I like to introduce myself my name is
marco antonio la anomaly no of the
coordinator of the services protected
embrace' protect your company in theeven
the spanish national cybersecurity
Institute and in this session we're
going to be talking about how cyber
security is no longer an option for
companies we have companies with high
technology dependence and with low
technology dependence but we police
cyber security is not an option for
anybody we're going to talk about the
threats that affect as a means and micro
companies with the lower to monological
maturity what tools we can use to
protect ourselves and how easy it is to
deceive businessmen and entrepreneurs
it's true that we are here in a room all
your fear fuzz can you give me your
credit cards and you should be credit
card
wonderful
it's an anti RF sleeve here you took
your pin number
the pin number have you seen what I've
just done you can cut this don't worry
it's okay but I've just done
it's what cybercriminals tried to do
with us try to gain our trust in order
to try to do something and the remaining
two one is sitting back can you exchange
your mobile phone what's it up front
cuz it's just the three of you I don't
know if your three privileged men but
there are other parallel sessions if you
could please exchange your mobile phones
wonderful
and regardless of what your feeling
tried to unblock your Mobile's try to
unblock them as you know based on your
knowledge see if you're capable of
unblocking
don't exceed yourself and be attempts in
order not to block smartphones have you
enabled to unblock your smart phones no
wonderful you can return to your mobile
phones to the owners it's just a few of
us but we know more about cyber security
and we apply more cybersecurity than we
may think or expect why because with the
exception of our colleague you've
trusted me I'm very persuasive but
you've got your Mobile's booked and we
know more about cyber security than we
believe and promise that cyber security
it's not subject matter that is
discussed with colleagues if for example
we have a colleague that doesn't have
code to access his mobile phone we don't
ask that colleague where that friend why
they don't block their mobile phones
with a code
some of us do integrate cyber security
practices are there not and it's very
important that we apply this to our
personal field or domain and also in the
professional domain as well
I always like to begin my presentation
by saying how security was 25 years ago
25 to 30 years ago what the typical
criminal was 25 to 30 years ago we're
talking about someone who had to
physically go to the purse place where
he or she wanted to perpetrate the
attack and the headlines back then were
of this nature person is kidnapped bag
is robbed a jewelry store and 30 years
later the profile upside of criminals
has changed and we see that now we're
talking about cyber criminals now we're
talking about a completely different
scenario and environment cyber criminals
operating the attack using the Internet
and now we're not talking about
criminals but cyber criminals and they
use the technology since services
provided by the Internet in order to
make the mouse affair in order to
perpetrate their misdeeds but my
headlines can we find 30 years later an
IT attack and paralyzes any pictures at
pirate
what we see is that in 2017 there have
been many attacks how could you
summarize 2017 what in your opinion is
the number of one mower what has been
the number one attack in 2017 you're
saying that we used to have cyber
criminals but in the past you were
infected with viruses but in the year 97
it was uncommon to see fraudulent money
transfers I mean this happened but it
wasn't as common but now all we see is
that this is common practice it's very
easy to have your money still into
having your credentials or personal data
stolen and here you can see the
evolution of security time for the
different IC T's and the seventies we
have computers information systems in
the 80s we see technologies and the
landscape becomes more complex and the
90s we see the emergence of the internet
and this was a game changer in year 2000
social media mobile devices one can
connect to the internet from the
server's modifies then we have the cloud
a new paradigm I yet new paradigm that
is a breeding ground for me
cyber criminals cybercrime and now we're
talking about the Internet of Things and
the Internet
well chunk even and it's probable that
and this new landscape there is a
further and security I don't know if
you've used IOT devices this morning
when making this presentation I pointed
out though some lamps that you can
connect via Wi-Fi you can dim the lights
through your smartphone I'm talking
about domotics just about controlling
for example heaters because I had
technology it's a bit more consolidated
but those lamps are connected to our
Wi-Fi network you can manage them from
our application that's it but do we
really know whether that app that
framework or that lightbulb is properly
secured in order not to compromise the
Wi-Fi network we want to make sure that
we can manage the parameters of the
light bulb through an app the
manufacturer and perhaps establishes
that some passwords need to be used and
what we see is that usability prevails
over a security in this case sorry the
comments have you made off-mike so we
can't interpret them yes as the user was
saying usability prevails over security
what's the motivation behind IT attacks
and attacks against companies was the
reason behind this number one goal
well well money making money of course
that's the reason behind these attacks
if you do industrial espionage yourself
stolen patent you do so to make big
bucks but I'm clearly accounts for 0.8%
of world GDP global GDP this is much
more than the money generated by human
trafficking and drug smuggling for you
to understand the dimension there's a
company that is an exception do you
think that's the case that's the
question I posed to you because small
companies believe that they cannot be
subject to the attacks of cyber
criminals they believe that this kind of
attacks only affect big corporations
that's not true it's true that big
corporations are more technologically
mature and are more protected because
