Hello.

Now that we know what we can and cannot do based on the classification of the information, let’s look at how to share it securely.

We share information every day with colleagues, customers, suppliers, and other partners.

But sharing information securely also means ensuring that it reaches only authorized individuals.

Sometimes it doesn’t take a cyberattack for sensitive information to be leaked.

Sharing a document with the wrong person, granting access to someone who doesn’t need it, using an unauthorized channel, or failing to implement the required security measures can result in information being exposed without us realizing it.

And once information leaves its intended environment, it is not always possible to retrieve it or limit its dissemination.

Before sharing any document;

Check:

• who needs access to the information.
• what level of access is required.

Always check:

• the recipients,
• assigned permissions
• the method you’re using to share it.

And be sure to implement the protective measures appropriate for its classification.

Remember: The correct information should be shared only with those who need it.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: INFORMATION SHARING se publicó primero en Secure & Academy.

Hello.

In the following tips, we’ll discuss factors to keep in mind when securely managing the information we work with every day.

To that end, the first step is to recognize that not all information has the same value.

A news article published on the corporate website does not require the same level of protection as customer data, a financial report, or employee information.

That is why it is important to understand the sensitivity level of the information we work with.

Therefore, we must handle the information we manage according to its classification, following corporate guidelines that will help us identify the level of protection required for each document or piece of data.

Understanding this classification is essential for handling the information correctly.

Before:

• use,
• share,
• publish,
• store
• or enter information into artificial intelligence tools,

Be sure to check its rating.

Its classification will determine how it should be protected and how we can use it.

And if you have any questions about how to categorize it, check the internal guidelines or ask the department in charge.

Remember: Protecting information starts with knowing its classification.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: CLASSIFICATION OF INFORMATION se publicó primero en Secure & Academy.

Hello.

As we’ve seen, social engineering can take the form of seemingly legitimate emails, messages, or phone calls.

Even if I change the channel, the goal is always the same: to influence our decisions so that we act without verifying the facts.

Behind these techniques, the same signals tend to recur:

• The need to act quickly.
• Unusual requests or contacts.
• Request for credentials or sensitive information.
• Requests for payment or changes to bank account information.

Situations that attempt to take advantage of our trust or prevent us from verifying the information.

When several of these signs appear at the same time, it’s time to stop and check.

Some of the most common types are:

• CEO Fraud: When a cybercriminal impersonates an executive to request payments, information, or urgent action.
• Supplier/Supply Chain Impersonation: where an attacker impersonates a supplier or regular business partner to modify data, request payments, or alter established processes.

In both cases, trust and urgency are used to get us to act without verifying the facts.

You know, be wary of:

• unexpected requests,
• last-minute changes,
• urgent payment requests or
• instructions that deviate from standard procedures.

Always verify the applicant’s identity and confirm any sensitive requests through an alternative channel.

Stop, think, and check.

Because when it comes to social engineering, taking a few seconds to verify something can prevent serious consequences.

Think before you act.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: SOCIAL ENGINEERING II se publicó primero en Secure & Academy.

Hello.

Another common social engineering technique is vishing.

In this case, the scam is carried out via a phone call in which the attacker impersonates a trusted person or organization.

Their goal is to obtain information or credentials, or to get us to take an action without verifying the request.

These calls may appear to come from:

• Banks,
• Suppliers,
• Technical services,
• Coworkers.

During the conversation, they usually convey:

• emergency,
• raise concerns
• to present a situation that requires immediate action.

All of this is meant to get us to make a quick decision before verifying whether the request is legitimate.

You know, be wary of:

• Unexpected calls.
• Requests for sensitive information.
• Unusual requests.
• People who pressure you to act quickly.

Before providing any information or taking any action, always verify the caller’s identity using an alternative channel.

Stop, think, and check.

If you have any doubts, end the call and confirm the request through official channels.

Because when it comes to vishing, a single conversation can be enough to set up a scam.

Think before you answer.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: VISHING se publicó primero en Secure & Academy.

Hello.

After phishing, another widely used technique is smishing.

In this case, the scam is carried out through text messages or messaging apps that appear to be legitimate.

Their goal is the same: to get us to share information, click on a link, or take an action without verifying it first.

These messages often appear to be communications from courier companies, banks, government agencies, or services we use regularly.

They often report on

• A pending delivery.
• A problem with a payment.
• An incident that requires immediate action.

All of this is meant to create a sense of urgency and get us to act without thinking.

You know, be wary of:

• Unexpected messages.
• Suspicious links.
• Requests for Personal Information
• Communications that pressure you to act quickly.

Before replying or clicking on a link, always verify the information through official channels.

Stop, think, and check.

If you have any doubts, do not click on the link or provide any personal information or credentials.

Because when it comes to smishing, a single message can be enough to set a scam in motion.

Think before you click.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: SMISHING se publicó primero en Secure & Academy.

