How User Training Can Be Used to Strengthen the “Weakest Link” in the Chain of Protection Against Cybercrime ^†

Abstract

According to the most recent reports from the Ministry of Interior, a large percentage of computer crimes committed in Spain correspond to fraud. By analysing the components that are involved in such crimes, we find that a primary component is participation, whether that be in a voluntary or involuntary and unnoticed way, as it is with some of the victims. We then analyse a proposal to incorporate instructional components within the academic frameworks of several degrees in computer science, with the aim that the new professionals in such areas can become educators for and leaders of the prevention against cybercrimes and thus increase protection for both individuals and institutions against attempts of deception and other computer crimes.

1. Introduction

Currently, one of the main issues of recurring concern is undoubtedly cybersecurity; day by day it is talked about in the media and is part of countless conversations around the issues that concern the general population [1]. According to the General Directorate of Coordination and Studies of the Secretariat of State (Spain) [2], there has been an increase of 26% compared to 2022, constituting a total of 472,125 criminal acts, and this is only those known to the corresponding authority. Of the crimes mentioned above, a large majority corresponds to the modality of computer fraud, because computer fraud requires either deceiving a naive user, or transgressing the protection barriers that some other user did not fortify in the most effective way. Due to the enormous complexity, they have a much lower occurrence, since they come from attackers with much greater preparation and respond to very targeted aspects. In this text, we will focus on computer fraud. This paper is organized as follows: This Section explains the current state of the field and the reason for the study (Section 1). The findings are described in Section 2. Lastly, the paper’s conclusion and future research directions are covered in Section 3.

2. Development

Of the criminal acts known to the authorities, the majority are computer fraud (see Figure 1), which constitutes cyber threats such as phishing, smishing, malware, ransomware, fake ecommerce, and even identity theft, mainly aimed at violating the information contained in the user’s devices. Mostly, this involves the (most commonly inadvertent) participation in, or facilitation/participation of, an authorized user; therefore, it is imperative to understand and take actions directed against this type of crime [3].

The different types of threats in the computer fraud group mainly use the strategy of “tricking” the victim into taking some course of action. In addition, there is also the virtual hijacking of computers or information and the creation of profiles that are either completely false, or imitating the identity of a person [4].

We can also assert that there are some factors that contribute to the success of the undertaking of fraud, such as the following [2]:

• Misinformed people.
• Fragmented or incorrect information, largely encouraged by the proliferation of so-called “Fake News”.
• Smear campaigns and threats to spread them.
• Access to systems and resources of institutions with few security measures.
• User dissatisfaction with strong passwords and two-factor authentication.
• Poor ability to detect the authenticity or falsity of messages or requests for action [5].

It can be asserted with sufficient certainty that having observant, analytical, and trained users with awareness of the uses of computer resources at their disposal could result in a significant reduction in the risk of suffering computer fraud.

The training of users is of utmost importance, since they are the weakest link in the data protection chain, mainly due to factors such as the convenience of frequent use of resources, as well as the complexity of computer systems, which is unknown and often ignored. In addition, user awareness is key, since some of the major cyberattacks have been detected thanks to a “I think something is wrong” correctly reported by an end user. Some of the sources consulted even recommend periodically carrying out risk perception assessments of users as well in order to be able to predict their behaviour in the face of potential vulnerabilities [6].

The situation gains relevance when we analyse the entire population of users of web services and we see that it is distributed almost equally among age groups between 26 and 65 years old, leaving in second place the two extremes in age, users between 18 and 25 and over 65 (see

Table 1. Age distribution of victims.

Age Group	Male	Female	Unknwon
Unknown Age	159	160	20
Minors	2238	2651	7
From 18 to 35	22,286	22,841	3
From 26 to 40	43,843	48,973	14
From 41 to 50	38,428	43,382	30
From 51 to 65	44,921	45,049	40
Over 65	22,895	16,650	20
TOTAL	174,770	179,706	134

).

These data allow us to infer that the population in the active working stage is potentially more likely to be a victim of computer fraud, or to be exposed to a greater risk of being attacked by one of the offenders of the aforementioned crime. In the business field, where the number of personnel with professional training in the field of computing is significantly lower, no source currently refers to any training program for users without specialization in computers, specifically in the area of cybersecurity. From the above, the core proposal lies in the implementation of IT professionals as trainers in the field of information security in each of their work environments.

2.1. The Role of the “Insider”

Users who have some level of access to the organization’s resources are defined as “insiders”, since they are affiliated to the organization and this affiliation can used for external purposes, which has the potential to be harmful to the organization. Such events can occur with the knowledge (and complicity) of the employee, although they can also inadvertently and carelessly “leave open” some doors for the entry of threats [7].

Each user who has a certain level of access to computer resources can become an “insider”, due to their level of knowledge of the security measures of the systems, as well as the degree of caution they have with security regulations and good practices with access data and devices [8].

Such a user can be of two types, a malicious user whose purpose is to cause damage to the organization, or a user who unintentionally commits some oversight or omission and compromises the security of computer resources, thus facilitating the obtrusion of external organizations that do have the intention of violating the company [8].

2.2. About the Training

Using the analysis, employees in most organizations must use electronic devices, which may or may not be connected to various systems and/or databases, so a number of mechanisms are proposed for user training, including seminars, online training, videos, emails, posters, and even gamified exercises that evaluate their susceptibility to threats.

The choice between the training programs can always be adapted according to the needs of the organization, as well as the periodicity of them, according to factors such as the size of the organization and the availability of time for such training.

The suggested training topics of greatest relevance at the time of writing this document are the following: (i) information privacy, (ii) software vulnerabilities, (iii) environment vulnerabilities, (iv) malicious code (viruses and their derivatives), (v) spyware, (vi) ransomware, and (vii) consequences of a cyber attack [6].

2.3. The Trainer

Mainly in medium and small organizations, it may seem unfeasible to add one more task to the staff of that department; however, it is also important to recognize that this area requires knowledge about the protection status of the data and the systems of the organization.

The IT branch of organizations should guarantee professional training (bachelor’s or master’s degree) in any of the areas of computer science that allow them to be aware of the assets which they are responsible for. These specialities almost entirely lack competencies that belong to the field of training, so a substantial majority of professionals in the field of computer science have the knowledge that needs to be transmitted but lack the tools and strategies to transmit it correctly [9]. The likelihood of having computer professionals with extensive knowledge in cybersecurity on top of possessing pedagogical/training skills is enormously low, and cannot meet the needs of a constantly growing sector.

3. Conclusions

The incidence of computer crimes, mainly fraud, has been steadily increasing in recent years. The age group most likely to suffer from it is those who are in the active working stage (26 to 65 years old). Most non-IT staff in organisations do not have any training in cybersecurity. A large number of cyberattacks occur with the (perhaps inadvertent) help of an authorised member of the organisation. The training of users of all levels of training in cybersecurity areas will contribute positively to avoid unwanted access due to carelessness. IT professionals should be in charge of educating and training their colleagues on cybersecurity issues. There is a niche opportunity to strengthen the curricula of computer-based professions with a complement in pedagogy, thus enabling computer professionals to successfully carry out a training programme. Non-IT personnel properly trained and sensitised in cybersecurity issues (inadvertently) will contribute to the detection of anomalies and incorrect uses that occur around them. In the field of human resources, an applicant who can demonstrate prior training in cybersecurity issues will have a significant advantage in the competition against other applicants for the position.