Chapter 8 — People and awareness

Chapter 8 — People and awareness

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Relevant awareness"]
  N2["8.2 Joiners and leavers"]
  N3["8.3 A reporting culture"]
  N4["8.4 Measuring behaviour"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Relevant awareness"]
  N2["8.2 Joiners and leavers"]
  N3["8.3 A reporting culture"]
  N4["8.4 Measuring behaviour"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 Relevant awareness]
    |
    v
[8.2 Joiners and leavers]
    |
    v
[8.3 A reporting culture]
    |
    v
[8.4 Measuring behaviour]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) design short, relevant awareness activities; (2) handle joiners and leavers reliably; (3) build a culture where reporting is welcomed.

8.1 Relevant awareness

Corbridge has previously used a generic annual video that staff watch with the sound off. Daniel replaces it with short sessions tied to the firm's own risks: phishing, payment fraud, handling client documents and what to do with a lost laptop. Each session lasts fifteen minutes during a team meeting and uses synthetic examples that look like the firm's real work. Ms. Ashby explains that people remember examples from their own job far better than general advice, and that short regular sessions beat one long session a year for keeping habits fresh.

8.2 Joiners and leavers

Daniel checks how accounts are created and removed. New staff get accounts promptly, but leavers' accounts are sometimes disabled days after they go, because human resources tells the support company by email when someone remembers. He sets up a simple form that human resources completes on a leaver's last day, which goes straight to the support company and copies Daniel. He then compares the account list with the payroll list monthly. The first comparison finds two former seasonal staff with active accounts, which are removed the same day.

8.3 A reporting culture

Ms. Ashby stresses that staff who fear blame hide mistakes, and hidden mistakes become incidents. Daniel works with Mrs. Pike to send a short message from her: reporting a suspicious email or a mistake is always the right thing, and nobody will be criticised for reporting. He creates a single email address and phone number for reports. In the next month, staff report nine suspicious messages and one email sent to the wrong client. Daniel thanks each reporter personally, because the thanks encourage the next report as much as any training.

8.4 Measuring behaviour

Daniel wants to know whether the sessions change anything. He tracks three simple numbers each month: suspicious emails reported, mistakes self-reported and days taken to disable leavers' accounts. Ms. Ashby advises against judging success by the number of people who click a test phishing email, because results vary with how hard the test is and can make staff resentful. Daniel agrees and decides that rising reports and falling leaver delays are better signs that habits are changing, and he plans to show them to leadership quarterly alongside other measures.

Worked example

Daniel replaces a generic video with short firm-specific sessions, fixes leaver delays with a form and monthly check, and gains nine reports in a month after a blame-free message.

Synthetic case. Staff and figures are synthetic.

Errors and limits

Judging awareness only by test click rates can mislead and discourage staff.

Exercises

• EX036 — Session length. How long is each awareness session? Rubric: 3 = fifteen minutes;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX037 — Leaver gap. Why were leavers' accounts disabled late? Rubric: 3 = HR emailed the support company when remembered;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX038 — Monthly check. What does Daniel compare monthly? Rubric: 3 = account list against payroll list;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX039 — Reports gained. How many suspicious messages were reported next month? Rubric: 3 = nine;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX040 — Better measure. Why avoid judging by test click rates? Rubric: 3 = vary with difficulty, cause resentment;; 2 = both;; 1 = one;; 0 = none.

Continue studying — lesson 08 (chapter 08 of 12)

← Chapter 07 · Course chapter index · Chapter 09 →

Continue to the next authored lesson.