Security Awareness Training

Module 6 — Lesson 9: Security Awareness Training

Technology is an important part of cybersecurity, but people are also
a critical part of an organization’s security defenses. Security
awareness training helps users understand common threats and teaches
them how to make safer decisions when using computers, mobile devices,
email, websites and organizational systems.

The goal of security awareness is not to make every employee a
cybersecurity expert. The goal is to help users recognize risky
situations, follow organizational security policies and report
suspicious activity quickly.

1. What Is Security Awareness?

Security awareness is the understanding of cybersecurity risks and the
actions users should take to protect information and systems.

An aware user understands that ordinary actions such as clicking an
email link, sharing a password, connecting a removable drive or
installing unauthorized software can create security risks.

2. What Is Security Awareness Training?

Security awareness training is an organized program designed to teach
users how to recognize and respond appropriately to cybersecurity
threats.

Training may be delivered through:

• Classroom sessions
• Online courses
• Short videos
• Email reminders
• Security newsletters
• Posters
• Quizzes
• Interactive exercises
• Simulated scenarios

3. Why Security Awareness Matters

Attackers frequently target people because users interact directly with
email, websites, applications, credentials and organizational data.

A strong awareness program can help reduce:

• Phishing success
• Password mistakes
• Unsafe browsing
• Unauthorized data sharing
• Malware infections
• Social engineering success
• Accidental data exposure
• Delayed incident reporting

4. Security Culture

Security culture describes how an organization collectively thinks
about and behaves toward cybersecurity.

A healthy security culture encourages users to report suspicious
activity without fear of unnecessary blame and encourages managers to
treat security as part of normal business operations.

5. Phishing Awareness

Phishing is a form of social engineering in which an attacker attempts
to trick a person into revealing information, opening a malicious
resource or performing an unsafe action.

Warning signs can include:

• Unexpected messages
• Urgent requests
• Unusual payment instructions
• Unexpected attachments
• Suspicious links
• Requests for passwords
• Unexpected account warnings
• Messages that create fear or pressure

6. How to Handle Suspicious Emails

Users should avoid clicking suspicious links or opening unexpected
attachments.

If a message appears suspicious, users should verify the request using
a trusted communication method and report the message according to
organizational procedures.

7. Spear Phishing

Spear phishing is a more targeted form of phishing. The message may
contain information about a specific person, department or organization
in order to appear convincing.

Users should not assume that a message is trustworthy simply because
it contains familiar names or organizational information.

8. Business Email Compromise Awareness

Business Email Compromise, or BEC, involves attempts to manipulate
organizations into making unauthorized payments, changing account
information or disclosing sensitive information.

Important financial requests should be independently verified,
especially when payment instructions or bank-account details suddenly
change.

9. Social Engineering

Social engineering involves manipulating people into taking actions
that benefit an attacker.

Common techniques include:

• Impersonation
• Urgency
• Fear
• Authority pressure
• Familiarity
• Reciprocity
• Curiosity

10. Pretexting

Pretexting occurs when someone creates a believable story or identity
to obtain information or persuade another person to perform an action.

For example, someone may pretend to be an employee, technician,
manager or service provider.

Users should verify unusual requests using trusted channels rather than
relying only on the identity claimed by the requester.

11. Impersonation

Attackers may impersonate executives, coworkers, vendors or technical
support personnel.

Users should be cautious when someone requests sensitive information,
urgent payments, password resets or unusual access.

12. Password Awareness

Users should understand that passwords are valuable security
credentials and should be protected carefully.

Good practices include:

• Use unique passwords for important accounts.
• Use a reputable password manager where appropriate.
• Do not share passwords with coworkers.
• Do not store passwords in insecure public locations.
• Use multi-factor authentication where available.
• Report suspected credential compromise promptly.

13. Multi-Factor Authentication Awareness

Multi-factor authentication, or MFA, requires more than one category
of evidence to verify identity.

Examples include:

• Something you know
• Something you have
• Something you are

MFA can reduce the impact of stolen passwords, although users must
still be cautious about unexpected authentication requests.

14. MFA Fatigue

Users may sometimes receive repeated unexpected authentication
requests. Attackers may attempt to persuade a person to approve a
request simply because the notifications are annoying or confusing.

Users should never approve an authentication request they did not
initiate and should report suspicious authentication activity.

15. Safe Browsing

Safe browsing practices reduce the likelihood of interacting with
malicious or fraudulent websites.

Users should:

• Be cautious with unfamiliar websites.
• Check website addresses carefully.
• Avoid downloading unauthorized software.
• Keep browsers updated.
• Be cautious with pop-ups.
• Report suspicious websites where appropriate.

