{"id":49283,"date":"2021-04-16T14:52:00","date_gmt":"2021-04-16T13:52:00","guid":{"rendered":"https:\/\/www.intelligentcio.com\/eu\/2021\/04\/16\/making-a-mark-in-retail-with-a-robust-cybersecurity-approach\/"},"modified":"2021-04-26T11:52:39","modified_gmt":"2021-04-26T10:52:39","slug":"making-a-mark-in-retail-with-a-robust-cybersecurity-approach","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2021\/04\/16\/making-a-mark-in-retail-with-a-robust-cybersecurity-approach\/","title":{"rendered":"Making a mark in retail with a robust cybersecurity approach"},"content":{"rendered":"\n

Pedro Borracha, Head of Information Security at Depop, discusses the fashion marketplace company’s need for security awareness training within the workforce, and tells us about how KnowBe4 is now very much embedded into Depop\u2019s cybersecurity maturity roadmap<\/em>.<\/p>\n\n\n\n

Founded in 2011, Depop is a peer-to-peer, global fashion marketplace with over 27 million users buying, selling and connecting. Headquartered in London, the company has over 300 employees and has offices in the UK, Australia and the US, specifically New York and Los Angeles. The mobile app adopts a layout similar to social media and encourages individuals to sell and buy unwanted items; endeavouring to make fashion more sustainable.  <\/p>\n\n\n\n

Getting the ball rolling<\/strong> <\/p>\n\n\n\n

When Pedro Borracha, Head of Information Security at Depop, first joined the company in July 2020 to build the company\u2019s informational security team, he spent his first three months investigating Depop\u2019s security posture. He ran penetration tests, conducted security assessments of Depop\u2019s cloud environment and organised a thorough audit with PwC.  <\/p>\n\n\n\n

On the back of this audit, Borracha needed to create a roadmap and it became clear that security awareness training, as well as the documentation of policies and procedures, were top priority.  <\/p>\n\n\n\n

Unfortunately, he also had to contend with an extremely busy workforce as most employees felt they did not have sufficient time to dedicate to security awareness training. He needed help transforming this mindset and reinforcing the idea that cybersecurity is everyone\u2019s responsibility. He needed the business to understand that cybersecurity training should be undertaken as part of employees\u2019 job roles during business hours.  <\/p>\n\n\n\n

Selecting a vendor<\/strong><\/p>\n\n\n\n

Borracha was familiar with KnowBe4, having successfully implemented the training at a former company. Nevertheless, he decided to do his due diligence and assess other options prior to committing. However, he quickly found that KnowBe4 offered, by far, the best option.  <\/p>\n\n\n\n

KnowBe4 particularly excelled on two fronts: user experience and an unmatched repository of training materials and phishing templates. <\/p>\n\n\n\n

\u201cI tried to think, not as an admin of the platform, but as a user, and everything was clear,\u201d said Borracha. \u201cThe user experience and interface are second to none and I can say this because I’ve looked at all the competitors. The second thing is the ModStore. The amount of material that we have access to and can distribute for training is again, second to none.\u201d <\/p>\n\n\n\n

While in the beginning, general training modules were issued to everyone, this has now evolved, becoming customised to roles and departments.  <\/p>\n\n\n\n

\u201cWith the plethora of training available, we can customise to the needs of each department,\u201d continued Borracha. \u201cAs far as I know, KnowBe4 is the only company that has so much choice that you can nit-pick exactly what you want for each team – and we have a lot of teams.\u201d <\/p>\n\n\n\n

By simply leveraging KnowBe4\u2019s filter function, Borracha and his team of three can nail down exactly what they need \u2013 length of video, subject matter, whether the modules are interactive or not etc. \u2013  in a matter of seconds. The same can be said about KnowBe4\u2019s simulated phishing feature; everything from who and when someone gets a phishing email, to how it looks, can be fully tailored to their needs.  <\/p>\n\n\n\n

