CoreQ Academy5.6 Given a scenario, implement security awareness practices.
People are both the most targeted part of security and one of the best sensors. Good awareness programmes are frequent, practical and measured.
Phishing
- Campaigns
- Simulated phishing emails sent to staff to measure and improve resilience.
- Recognizing a phishing attempt
- Urgency, unexpected attachments, mismatched sender or link addresses, requests for credentials or payment changes.
- Responding to reported suspicious messages
- Easy reporting (a report button), fast triage, feedback to the reporter, and removing similar messages from other inboxes.
Anomalous behavior recognition
- Risky
- Behaviour that increases danger, such as disabling security tools or sharing passwords.
- Unexpected
- Out-of-pattern activity, such as a colleague asking for data they never need.
- Unintentional
- Honest mistakes, such as emailing the wrong person; train and make reporting blame-free.
User guidance and training
- Policy/handbooks
- Clear, accessible rules people can refer to.
- Situational awareness
- Noticing what is happening around you: tailgaters, shoulder surfers, unusual requests.
- Insider threat
- Recognising and reporting warning signs of insider risk.
- Password management
- Using password managers, unique passwords and MFA.
- Removable media and cables
- Not plugging in unknown USB drives or charging cables, which can carry malware.
- Social engineering
- Recognising pretexting, impersonation and pressure tactics.
- Operational security
- Not revealing sensitive details through social media, conversations or documents.
- Hybrid/remote work environments
- Securing home networks, using VPN, protecting screens and devices in public.
Reporting, monitoring and programme development
- Initial
- Training when someone joins, before they get access.
- Recurring
- Regular refresher training and campaigns throughout the year.
- Development
- Designing the programme: goals, audiences, content and metrics.
- Execution
- Running the programme, tracking completion and measuring outcomes such as report rates and click rates.
Check your understanding
Knowledge quiz · pass mark 80%
- An employee finds a USB drive in the car park labelled "Salaries". They should:
- Awareness training is most effective as a one-time onboarding session.
- Which metric best shows a phishing programme is working over time?
Original CoreQ Academy material, mapped to objective 5.6 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.