Traditional antivirus programs are not enough to guarantee the security of our computers. This is how convinced Nikolaos Tsouroulas, Head of Cybersecurity Product Management at 11Pahts – Telefónica, was at the latest edition of #ForoIn organized by DigitalES, where the problems derived from the failures and breaches detected in cybersecurity were addressed.

The speaker analyzed different incidents (Petya, Wannacry, Mirai) to extract lessons learned to successfully address one of the most likely and most impactful risks we face today. Along these lines, he asserted that anti-virus software is still necessary, but that it must be complemented with other security measures. «It’s like a house that you put doors and windows on, but you also reinforce with cameras and other security elements,» he exemplified.

Tsoroulas analyzed the motivations behind the attacks and debunked the myth of cyberactivism as the main cause of the incidents. «The garage hacker is disappearing, today it is advanced criminal organizations that attack the security of devices,» he said.

This security, he added, is especially critical in apps, where up to 80 million vulnerabilities have been found, one million of which may be critical. Therefore, security should be introduced as early as possible in the development cycle of any product or service. 

The Forum was completed with the intervention of Vicente Segura, Head of IoT Security Products, 11Paths – Telefónica, who stressed that security is currently the main barrier to undertake projects in the Internet of Things. «The security of a system is equal to the security of its weakest link, which is why it is necessary to raise employee awareness and keep an eye on the supply chain,» he asserted.

For those who are passionate about the subject, more than 120 minutes of debate on Cybersecurity can be followed in full in this video.  

The different incidents that have occurred over the last few years have left a series of lessons that Tsoroulas summarized in 10 points, which he pointed out as basic for defending a company against any attack.

1. Anyone can create a Wannacry. The most publicized incident of the past year was the work of a «plumber» based on a known vulnerability. 

2. The importance of fixing the basics. Security is built from asset inventory, patching and training.  

3. Update your antivirus with an EDR. Endpoint Detection and Response allows you to detect attackers assuming the breaches exist. 

4. Cybersecurity should be represented on a company’s board of directors. It is a key element for business development. 

5. Protect against targeted attacks with a post-execution strategy. 

6. Use and share threat intelligence. 

7. Adopt secure devops methodology. 

8. Control our digital footprint with the Digital Risk Monitoring service. 

9. Manage third party risk with Cybersecurity scoring and rating tools. 

10. Complete our risk management framework with cyber insurance.