Passwords are the first and main means of protecting information.

About 10% of all internet users’ passwords are a word or phrase from the top 25 most common passwords (123456, 123456789, qwerty, password, iloveyou, admin, etc.). These passwords are even used to protect corporate resources and accounts containing confidential information.

Information security training teaches users how to:

• make strong passwords that can’t be guessed using brute force attacks or dictionaries
• remember passwords or store them so cybercriminals can’t use them, even if they see how they’re stored
• use different passwords for different resources, and change them regularly
• use password managers
• recognize malicious resources where you shouldn’t enter your passwords under any circumstances
• create strong code words/pattern keys, and use hardware tokens

…and more.

Email is the new standard for modern communication. It’s used for personal and business correspondence, sending files and documents (including confidential), and registering on online resources.

Access to your email opens up unlimited doors for cybercriminals. They can hack almost any resource you’re registered in to gather what they need to rob you, blackmail you or steal corporate information.

But the most effective and dangerous cyberattack method, especially in the context of the massive migration to remote work due to COVID-19, is email phishing, a type of social engineering that helps scammers access your personal or work data via email.

Information security training teaches users:

• email awareness: creating strong passwords, checking recipient addresses before sending, proper ways to send confidential information, corporate email basics
• how to recognize malicious emails (phishing) based on all the signs: visual, textual and semantic
• various methods to avoid scammers
• what to do if your email is hacked

…and more.

There’s nothing more relevant than the Internet in the 21st century. We use it to receive information, work, have fun, communicate, shop, exchange data, and more. In fact, it’s like a digital mirror of the real world, where surfing is the same as traveling.

But just like in the real world, the Internet is a dangerous place. Cybercriminals set all sorts of traps to collect data or make money off of inexperienced and inattentive users. And this doesn’t just mean scam websites (although they’re the main issue), as even well-protected state portals can be infected with malicious code.

Information security training teaches users how to:

• recognize malicious resources, including those pretending to be trustworthy
• follow the rules to safely download data, files and software online
• follow the rules to safely enter their data online, including payment information
• use cloud storage safely
• minimize their digital footprint

…and more.

Social media contains concentrated doses of user information. Cybercriminals can glean from a social media account the full name of a person, their address and phone number, how much they earn and where they store their savings, when they go on vacation and who they travel with. People on social media carelessly post pictures of their passports and plane tickets, confidential documents and information about deals at work, where their apartment is located and how to get inside.

Today, almost everyone has accounts on several social networks, including Facebook and Vkontakte, Twitter and Instagram, TikTok and Youtube. And they’re filled with information about users’ lives, families and jobs.

Then there are messengers, both integrated in social media and independent (Telegram, WhatsApp, Viber, Skype). Cybercriminals exploit them to carry out phishing attacks. For example, in 2017, cybercriminals stole almost $500,000 by sending phishing messages to members of the Enigma blockchain project through Slack, a corporate messenger.

Information security training teaches users how to:

• spot fake social media sites
• only post safe information on social media that can’t harm you or your company
• spot and stop scammer attacks
• understand the legal repercussions of posting personal data

…and more.

f the internet is its own little world, then your computer is its front door. But it’s not just the front door! We also use computers for work and play, to create new things and to study the past. We rely on them to store gigabytes of valuable data, including work documents, archives, pictures, outlines, as well as passwords and other ways of accessing network resources.

Users are often irresponsible about their computer’s “health.” They don’t use antivirus software, disable security systems, and install unlicensed programs. This leads to some unfortunate consequences. For example, a 2017 study by Kaspersky Lab showed that 42% of personal computers in Russia are infected with malware!

Information security training teaches users:

• how to properly install software on work and personal computers
• how often to update software and how
• how to properly use antivirus software
• what to do if their devices are stolen
• how to safely use public Wi-Fi

…and more.

Mobile phones are more than just a way to communicate — they’re a universal tool for managing your life and work. We use them to talk and message, search for information online, pay for purchases, take photos and shoot videos. This means that mobile phones are a huge repository of information about their owners, and cybercriminals exploit this.

Cybercriminals don’t even need to steal phones. All they need to do to get full control is install a tracking program on them, for example, when a user connects to a public Wi-Fi network. Then, for example, scammers can read text messages with bank confirmation codes to bypass two-factor authentication and steal money from your accounts.

Information security training teaches users how to:

• protect their devices against malware
• safely install apps
• configure a remote administration system to help in the event a device is lost or stolen
• remove factory backdoors
• connect to other devices safely

…and more.

Everyone, regardless of their age, social status and job, should know how to properly handle the confidential information they have access to.

It’s also crucial to understand that any information you handle at work might be confidential by default, otherwise known as the “presumption of confidentiality.” In other words, it must first be proven that information can be shared.

