Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Awareness, training, education"]
  N2["5.2 Social engineering tactics"]
  N3["5.3 Knowledge and behaviour"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Awareness, training, education"]
  N2["5.2 Social engineering tactics"]
  N3["5.3 Knowledge and behaviour"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Awareness, training, education]
    |
    v
[5.2 Social engineering tactics]
    |
    v
[5.3 Knowledge and behaviour]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) define security awareness, training and education; (2) recognise common social engineering tactics; (3) explain why knowledge does not guarantee behaviour.

5.1 Awareness, training, education

NIST SP 800-16 (Wilson et al., 1998) distinguished awareness, which draws attention to security, from training, which builds skills, and education, which builds understanding. NIST SP 800-50r1 (Hansche et al., 2024) updates guidance on building a cybersecurity and privacy learning programme. Nadia uses these distinctions to analyse Ashcombe's current efforts: a yearly video counts as awareness, but nobody has been trained to verify unusual requests. She sees that different staff need different mixes, and that awareness alone cannot build the skills needed for handling member data requests safely.

5.2 Social engineering tactics

Nadia studies common tactics described by Hadnagy (2018): pretexting, where an attacker invents a believable story; phishing, using deceptive emails; and impersonation by phone. Cialdini's principles of influence, such as authority, urgency and liking, explain why these tactics work. At a library, a caller might pose as a council officer demanding member details urgently. Nadia learns to recognise these patterns so she can design procedures that help staff pause, but she studies them only to defend, never to deceive real people without authorisation.

5.3 Knowledge and behaviour

Staff at Ashcombe can describe phishing when asked, yet some still click. Nadia learns that knowing is not doing. Bada, Sasse and Nurse (2019) argued that awareness campaigns often fail because they assume knowledge leads to behaviour, ignoring workload, habits and the effort secure actions take. People act under time pressure, with incomplete information and competing goals. Security literacy therefore includes understanding why behaviour departs from knowledge, which points to designing easier secure options rather than repeating the same messages louder. Dr Prescott agrees.

Worked example

Nadia distinguishes awareness, training and education, recognises pretexting and influence tactics and explains why knowledge does not ensure behaviour.

Synthetic case. Examples are synthetic; SP 800-16, SP 800-50r1, Hadnagy (2018), Cialdini (2021) and Bada et al. (2019) are real.

Errors and limits

Tactics evolve. Categories overlap in practice.

Exercises

• EX013 — Three levels. What three levels did SP 800-16 distinguish?
  Show marking criteria

  Rubric: 3 = awareness, training and education;; 2 = three;; 1 = vague;; 0 = none.
• EX014 — Pretexting. What is pretexting?
  Show marking criteria

  Rubric: 3 = inventing a believable story to deceive;; 2 = story;; 1 = phishing;; 0 = none.
• EX015 — Campaign failure. Why do campaigns often fail according to Bada et al. (2019)?
  Show marking criteria

  Rubric: 3 = they assume knowledge leads to behaviour;; 2 = assumption;; 1 = vague;; 0 = none.

Synthesis

Security literacy covers awareness, tactics and the gap between knowing and doing.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →