Case Study: Delivering Cybersecurity Awareness Training

Case Studies Cybersecurity and Infrastructure Digital Transformation

Introduction

In 2023, the Bucharest Bar Association, representing over ten thousand lawyers in Bucharest, faced increasing cybersecurity concerns.

With the growing complexity of digital threats, it became imperative to equip their employees with the necessary skills and knowledge to protect sensitive legal and non-legal information.

OPTI delivered a comprehensive cybersecurity training program tailored to the specific needs of the association’s staff.

Challenges

The Bucharest Bar Association was confronted with several critical cybersecurity challenges.

Legal duty - As a professional organization responsible for handling vast amounts of sensitive data, the Bar Association needed to mitigate risks associated with cyber threats.

Training needs - Employees required relevant and up-to-date training to effectively manage and respond to potential cybersecurity threats.

Rising complexity of threats - The evolving nature of cyber threats necessitated a training program that covered a broad range of topics, from basic cybersecurity principles to advanced protection measures.

"The team of OPTI are notable for their respect for deadlines and for avoiding financial overruns, for the adaptability of their solutions to our needs and for the general quality of their software implementation. We will continue our collaboration to fulfil the needs of the Bar Association in other projects."

- The Dean of the Bucharest Bar Association

Solution

OPTI developed and implemented a four-week cybersecurity training program for over forty employees of the Bar Association..

Each module was designed to address specific aspects of cybersecurity, ensuring that participants gained a thorough understanding of the risks and the necessary protective measures.

Introduction to cybersecurity
- Overview of the Confidentiality-Integrity-Availability (CIA) model.
- Emphasized the importance of a dual approach (organizational and personal) for effective cybersecurity.
- Discussed the current evolution of cyber risks and methods for prevention and mitigation.
Email communication security
- Focused on identifying and preventing threats such as spoofing, phishing, viruses, trojans, spambots, and malware.
- Emphasized the importance of email confidentiality and protection of sensitive information during email communication.
- Discussed the current evolution of cyber risks and methods for prevention and mitigation.
Internet browsing security
- Server and cloud security data ownership, and recovery.
- Risks associated with phishing, websites, searches, and social media.
- Provided guidance on browser-level precautions, password management, and securing personal accounts.
Security in proprietary software solutions
- The security of operating systems, office suites, email, and messaging software.
- The Bar Association's own software solutions, as well as those of partners and third-party providers.
Home computer security
- Infrastructure and network security for remote work.
- Provided precautions at both individual user and organizational levels to protect data and information when working from home.
Personal data protection
- Covered GDPR, legal bases, special categories of data, and basic principles of data protection.
- Explained the rights of data subjects and the implications of automated decisions, including measures for information access, rectification, and erasure.

The training program covered essential pillars of information security, including preventing phishing attacks and adhering to GDPR compliance. The goal was not just to instruct but to create a culture of security within the organization, where every employee becomes an active part of the cyber defense

Results