their most important asset ie
information is more protected but
companies with a lower degree of
technological maturity will not
implement sufficient protective measures
to protect their info and will be an
easier target for these and cyber
criminals so all companies big or small
a target potential target for cyber
criminals but should i implement cyber
security meshes in my company being my
answer is very straightforward and these
days there are no companies with
projects that involve services published
on the internet or used to communicate
with the administration there's always
some
that involves ICTs in the past we
printed documents and and would then
take hard copies but now the situation
has changed that is why it is of utmost
important to implement cybersecurity
measures and companies we were of the
main risks that affect companies what a
European can be major is to which
companies are exposed yes I agree
ransomware fishing wire says you've
mentioned too many threads so you also
have flooding bars there's real risk but
the most important risk is not having
access to our businesses info for the
reasons you've mentioned I would like to
underline the good name or reputation of
companies because separate company
suffers an incident that affects a
customer data her makes public some day
- well challenge your good name and put
it into question whether that's the case
we will lose the trust of our customers
and the United States for you to
understand this is considered to be good
name the most valuable intangible asset
I'm going to run over the problems
you've mentioned we have first the
hardware problems due to inadequate
handling and let me give you an example
for you to understand someone that is
trying to break in in our office or
maybe the cleaning
staff that mmm unplug cable or turn off
a switch or other cases for example when
children visit an office and touch
something or turn off equipment that
would be a form of or an example of hard
word problem caused by mishandling and
then we have the unhappy or dissatisfied
employees or insiders insiders can pose
a major threat to companies why because
since those people have worked in the
company they can have access to
information make it public silly that's
imagine a company that has
under-the-table activities and this
insider case access to this information
and makes it public well of course this
is a threat to the good name of the
company we'll talk about that later now
there are many companies that are
working hard to develop apps that can
detect insiders within organizations
with a girl of identifying grim and
doing a psychological profiling in order
to try to implement the appropriate
measures for those insiders not to be
able to access that information or
implement policies to prevent staff from
accessing files for from extracting info
from USB drives or other devices and
then we have other problems that have
companies that are well-known
famous vulnerabilities who want to cry
ransomware who was due to a
vulnerability and Windows operating
system that wasn't probably a patch I'm
saying appropriately because the patch
existed but it wasn't good enough for
the Apple I think that there is no patch
or perhaps the worst of the update is
already available in the case of
Microsoft the vulnerability was
corrected in March bothy around
somewhere appeared in May so she had all
the companies updated their apps and
tested them well well prolly this year
we wouldn't have heard anything related
to one a fine or petia and probably many
of the ransomware some wouldn't have
appeared we have the typical viruses the
typical malware and ransomware is a type
of malware and then we have
impersonation in different contexts for
example celebrities when they say
something and the social media of to say
that there are accounts of being hacked
when you're quoted and they don't like
that and then we have industrial
espionage or targeted attacks you know
that this is quite common we see there
companies whose um competitors are
eating up their piece of the cake are
trying to steal their patents push them
out of the market for example Black
Friday let me give you this example we
have the denial of service attacks and
you know that these
have to do with the trying to attack a
web service to render is inoperable and
it would be possible to hire do s
service because cybercrime exists as the
service we can hire cybercrime services
believe it or not there's no website
that sells electronic services on Black
Friday let's imagine and that we have
another website that sells the same and
we want this other company to render the
first company inoperable so that the
potential customers can be redirected to
this second militia is a website so that
during 12 hours from the first company's
website is crashed and potential
customers purchase and the other website
we have this kind of attacks targeted
attacks that are much more complex
threats the design of which is more
complicated sometimes it takes months or
even years but their targets or their
goal is to steal highly confidential
government information at times and
these are often highly sophisticated
text but now for video led me to try to
convey to you what happens in the minds
of cyber criminals
[Music]
I can still remember when I had to wait
until the end of my working day to be in
a position of breaking in and stealing
money computers and company information
but since I started stealing through the
internet it's much easier to steal
corporate info and the good thing is
that many companies don't even detect my
attacks do you know how I break into the
Internet well you'd be surprised with
how much information is out there and
how easy it is to infect computers and
unpredicted companies sometimes it's as
easy as an email with an attached virus
once installed I can still truly ins or
steal information and resell it and as
you all know is sewing an anti-virus
it's very simple I don't even have to
you know redouble my efforts I just need
to go and find an unwary person who is
willing to click on a link to execute a
file or having that person introduced
his credentials and a fake email address
that I sent a via email and the fact
that people are not aware of the
