Security Awareness

Introduction

Cyber security is not only about firewalls, antivirus software, encryption,
servers, or security tools. People also play a major role in protecting
digital systems and information.

A technically secure system can still be exposed when users click malicious
links, reuse passwords, reveal confidential information, install unsafe
software, ignore security warnings, or fail to report suspicious activity.

This is why security awareness is an important part of cyber
security.

1. What Is Security Awareness?

Security awareness is the knowledge and understanding that helps people
recognize security risks and behave safely when using computers, networks,
applications, mobile devices, websites, email, and other digital systems.

In simple terms:

Security awareness means knowing what can go wrong and knowing how
to behave safely.

Security awareness is not limited to cyber security professionals. Students,
teachers, developers, administrators, business owners, employees, customers,
and ordinary internet users all benefit from security awareness.

2. Why Security Awareness Matters

Modern organizations depend heavily on digital technology. Employees and
customers interact with websites, databases, email systems, cloud platforms,
mobile applications, payment systems, and social media.

Every interaction creates an opportunity for either safe or unsafe behavior.

For example, consider two users who receive the same email:

• User A clicks the link immediately.
• User B checks the sender, examines the link, notices unusual wording, and verifies the request.

The technical security systems surrounding both users may be identical, but
their behavior creates different levels of risk.

Security awareness helps people recognize these situations before they
become security incidents.

3. People Are Part of the Security System

A common mistake is to think of people as separate from cyber security.
People are actually part of the overall security environment.

A security system can be viewed as three connected areas:

• People — users, administrators, developers, managers, customers.
• Processes — policies, procedures, reporting methods, access rules.
• Technology — firewalls, encryption, authentication, monitoring, antivirus and other controls.

If one area is ignored, the overall security posture can become weaker.

4. Common Security Awareness Risks

Security awareness focuses on everyday behaviors that can create security
risks.

Examples include:

• Using weak passwords.
• Reusing the same password across multiple websites.
• Sharing passwords with other people.
• Clicking unknown links.
• Opening unexpected attachments.
• Downloading software from untrusted sources.
• Ignoring software updates.
• Leaving devices unlocked.
• Connecting to unsafe public networks without proper protection.
• Posting sensitive information publicly.
• Sending confidential information to the wrong person.
• Ignoring suspicious login notifications.
• Failing to report security incidents.

5. Phishing Awareness

Phishing is one of the most important topics in security awareness.

A phishing message attempts to trick a person into revealing information,
clicking a malicious link, opening a malicious attachment, transferring
money, or performing another action that benefits an attacker.

Common phishing warning signs

• Unexpected messages.
• Urgent demands.
• Requests for passwords or financial information.
• Suspicious links.
• Unexpected attachments.
• Spelling or grammatical abnormalities.
• Messages that create fear or panic.
• Messages promising unrealistic rewards.
• Requests that bypass normal organizational procedures.

However, attackers can create messages that look professional. Therefore,
users should not depend on spelling mistakes alone to identify phishing.

6. Verify Before You Trust

One of the most useful security awareness habits is:

Stop, verify, then act.

When a message requests an unusual action, verify the request using a trusted
communication channel.

For example, if an email appears to come from a manager requesting an urgent
payment, do not automatically follow the instruction. Confirm the request
through an independently known phone number or communication channel.

This technique can reduce the impact of impersonation and social engineering.

7. Password Security Awareness

Passwords remain an important part of account security.

Good password practices include:

• Use strong and unique passwords.
• Avoid using the same password for important accounts.
• Do not share passwords unnecessarily.
• Use a reputable password manager where appropriate.
• Enable multi-factor authentication when available.
• Do not store passwords in publicly visible locations.
• Change compromised credentials promptly.

A password that protects an email account should not be reused for a banking
account, administrative account, or important business system.

8. Multi-Factor Authentication

Multi-factor authentication, commonly called MFA, adds another verification
step beyond a password.

Authentication factors can include:

• Something you know, such as a password.
• Something you have, such as an authentication device.
• Something you are, such as a biometric characteristic.

MFA can reduce the impact of stolen passwords because an attacker may still
need another authentication factor.

9. Safe Email Practices

Email is an important communication tool, but it is also frequently used in
cyber attacks.

Users should:

• Check unexpected messages carefully.
• Verify unusual requests.
• Avoid opening suspicious attachments.
• Check links before clicking them.
• Be careful with requests for confidential information.
• Report suspicious messages according to organizational procedures.

10. Safe Browsing

Security awareness also applies when browsing websites.

Users should pay attention to:

• The website address.
• Unexpected redirects.
• Suspicious downloads.
• Fake login pages.
• Browser security warnings.
• Requests for unnecessary permissions.

Users should avoid downloading software, documents, browser extensions, or
other files from unknown or untrusted sources.

11. Software Updates

Security vulnerabilities can exist in operating systems, applications,
plugins, browsers, mobile apps, and other software.

Software vendors regularly release updates that may fix security
vulnerabilities and other problems.

Ignoring important updates can leave systems exposed to known vulnerabilities.

Security awareness therefore includes understanding why software should be
updated through trusted and authorized channels.

12. Device Security

A laptop, smartphone, tablet, or desktop computer can contain valuable
information.

Basic device security practices include:

• Lock the device when leaving it unattended.
• Use appropriate authentication.
• Install security updates.
• Use approved security software where appropriate.
• Avoid installing unauthorized applications.
• Protect sensitive files.
• Back up important information.

13. Physical Security Awareness

Cyber security also has a physical component.

Someone who gains unauthorized physical access to a computer, server,
network device, or office may be able to create security problems.

