Information Technology (IT) support, also known as technical support, is essential for the successful and efficient operation of organizations in the digital age. It helps ensure the stability, productivity and security of your systems and those of the people who depend on them.

Its importance lies in several key aspects such as maintenance of the technological infrastructure (this includes servers, networks, operating systems, software, hardware and other essential components); and ensure business continuity, implement and maintain security measures (such as firewalls, antivirus and intrusion detection systems); periodic updating and maintenance of the software, implementation and management of data storage systems, backup and recovery of data in case of failures; resource optimization (such as server capacity management), keep up to date with the latest technological trends and evaluate how these can benefit the organization and provide data and analysis that help to decision-making.

Content:

• The 5 levels of IT support: description, functions and skills
• Establishing a tiered help structure
• Conclusion
• Frequently Asked Questions

The 5 levels of IT support: description, functions and skills

IT Support Level 0: Self-service

IT support level 0, often called “self-service,” is the initial level of technical support offered to users so they can solve technical problems on their own without needing to interact with a support technician. This tier support focuses on providing users with the tools, resources, and documentation needed to address common technical issues on your own. Some key aspects of IT Support Tier 0 include:

• Self-service portal.
• Knowledge base.
• Guided self-service.
• Online community.
• Diagnostic tools.
• Training.
• Automation.

IT Support Level 1: First person-to-person contact (basic support)

Level 1 IT support, also known as “first person-to-person contact” or “basic support”, focuses on solving the simplest and most common technical problems that do not require advanced technical knowledge. Common features and responsibilities of tier 1 support are described below:

• Helpdesk.
• Incident logging and tracking.
• Troubleshooting common problems.
• Documentation and updating of the knowledge base.
• Coordination with other teams.

IT Support Level 2: Technical support

IT Support Tier 2, also known as “technical support” or “advanced support”, handles more complex and technical issues that go beyond the capabilities of Tier 1. Some of the main features and responsibilities of tier support 2 are:

• Root cause analysis.
• Development and maintenance of technical documentation.
• Interaction with suppliers and manufacturers.
• Training and mentoring of level 1 staff.
• Proactive monitoring and maintenance.
• Participation in IT projects.

IT Support Level 3: Expert support

IT Support Level 3, also known as “expert support” or “high level support,” is responsible for addressing the most complex and challenging issues that require deep technical knowledge and expertise. The most outstanding features and responsibilities of tier support 3 are:

• Research and development.
• Design and implementation of advanced solutions.
• Participation in strategic projects.
• The development of policies and procedures.
• Crisis management.

IT Support Level 4: Third Party Support

Level 4 IT support, also known as “third-party support” or “external support,” is reserved for extremely complex issues or situations where specialized expertise is required, which goes beyond what an organization can offer internally. Common features and responsibilities of tier support 4 are described below:

• Technology vendor support.
• Development of customized solutions.
• Technology integration.
• Participation in security audits and reviews.
• Service contracts coordination and management.
• Supplier relationship management.
• Trend analysis and strategic recommendations.

Establishing a tiered help structure

Implementing a tiered support structure involves careful planning and execution to ensure efficient technical assistance. Among the main steps to establish a tiered help structure is the choice of the appropriate IT Service Management (ITSM) platform, which is scalable and customizable.

Once the ITSM tool has been chosen, a self-service platform or a dedicated web portal must be configured there and the IT support levels of the organization must be clearly defined. In addition, the ITSM platform must include process automation, such as ticket routing, incident prioritization or reporting; providing updated documentation at each support level; tools to measure the performance of the IT structure and demand management to plan workloads.

Finally, to create an effective structure it is essential to establish effective communication channels and perform periodic evaluations to adjust the structure and processes to the changing needs of the organization.

Conclusion

Implementing a tiered help structure in an IT environment brings multiple benefits to the organization.

Benefits of Implementing IT support levels

Support levels enable efficient distribution of support requests, ensuring that issues are addressed at the appropriate level for resolution. This operational efficiency results in an improvement of user satisfaction and in cost savings by ensuring that technical resources are used more competently.

On the other hand, quick management of critical incidents provided by the help structure by levels, escalating the problems according to their nature to the different levels of support, allows to guarantee the continuity of the business. Finally, sharing documentation and knowledge allows capacity building among company personnel.

