the implementation of a security master plan?
First, we need to assess the level of risk of our company.
We need to be aware of the problems that exist in order to be able to implement controls and measures aimed at mitigating those errors.
Of course, we also need to define strategic objectives.
Cybersecurity in our company needs to be aligned with our business, because if they run parallel and don't interconnect, we're not doing things well.
So it needs to benefit our business.
We have an e-commerce website.
Implementing the Organic Act for Data Protection to make sure that users use our website and have their data protected will, of course, generate trust.
What departments and what processes are affected by this or could be affected by these risks?
We need to define that as well.
And last but not least, we need to define best practices for employees or for their training, awareness-raising, so that cybersecurity is part of their daily activities.
How can we implement this plan?
There is no one-size-fits-all solution.
Security policy can be very sophisticated, covering all processes or something that is very simple.
Just one page to specify, for example, security tips for passwords, for periodicity of backups, for example.
Our suggestion is as follows.
To go for ongoing improvement and with six stages.
Stage one, to define the state of the company.
Stage two, strategy of the organization to align it with the cybersecurity policy.
Objectives and priorities, classification and prioritization, because we cannot protect everything that's impossible.
Some things will have to be left aside or not expose them to risk necessarily, but we need to establish priorities as to what the most critical elements are.
And in case they fail, we won't be able to do our business.
Number five, big companies need to have the support or enjoy the support of management.
Without their support, we can't do anything, and that stage is implementation.
And of course, we need to go for an ongoing improvement cycle.
Can we sleep in our laurels if we implement this master plan?
No, this is a step in the right direction, but we need to make sure that we review this policy from time to time.
Let's imagine that an organization has outsourced ICT services, but our company has grown, and now we can afford to recruit an in-house IT technician.
So the situation changes, meaning that we need to revisit our master plan.
At Intiva, we've seen that companies have difficulties in doing this, and they are often unaware about their security level.
Not all companies do this.
So to help them out in this endeavor, we've created this self-diagnosis tool to help them.
So that someone with basic knowledge on cybersecurity or very limited or non-existent knowledge can carry out a detailed analysis of the risk level.
There you have the email address where you can access this self-diagnosis tool.
And I'm going to do a simulation for you to understand how you can use this tool to assess the cybersecurity level of your company.
Now, of course, first you need to select the technologies used by your business.
So you need to select the technologies that our business uses, for example, email, website, and in-house servers.
These are pretty common.
Companies, formal companies, tend to use these technologies.
And once we select the technologies, the application launches a series of items or questions to try to profile your security level.
How do you keep your security systems updated?
Well, we subcontract IT maintenance, for example.
I'm just making this up.
But most companies tend to have an antivirus installed.
Sometimes they have other protective measures like physical firewalls.
And they train employees, but not all companies train employees.
But they've been given some handbook on cybersecurity, documented, published by the Spanish Institute.
Access to the premises.
Using video cameras in their premises.
Whether they have defined any password policy control users, choose them.
This is a simulation with a company that has a low cybersecurity level.
What are the supports they will usually have?
Machine destruction, paper destruction company, whether they are present in the social media.
Yes, we do, but we update them only when there are important news.
And in those questions about how long can you be without the service, they always select the shortest possible time, less than four hours.
So if the server goes down at night, in less than four hours, we should put the server up and running, depending on the business company.
If it's a company that is in an international market, it could be critical.
How often do you make backups of your email on PCs?
They usually do not know, but at least once a week.
What is the email you use?
Usually they have their own server that is kept by the internet providers that create the accounts and manages the whole service.
How long can your company be without a website?
Obviously, to implement those measures, if we want an online service 24 per 7, it's going to be more expensive.
How often do you make backups of your website contents?
Once a month.
I'm going to tell you the truth, they don't know.
Usually when we do those tests, many companies, due to the fact that they may be ashamed of saying they don't know, they just answer anything.
Usually internet suppliers.
How often do you update your website?
They do not know.
Do you think that a legislative problem in relation to security?
I'm not sure.
How long can your company be without your systems?
The minimum.
I don't know if I comply with my OLP.
To the right, there's a bar that shows progress on the level of cybersecurity of this company.
How often do you make backups of the systems?
Not of data in this case.
Usually they don't know.
Do you have remote connections to your systems?
On occasions they use an application.
The name is TeamViewer or Windows Remote Desktop.
Who does have privileges to administer the internal applications of the company?
Usually the ICT providers.
Where do you have the servers?
Usually in a room with limited access because they realize that anybody can get and do something.
Do you have a contingency plan in case you have a problem?
Usually they have something, although they've never tried.
Then we'll see why the ICT company has a specific knowledge about cybersecurity and what I said at the beginning.
If we ask them, they will say that they have experience.
Do you have contracts with your ICTs?
They think so, but they never remember the content.
And once we finish with this self-diagnosis, with all the questions, and I invented the replay, they say that 73.7 means high risk.
Among the different alternatives of people, processes and technologies that were evaluated by this tool, they say that our company is at a very high risk.
What do we offer?
Different documents with policies to mitigate risk related to those technologies or elements.
So in this way, companies might have a starting point where they could start implementing cybersecurity measures.
Okay, now we're going to see the protection of the job station.
The users will use the computer, will use internet services.
And what do we have to take into account?
Many of them are just common sense, not to have written passwords.
We should use a password manager so they are safer.
But about post-its, sometimes we don't realize.
If you see here at the computer, at the entry of the whole exhibitions hall, there are a couple of post-its with the information.
But when we start moving the keyboard and we see under the table, we start seeing things.
We don't use a password manager or memorize them, which is very complex.
And we have to protect ourselves with a password.
Mobile devices, USB, anything that is small shouldn't be unprotected.
Anybody can steal it, get the information and use it against us or sell it.
Documents destruction, private information or confidential information.
Depending on the documentation, we should process it according to the law.
If it's confidential information, it should be destroyed.
If it's internal information, the same.
And if it's public information, we can destroy it too.
About hard disks and weird supports or those that we can just use a hammer and smash the hard disk.
But it's not very practical.
There are Devon applications that are similar that allow us to safely erase the information.
Passwords.
You know how passwords should be, as it was said in the video.
But what happens if I am a victim of phishing?
And I can have a wonderful password because I'm really aware and I generate very robust passwords.
But if I'm a victim of phishing, I'm given my password.
What happens?
And as much as possible, if we use popular or common services, we can use a dual authentication factor as banks do when we do any operation.
Through a pin code or Google or we can contract a service that includes a dual authentication factor.
So we can increase the level of security.
We need secure applications.
Everything in our teams should be legitimate without cracks.
Why?
Because if we apply the crack in our company, we're infecting the computers without knowing it.
You take your computer to a technical service.
They are asking for a pirate office or Windows.
And what happens?
We are elevating our company's risk.
If we don't have a budget to use certain applications, there are many different alternatives in open source with the same functionalities.
Maybe they are not as pretty, but they are available.
About portable information, USB, hard disk and smartphones, we have all lost USBs.
I've lost many, depending on the information inside the USB.
When this information is related to healthcare, a company of the healthcare industry and in the USB to work at home, we have Excel files or documents with information referred to different patients.
If this USB is lost and this information is made public, it's going to be very damaging for a company.
So if we're going to use those hard disks or USB to transport information, information should be ciphered.
We have tools as ROS or VeraCrypt.
They are free and we can cipher the information in such a way that even though we lose it, nobody will access the information.
The same about the smartphones.
Now Android ciphers our mobile phone.
But what happens with the cards?
Either we cipher them or anybody that might get a mobile phone can extract it with iPhone iOS.
There's not a problem because version 7 has ciphering by default.
Personal data protection.
On many occasions, companies see our agency, data protection agency, as an enemy.
It's complicated to comply with the law.
Next year with the new law, things are going to be even harder for companies.
But if we comply with this law, with the LOPT, we generate trust because users, customers, people that work for us...
If they know that we comply with the law, they will be more secure.
Many people do not try to convey this message, but in fact to comply with this law, the LOPT generates trust.
Then we have other possibilities.
It's more and more common to work at home, to control work and family life, but we should do it in a secure manner.
If we work from our mobile device, we should see or we should know that this mobile device is secure.
For example, in our leisure time, we might access applications to watch free movies and we are infected with messages that request us to update our release.
And this is what happened to Alexandra.
In the example I've given at the beginning of the presentation, she was infected.
And in this case, we could be putting at risk our company about PCs or laptops.
It would be better to use a computer to work for work and then another computer to use it for our personal life.
Video games, access websites.
And if we cannot have two computers, we should use the computer with an account with limited privileges.
If they introduce a keylogger, it does not matter.
But in case of malware, it wouldn't affect the whole system, but only to the user.
Although there are bugs that, in fact, or viruses that can overcome those protections.
Sometimes this is what happens.
We know that we should have an insurance for our company.
And when we buy a car, we get out of the car dealers.
We always need an insurance.
And the same with companies.
Sometimes this is what happens.
What do we do in these situations when something fails?
Do we have a contingency plan?
Do we have any other choice?
Usually, we can pray.
But in those cases, if we hadn't implemented a technological measure, the problem would not be solved.
I remember my grandmother, whenever I lost something, she prayed to Saint Anthony.
And on occasion, somebody found what she lost on occasion.
And my grandmother was very thankful.
But if we can't apply any measure, it's going to be very difficult.
Plan A has failed, which is the starting point.
Do you have any contingency plan?
Security copies, backup copies is what has avoided many companies to be crushed by WannaCry.
But it's not so much a problem of doing backups, which is something that we should implement.
