Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Security Awareness Training
People as a line of defence
Road safety isn’t just seatbelts and airbags. It’s also drivers who check their mirrors and slow down near schools. Good habits, practised often, prevent most accidents.
Many incidents start with a person: clicking a phishing link, reusing a password, emailing data to the wrong person, or letting a stranger through a door. Technical controls reduce the risk, but security awareness is the primary control against attacks that target people.
The programme
- Onboarding: policies, acceptable use and how to report incidents, with a signed acknowledgement, before access is granted.
- Periodic training: at least yearly, refreshed for current threats.
- Role-based training for high-risk roles:
- administrators: privileged access, secure configuration
- developers: secure coding
- finance and procurement: payment fraud and business email compromise
- executives: targeted attacks, travel security (they’re high-value targets too)
- HR: handling personal data
- Phishing simulations and other exercises.
- Ongoing reinforcement: short messages, briefings after real incidents, intranet content. Once a year on its own isn’t enough.
- Clear reporting channels: a report button, a hotline, and a positive response when people use them.
Measure behaviour, not attendance
The real question is whether behaviour changes:
- phishing simulation click rates falling over time
- reporting rates rising, and reports coming in faster
- fewer incidents caused by user error
- spot checks: clean desks, locked screens, tailgating attempts
Completion rates and training hours only show the programme ran, not that it worked.
Example. Training completion is 100% every year, and management calls the programme a success. But phishing simulations show a 28% click rate that hasn’t moved in two years, and fewer than 2% of staff report simulated phishing. The auditor reports that the programme isn’t changing behaviour, and recommends shorter, more frequent, role-specific training with feedback after each simulation.
Culture
Awareness works best where reporting mistakes is encouraged. If people fear punishment for clicking a link, they’ll hide it, and the security team loses valuable time. Thank people who report, even when they clicked first.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Best measure of awareness program effectiveness | Behaviour change, such as lower phishing click rates and higher reporting |
| Most effective control against social engineering | Security awareness training |
| When awareness training should begin | At onboarding, before system access |
| Who needs additional role-based training | High-risk roles: admins, developers, finance, executives |
In short
- Security awareness training is the primary control against social engineering and a key part of every security program.
- Training starts at onboarding, is repeated regularly, and is updated as threats change.
- Role-based training gives extra content to high-risk roles: administrators, developers, finance, executives.
- Phishing simulations measure and improve how staff respond to realistic attacks.
- Effectiveness is measured by behaviour change (fewer clicks, more reports), not by attendance or completion rates.
- A simple, well-known way to report suspicious activity is essential.
Exam traps
- Completion rates show activity, not effectiveness.
- Annual training alone isn't enough; reinforcement through the year works better.
- Punishing people who report mistakes discourages reporting.
- Executives are high-value targets and need training too.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The programme
Measure behaviour, not attendance