16. Software Installation Awareness

Users should install only approved software from trusted sources.

Unauthorized applications can introduce malware, vulnerabilities,
privacy risks or licensing problems.

17. Removable Media Awareness

USB drives and other removable devices can carry malicious software or
sensitive information.

Users should follow organizational policies for removable media and
should not connect unknown devices to protected systems.

18. Data Protection Awareness

Users should understand what information is sensitive and how it
should be handled.

Sensitive information may include:

• Customer information
• Student records
• Employee records
• Financial information
• Passwords and credentials
• Business plans
• Confidential documents

19. Data Classification

Organizations may classify information according to sensitivity.

For example:

• Public: Information approved for public release.
• Internal: Information intended for authorized organizational use.
• Confidential: Information requiring controlled access.
• Restricted: Highly sensitive information requiring stronger controls.

20. Email Security Awareness

Email is an important business communication tool and a common method
for delivering phishing messages.

Users should be cautious with unexpected attachments, links,
authentication requests and financial instructions.

21. Mobile Device Awareness

Mobile devices can contain sensitive information and authentication
tokens.

Users should:

• Use screen locking.
• Keep mobile operating systems updated.
• Install applications from trusted sources.
• Protect the device from theft.
• Report lost organizational devices quickly.
• Avoid exposing sensitive information in public.

22. Public Wi-Fi Awareness

Public networks can create additional security risks.

Users should follow organizational guidance when connecting to public
Wi-Fi and should use approved secure connections for sensitive
activities.

23. Physical Security Awareness

Cybersecurity also includes protecting physical devices and information.

Users should:

• Lock their workstation when leaving it.
• Protect laptops and mobile devices.
• Prevent unauthorized people from accessing restricted areas.
• Dispose of sensitive documents securely.
• Report lost devices.

24. Clean Desk and Clear Screen

A clean-desk and clear-screen practice reduces the possibility that
unauthorized people will see sensitive information.

Users should avoid leaving confidential documents, passwords or
unlocked systems unattended.

25. Remote Work Security

Remote work introduces additional security considerations.

Users should:

• Use approved devices.
• Protect home Wi-Fi equipment.
• Use approved remote-access systems.
• Keep devices updated.
• Protect confidential conversations.
• Lock devices when unattended.

26. Social Media Awareness

Publicly available information can sometimes be used to make social
engineering messages more convincing.

Users should consider what organizational information they share
publicly and follow company policies concerning official accounts.

27. Shadow IT

Shadow IT refers to technology services or applications used without
appropriate organizational approval.

Examples may include unauthorized cloud storage, messaging platforms,
file-sharing services or applications.

Users should use approved services because security teams need
visibility and control over organizational information.

28. Incident Reporting

One of the most important awareness behaviors is reporting suspicious
activity quickly.

Users should report:

• Suspected phishing
• Lost devices
• Unexpected password changes
• Suspicious authentication requests
• Malware warnings
• Accidental data sharing
• Unauthorized access
• Suspicious system behavior

29. Why Early Reporting Matters

Quick reporting can give the security team more time to investigate,
contain and resolve a problem.

Users should not delay reporting because they are embarrassed about
clicking a suspicious link or making a mistake. Early reporting can
reduce damage.

30. Security Awareness and Incident Response

Users are often the first people to notice unusual behavior.
Awareness training therefore supports the incident-response process.

A trained user may recognize a suspicious event and report it before
the problem spreads to additional systems.

31. Security Awareness and Endpoint Protection

Endpoint security technologies provide technical protection, while
awareness training helps users avoid actions that could undermine
those controls.

The combination of technology and informed users creates stronger
defense than either approach alone.

32. Security Awareness Program

A mature awareness program should be continuous rather than a single
annual presentation.

A program may include:

• New-user security orientation
• Periodic security training
• Phishing awareness exercises
• Security newsletters
• Short security reminders
• Knowledge assessments
• Incident lessons
• Role-specific training

33. Role-Based Security Awareness

Different users have different security responsibilities.

For example:

• Ordinary Users:
  Need phishing, password, device and data-protection awareness.
• Managers:
  Need additional awareness of approvals, risk and incident escalation.
• IT Administrators:
  Need stronger technical and privileged-access security training.
• Developers:
  Need secure coding and application security awareness.

34. Security Awareness Metrics

Organizations can measure awareness programs using appropriate
indicators.

Examples include:

• Training completion rates
• Assessment results
• Phishing simulation results
• Incident reporting rates
• Time taken to report suspicious activity
• Repeated policy violations

Metrics should be used to improve security behavior rather than simply
to punish users.

