Chapter 25 — Security awareness support
Lesson map
Lesson 25 published. Map, example, EX073.
flowchart TD
N0["Learning outcomes"]
N1["25.1 The technologist's part"]
N2["25.2 Short sessions"]
N3["25.3 Reporting culture"]
N4["25.4 Measuring"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX073"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["25.1 The technologist's part"]
N2["25.2 Short sessions"]
N3["25.3 Reporting culture"]
N4["25.4 Measuring"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX073"]
[Learning outcomes]
|
v
[25.1 The technologist's part]
|
v
[25.2 Short sessions]
|
v
[25.3 Reporting culture]
|
v
[25.4 Measuring]
|
v
[Worked example] --> [Exercise EX073]
Learning outcomes
You will (1) support awareness activities as a technologist; (2) use real examples safely; (3) encourage reporting.
25.1 The technologist's part
Awareness at Riverbend is led by the human resources manager, but Jamal supports it with technical knowledge. He provides real examples from phishing reports, with personal details removed, for monthly staff tips. He also explains how the report button works. Ms. Grant notes that technologists see attacks first-hand, so their examples make awareness more concrete and relevant than generic training materials. He agrees a simple process with the human resources manager: each month he sends two anonymised examples with a short explanation, and she includes them in the staff newsletter with a reminder about the report button.
25.2 Short sessions
Jamal helps run ten-minute sessions at staff meetings in each centre. He shows two real phishing messages and points out clues: a sender address slightly different from the real one, urgent wording and a link that does not match the claimed site. Staff practise spotting clues on printed examples. He keeps sessions short because centre staff work shifts and cannot attend long training. After each session he asks staff which clue they found hardest to spot, and most say mismatched links. He adds a short guide to checking links on a phone.
25.3 Reporting culture
Jamal makes sure every report receives a thank-you within a day, even when the message was harmless. When a lifeguard reports a suspicious text message claiming to be from Riverbend payroll, Jamal confirms it was a scam and warns all staff. The lifeguard is thanked publicly at the next staff meeting. Ms. Grant explains that recognition encourages reporting, which helps detect attacks early. He keeps a log of reports and thank-you messages, and the human resources manager mentions reporting in the staff newsletter each month to keep the habit visible.
25.4 Measuring
Jamal tracks the number of reports per month and the time from first report to removal of phishing from mailboxes. Reports rise after the sessions. He avoids measuring individual click rates, which could discourage reporting. Ms. Grant notes that awareness measures should focus on helpful behaviour, such as reporting, rather than on catching people making mistakes. He presents the figures quarterly to the IT manager and the human resources manager in a short chart. They agree to keep the focus on reporting and to repeat the sessions each year with new examples.
Worked example
Jamal supplies anonymised real examples, runs ten-minute centre sessions, thanks every reporter and measures reports and removal time rather than individual clicks.
Synthetic case. Messages are synthetic.
Errors and limits
Measuring individual click rates can discourage reporting.
Exercises
- EX073 — Session length. How long are the sessions? Rubric: 3 = ten minutes;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX074 — Phishing clue. Name one phishing clue Jamal shows. Rubric: 3 = slightly different sender address;; 2 = one;; 1 = vague;; 0 = none.
- EX075 — Lifeguard report. What did the lifeguard report? Rubric: 3 = a scam text claiming to be from payroll;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 25 (chapter 25 of 30)
← Chapter 24 · Course chapter index · Chapter 26 →
Continue to the next authored lesson.