Passwords are the first and main means of protecting information.

About 10% of all internet users’ passwords are a word or phrase from the top 25 most common passwords (123456, 123456789, qwerty, password, iloveyou, admin, etc.). These passwords are even used to protect corporate resources and accounts containing confidential information.

Information security training teaches users how to:

• make strong passwords that can’t be guessed using brute force attacks or dictionaries
• remember passwords or store them so cybercriminals can’t use them, even if they see how they’re stored
• use different passwords for different resources, and change them regularly
• use password managers
• recognize malicious resources where you shouldn’t enter your passwords under any circumstances
• create strong code words/pattern keys, and use hardware tokens

…and more.

Email is the new standard for modern communication. It’s used for personal and business correspondence, sending files and documents (including confidential), and registering on online resources.

Access to your email opens up unlimited doors for cybercriminals. They can hack almost any resource you’re registered in to gather what they need to rob you, blackmail you or steal corporate information.

But the most effective and dangerous cyberattack method, especially in the context of the massive migration to remote work due to COVID-19, is email phishing, a type of social engineering that helps scammers access your personal or work data via email.

Information security training teaches users:

• email awareness: creating strong passwords, checking recipient addresses before sending, proper ways to send confidential information, corporate email basics
• how to recognize malicious emails (phishing) based on all the signs: visual, textual and semantic
• various methods to avoid scammers
• what to do if your email is hacked

…and more.

There’s nothing more relevant than the Internet in the 21st century. We use it to receive information, work, have fun, communicate, shop, exchange data, and more. In fact, it’s like a digital mirror of the real world, where surfing is the same as traveling.

But just like in the real world, the Internet is a dangerous place. Cybercriminals set all sorts of traps to collect data or make money off of inexperienced and inattentive users. And this doesn’t just mean scam websites (although they’re the main issue), as even well-protected state portals can be infected with malicious code.

Information security training teaches users how to:

• recognize malicious resources, including those pretending to be trustworthy
• follow the rules to safely download data, files and software online
• follow the rules to safely enter their data online, including payment information
• use cloud storage safely
• minimize their digital footprint

…and more.

Social media contains concentrated doses of user information. Cybercriminals can glean from a social media account the full name of a person, their address and phone number, how much they earn and where they store their savings, when they go on vacation and who they travel with. People on social media carelessly post pictures of their passports and plane tickets, confidential documents and information about deals at work, where their apartment is located and how to get inside.

Today, almost everyone has accounts on several social networks, including Facebook and Vkontakte, Twitter and Instagram, TikTok and Youtube. And they’re filled with information about users’ lives, families and jobs.

Then there are messengers, both integrated in social media and independent (Telegram, WhatsApp, Viber, Skype). Cybercriminals exploit them to carry out phishing attacks. For example, in 2017, cybercriminals stole almost $500,000 by sending phishing messages to members of the Enigma blockchain project through Slack, a corporate messenger.

Information security training teaches users how to:

• spot fake social media sites
• only post safe information on social media that can’t harm you or your company
• spot and stop scammer attacks
• understand the legal repercussions of posting personal data

…and more.

If the internet is its own little world, then your computer is its front door. But it’s not just the front door! We also use computers for work and play, to create new things and to study the past. We rely on them to store gigabytes of valuable data, including work documents, archives, pictures, outlines, as well as passwords and other ways of accessing network resources.

Users are often irresponsible about their computer’s “health.” They don’t use antivirus software, disable security systems, and install unlicensed programs. This leads to some unfortunate consequences. For example, a 2017 study by Kaspersky Lab showed that 42% of personal computers in Russia are infected with malware!

Information security training teaches users:

• how to properly install software on work and personal computers
• how often to update software and how
• how to properly use antivirus software
• what to do if their devices are stolen
• how to safely use public Wi-Fi

…and more.

Mobile phones are more than just a way to communicate — they’re a universal tool for managing your life and work. We use them to talk and message, search for information online, pay for purchases, take photos and shoot videos. This means that mobile phones are a huge repository of information about their owners, and cybercriminals exploit this.

Cybercriminals don’t even need to steal phones. All they need to do to get full control is install a tracking program on them, for example, when a user connects to a public Wi-Fi network. Then, for example, scammers can read text messages with bank confirmation codes to bypass two-factor authentication and steal money from your accounts.

Information security training teaches users how to:

• protect their devices against malware
• safely install apps
• configure a remote administration system to help in the event a device is lost or stolen
• remove factory backdoors
• connect to other devices safely

…and more.

Everyone, regardless of their age, social status and job, should know how to properly handle the confidential information they have access to.

It’s also crucial to understand that any information you handle at work might be confidential by default, otherwise known as the “presumption of confidentiality.” In other words, it must first be proven that information can be shared.

Not all information that isn’t subject to disclosure has a “classified” stamp or some other privacy marking. It’s most often the case that confidentiality is determined by indirect and non-universal signs. In fact, more than 60% of leaks in large tech companies occur because of negligent employees with access to confidential data!

Information security training teaches users how to:

• determine what data is confidential
• properly store and send confidential data
• mark confidential documents when creating them
• properly work with confidential document templates

…and more.

Personal data is any information directly or indirectly related to the data subject, including first and last name, date of birth, passport and driver’s license number, religion, income, place of work, etc. Once a scammer gets a certain amount of a victim’s personal data, they can use it for their own purposes (for example, to steal their identity and commit crimes without any of the blame).

But handling personal data properly is just as much a legal responsibility as it is an information security issue. Almost every country has personal data protection laws where violations can cost companies a fortune in fines.

For example, in 2018, a serious leak of customer personal data was discovered in British Airways databases. The leak fell under the jurisdiction of the GDPR (General Data Protection Regulation) in the European Union and European Economic Area, and the company was forced to pay €205 million in fines!

Also, the GDPR and other local regulations most often apply beyond the borders of certain countries to also apply to citizens living and working abroad. In other words, knowing how to properly handle personal data requires careful attention and can save a company from major problems.

Information security training teaches users how to:

• correctly handle, store and send their own personal data
• correctly handle other people’s personal data in accordance with local laws
• recognize when personal data is being used illegally by cybercriminals

…and more.