importance of cyber security place to my
benefit many times they install apps and
their website they expose them to the
internet without realizing that they
need to implement patches and update
them change the password and the
directory of the settings files
thanks to those that clumsiness I cannot
break into their premises spiritual
purposes and I love it when people
contact me because they want me to spy
on their lovers a mobile phone or they
ask me to steal data I review info on
caches and even personal pictures and I
wouldn't be able to do this every users
world use access keys when I go to a
hotel I start stealing why find
connections I am able to collect all the
data transferred by these people you
probably don't know how fun it is to
access to these networks open networks I
love it when they aspect to steal
confidential data from companies I call
and I tell them that I'm on IT
technician that works for the companies
and sometimes I even give me their
username and passwords and than me take
away their computers well I'll enjoy a
cup of coffee
didn't they explain to them that
passwords are personal and
non-transferable some people believe
that 6 consecutive letters and the
keyboard are good passwords but I have
tools in order to test thousands of
passwords first session should they know
that they would use longer keywords that
would include uppercase the word case
symbols and numbers and the internet is
so great for space for us thanks to
those bold and unwary users thanks to
those companies that are not concerned
about our cybersecurity and there aren't
even considered
the need to implement measures we're
getting wealthy and filling our pockets
thanks to them as you can see many
things can be done that can harm and
damage companies but do you cyber
criminals still on the one hand they
work on what affects people basically
social engineering which is what I did
with you whether credit card tried to
convince you so that you can give me
something in exchange and urgency as
motivation
so users do not have time to think or to
react whether I have to say to reply to
these those are the typical phishing
warning messages well if you don't
introduce this information in 24 hours
you will run out of time so be the
basement and some other actions that end
up in a possible problem then we have
systems and architectures that support
technology stolen cards information
failure management when applications are
not rightly said they'll run somewhere
and some other vulnerabilities that
affect web service web servers etc I'm
just going to give you a few examples
Maria's story will be used as the
tagline social engineering and spy isn't
spearfishing I'm sorry and basically is
the Faceman and fighting
Maria's employee Alexandra got an email
from somebody that was speaking on
behalf of the ski instructor of her
child's school with an attached document
that was infected this person the cyber
criminal before sending email and to do
research so that the whole information
was coherent and this person might end
up in the trick basically a research on
social media in this case it was
Alexandra body could have been anybody
in the company to see whether she had a
child that was having ski lessons etc
and this is what we do we publish our
information in the media in the social
media this PDF one day information was
coherent and Alexandra's a timetable was
the right one so that this person could
see that there was not a change and
could forget about the email but the
Maria's
eye team
departments and semesters and saying
something had happened in the website
the website had been committed when all
of maria access her web site usually the
search engines have a system to detect
whether the website had been
impersonated or not that is woman in
chrome Belize red X and when she
accessed her website the surprise was
that he was being used to sell falsified
Sue's so you can see now how the cyber
criminals changed and modified Maria's
website can you think about the way they
managed house I were criminals attacking
Alexandra were able to corrupt arias
website sorry we're not getting their
replies because the audience is not
using a microphone the server is in a
hostile far away so the key is they're
following Alexandra was managing the web
content the cyber criminals had the
passwords and the ID and they could
upload the website with whatever
information they wanted what are the
most serious cases courses story and
they are real cases what we call
the whale in fishing is for small users
and whaling his letters tried to get the
money of a bigwig here what they use is
something very similar to the previous
example social engineering with
impersonation how do they get it they
use email because it's the most
economical and easy system or channel
and because email is something that was
born without the need for secure
security so what they tried to do in
this case is to contact somebody the
management level in the company
indicating that they want to carry out a
very good financial transaction speaking
about the need to keep the secret so
that this person ends up doing the money
transfer then we have the story of the
ransomware somebody that gets an invoice
from utilities or tax authorities that
the postal services we click on the
attached file and the difference is
infected and files are ciphered you know
what happens we see it in the news the
device is blocked and what is
interesting is that they request some of
money to rescue the files in the past a
few years ago we didn't need this
urgency now all ransomware include
accountant to urge the users
to pay before the end of the deadline
otherwise they would lose their files so
we always advise not to access to this
blackmail otherwise this business line
used by cyber criminals isn't gonna be a
neverending story so you should never
pay there are samples of malicious
applications with those features that
within their code they do not have the
recovery of capability so the payment
will never secure that we recoup our
files or the end of the blackmail so
that you see how cyber criminals can
compile our own information you know
that search engines compile our
information from our websites then they
compile information that was indexed in
