Participants discussed protecting data and were introduced to the CIA triad (confidentiality, integrity and availability) as one of the fundamental concepts of information security. Through discussions on protection needs and loss scenarios, participants examined how cybersecurity risks translate into broader business risks, including regulatory violations, operational disruption, reputational damage, financial losses and risks to human health and safety. A practical exercise challenged participants to assess protection needs within their own organisational contexts by identifying key requirements, analysing possible loss scenarios and determining which assets require the highest level of protection. A key takeaway from the session was the importance of understanding what needs to be protected and why, helping establish a common language between business and technical teams for more effective cybersecurity risk management.
Participants were introduced to Zero Trust security principles where no used, device or system should be automatically trusted. Unlike traditional perimeter-based security models, Zero Trust continuously verifies every access request through measures such as multi-factor authentication, least privilege access and network segmentation. Session highlighted why this approach is increasingly important for businesses facing modern threats such as phishing, ransomware and supply chain attacks. Participants explored how Zero Trust can help organisations limit the spread of attacks inside networks. For example, preventing a compromised employee account from gaining unrestricted access to sensitive systems or company-wide data while also improving visibility, breach containment and overall organizational resilience.
A session explained supply chain security and the growing risks organisations face through external supplies, software providers and service partners. Participants discussed how cybercriminals increasingly target supply chains because compromising a single vulnerable supplier can provide access to an entire business ecosystem. Through case studies and practical discussions, the session highlighted the challenges SMEs face, including limited resources, dependence on third-party providers and reduced visibility across supplier networks. Moreover, participants discussed practical steps for improving supply chain security, such as establishing supplier security requirements, conducting risk assessments, implementing multi-factor authentication and limiting supplier access through Zero Trust principles. The importance of continuous monitoring, incident reporting and employee awareness was also emphasised, with participants examining how proactive supplier security policies and automation can help SMEs reduce risks and improve overall resilience against supply chain attacks.
Additionally, participants reviewed ten rules of cyber hygiene which help to establish regular practices and precautions to maintain digital security. Participants discussed the importance of strong passwords, multi-factor authentication, updating software, caution with external links, data backups and user access.
The day also included preparations for participants’ final presentations, where groups began outlining business goals, primary loss scenarios and initial security implementation plans, including proposed standards, priorities and first practical steps for improving cybersecurity resilience.
Training, conducted by EU CyberNet experts Mari Seeba and Milena Patiño Villa, is organised cooperation with the General Secretariat of the Andean Community and the Delegations of the European Union to Bolivia, Colombia, Ecuador and Peru. Training takes place from 11 to 13 May in Lima, Peru.
Photos: https://www.flickr.com/photos/eucybernet/albums/72177720333581545
