Dos personas mirando un ordenador con información

December 09, 2022

Training employees to protect the security of the company

According to official statistics, in 2021 305,477 crimes related to information technology occurred in Spain, an increase of 6.1%. We should also add that the vast majority of cyberattacks (98%, according to some sources) include social engineering as one of their vectors of attack and that, every year, a company receives more than 700 attacks which feature social engineering.

Social engineering is the use of deception to manipulate people to disclose (consciously or unconsciously) confidential or personal information that may be used for fraudulent purposes. It is a manipulation technique that uses human error to obtain private information, access or valuable objects. In cybercrime, these "human hacking" scams tend to attract unsuspecting users so that they display their data, spread malware infections, or provide access to restricted systems. Attacks can occur online, in person and through other interactions.

This is one of the main reasons why employee training is essential in order to increase and maintain the security of our company.

Impact of an attack

To fully understand the importance of training employees to better defend themselves and their work assets, we must first analyse the total impact that a data breach can have on a company.

In these circumstances, a data leak is defined as "an incident in which information is stolen or extracted from a system, without the knowledge or authorisation of the system owner". Any kind of leak (especially where it affects personal data) is a headache for any company, regardless of its size, age or the sector in which it operates.

A breach can arise from a number of sources, so it is essential to ensure that employees understand what they should be looking for, and know how to keep important information safe.

Ongoing training

Training employees about security needs to be a continuous, full-route policy that enables individuals to define and recognise threats, the potential excessive consequences (personal and business) and effective prevention measures.

As such, all companies must have a cybersecurity training programme to mitigate the potential of an attack and its possible consequences. To ensure the success of this plan, it must cover various aspects. These include ensuring that employees know as much as possible about network security, which

can be one of the principal methods of attack or transmission of a threat, and the reactions necessary in the event that they suspect or discover an attack or attempted attack.

This training must be exhaustive and cover all of the different types of threats faced. Employees must be aware of the different types of attacks that exist in order to differentiate them. Armed with this knowledge, they will be more prepared to detect them, and avoid falling into the trap.

It is also important for employees to know who the organisation's security officers are, and the protocols to be followed in the event of a threat. It is very important that any problems that may arise are informed correctly, in a timely manner, and to the correct authority, particularly when it comes to matters of security.

The issues that should be covered during this training include the dangers of computer piracy, stolen mobile devices or the publication of sensitive information, among other forms of data violation. Training must also be carried out at regular intervals and include tests, such as "real fire" drills.

There are various solutions on the market which allow companies to send "test" mails to employees, and therefore spot who might be more likely to fall into social engineering networks. Typically, they would then provide training to those who do click on the link or enter information in response to the fake email.

The most important investment

We can see that training in cybersecurity for employees is probably the most important element of your entire security strategy. If an IT security department spends thousands, or even millions, of euros on the latest high-tech firewalls, malware prevention software and data loss mechanisms, but does not adequately train their employees about security threats, the money spent is worth very little.

This is particularly important when employees have access to sensitive information. Although there are many sophisticated security tools which can be used to protect data, employees are still the final hurdle, and often the weakest, when it comes to an attack which can bypass these measures. The employee may not even be aware of the damage that can be done.

You may be interested in

September 30, 2022

SEIDOR promotes its first Amazon Web Services (AWS) skills centre in Spain in Aragon

Through this initiative, SEIDOR is solidifying its presence in the region of Aragon, where it has a team of 120 professionals and where it closed out fiscal year 2021 with a turnover of 15 million euros.

October 25, 2022

We collected 52 kilos of rubbish on Pinedo beach, in Valencia

At SEIDOR we are committed to environmental management, which is why we joined the United Nations Global Compact in 2014. An initiative that is helping us to promote activities and initiatives aimed at improving our way of relating and adding value to society by developing our activity in a sustainable way.