the documents and at present they can
index meta data hidden in the document
this information those meta data are
referred to the server related to the
word or excel file or the user they
generate the document and some other
information in this case because the
attack is usually carried out through
email let us see how long does it take
to a cyber criminal to compile
information related to the email that
are published in Internet
I can do it with any of your companies
if you have information this is not too
damaging or to risking I'm going to use
some cyber camp
looking for 100 results what I'm doing
here based on a domain do assert of all
associated email I can do it on this
domain or on thousands and thousands of
domains I can do not only this it will
be more appropriate to use it for a
targeted attack if I want to send a
massive attack I'm I use any of internet
database and use them to send spam you
can see that here I already have
different emails related to this event
if I wanted to do a girl a targeted
attack it would be easy that's a rather
simple part let us be now more
sophisticated and tried to design a
facin where we can steal Facebook ID
from a user this is just for you to see
how long does it take to set a malicious
server and carry out an attack I already
have a virtual machine that is going to
be the malicious server is going to be a
social engineering attack attack vector
the web will capture the ID so I write
the malicious server address
now what is the site I want to clone in
this case is Facebook and I already have
the malicious server now I just have to
wait I just have to develop the system
so that people might be hooked to this
this is Facebook but if I wanted to
attack a company's back-end I could
clone the company's back-end and use it
in order to make it more credible let us
think that now we have this document and
that you have access to publish in our
profiles wall in facebook so I pick up
the document I can make it a PDF or in
an email with enriched text I can look
for the IP address or the impersonated
domain and I can access to the domain we
have the Facebook page that is alone but
if you see in the upper part we have the
IP without certificate that's what is
very important when we browse the net we
should pay attention to those details
not to be subject to any of those
attacks in this case I'm going to
[Music]
for the login window here and the
passwords capturing on the other side
you see how easy it is on one hand I
have the victim I'm going to introduce a
hypothetical ID mark or asano in this
case on the password if you see now in
addition to have the information the
tool redirects the user to the real
Facebook site so the user might think
that he made a mistake without
introducing the ID and doing it again
and when he does it again he will think
that nothing has happened but I would
already have his or her ID it didn't
take me not even five minutes and this
can be extrapolated to a bigger scale
and in two or three days to set an
infrastructure to attack thousands of
users through email if you are a server
with a certificate as Facebook whatever
certificate we might have a more
trustable domain without any alert or
warning and we could try to impersonate
the squatting type which is to try to
register at the main very similar
instead of fast a book I'm sorry for the
pronunciation dot-com domain which is
fathom bulk with a different spelling
and the user may not even realize there
is a legitimate page sorry the audience
is not using the microphone it looks a
search in Google Bing and Excel it looks
for all public information related to
this domain MX email in order to have
the information today we and you as a
businessman is not unusual to use ICT or
to outsource ICT services we've been
doing it for many years but what happens
when we talk about cybersecurity even
companies do you say you said everything
you offer is okay there I see these
might say and they don't want to lose
you as customers so they might say yes
they might know something but how far
[Music]
do they know about cybersecurity we to
protect our companies as self employees
SMEs or owners of a micro company we
should know about the conditions and
cybersecurity services are important all
agreements have to be reflected in the
SLA in case they use data from our
customers users clothes information they
should be subject to a disclosure
agreement why if we do not have clauses
for a potential loss or leak of
information that is provoked by our ICT
and cyber security provider we will
never be able to present a claim or
denounce him or her because there isn't
any sanction when this type of attack
might happen on many occasions we might
change our supplier either because it's
more economical or is more efficient or
because we know about something or
somebody but in this case if we have an
SLA or an NDA with the supplier we
should make sure that this supplier
based on the previous clothes they
comply with them if they had access to
information they should destroy this
information he take the necessary
measures so that this supplier can no
longer access our systems or services
that are published in Internet I spoke
about the insiders before but sometimes
suppliers become insiders let us see
what things should be included in a
confidentiality agreement those are the
elements that we should take into
account data protection lower is the
question please
[Music]
elemental response aria
in fact you can think that if a company
that you have somebody that steals the
data and publish them in Internet the
responsibility would be on you as the
owner of the company no matter whether
somebody else has made the action you
are the ultimate responsible then you
can make measures to show that you
haven't realized the action buddy and
you had to prove there is being a third
party whether intentionally
intentionally but below protects the
users more than the entrepreneur's
entrepreneurs have to comply with the
law and users should survey for its
compliance and then the assumption in
institution that is the agency
[Music]
since the creation of our company we
have many different agreements and
contracts with suppliers and customers
some of them were not accurate for some
other cases they were verbal and that