Time to make an effort, not an excuse<\/strong> <\/p>\n\n\n\n

Since using KnowBe4, the company mindset on security awareness training – and cybersecurity more generally – has done a 180. Through gamification and the platform\u2019s leader board, employees have become inspired to engage in some friendly competition. Through notifications, Borracha can also inform managers if their teams are falling behind.  <\/p>\n\n\n\n

\u201cIn the beginning, people will say, \u2018what is this training? Is this optional? Is it mandatory? I’m too busy\u2019. I know all the excuses. But KnowBe4 has allowed us to slowly but surely transform training into something that is welcomed,\u201d said Borracha. \u201cWe have successfully distributed policies via KnowBe4, too. I recently sent out an acceptable use policy and in just over an hour, 81 employees had already acknowledged it. That\u2019s one person per minute. When we first started, this would have been unthinkable.\u201d <\/p>\n\n\n\n

KnowBe4 is now very much embedded into Depop\u2019s cybersecurity maturity roadmap and it is used daily for training campaigns, phishing exercises as well as reports submitted to the executives on a weekly basis.  <\/p>\n\n\n\n

What\u2019s more, if there is ever something Borracha wished KnowBe4 could do to improve its offering, or if he needed help resolving an issue, he knew he could depend on his customer success manager to make it happen. <\/p>\n\n\n\n

\u201cI have full faith that if I send an email to my customer success manager, I will get a reply in less than 10 minutes,\u201d said Borracha. \u201cThey really listen and follow through.\u201d <\/p>\n\n\n\n

Overall, Borracha believes that Depop\u2019s return on investment with KnowBe4 is critical to circumventing external threats. In only eight months, Borracha has seen a 20% decrease in the number of people falling for a phishing scam. Following a baseline campaign in December, Depop\u2019s Phish-To-Click ratio was at 29%, this then dropped to 17% in January, then 9.8% in February. With every week of training, Pedro is seeing a clear reduction in the risk. <\/p>\n\n\n\n

A word of advice<\/strong> <\/p>\n\n\n\n

\u201cI would definitely recommend KnowBe4. However, one thing I would suggest companies do before committing is to do a demo. Make sure that you understand all the technical requirements and speak with your IT department to ensure that your systems are compatible. While it\u2019s certainly not a deal-breaker, failing to check could result in some delays during the implementation process,\u201d said Borracha.  <\/p>\n\n\n\n

What\u2019s next?<\/strong> <\/p>\n\n\n\n

In terms of future plans, Borracha and his team expect to implement USB Security tests when employees eventually return to the office. This will see USB sticks randomly placed around the office and the team will monitor if any files are opened by staff.  <\/p>\n\n\n\n

They also hope to assign corporate mobile phones to all employees to have full control over the security of these and the confidential data held on them. Once this is in place, Pedro and his team intend to issue simulated vishing – voice phishing, a common tactic for social engineering – training too. <\/p>\n\n\n\n

\u201cWhile we still have some way to go to improve our cybersecurity posture, with KnowBe4 we are taking the right steps to get there. I\u2019m a big KnowBe4 fan,\u201d Borracha concluded.  <\/p>\n","protected":false},"excerpt":{"rendered":"

Pedro Borracha, Head of Information Security at Depop, discusses the fashion marketplace company’s need for security awareness training within the workforce, and tells us about how KnowBe4 is now very much embedded into Depop\u2019s cybersecurity maturity roadmap. Founded in 2011, Depop is a peer-to-peer, global fashion marketplace with over 27 million users buying, selling and connecting. Headquartered in London, the company […]<\/p>\n","protected":false},"author":21,"featured_media":49407,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[205,51,57,1735,93,24],"tags":[564,15924,12283,15925,4596,10584],"class_list":["post-49283","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-case-studies","category-case-study-newsletter","category-enterprise-security","category-retail","category-top-stories","category-used","tag-cybersecurity","tag-depop","tag-knowbe4","tag-pedro-borracha","tag-retail","tag-security-awareness-training"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/49283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=49283"}],"version-history":[{"count":5,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/49283\/revisions"}],"predecessor-version":[{"id":49516,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/49283\/revisions\/49516"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/49407"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=49283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=49283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=49283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}