Not all information that isn’t subject to disclosure has a “classified” stamp or some other privacy marking. It’s most often the case that confidentiality is determined by indirect and non-universal signs. In fact, more than 60% of leaks in large tech companies occur because of negligent employees with access to confidential data!

Information security training teaches users how to:

• determine what data is confidential
• properly store and send confidential data
• mark confidential documents when creating them
• properly work with confidential document templates

…and more.

Personal data is any information directly or indirectly related to the data subject, including first and last name, date of birth, passport and driver’s license number, religion, income, place of work, etc. Once a scammer gets a certain amount of a victim’s personal data, they can use it for their own purposes (for example, to steal their identity and commit crimes without any of the blame).

But handling personal data properly is just as much a legal responsibility as it is an information security issue. Almost every country has personal data protection laws where violations can cost companies a fortune in fines.

For example, in 2018, a serious leak of customer personal data was discovered in British Airways databases. The leak fell under the jurisdiction of the GDPR (General Data Protection Regulation) in the European Union and European Economic Area, and the company was forced to pay €205 million in fines!

Also, the GDPR and other local regulations most often apply beyond the borders of certain countries to also apply to citizens living and working abroad. In other words, knowing how to properly handle personal data requires careful attention and can save a company from major problems.

Information security training teaches users how to:

• correctly handle, store and send their own personal data
• correctly handle other people’s personal data in accordance with local laws
• recognize when personal data is being used illegally by cybercriminals

…and more.

Neural networks are an extremely useful tool that can simplify many tasks: speed up software development, compile information for scientific research, produce high-quality technical texts, and much more. But despite all its advantages, artificial intelligence also poses a threat. This threat has nothing to do with a machine uprising; rather, it stems from the fact that fraudsters are actively exploiting the capabilities of neural networks. In the past, faking a voice — let alone a video — was an extremely difficult task, generally within the reach only of intelligence agencies or filmmakers. Today, anyone can use a laptop to manipulate virtually any image, imitate any voice, and generate a fake video featuring virtually any person.

Moreover, not all risks associated with artificial intelligence stem from criminal activity. Just as serious is the fact that employees are increasingly using AI models in the workplace, often without following security rules or even considering the potential negative consequences. There are several problems here. First, employees may provide neural networks with input data that is confidential. Second, they use neural networks for tasks that should not be performed with AI. Third, they may obtain results from neural networks that are demonstrably inferior to what they could have achieved through their own efforts. Finally, employees may use neural networks that have been compromised and could cause harm.

Information security is by no means limited to the digital world. Information is stolen not only through malware or social engineering. Physical theft of storage media is an equally common scenario, not to mention that such media can be damaged by environmental factors or simply lost. Proper storage and transportation of electronic media, as well as handling them correctly both inside and outside the office, are just as much a part of information security as knowing how to use antivirus software or distinguish a phishing email from a legitimate one. And this is not just about tiny USB drives: according to statistics, a laptop is stolen somewhere in the world every 53 seconds. And it may well be a corporate device containing important information.

Another aspect of physical data security is countering espionage. Spy movies are not always pure invention: in real life, criminals likewise use miniature listening devices and video cameras to obtain valuable information. Eavesdropping can be carried out either through malware installed on an employee’s smartphone or by entirely physical means — for example, using a microphone concealed in a meeting room. Moreover, directional laser microphones capable of detecting sound vibrations from window glass are not science fiction either, but real devices that can be purchased legally.

Digital security is therefore undoubtedly important, but we should not forget that a significant part of our lives still takes place offline.

Failures in the software and hardware of industrial control systems (ICS) can lead to real-world disasters, potentially even on a global scale. Attackers skillfully exploit users’ lack of awareness — for example, the fact that employees do not always know how to respond correctly to abnormal situations involving industrial control systems. Moreover, without understanding the potential scale of the damage, personnel often take a careless approach to cybersecurity. And in this field, attackers may not be individual troublemakers, but powerful organizations with enormous resources at their disposal. This creates a serious imbalance of power.

At the same time, industrial systems are attractive targets for attackers, and both the number of attacks and the damage they cause are increasing every year. For example, back in the 2010s, cybersecurity incidents at industrial enterprises were isolated cases, whereas today their number is measured in the tens of thousands. The threat is real, and an individual approach to protecting industrial systems is therefore extremely important.

Ensuring the security of industrial operations is a complex task that goes far beyond purchasing and implementing the necessary security solutions. It is a continuous process that includes cooperation between different departments within an organization, secure interaction with external companies, system verification and testing, and the secure operation of those systems.

It is worth noting that industrial control systems at industrial enterprises differ in a number of ways from the information systems familiar to ordinary users. Cybersecurity at an industrial enterprise is therefore a highly specific task.