In this section of the course
we're going to be discussing security awareness.
Now, security awareness refers
to the knowledge and understanding
that individuals possess
regarding potential security threats and the measures
that can be taken to mitigate or prevent them.
Our primary goal of security awareness training
is to equip individuals with the necessary skills
and knowledge to recognize
and respond to these security threats,
and ultimately to protect both personnel
and organizational data from those security threats.
Now, in our increasingly digital world,
cyber threats are always evolving
and attackers are continuously devising new methods
to exploit vulnerabilities.
Phishing emails, malware attacks,
and social engineering schemes
are just a few of the many techniques
this cyber criminals could employ.
While technical robust defenses are vital,
human error remains
one of the most significant vulnerabilities
inside of our enterprise networks.
So by the end of this section,
you should be able to understand the common threats,
recognize potential risks, and have a clearer idea
of the best practices that you can employ
in your daily digital interactions
to maintain a more secure environment.
Now, in this section of the course,
we'll be focused solely on domain five
and only on objective 5.6.
Objective 5.6 states that given a scenario
you must be able to implement security awareness practices.
First, we're going to discuss how to recognize insider threats.
An insider threat is a security risk that originates
from individuals within an organization like your employees,
former employees, contractors, or business partners.
These individuals have inside information
concerning the organization security practices,
data and computer systems,
and they could exploit this information
to harm the organization intentionally or unintentionally.
Next, we're going to take a look at password management.
Now, password management refers to the practices and tools
that are used to create, store, and manage passwords
for various online accounts and systems.
Proper password management
will ensure that passwords are strong,
unique for every account and stored securely,
and this will in turn reduce the risk
of unauthorized access.
Then we'll discuss how you can avoid
social engineering attacks,
including techniques like maintaining good
situational awareness so you can avoid shoulder surfing
and eavesdropping,
as well as avoiding using removal mode media
and cables that don't belong to you,
and how to avoid phone scams
and people trying to get information out of you,
and how you can maintain good operational security
across your entire organization.
After that, we'll discuss policies and handbooks.
Now, policies are formal documented guidelines or rules
that define how an organization operates
and makes its decisions.
They're going to provide a framework
for consistent decision making and actions
on specific issues or topics.
Handbooks, on the other hand, are comprehensive guides
that provide information on specific topics,
and they often serve as a reference for individuals
within the organization.
For example, you may have gotten an employee handbook
that outlines the company's policies, procedures,
and their expectations of you.
Next, we're going to explore the world of remote
and hybrid work environments.
Now, remote work refers to a work arrangement
where employees can perform their job functions
outside of the traditional office environment,
and most often this is called work from home
or working from another remote location
by leveraging technology,
and other things like the internet.
Hybrid work, on the other hand,
is a model that combines traditional in-office work
with remote work.
Employees in a hybrid work model,
may spend part of their work week in the office
and then they'll spend the rest of it working remotely,
and this offers them a good blend of both environments.
Then we'll discuss how you can create a culture
of security in your organization.
Now, a culture of security
refers to an organizational mindset
where every member of the organization prioritizes security
inside of their daily tasks
and their decision-making processes.
In this kind of a culture,
individuals are continually educated about potential threats
and they're proactive in taking steps to mitigate risks.
The emphasis here is on a collective responsibility
to protect the organization's data, assets and reputation.
And then finally, we'll take a short quiz
to see what you learned during this section of the course
and review each of those quiz questions fully
to ensure you can explain every answer
and why it was right or why it was wrong.
So if you're ready, let's get started in our training
on security awareness practices
in this section of the course.