35. Security Awareness and Human Error

Human mistakes can happen even in organizations with strong technical
controls.

Good security programs therefore focus on reducing risky behavior,
making secure actions easier and encouraging users to report mistakes
quickly.

36. Example: Suspicious Email

Imagine that a staff member receives an email claiming that their
account will be suspended unless they immediately click a link and
enter their password.

The safer response is:

1. Do not click the link.
2. Do not enter the password.
3. Check the message carefully.
4. Verify the request using a trusted channel.
5. Report the message according to policy.
6. Delete or quarantine the message as instructed.

37. Example: Unexpected MFA Request

A user receives an authentication notification even though they did not
attempt to log in.

The user should:

1. Reject the unexpected request.
2. Report the event.
3. Review account activity if appropriate.
4. Follow the organization’s credential-security procedure.

38. Example: Lost Laptop

An employee realizes that an organizational laptop has been lost.

The employee should:

1. Report the loss immediately.
2. Provide relevant device information.
3. Follow organizational incident procedures.
4. Allow the security or IT team to apply appropriate controls.

39. Security Awareness Training Example

A short awareness session can follow this structure:

1. Introduction to cybersecurity.
2. Common threats.
3. Phishing examples.
4. Password and MFA security.
5. Data protection.
6. Safe device usage.
7. Incident reporting.
8. Short quiz.

40. Practical Defensive Exercise

Review five fictional email messages and classify each one as:

• Likely legitimate
• Suspicious
• Likely phishing

For each message, document the clues that influenced your decision.

Do not interact with real malicious messages during this exercise.
Use approved training examples or simulated scenarios.

41. Security Awareness Checklist

• Do I know how to report a security incident?
• Do I know how to identify suspicious email?
• Do I protect my passwords?
• Do I use MFA where required?
• Do I avoid unexpected attachments?
• Do I verify unusual financial requests?
• Do I lock my computer when leaving it?
• Do I protect sensitive information?
• Do I use approved software and services?
• Do I report lost devices quickly?

42. Common Security Awareness Mistakes

• Assuming familiar-looking emails are automatically safe.
• Sharing passwords.
• Approving unexpected MFA requests.
• Opening unknown attachments.
• Using unauthorized applications.
• Leaving computers unlocked.
• Sharing sensitive information publicly.
• Ignoring security warnings.
• Delaying incident reporting.
• Assuming cybersecurity is only the IT team’s responsibility.

43. Best Practices for Users

• Think before clicking.
• Verify unusual requests.
• Protect credentials.
• Use MFA where available.
• Keep devices updated.
• Use approved software.
• Protect sensitive information.
• Lock unattended devices.
• Report suspicious activity.
• Follow organizational security policies.

44. Practical Lab

Create a one-page Security Awareness Training Guide for a small
organization.

Include at least:

1. Five phishing warning signs.
2. Five password security rules.
3. Three MFA safety rules.
4. Three data-protection rules.
5. Three safe-browsing rules.
6. Three mobile-device security rules.
7. Five incidents that users must report.

Present the guide in a form that ordinary users can understand quickly.

45. Knowledge Check

1. What is security awareness?
2. Why is security awareness training important?
3. What is phishing?
4. Name five warning signs of a suspicious message.
5. What is social engineering?
6. Why should unexpected MFA requests be rejected?
7. Why is incident reporting important?
8. What is a security culture?
9. Why should users avoid unauthorized software?
10. Name five security behaviors every computer user should practice.

46. Key Terms

• Security Awareness:
  Understanding cybersecurity risks and safe security behavior.
• Security Awareness Training:
  Organized education designed to improve users’ cybersecurity knowledge
  and behavior.
• Phishing:
  A deceptive attempt to obtain information or cause an unsafe action.
• Spear Phishing:
  Targeted phishing directed at a specific person or organization.
• Social Engineering:
  Manipulating people into performing actions that benefit an attacker.
• Pretexting:
  Using a fabricated scenario or identity to influence a person.
• Security Culture:
  The collective security attitudes and behaviors within an organization.
• MFA:
  Multi-Factor Authentication.
• BEC:
  Business Email Compromise.
• Shadow IT:
  Technology services or applications used without appropriate
  organizational approval.

47. Lesson Summary

Security awareness training helps users recognize cybersecurity threats
and make safer decisions. Important topics include phishing, social
engineering, password protection, MFA, safe browsing, data protection,
mobile security, remote work and incident reporting.

A strong security awareness program should be continuous, practical,
role-based and connected to the organization’s security policies and
incident-response processes.

Every user has a role in protecting information systems. Technology,
policies and trained people must work together to create effective
cybersecurity defense.