But we should make sure that they can be restored.
We've seen many occasions where they do backups, but they don't check whether they can be restored.
On many occasions, files, the process hasn't ended correctly, or there are similar situations, and files are corrupted and cannot be restored.
And then to implement a contingency plan, not only for technological measures.
Let us imagine that we have a server connected to the power network, and there can be a cut.
We have all suffered from any of those power cuts at home.
So if you are subject to this type of risk, we need an OPS or any system between the plug and the server.
So in case the video... so we can protect the continuity.
So what do we have to do?
We have to manage our risks.
We should identify our assets and the risk to follow with the server example.
We have one server, different desktops.
We have information.
What is the most valuable thing of our business?
Information.
So we should implement a backup system that would protect that this information will not disappear, or if it does, to recover it.
How can we avoid risk?
Assessing the impact in euros.
What would cost us not to have these assets?
Multiplying it per the likelihood of occurrence.
How many electricity interruptions can we have a year?
And then finally, we should need to implement certain actions.
For the last few years in Spain, although in the United States it's been the case for 20 years, we have cyber risk insurance policies.
Us, because of lack of knowledge or because it's very expensive to implement certain measures in company, we contract an insurance and we forget about the problem.
Let us imagine, and I'm just making it up, that there is cyber insurance that could protect against failures related to the lack of compliance of the Spanish legislation of data protection.
If we have an information leak that proves that our data have been published in a non-authorized way, the insurance will pay.
And will compensate the people affected.
If we offer cyber security, we're giving trust, and trust to our company will generate money.
How can INCIBE help us through all services?
For a couple of years, we've been designing services for companies that have a low technological maturity.
I insist that it's very important for companies to start applying cyber security.
We have to raise the awareness, it's very important to raise the employees' awareness.
We have developed a kit with a deployment plan that lasts six to eight months.
The first measure is to assess the level of risk and the awareness of employees.
There are different stages at the end of the cycle.
We can evaluate whether there's been awareness raising or whether the situation stayed the same.
It has some APT tools and different presentations for the company.
Then the self-diagnosis tool that I've shown you before.
Security policies service that includes 19 management of passwords, Wi-Fi connection.
They're explained in a very simple way, very briefly.
And with different checks, we can identify whether we can implement them or not.
The MOP for microcompanies and SMEs.
We do three or four calls.
This is a seminar or a course for companies.
Interactive itineraries through two characters, Miguel and Laura, that work in a company.
We can identify risk related to different industrial sectors.
One for healthcare, one for professional offices or firms.
There are many risks that are common.
Then we have a serious game.
It is a video game.
I don't know if any of you played Carmen Sandiego's video game.
That game tried to teach geography, chasing criminals.
So this serious game tried to do the same, teaching cybersecurity in a play.
Then we have also created a single shop for companies where companies can send us any question related to cybersecurity.
We don't manage any other paperwork, but everything related to cybersecurity.
And we also have a cybersecurity catalogue where we have more than 5,000 solutions and services related to cybersecurity.
Audits, regulation, anti-virus solutions, firewall solutions, everything.
We have almost all in the market.
And we have a ransomware service.
We are aware that companies are very much affected by this threat.
And all the services are free.
We are part of the public administration.
And as I said, we offer free services.
And the ransomware service can be used by any Spanish company to try to decipher or offer ciphering key passwords.
And you can find all the information in Protect Your Company in our web portal.
And I don't have anything else to add.
If you have any question, doubt or comment, please use the microphone.
Because as we are streaming...
He, excuse me.
Hi, my name is Eduardo.
Hi, I'm Eduardo.
The question is, at the beginning of the talk you said, you spoke about raising the awareness for SMEs and microcompanies.
Those of us that work in cybersecurity, the question is, to this sector, what do you sell, what do you offer?
Obviously, they are aware that there is a problem.
But there is another problem, which is cost.
The cost to be protected from everything.
Where do we start?
In fact, we'll start speaking about an SME that does not want to spend much money or microcompany.
Just a self-employee.
But somebody that wishes to be protected.
On one hand, my recommendation, we always...
First is raising the awareness.
That's very economical.
To know about your risks using technologies and services.
Then, to use or try to use tools, low-cost tools.
Although any tool that might be free for a user will always have a cost for companies.
And otherwise, use free alternatives.
If you don't have money to implement a firewall from Nortel or Palo Alto or Cisco, you, with Linux through iPad table rules, you will implement it.
If you don't know how to do it, you will have to contract it.
But it's something you have to do.
In some occasions, it's going to be more economical than in others.
But solutions for all situations.
There are solutions for all situations.
Any other questions or comments?
Okay, from INCIBE, just to say that we're available for anything you might need.
And we hope that cybersecurity is now more present in you tomorrow.
And the day after tomorrow, we will continue with more talks and workshops.
And I hope you had enjoyed the presentation.
Thank you.