was a pain that could have serious
consequences you seen our deontological
code based on ethical values and the
business responsibility and to keep a
good reputation with our suppliers and
customers we started to make all our
agreements formal we said agreements
with the legal office that helped us in
legal matters and with their accountant
that makes our payrolls they use
information that is sensitive so we had
to set confidentiality agreements and
access to sensitive information we also
reach agreement with our customers those
that provide information about their
investment project so that they could
have the guarantee that we were going to
protect their information respecting the
confidentiality and we are simply is we
now have confidentiality agreements now
I will show I will tell you some
recommendations about what you should
include in a confusion the NC ality
agreement based on our experience the
structure and contents of a
confidentiality agreement my very but it
usually first the following information
plays
and then you parties the reason why the
agreement is said service and
confidentiality clause then we give
information about the object of each of
the parties we should indicate the
service that will be covered by the
agreement and lastly we will cover
confidentiality issues the agreements
should include the description about
what information is considered
confidential
for example procedures techniques
drawings designs drafts diagrams and
models the supplier may have to provide
the service but this error log might
depend on your company we need to make
sure because we explain the
confidentiality commitment for example
acceptable use of the information how
long the duty of secrecy is in force in
the confidentiality agreement with our
legal office we indicate the following
information could only be used to
provide legal service and not for
commercial purposes or similar purposes
literally should office should provide
the information to the employees about
the importance of keeping professional
secrecy
professional secrecy about our company
could be kept forever even at the
termination of the service the legal
officer replied the corresponding
security message to the files according
to the LLP T and RD LLP D and the
termination of the service the legal
office will leave Bank the information
or will destroy it in a secure manner to
get a good security level in our
initiation we should take into account
things that go beyond technical measures
confidentially the agreement allows to
regulate service provision improving the
security of our information when it's
accessed by third parties we can
regulate service provision today and
this will avoid problems in the future
don't leave this aside as we see is very
important that we if we're going to use
data or or an accounting service to make
the payrolls we need a confidentiality
agreement and as I said before this data
should be only used for a specific
purpose it can never be used for any
other purpose that is not included in
the agreement
we're not going to move to the security
guiding plan and how it can help us
protect our company on many occasions is
difficult for
SME or a micro company do you haven't
starting but when we surf the net do we
need to we need to make our companies
good we need certificate information
manager things that are very interesting
but might be too complex for what we
need in this case we have smaller
simpler alternatives as PD s where we
can have the starting point to evaluate
the security level so that we can
implement the necessary controls to
guarantee security the first thing is to
identify the security level in our
company if we don't know what do we have
to protect it will be very unlikely that
we know what do we have to implement
then we have to define the strategic
objectives cyber security and business
should be totally aligned if they run in
parallel we will not be compliant with
the objective of generating trust take
into account departments and processes
affected and then to implement good
practices for the employees at the end
of the day they will be the ones that
will generate incidents or issues in the
company sometimes intentionally and some
others not
to be implemented this planet well of
course this plan is to be designed in
the framework of ongoing improvement
there's no one cell way of implementing
the plan the ideas that we implement
controls on the most and secure systems
we need to first carry out a diagnosis
you know what the state of play is then
to define projects initiatives to
classify and prioritize cyber security
based on what we want to protect and
then the management of the company will
have to approve and adopt there's a
master plan and then of course
implemented one of the most important
stages of the implementation of a
security plan a plan is to make sure
that the plan is realistic and feasible
it's like when we organize a party we
want fireworks we want a class but
that's too much we need to be very
specific and we need to make sure that
our plan is realistic and can be
implemented it's the plan by itself
enough well of course not it will be an
important step forward in an
organization but this planning is to be
periodically reviewed and updated why
well because her process is an
organization can change with time and we
need to make sure that our security
strategy or policy is adapted to respond
to these changes we need to have
periodic controls and full of to ensure
that we are protecting our company well
let's imagine that a significant changes
have been implemented in the
organization let's imagine that in the
past we have the IT system outsourced
but decision has been made in the
company to hire somebody in-house to
do the IT work so at that point we will
have to review the entire plan the
entire stir I call the controls you've
implemented because the situation has
changed it will know that there be a
company and outsource company you will
do this but somebody working in the
house in India and the Spanish and
cybersecurity Institute were aware of
all the problems that companies find
when they decide to implement
cybersecurity and to this end we created
a tool that we've called the
self-diagnosis tool that can be a first
