Chapter 5 — Security literacy

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Common threats"]
  N2["5.2 Everyday controls"]
  N3["5.3 Communicating well"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Common threats"]
  N2["5.2 Everyday controls"]
  N3["5.3 Communicating well"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Common threats]
    |
    v
[5.2 Everyday controls]
    |
    v
[5.3 Communicating well]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain basic threats to a small organisation; (2) relate them to everyday controls; (3) communicate security without fear.

5.1 Common threats

Sofia learns the threats Elmfield faces most: emails that trick staff into giving passwords or paying fake invoices, ransomware that encrypts files, lost devices, mistakes such as sending tenant data to the wrong person and misuse of access by contractors. She notes that most incidents in small organisations come from ordinary failures, not sophisticated attacks. Understanding which threats are common helps Elmfield focus limited resources where they will prevent the most harm. For Elmfield, a fake invoice that is paid or tenant data sent to the wrong person is far more likely than a targeted attack.

5.2 Everyday controls

For each threat she lists everyday controls. Multi-factor authentication limits damage from stolen passwords. Backups kept offline allow recovery from ransomware. Encryption protects lost laptops. Checking recipient addresses and using secure sharing links reduce misdirected emails. Named contractor accounts with limited access reduce misuse. She learns that the NIST CSF 2.0 small business quick-start guidance stresses similar basics. Controls do not need to be complex to be effective, but they must be applied consistently. Multi-factor authentication helps only if it covers all three hundred accounts, which is why consistent application matters more than complexity.

5.3 Communicating well

Sofia prepares a short talk for Elmfield's housing officers. She avoids frightening language and blame. Instead she explains why each control helps tenants and staff, gives simple instructions and invites questions. She learns that fear may cause short bursts of caution but often leads to hiding mistakes. Encouraging staff to report errors quickly, such as a misdirected email, lets Elmfield limit harm. Good communication is itself a control, because it shapes how people behave when something goes wrong. A housing officer who reports a misdirected email within minutes may let Elmfield ask the recipient to delete it before harm occurs.

Worked example

Sofia identifies Elmfield's common threats, maps them to everyday controls and gives a blame-free talk encouraging quick reporting.

Synthetic case. Threats and talk are synthetic; CSF 2.0 guidance is real.

Errors and limits

Simple controls fail if inconsistent. Talks have short-lived effects.

Exercises

• EX013 — Common cause. Where do most incidents in small organisations come from? Rubric: 3 = ordinary failures, not sophisticated attacks;; 2 = ordinary;; 1 = vague;; 0 = none.
• EX014 — Ransomware control. Which control enables recovery from ransomware? Rubric: 3 = offline backups;; 2 = backups;; 1 = vague;; 0 = none.
• EX015 — Fear effect. Why avoid fear in security talks? Rubric: 3 = it leads to hiding mistakes;; 2 = hiding;; 1 = vague;; 0 = none.

Synthesis

Security literacy links common threats to everyday controls and blame-free communication.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →