The Cybersecurity Awareness

Being aware of the existence of a danger and the consequences that this entails is the first defense tool.

Cybersecurity awareness transforms employees into the first line of defense against cybercrime, raising awareness, making them aware of the types, methods and impacts of cyber attacks against computers, servers, networks, mobile devices and corporate data.

The aim is to raise the security level of the entire organization, transforming behaviors and improving the security posture.

What is cybersecurity awareness

Security awareness refers to the knowledge that must be acquired through a timely and constant training process intended for all users of connected devices and, more specifically, for employees considered central figures in translating into practice daily as contained in the corporate security policies.

Due to simple inattention, forgetfulness or lack of knowledge regarding the safety measures to be adopted, the employee may find himself enabling illegal access to the company network.

The causes can be different, from simply clicking on a link contained in a suspicious e-mail message, to opening an attachment from an unknown sender and, perhaps, downloading unsafe content.

However, security awareness in an organization does not only concern employees, but all staff, including management figures.

Thinking the opposite is equivalent to a limited vision of security, which does not take into account all its dynamics and all its actors, including those who, precisely because of the high office they hold and the high level of responsibility, make extensive use of mobile devices containing a large amount of sensitive information about the company, its business or its customers.

Furthermore, the management is subject to frequent movements which exposes them to further risks, as they often make use (without knowing the level of protection) of public infrastructures for wireless Internet access, with the risk of incurring external attacks aimed at data theft.

Therefore, everyone in the company must be aware of the different types of threats, their impacts on the company’s operations, on the continuity of the services provided, on the business, on privacy and data confidentiality, and it is essential to be aware of the role that the human component covers as a first measure of defense.

Types and objectives of cybersecurity awareness

Depending on the type of company and its peculiarities from an organizational point of view, information and training can follow different channels, ranging from classroom teaching by trainers inside or outside the company, to e-learning programs specifically developed on the basis of the general staff preparation level, up to gamification techniques or the development of specific information material provided by means of newsletters or via the company Intranet.

First of all, the contents must start from the basics, explaining which are the most common cyber attacks, how to identify them and how computers and mobile devices must be protected, how one’s access credentials and personal information must be made inviolable.

Subsequently, it will be possible to focus on more complex issues, which concern, for example, concrete control and prevention solutions, as well as effective response to attacks.

The main objective is to ensure that everyone in the company, regardless of individual roles and individual tasks, take possession of the basic skills and methods of IT security, designed to prevent and, in case of criticality, to defend themselves. But not only.

At a deeper level, the security awareness purpose is to bring the culture of cybersecurity into companies, making users more responsible on the issue, motivating them to take a more active attitude towards the possible threats to which themselves, as part of the “system company”, are exhibited.

The threats to defend against

Knowing the evil in order to defend yourself: this is the cardinal principle of security awareness.

The evil, in this case, is given by threats to IT security, among which – just to cite a few examples – the most common is malware.

In brief, it is a software – in many cases circulated through apparently unsuspected email attachments or downloads – aimed at putting the victim’s computer out of use.

There are different types, including viruses and Trojans: programs with malicious code that can reproduce and infect files within the system.

Spyware, on the other hand, is another dangerous type of malware capable of recording – without the user noticing – the actions of the latter, managing, for example, to take possession of the data of his credit card and other sensitive information.

While ransomware is that malware capable of preventing the victim from accessing his files and data (often by encrypting them), unless he pays the criminal a ransom in money.

Another type of attack, which you need to be fully aware of in order to prevent and combat it, concerns phishing: in this case the user receives an unsuspecting email which, in reality, hides the purpose of extorting personal information, including credentials access to sites (often related to the banking and social sectors).

Always aimed at stealing data is the Man in the Middle attack, which acts by intercepting communications between two users, while the DoS (Denial of Service) attack overloading networks and servers, aims to make the information system or the application displayed on the web.

In companies, the protocols for encrypting email messages, files and confidential information are among the defense measures mentioned above, thus protecting data in transit, the used channels, and defending against any attempted theft.

In addition, the security protocols must be combined with constant threats databases updating to enable real-time malware detection and those viruses that “camouflage themselves” by changing code or shape over time.

And some programs also allow you to isolate (in the so-called sandboxes) those software considered potentially harmful, to study them and understand how to intercept them more quickly and more efficiently.

TelsySkills: the first step against cyber vulnerabilities

As it has been shown, in the vast majority of cases, the greatest element of criticality in managing an IT vulnerability concerns people first and foremost.

In fact, the main actors are employees: whether it is a lack of attention to security policies, excessive laxity in the management and storage of data and information, a bad setting of a software or infrastructure component, or simply a phishing attack, according to a Verizon report it is human error that accounts for 82% of security incidents.

So, proper staff training is essential for the security of the entire organization.

Telsy offers TelsySkills, its security awareness solution, an interactive and comprehensive platform that turns employees into the first line of defense against cybercrime.

TelsySkills build up a unique and effective proposal to counter cybercrime, focusing on the human factor as the key to success.

It is an e-learning platform composed of 3 specific modules dedicated to employee training against most vulnerabilities in the IT field, increasing employee awareness through the adoption of the most advanced learning techniques.

The modules are composed as follows:

• Awareness: a dynamic, stimulating and interactive learning path to make employees more aware of using the web.
• Channel: composed of video lecture sessions focused on cyber risks with innovative, engaging, and immersive storytelling.
• Phishing: experiential training with simulated phishing, smishing, and vishing campaigns.

Why choose TelsySkills?

• Increase awareness of cyber risks
• Interactive approach and pervasive gamification
• Fully automated and low operational impact for HR, IT and Security functions
• Short, self-paced sessions

Learn more about Telsy’s cyber solutions