Adapting the structure to the needs of the organization

It is important to note that there is no single and universally applicable IT levels support structure. Each organization has specific needs and requirements, so it is essential to adapt the structure to its particular circumstances taking into account the size and complexity of the organization, the nature of the operations, that it carries out according to the industry to which it belongs, the needs of the users, both internal and external, of the company; the economic and human resources that the organization has and the technological changes that take place and that require a flexible infrastructure capable of adapting to technological and business evolutions.

Frequently Asked Questions

Summary of frequent questions about IT support and careers in this field

What is IT support for?

IT support is a very useful tool, both for companies and individuals, to receive assistance in any of the tasks to be carried out in their corresponding IT environments. It guarantees that they will be able to meet their goals or continue to offer services to their customers even if they suffer hardware, software or network failures.

What are the IT support levels?

• Level 0: Self-Service
• Level 1: Basic support
• Level 2: Technical support
• Level 3: Expert support
• Level 4: Third party support

How do I start my career in IT support?

Of course, to get a job in this field requires technical knowledge of systems and processes. To begin with, you could complete related courses or get one of the necessary certifications.

What is remote IT support?

Remote IT support allows support technicians to provide their services to customers more quickly and effectively through remote control, email or chat. Even at a distance, they are able to diagnose any problem and provide the steps to follow to solve it.

What are the skills to work in IT support?

Of course, dealing with clients will always require professional and effective communication skills. Additionally, the ability to effectively troubleshoot and keep up with all IT news is critical for any professional IT.

Laura del Río Gómez

Expert in journalism and social networks, Laura writes technical articles specialized in technology, innovation and IT entrepreneurship. She also coordinates contents in TicPymes, a media specialized in SMEs and startups.

 

 

Surely you may have at one time or another received an email warning of an outstanding invoice, a parcel shipment that you did not expect or a warning from the bank about suspicious activity in your account. These messages usually adopt an alarming tone and provide you with a link to a website that you must visit right away to verify your personal information or to complete payment information. Caution! This is a “phishing” attempt, one of the most popular scam methods on the Internet!

Content:

• What is phishing?
• Key elements in a phishing attack
• Types of phishing
• How to detect Phishing attacks?
• How to prevent a Phishing attack?
• Protecting your organization from phishing
• Other tips to prevent phishing attacks in the business environment
• Conclusion

What is phishing?

Phishing is a form of cyberattack that uses technology and social engineering to breach user security.

The term comes from the word “fishing”, since cybercriminals employ bait tactics waiting for users to “bite” or fall into the trap. They usually aim to get hold of financial information, payment service passwords (such as PayPal), or login credentials.

Actually, phishing is nothing new. The first cases of this type of fraud date back to the mid-1990s, when a group of fraudsters posed as employees of the AOL company to steal confidential customer data. Already in the 2000s, attacks began to specialize, focusing mainly on the banking sector.

Over the years, scams have become more sophisticated and, despite advances in cybersecurity, phenomena such as the rise of teleworking or the fraudulent use of AI have contributed to the rise of new ways of phishing.

Phishing as a source of concern

Anyone can become a victim of phishing. Even though cybersecurity systems are getting more powerful by the day, scammers have also honed their skills and organized themselves into small teams, specializing in social engineering tactics.

Companies often become the preferred target of these cybercriminals who try to steal your sensitive data or trick intermediary charges into making unauthorized transfers. A fairly common example of phishing is vendor invoice fraud, in which fraudsters impersonate trusted business partners to request payment for an outstanding invoice.

Even more disturbing are cases like the one we saw at the beginning of 2020 in the magazine Forbes in which a Japanese company was the victim of an elaborate scam in which the generative AI was used to clone the voice of a manager and authorize a transfer of 35 million dollars.

Audio cloning, audiovisual deep fakes and, in general, the use of the latest technology for criminal purposes pose a great threat and, at the same time, a challenge for cybersecurity companies.

Risks associated to phishing attacks

Financial losses have an immediate impact, but there are other long-term consequences that phishing victims can experience:

• Reputational damage: Data breaches can erode customer trust, causing permanent damage to the company’s reputation.
• Service outage: A cyberattack can cripple the company’s computer systems, especially if it involves ransomware. It all starts by downloading a malicious file included in the phishing messages. Once in the system, it encrypts critical files and blocks access to business-critical information.
• Fines and penalties: Violation of data protection regulations (such as GDPR) may result in sanctions by authorities.