step to help you know the level of
awareness or add adaption that is
required and your company in terms of
cybersecurity let me show you a demo
because in only five minutes you can
analyze your company the website
addresses a village in ciudad es and
through a series of very simple
questions in which we will describe the
services provided by our company and
after answering all those questions
we're going to receive a percentage and
that reflects the level of risk that our
company does a visa vie cyber security
for example watch technologies dosirak
company you use that's the number one
question most companies tend to use
emails let's imagine since we're all
these few in this room let's imagine
that you have a company or you either
run a company or work for a company what
services do your companies who use email
what else
websites you do you have your own
servers yes as you mode to work or tell
you where come out well it's not a
common yes it is in my company at least
and and also tablets or smartphones for
work purposes yes well we're going to
answer with your answers how do you
update and keep your security system
self to date in house so we outsource or
subcontract and IT technician so you'll
have an in-house IT expert yes okay do
you have protection system in place for
computers yes what do you have so I and
Tiberius fireballs encryption sorry
you're not seeing this sorry
here it is good 5 volts antivirus
encryption that's option perhaps yeah ok
next question have you trained your
staff recently in cybersecurity yes no
or was it a one-off chorus or do you
provide them with written documentation
we have fair weekly tips so your friend
about written documents you few
documents no apparently not sorry we're
not able to interpret the comments and
questions from the members of the
audience okay you provide your employees
with documents for them to read do you
control access to the premises camera so
box but you don't have security guards I
guess no do you have any keyword
protection policy in place and the
server and is it mandatory yes good
[Music]
but do you do at the end foot you're no
longer going to work do you subcontract
the destruction I'm referring to
documents and paper documents you
haven't self contracted any service
right do you have social media yes
profiles and who manages the accounts on
social media
okay I'll choose the middle option okay
and how much time can the company
instead without having access to the
email less than four hours this
unfortunately this is the case well what
frequency do you backup your files and
emails daily daily backups good do you
use a fee or a paid email service who
creates and eliminates email accounts I
guess you have on i.t today I shouldn't
have that's what do you said earlier
okay and house right yes and house the
IT technician another question
how long can your company have the
website Jam as Vito as possible less
than four hours with what frequency do
you do backups of your website monthly
backups you aren't aware of that you
know daily
weekly halfway between monthly and daily
this is a hybrid company okay who has
access to or who uploads contents in the
website I guess that the internal IT
technician the in-house ignition or
somebody in this team is what frequency
to you up today the tools that manage
web page content I'm afraid to plug in
some modules whenever their updates who
chose that with what frequency let's
think about the worst case scenario okay
what's a month that's it do you believe
third you are here too legislation in
the field of cybersecurity
yes this is the question that is often
controversial because they think they do
but they don't know 100% sure they are
not 100% sure that they do because
there's a shin changes you think it's a
case you think you don't comply that's
how you comply with almost everything
we're being very optimistic usually
people weren't
for how long can your company operating
with the system crashed without her
anchoring in losses less than four hours
and with what because he do you do
backups of the systems weekly quickly
we've got it connected he's saying but
I'm afraid it's hard to hear from the
booth because the mic is not being used
do you have remote servers yes all the
four employees right VPN Remote Desktop
booth has privileges to administer the
website I guess that in-house IT
technician or the service in the secured
room you have a CPD no restricted access
room do you have contingency plan in
case of well disaster back of CPD or a
backup in the cloud cloud services and
you've tested the plan you do some
malicious to check that the plan the
deed works you say yes to everything
because our company does cybersecurity
so well but sometimes there's another
case
okay well defined tested for how long
can your company operate without your
employees being able to work remotely
less than four hours what services they
offer
you said you're a cyber security company
good we could talk about this later
there's stuff for hours
who does remote connections to your
systems at employees I guess Rises and
turn off applications to its staff
members can access probably in-house
technician right is there a plan B in
case the workers cannot remotely access
have you considered this consider the
difference in air
okay cybersecurity company so I guess
that your staff are familiar with the
importance of cybersecurity good
fortunately for me sorry we had finished
but what frequency did you update the
software of equipment and systems that
you have an in-house IT technician I
guess you've got all these updates still
be implemented and this is one of the
lowest percentages have encountered
because our field and because of the
type of company you work in companies
that wish to know their risk level will
have to answer these questions and based
on the percentage obtained a series of
tips our recommendations are issued and
we then send guidelines or
recommendations to mitigate risks you
have written very simple documents for
companies to be able to implement
safeguards etc
good so you have a very clear idea
regarding what cybersecurity is about it
we need to start checking the
workstation and making sure that cyber
security measures are duly implemented