Hello.

In our previous tip, we looked at how cybercriminals use social engineering to influence our decisions.

One of the most commonly used techniques to achieve this is phishing.

Emails that appear to be legitimate but are intended to obtain information or credentials, or to get us to take a specific action.

These messages often use elements that inspire trust or create a sense of urgency.

• A problem with an account.
• An unpaid bill.
• An alleged incident.
• An unexpected request.

All of this with one goal in mind: to get us to click before we think.

And when we act without verifying, the risk increases.

You know, be wary of:

• Unknown senders.
• Suspicious links.
• Unexpected requests.
• Messages that pressure you to act quickly.

Before clicking, always verify the sender and carefully review the message’s content.

Stop, think, and check.

If you have any doubts, do not click on any links or open any attachments.

Because when it comes to phishing, a single click can be all it takes.

Think before you click.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: PHISHING se publicó primero en Secure & Academy.

Hello,

Every day we make dozens of decisions, such as opening an email, replying to a message, or answering a call. In most cases, these are legitimate, but some have a very specific goal: to influence our decisions.

Cybercriminals don’t just seek to exploit technology; they also seek to manipulate us into revealing information, sharing access, or taking actions we wouldn’t normally take.

We refer to this as social engineering.

Although the methods may vary, there are usually some common red flags, so be wary of unexpected requests, messages that convey a sense of urgency, requests for sensitive information, or actions that must be taken immediately.

If something is pressuring you to act quickly, it’s time to stop and check.

You know, always verify the information through an alternative source, and never act solely because of the urgency of the message.

Stop, think, and check.

Because when it comes to social engineering, a few seconds of verification can prevent serious consequences.

Think before you act—social engineering preys on decisions.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: SOCIAL ENGINEERING se publicó primero en Secure & Academy.

Hello,

Remember…

… Before you log off, don’t let your guard down.

Put the tips we’ve covered these past few days into practice:

1. Physical Security
   • Controls access.
   • Accompany visitors.
   • Closes facilities.
2. Clean Post
   • Lock the computer.
   • Don’t leave any information visible.
   • Log out.
3. Safe Planning
   • Use official websites.
   • Be wary of special offers.
   • Be careful what you share.
4. Mobile devices
   • Protect access.
   • Keep it up to date.
   • Use trusted apps.
5. Secure Connection.
   • Avoid open networks.
   • Use a VPN if necessary.
   • Do not perform sensitive operations.

Take a break from work—but not from security!

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: PRE-VACATION SUMMARY se publicó primero en Secure & Academy.

Hi, when we’re out and about, it’s common to look for a Wi-Fi network so we can connect quickly…

But not all connections are equally secure.

Let’s take a look at what we need to keep in mind to connect securely.

In places like airports, train stations, and coffee shops, the use of public Wi-Fi networks is very common.

However, these networks may be insecure and allow third parties to intercept information or access our data.

That is why it is important to pay attention to:

– The type of network you’re connecting to.

– The information you transmit while you’re online.

– And the security of the device itself.

Because in these situations, cybercriminals can exploit insecure connections to gain access to sensitive data.

To avoid this:

– Avoid connecting to open or unsecured Wi-Fi networks.

– Use a VPN if you need to connect to public networks.

– Do not make any payments or access sensitive information.

– And it automatically disconnects when you’re not using it.

And you know… disconnect from work, not from security.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: WIFI NETWORKS se publicó primero en Secure & Academy.

Hello, now that we’re already thinking about taking a break, there’s something we shouldn’t lose sight of…

Our cell phone has become an essential tool for everything: running errands, accessing information, and staying in touch.

Let’s take a look at what we need to keep in mind to use it safely.

These days, cell phone use has increased significantly: we use them to make reservations, pay bills, look up information, and stay in constant contact.

This intensive use also increases risks, such as unauthorized access to the device, the installation of malicious apps, or the exposure of personal and professional information.

That’s why it’s important to pay attention to how you protect your device on a daily basis:

– Access to the cell phone and who can use it

– The protection of the information it contains

– And situations in which you may be exposed or have no control over

To avoid this:

– Secure access to your device with a PIN, pattern, or biometric authentication, and enable two-factor authentication whenever possible.

– Also, lock down your apps and use recommended security solutions.

– Keep your system and apps up to date, and review the permissions you grant.

– Always use secure and reliable Wi-Fi networks, and avoid public or unsecured connections.

Remember, log out safely.

IMPORTANT NOTE:

If, despite complying with all these measures, you encounter situations that do not conform to the level of security required or established in internal policies, do not hesitate to inform your line manager, the Security Manager, security personnel and/or the IT department, depending on the type of suspicion.

If it happens to you on a personal level, report it directly to the police authorities, so that they can give you appropriate advice and conduct an investigation.

La entrada SECURE&TIP: MOBILE DEVICES se publicó primero en Secure & Academy.