It is important to be prepared to deal with these threats using robust cybersecurity solutions and internal employee awareness programs as the main weapons to prevent phishing attacks.

Relevant statistics and data

Email fraud already accounts for 27% of economic losses for cybersecurity breaches and is responsible for 90% of data breaches, according to the report Cybersecurity Threat Trends 2021 (CISCO). This is mainly because phishing campaigns have become massive and scammers use hundreds of emails to reach more people.

Key elements in a phishing attack

Luckily, phishing messages are usually quite clumsy and recipients quickly realize that they are facing a scam, but sometimes they are so customized that they cast doubt on whether they are legitimate or not.

To gain the trust of their victims, fraudsters impersonate institutions, banks or companies that offer their services over the Internet.

Most of these fraudulent emails consist of:

1. An unknown sender, with generic email extensions (Gmail, Hotmail, etc.) or names that resemble those of official companies, but with strange words that we cannot identify.
2. A generic greeting (“Dear customer”, “Dear friend”) since cybercriminals generally do not know the identity of the recipient.
3. An urgent request for our personal information (ID, credit card number) under the pretext of solving an issue.
4. An external link that leads to a fraudulent website with the same logo, design and colors of the brand they intend to impersonate. On this landing page you will be prompted to update your details to continue. Here is where information is stolen.
5. There is also the possibility that the email contains an attachment infected with malicious software (malware, ransomware). If you download it, it will compromise the security of the system.

It is important to be cautious and learn to recognize these phishing signals to minimize risks.

Types of phishing

There are currently over 10,000 forms of phishing (as reported by Wikipedia). These are some of the best known embodiments.

Traditional phishing

It is the most common form of email fraud. It is based on the random issuance of emails impersonating the identity of a trusted company or institution. Messages include links to fraudulent websites or infected files.

Spear phishing

While traditional phishing is a random scam, spear phishing targets a specific person, usually an influential position within the company. To earn their trust, cybercriminals conduct extensive research on the Internet, collecting personal data from social networks such as LinkedIn, where they check information such as age, location or position within the company.

Whaling

In whaling, the target is important people within the company or executive positions (CEO, CFO, etc.). Scammers investigate their prey for weeks and send highly personalized emails, related to critical business issues.

Smishing

Fraudulent messages are sent via text messages (SMS) or WhatsApp. For example, we received a notice from our bank reporting an unauthorized purchase with our card with a link to change the PIN and login details. If YOU do, we will have fallen into the trap.

Vishing

It comes from the union of “voice” and “phishing”. In this case, the scam is done by phone call. A typical example is technical service fraud where scammers call to report a computer failure that doesn’t actually exist and convince us to install a Trojan that will steal your data.

Angler Phishing

It is a new tactic that consists of creating fake profiles on social networks with the name of prestigious institutions and companies. The goal is to steal sensitive data from other users.

How to detect Phishing attacks?

Recognizing a phishing message is not always easy, but there are some indications that may make us suspect that the request is unusual.

• Alarmist tone: They often convey urgency and urge the user to act immediately. Cybercriminals use emotions such as fear or curiosity and use intimidation tactics to make us act irrationally.
• Grammatical errors: Many phishing messages contain spelling and grammatical errors as they were written by non-native speakers. Anyway, nowadays many scammers use tools like Chat GPT to correct their texts, so we must be wary even of messages without spelling mistakes.
• Suspicious links or unsolicited attachments: Does the sender ask you to click on a link? Does it include alleged unpaid bills or fines that you can’t identify? This is most likely a cyberattack.

How to prevent a Phishing attack?

• Do not open messages from unknown senders.
• Do not provide your personal information through a link in an email.
• Don’t download suspicious attachments.
• Hover over the link and check if the url starts with https. This indicates that the site has a safe certificate.

If despite these precautions you fell into the trap and provided your data, change the passwords of the affected accounts as soon as possible and report the scam to the local police. You may also contact the Internet User Security Office of INCIBE (National Institute of Security) to investigate the fraud.