post it's true that now it's not that
common to find hostess without
credentials but we've seen this an audit
when we open up new drawers or we
squeeze around we find post-its with the
credentials and mobile phones and small
devices shouldn't be left on the
workstation and a confidential info on
paper needs to be stored and you cannot
pin confidential documents either as for
passwords same applies you need to have
policies in place forcing users to
change their passwords and as we've seen
earlier passwords need to be robust
sometimes the promise that our employees
introduce or enter their passwords and
malicious aside so we need to make sure
that we have two-factor authentication
mechanisms in place we need to have
secure applications we need to use
trustworthy on applications instead of
paid applications with cracks that can
potentially infect your system
sometimes you have a friend for example
and you've seen this quite frequently
that says that he's going to install a
pirate office and that kind of
insulation can lead to malicious
software and we need to be very careful
with USB Frye's a smart Foss my sure eve
the lost USB tries or pen drives
sometimes what happens is that in pen
tries we have confidential data so
whoever finds them can access your
personal data and that can translate
into theft of info filtration of info
and of course damage to our companies we
need to make sure that our customers
info is safe we need to first classify
the type of information we manage we
have three types confidential public and
in-house and confidential as established
by law will have to be stored in a
specific manner in-house information
refers to information that is intended
to the internal use of the company and
then we have the corporate information
and we need to see how and where that
information is stored because depending
on the type of information it will have
to be stored differently confidential
data needs to be stored in
space away the restricted access in
encrypted manner as well how are we
going to distribute or disseminate that
information we will have to see how
we're going to control access or
restrict access and how we're going to
use that information on the one hand
through audits or by auditing access to
know where it is
who accesses it and what use is made
whether it's modified or eliminated or
erased and if we encrypted we're going
to attach our provider yet another layer
of security since May the 25th of last
year the personal information Act that
was passed in Spain large companies to
encrypt data and of course we need to
make sure that documents physical
documents are destroyed in a safe manner
there are some companies that destroy
documents in a professional way and
there are also applications to help
destroy virtual documents the different
measures have can be implemented on hard
drives in order to eliminate files
personal data protection that we manage
data from our customers and clients it's
very important that we comply with the
loped the Spanish Agency for data
protection defines how we need to
implement protection and how we need to
comply with the legislation of course in
this case the LLP D let me begin by
talking about LOV D when we ask
data to users by the way my son and my
wife just entered the room when they of
course letter of consent needs to be
signed and we cannot store data that
we're not going to use and we need to
inform users on how they can exercise
their right to access and modify cancel
and challenge their data and we need to
that the measure established by the
Spanish I just need to ensure a good
protection of data sometimes we view
this a compliance of with L opt as a
threat because of course of
non-compliance can be translated into
fines or penalties however if we adhere
to this ll PD will generate trust among
our customers this is like the
confidence labels given to websites this
is going to translate into further trust
on behalf of our customers what happens
when we work remotely when we work from
home well we see that this is more and
more common to foster the work-life
balance and we the telework is more
frequent these days however when working
from home we need to make sure that our
computers are protected and not infected
because of the access through an
affected equipment we will be
compromising the security of our come
some equipment in the case of mobile
devices something similar to desktop
computers happens if we have different
smartphones or let's say of the number
of mobiles and the company would be
interesting to have a specific software
that we are working using our personal
computers we would need to verify and
check first that there are nobles and
the vulnerabilities and use them with
accounts with limited through they just
how many of you use of personal
computers with fur village with
religious without having the
administrators helmet so to say I'm
family your home how the I'm refering to
the computer you use your personal
computer with what kind of account do
you use your personal computer well done
that's the way to go
how about you well the administrator
that's quite common LSE so it's very
important to restrict or limit the use
of administrator accounts because if we
compromised the administrators that can
we will it compromise absolutely
everything
we're very much aware about this these
threads we protect ourselves we
sometimes hire an insurance policy but
the point is that when we are subject to
attacks we are not as protected as we
expected we have a company that works in
the field of cyber security represented
in this room what can we do and when
these situations occur well there's the
first option which is to pray but we if
we haven't implemented technological
measures well pray will not be enough my
grandma used to pray to Saint Anthony
whenever she lost someone lost something
but we haven't implemented any
protective measures I'm afraid we're in
trouble
so if plan a hasn't worked out we'll
probably have a plan B a backup copy
backups are very important but something
is he more important which is to make
sure that backups can be restored
because many times what we see is that
those checks aren't done and when we
want to restore the backups we realize
sadly that they can't be restored
