David Hernández
Director General
View from the Top

Building a Human Firewall to Contain the Cyberthreat

By Jan Hogewoning | Thu, 01/14/2021 - 09:31

Q: What is the secret behind your success with big companies?

A: Protectia has a very strong commitment to its clients, which we demonstrate through our quality of service and hard work. Some of our clients have been with us for over 12 years. Our ability to provide solutions in many different situations makes us reliable. Many new clients come to us through recommendations.

We always look to evolve. This means we constantly need to study new threats and new technology trends. During our 17 years of operation, we have adapted our use of technology, supported by a multidisciplinary team of engineers, IT architects and analysts. A lot of it is guided by better practices and reference indicators. We have also been able to develop our own methodology to implement cybersecurity projects. This allows a shorter time to production of technology and a better control of processes. One of our most notable success cases is with Monterrey’s soccer team, Rayados. 


Q: What is your approach to implementing a cybersecurity strategy?

A: We work very closely with clients. First, we assess what their posture is against cyberthreats. We then map this against the level of risk and define a medium-term strategy, usually for one year. This generates improvements in cybersecurity levels very quickly. Companies are usually reactive when it comes to cyberthreats. They act after they have suffered an attack, moving resources or investing. We do not think this is the most adequate approach. Our focus is to determine first what their needs are, diagnose the risks and then build an architecture around that. 


Q: How did you chose your software suppliers?

A: This has been a long path in which we always look primarily at the clients’ requirements. We personally go out and seek vendors, attending cybersecurity fairs in Las Vegas, New York, Washington D.C. and San Francisco. We also work with analysts like Gartner and Forrester to determine what the latest trends are. Sometimes, a very innovative product is not what our clients need in Mexico. 


Q: How do you define your concept of a human firewall?

A: What we have observed over the years is that many attacks or security breaches have a human element. The attackers are human, employees play a role in attacks and security decision-makers are human. Many attacks, like ransomware, data theft or malicious crypto-mining, start with social engineering. People within an organization are implicated whether they know it or not. For this reason, we work to implement a culture that values cybersecurity. When we first walk into a client’s office, we test their employees. We want to know how susceptible they are to attacks. Usually, between 40 and 47 percent of employees are susceptible. This is a tremendous number. Once we test this, we can start to train people using content distributed through different media. We try to adapt our content and workshops to the method in which employees work. We have to personalize the training because there is a difference between what a person knows, their willingness to change and whether they actually change their behavior. After a year, we have seen clients’ practices improve by up to 87 percent. 


Q: How has the pandemic impacted employee behavior?

A: The employee is more distracted. These are stressful times and people spend longer hours working. This makes them more likely to make mistakes and fall prey to cyberattacks. Also, the home takes away some of the professional pressure when it comes to how to manage your accounts and devices. Attackers are also making use of the panic around the SARS-CoV-2 virus. They began spreading malware in messages that looked like information about the pandemic or they sent messages to people promising unemployment support measures.


Q: What areas of cybersecurity do you think lack sufficient technology among Mexican companies?

A: There are five processes in cybersecurity: identification, protection, detection, response and recovery. Eighty percent of companies dedicate their resources to only one process: protection. Particularly in the area of detection and response, there is a great deal of work to do. You want to be able to have these capabilities across your entire organizational network. This requires extensive mapping of the level of risk across your organization in the context of the critical processes of the business. 


A: Where does your company see the most opportunity to attract new clients?

A: We are big in the retail sector, where we serve large and small clients. I also see a great deal of opportunity in the logistics and manufacturing sectors, particularly in the north. At the moment, most of our clients are in the finance and retail sectors, along with a few other large corporations. In the medium-sized company segment, between 500 and 1,500 people, there is also a big need for adequate cybersecurity strategies for remote workers and other digital communication threats.



Protectia is a cybersecurity services company based in Monterrey, Nuevo Leon. 

Photo by:   Protectia
Jan Hogewoning Jan Hogewoning Journalist and Industry Analyst