Protecting your organization from phishing

IBM assures in its report Cost of a Data Breach Report 2021 that it can take an average of 213 days for a company to warn that it was the victim of a phishing attack. During this time, cybercriminals will access all kinds of confidential information: database passwords, trade secrets, access credentials to the corporate network… That is why it is important to be prepared and work proactively to stop the threat of phishing.

Some preventive measures:

Employee Awareness

Make cybersecurity part of your company’s organizational culture and create campaigns to warn your employees of the risks of Internet scams. A good measure is to implement a phishing simulation software to train them and teach them to differentiate an authentic email from a fraudulent one.

Implementing email security solutions

The first line of defense against a phishing attack is the anti-spam filter built into email. Make sure it’s up to date with the latest versions and security patches. You may also configure email authentication policies as Domain-based Message Authentication, Reporting, and Conformance (DMARC) to reduce the risk of phishing.

Endpoint monitoring and protection

Endpoints are the end devices (computers, tablets, smartphones) connected to the network. EDR solutions have been designed to monitor and detect the presence of malware on these endpoints.

Unlike antiviruses that work with previously identified patterns, EDR solutions are more advanced since they give automated and real-time responses to contain the attack. They use technologies such as AI and machine learning capable of detecting anomalous behaviors, such as the execution of malicious scripts.

Endpoint protection is a basic cybersecurity measure, but should be combined with other solutions such as network traffic monitoring or safe remote access solutions such as Pandora RC.

How does Pandora RC help improve remote access security?

More and more companies are adopting policies of teleworking or hybrid work. It is a reality that poses new challenges in terms of cybersecurity. Remote workers operate in less secure environments than those under the supervision of IT teams.

Tools like Pandora RC help monitor your systems by offering remote support and quick assistance if a phishing attack is suspected.

Other ways Pandora RC can help prevent cyberattacks:

• It generates 100% local passwords avoiding vulnerabilities in centralized systems.
• Remote connections must be pre-approved.
• It uses dual authentication access policies. This reduces the risk of unauthorized access, as users have to validate their identity in two steps.
• It is a flexible and scalable solution. In addition, it is available as a SaaS or On-Premise solution for companies that want to have more control over their infrastructures.

Other tips to prevent phishing attacks in the business environment

As phishing techniques become more sophisticated, the need for protection is increasing. Therefore, it is not a bad idea to keep in mind some basic tips:

• Try to stay up to date on new scams, follow the news in the media, and read tech blogs like Pandora FMS blog.
• Use strong passwords on your accounts that include a combination of numbers, letters, and special characters. Never choose personal data such as date of birth, cities or pet names for your passwords; phishers could guess this information by checking your social media.
• Use a multi-factor authentication (MFA) system to add an extra layer of security to your connections. That way, if a hacker gets your login credentials, they would still need to know the code sent to your mobile to access your accounts.
• Installing a firewall is critical to blocking unauthorized access to sensitive information. Make sure it’s properly configured and only allows safe transactions.
• Keep your browser and operating system up to date as cybercriminals often take advantage of vulnerabilities in outdated systems.
• Prevents access to sensitive information over public Wi-Fi networks. Many of these networks lack encryption protocols and transmitted data could be intercepted. Turn off the option to automatically connect to open Wi-Fi networks on your mobile.
• Make automatic backups of company data to be able to recover information in the event of an attack. We recommend them to be immutable backups (they cannot be deleted or modified). This ensures that copies are protected and can be restored even if a ransomware attack takes place.

Conclusion

As we mentioned at the beginning, phishing has existed since the beginning of the Internet and will probably evolve and we will learn about new forms of this form of cyberattack. Although we must be vigilant in the face of these threats, slowing technological development is not the solution. The key is to adopt cybersecurity measures and educate users to minimize risks and create a safe working environment.

Ahinóam Rodríguez

Estudié Filología, pero las circunstancias de la vida me llevaron a trabajar en el sector del Marketing como redactora de contenidos. Me apasiona el mundo del blogging y la oportunidad de aprender que se presenta con cada proyecto nuevo. Te invito a seguir mis publicaciones en el blog de Pandora FMS para descubrir las tendencias tecnológicas que están transformando el mundo de los negocios.