Examples of physical security awareness include:

• Do not leave confidential documents unattended.
• Do not allow unauthorized people into restricted areas.
• Protect laptops and mobile devices.
• Use visitor procedures where required.
• Secure removable storage devices.

14. Social Engineering Awareness

Social engineering involves manipulating people into performing actions or
revealing information.

Attackers may use:

• Authority.
• Fear.
• Urgency.
• Curiosity.
• Trust.
• Rewards.
• Impersonation.

The attacker may not need to break the technology directly. Instead, the
attacker attempts to persuade a person to bypass a security control.

15. Information Handling

Security awareness includes understanding how information should be handled.

Not every piece of information should be publicly shared.

Examples of potentially sensitive information include:

• Passwords.
• Authentication codes.
• Private customer information.
• Financial records.
• Student records.
• Business documents.
• Internal system information.
• Database credentials.

Users should follow organizational policies when storing, transmitting, or
disposing of sensitive information.

16. Security Awareness and the Dwallnet LMS

Consider a Dwallnet learning management system containing student accounts,
course records, assignments, certificates, and administrative information.

A security awareness program would teach staff and students to:

• Protect their account credentials.
• Use strong authentication.
• Recognize suspicious emails.
• Avoid sharing private student information.
• Report suspicious account activity.
• Use approved software and devices.
• Protect administrative access.

Technology controls and user awareness should work together.

17. Reporting Security Incidents

Security awareness is not only about preventing incidents. It is also about
responding appropriately when something goes wrong.

Users should know how to report:

• Suspicious emails.
• Lost devices.
• Unauthorized account activity.
• Accidental disclosure of information.
• Malware warnings.
• Suspicious login notifications.
• Unexpected system behavior.

Early reporting can help an organization investigate and contain an incident
before it becomes more serious.

18. Security Culture

A strong security culture means that security becomes part of normal
organizational behavior.

Employees should not feel that security is only the responsibility of the IT
department.

Developers, managers, administrators, teachers, students, customer support
staff, and other users can all contribute to security.

A positive security culture encourages people to ask questions, report
mistakes, follow procedures, and learn from incidents.

19. Security Awareness Training

Organizations can improve security awareness through regular training.

Training may cover:

• Phishing awareness.
• Password security.
• MFA.
• Data protection.
• Safe browsing.
• Device security.
• Social engineering.
• Incident reporting.
• Acceptable technology use.
• Security policies and procedures.

Training should be reinforced regularly rather than being treated as a
one-time activity.

20. Security Awareness Is Continuous

Cyber threats change over time.

New technologies, new applications, new attack methods, and new forms of
social engineering can create new risks.

Therefore, security awareness must also evolve.

A person who learned about phishing several years ago should continue learning
because attackers constantly change their methods.

21. Common Security Awareness Mistakes

22. Practical Security Awareness Checklist

Use the following checklist when working online:

• Do I know who sent this message?
• Was I expecting this attachment?
• Does this link lead to the correct website?
• Is this request unusual or urgent?
• Am I being asked to reveal sensitive information?
• Is my password unique?
• Is MFA enabled where appropriate?
• Is my device updated?
• Is my account showing suspicious activity?
• Do I know how to report a security incident?

23. Practical Exercise

Imagine that a student receives the following message:

“URGENT! Your Dwallnet account will be disabled today. Click this link and
confirm your password immediately.”

Ask yourself:

1. What makes the message suspicious?
2. Is the urgency itself a warning sign?
3. Should the student click the link?
4. How could the request be independently verified?
5. Who should the student contact?
6. What should happen if the student already clicked the link?

The correct security mindset is to stop and verify rather than react
immediately to pressure.

24. Security Awareness Code Example

The following simple PHP example demonstrates how an application might
categorize security awareness actions for training purposes.

<?php

$security_actions = array(
    'phishing'    => 'Verify suspicious messages before clicking',
    'passwords'   => 'Use strong and unique passwords',
    'updates'     => 'Install trusted security updates',
    'reporting'   => 'Report suspicious activity quickly',
    'information' => 'Protect sensitive information'
);

foreach ( $security_actions as $topic => $action ) {
    echo ucfirst( $topic ) . ': ' . $action . '<br>';
}

?>

This example is not a complete security system. It simply demonstrates how
security awareness topics can be represented as structured application data.

25. Class Discussion

Discuss the following questions:

1. Why can human behavior affect cyber security?
2. Why are phishing attacks effective?
3. What makes a message suspicious?
4. Why should passwords not be reused?
5. How does MFA improve account protection?
6. Why are software updates important?
7. What should a user do after discovering suspicious activity?
8. Why should security awareness be continuous?
9. How can an organization create a positive security culture?

Key Takeaways

• Security awareness helps people make safer technology decisions.
• People are an important part of the overall security system.
• Phishing and social engineering rely heavily on deception.
• Users should verify suspicious requests before acting.
• Strong and unique passwords are important.
• MFA provides an additional layer of account protection.
• Users should keep software and devices appropriately updated.
• Sensitive information should be protected.
• Suspicious activity should be reported quickly.
• Security awareness is a continuous process.
• Everyone has a role in building a strong security culture.

Lesson Summary

Security awareness is the knowledge and behavior required to identify and
reduce everyday cyber security risks.

Technology alone cannot provide complete protection. People must understand
how attacks work, recognize suspicious behavior, protect their accounts and
information, follow security procedures, and report incidents.

The goal of security awareness is not to make users afraid of technology.
Instead, it is to help people use technology confidently and responsibly
while understanding the risks that exist in digital environments.