because the files are corrupt and
therefore cannot be adequately
restored it's very important to have a
contingency plan in place I'm not only
referring to backups that's not the only
measure that's only part of the
contingency plan contingency plan needs
to envisage need to envisage other risk
of flooding fires
just to mention two examples so that
when these threats occur we can start
protecting ourselves as soon as possible
in order to design a contingency plan
the first thing we need to do is to
identify risks we're basically talking
about how we can assess those risks and
this is very simple to do as a formula
and to measure the impact in years and
multiply this by the likeliness of
occurrence and apply this simple form I
we can identify risk for example a
certain server connected directly to the
current may we have electricity or cuts
from time to time so in that case you
would have to have a UPS between the
plug and the server to make sure that
all this processors are being executed
can be duly completed in the event of a
power cut now we have another option
which is to outsource risk so to say
maybe implementation by our behalf would
be overly complex or overly costly or
because we decide to transfer their
responsibility to a third party in this
case it's quite common in Spain and the
United States they've been doing this
for more than 20 years but this is a
possibility now in Spain and basically
what they were doing is hiring
loped audits and website audits so in
summary if we offers cyber security our
award is the customers trust and
confidence in us as a company
how can you give it is finished
cybersecurity is it it helped us all the
services we provide are free of charge
let me summarize them we have the
awareness kit that includes an
implementation manual that basically
describes main tests we have a quarterly
tests we have brochures we have spirit
or targeted attacked then we have the
self or auto diagnosis to that I've
shared with you earlier we have 19
security policies that are very easy to
implement in a company that go from the
management passwords Wi-Fi connection
remote access uploading files and the
cloud then we have the mock MOOC for
companies and self-employed every 3 or 4
months we organize course that lasts
between a month and a month and a half
that we have the interactive
virtual of courses that can help us
understand all the intricacies of
cybersecurity and we cover all the
different sectors industrial sector
health sector etc and we have a serious
game or a video game it's a video game
that can teach people everything that
has been known about cybersecurity that
we have one style shop a single point of
contact that companies can access in
case they have doubts and queries
regarding cyber security and then we
have an interesting catalog for you a
cyber security catalog where we include
all the companies so that they are part
of our almost 5000 and something
services and solutions that we offer it
at NPM and all the info can be found and
be protected to embrace a particular
company's section in the TV website we
also have security new some letters that
we send to assamese we have a blog
service with the latest news hey that's
it any questions at this point
probably not
and what about you gentlemen any
questions come on
I have jotted down three questions
can we receive templates of
non-disclosure agreements and then
modify them well some years ago when we
were called seemed echo instead of in
fever we had this section called
technology contracts and we had some
templates for non-disclosure agreements
but we no longer offer this service
because these some agreements change
with time and we cannot ensure that
there was some agreements adhere to the
legislation enforce we assess Emmys
Formica companies we're constantly
seeing vulnerabilities and attacks
multinationals and governments that are
being attacked and we as small companies
have a more limited resources what can
we do to be minimally protected to be
able to convey trust and confidence to
your customers is this possible with
limited resources yes indeed it is you
need to understand that first you need
to raise awareness among the staff your
company provide them with info regarding
the threats that exist the risks how
they can be detected fresh
awareness-raising and please second
since you have people that work in
houses IT technician you need to provide
them with technical information
regarding the cyber security so that
they're updated regarding all existing
vulnerabilities that affect the systems
that are part of your company's
inventory so depending on your
technological dependence this is quite
easy to do and
if for example government or the
government's are going to spy through
vulnerabilities well of course we cannot
protect ourselves from that nobody will
be able to do so but any action I was
referring to multinationals big
corporations that I have huge resources
that and that in spite of their
resources are attacked we as small
companies have very limited resources so
what can we do to protect ourselves well
your technological dependence is small
in terms of devices you if you have
three servers you're not going to spend
twenty five thousand euros and security
maybe that's not feasible so perhaps in
your case you need to make sure to
upload the contents of your server in
the cloud and to outsource the risk to
let's say Amazon or Google and Trust in
this case Amazon for example unless
based on your experience at in Theban
what percentage upon their abilities and
attacks that you were worth what
percentage it represents the attacks
from within and from outside - are you
referring to insider attacks versus
outsider attacks and well let me try to
give you a figure 99% are outside our
external attacks and 1% are insider
attacks
well the attacks carried out from the
outside are constant ongoing but
information filtration
at X or perhaps a developer in the
company developing something well that's
something that can happen but those
attacks aren't as common as external
attacks because we see that there are
balkan nets that are constantly
automating attacks it's an ongoing
process I'm afraid and that's--it's it's
been an intimate presentation and thank
you very much and I hope