CompTIA Security+ Preparation · lesson 45 of 45 · 25 min
Security Awareness Training Fundamentals
Humans are the most targeted attack vector. Security awareness training reduces the risk of social engineering, phishing, and insider threats by educating users about security risks and their responsibilities.
Training program components: Initial onboarding training (all new employees), Annual refresher training (all employees), Role-based training (IT, finance, executives — higher-risk roles get more training), Just-in-time training (triggered by a specific event, like clicking a phishing simulation).
Topics covered: Phishing recognition, password hygiene, social engineering, physical security (tailgating, clean desk), data handling, incident reporting, acceptable use, remote work security.
Training delivery methods: Computer-based training (CBT), in-person workshops, video modules, gamification, newsletters, posters, simulated attacks.
Phishing Simulations and Metrics
Phishing simulation — sending fake phishing emails to employees to test their awareness. Employees who click are automatically enrolled in remedial training. Measures the organization’s susceptibility to phishing.
Key metrics: Click rate (% who clicked the phishing link), Report rate (% who reported the phishing email), Credential submission rate (% who entered credentials), Repeat offenders (employees who fail multiple times).
Improving metrics: Regular simulations, immediate remedial training for failures, positive reinforcement for reporting, making reporting easy (one-click report button).
Security culture — the goal of awareness training is to build a security-conscious culture where employees naturally think about security in their daily work. Metrics track progress toward this goal.
Insider threat awareness — training employees to recognize and report suspicious behavior by colleagues. Insider threats are often motivated by financial gain, disgruntlement, or coercion.
Social engineering red flags: urgency/pressure, requests for credentials, unusual requests from known contacts, too-good-to-be-true offers, requests to bypass normal procedures.
The Human Firewall
Technical controls can be bypassed, but a well-trained employee who recognizes and reports a phishing email is one of the most effective security controls. Security awareness training turns employees into a “human firewall.”
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Security Awareness Training
Phishing simulations measure:
- Network security
- Employee susceptibility to phishing attacks
- System patch levels
- Password strength
- Answer: Employee susceptibility to phishing attacks
Phishing simulations send fake phishing emails — the click rate, report rate, and credential submission rate measure employee awareness. Just-in-time training is triggered by:
- Annual calendar reminders
- A specific event like clicking a phishing simulation
- New employee onboarding only
- Quarterly schedules
- Answer: A specific event like clicking a phishing simulation
Just-in-time training is delivered immediately after a failure — the teachable moment when the employee is most receptive. Role-based training is important because:
- All employees have the same risks
- High-risk roles (IT, finance, executives) face different and greater threats
- It is cheaper than general training
- It replaces general awareness training
- Answer: High-risk roles (IT, finance, executives) face different and greater threats
Executives are targeted by BEC (Business Email Compromise); IT staff by credential theft; finance by wire fraud — each needs targeted training. A low report rate in phishing simulations indicates:
- Employees are very secure
- Employees are not reporting suspicious emails — a gap in security culture
- The simulations are too easy
- Technical controls are working
- Answer: Employees are not reporting suspicious emails — a gap in security culture
Reporting is as important as not clicking — employees who report phishing help the security team identify real attacks quickly. Social engineering red flags include:
- Emails from known contacts with normal requests
- Urgency, pressure, and requests to bypass normal procedures
- Scheduled maintenance notifications
- Password reset emails you requested
- Answer: Urgency, pressure, and requests to bypass normal procedures
Attackers create urgency to prevent victims from thinking critically. “Act now or your account will be closed” is a classic red flag. The “human firewall” concept refers to:
- A physical security barrier
- Well-trained employees who recognize and report threats
- A network security device
- An AI-based security system
- Answer: Well-trained employees who recognize and report threats
Trained employees are a critical security layer — they can catch phishing, social engineering, and suspicious behavior that technical controls miss. Insider threats are often motivated by:
- Technical curiosity only
- Financial gain, disgruntlement, or coercion
- Desire to improve security
- Accidental actions only
- Answer: Financial gain, disgruntlement, or coercion
Insider threats: malicious insiders are often motivated by money (selling data), revenge (disgruntled employees), or external pressure (coercion). Making phishing reporting easy (one-click button) improves:
- Click rates
- Report rates — more employees report suspicious emails
- Training completion rates
- Password strength
- Answer: Report rates — more employees report suspicious emails
Friction reduces reporting. A one-click report button in the email client makes it easy — increasing report rates significantly. Security culture is best described as:
- Having the latest security tools
- An organizational mindset where all employees naturally consider security
- Passing compliance audits
- Having a large security team
- Answer: An organizational mindset where all employees naturally consider security
Security culture means security is everyone’s responsibility — employees think about security without being prompted.
The percentage of employees who clicked a simulated phishing link is called the _____ rate.
Answer: click
Click rate = % of employees who clicked the phishing link. This is the primary metric for measuring phishing susceptibility.
Previous lesson: Data loss prevention (DLP): policies, endpoint DLP, network DLP, cloud DLP
Back to CompTIA Security+ Preparation