SkarpChapter 24 of 25
Security Awareness, Training, and Building a Security Culture
Turn users from the weakest link into a security asset by designing awareness and training programs that address real-world threats and behaviors.
Why Security Awareness Matters (and How It Fits Security+)
Awareness in Security+ and Real Life
Security awareness is heavily tested in Security+ and is critical in real organizations. It turns everyday users into active defenders instead of easy targets for attackers.
Where Awareness Fits
Awareness connects to governance, risk, and compliance, third‑party risk, and social engineering. Policies and contracts only work if people understand and follow them.
What You Will Be Able To Do
You will define security awareness, describe core topics, explain phishing simulations, identify simple effectiveness metrics, and link awareness to GRC and social engineering risk.
Security Awareness vs Training vs Education
What Is Security Awareness?
Security awareness is high‑level understanding and attitudes about security for all users. It helps people recognize risks and make safer everyday choices.
Training vs Education
Training builds specific skills for particular tasks or roles. Education is deeper, long‑term learning for specialists, like full courses or professional certifications.
Exam Tip: Choosing the Right Level
If the problem is organization‑wide risky behavior, the answer is often awareness. If it is a technical mistake by a specific team, the answer is usually targeted training.
Designing an Enterprise Security Awareness Program
Start With Risk and Requirements
Design awareness by first assessing incidents, high‑risk groups, and GRC obligations. Awareness should address real risks and support specific policies and regulations.
Objectives, Content, and Delivery
Set measurable objectives, then create short, behavior‑focused content. Deliver it through mixed channels like e‑learning, briefings, posters, and chat reminders.
Make It Ongoing and Measured
Avoid one‑off trainings. Reinforce messages frequently and measure completion, behavior changes, and incidents to continuously improve the program.
Core Topics in a Security Awareness Program (Security+ Aligned)
Passwords, Phishing, and Data
Core awareness topics include strong passwords and MFA, recognizing phishing and social engineering, and proper handling and classification of sensitive data.
Physical, Devices, and Networks
Users must learn badge use, tailgating prevention, clean desk, secure device use, patching, safe Wi‑Fi, and what to do if a device is lost or stolen.
Incident Reporting and Privacy
Awareness teaches staff how to report incidents, follow acceptable use policies, and respect privacy while understanding that monitoring may occur.
Scenario: Fixing a Weak Security Culture
The Problem Organization
Users reused passwords, attackers breached CRM, finance fell for spoofed CFO emails, and annual training was a boring slide deck few read.
Strengthening Behavior
Introduce campaigns on password reuse and MFA, role‑based training for finance on BEC, and simple ways to report phishing, with recognition for reporters.
Leadership and Controls Together
Have executives visibly support new behaviors while also adding technical controls like MFA and better email filtering. Exams favor this combined approach.
Phishing Simulations and User Testing
What Phishing Simulations Do
Simulated phishing emails measure who clicks, submits credentials, or reports them. They provide behavioral data and trigger just‑in‑time training.
Benefits and Good Design
They make threats feel real, reveal high‑risk groups, and improve learning when designed ethically, starting moderately and avoiding "gotcha" tactics.
Beyond Email: Other Tests
Organizations also use tabletop exercises, physical social engineering tests, and short knowledge quizzes to assess and strengthen user behavior.
Quick Check: Phishing Simulations
Test your understanding of phishing simulations and their purpose.
An organization begins sending monthly phishing simulations to all employees. Which primary goal BEST aligns with good security awareness practice and Security+ concepts?
- Identify employees to punish for failing the test so others are deterred
- Collect behavioral data to target coaching and reduce real phishing risk over time
- Replace the need for any other awareness training or policy communication
- Meet a compliance checkbox without changing how employees behave
Show Answer
Answer: B) Collect behavioral data to target coaching and reduce real phishing risk over time
The main purpose of phishing simulations in a mature awareness program is to collect behavioral data and use it to guide coaching, targeted training, and risk reduction. Punishment, replacing all other training, or pure checkbox compliance conflict with best practices and often harm security culture.
Measuring Awareness Effectiveness: Simple, Practical Metrics
Beyond Checkboxes
Completion rates show who took training but not whether behavior changed. Effective measurement focuses on behavior and risk trends, not just attendance.
Key Behavioral Metrics
Track phishing click and report rates, user‑reported incidents, and time to report. Look for lower clicks, faster and more accurate reporting over time.
Link to GRC and Audits
Use metrics to show reduced risk and fewer audit findings tied to user behavior, demonstrating that awareness supports governance, risk, and compliance.
Thought Exercise: Choosing the Right Metric
Consider each situation and decide which metric would be most meaningful. Think it through before checking the explanations below.
- Goal: Reduce successful phishing attacks that lead to credential theft.
- Which metric is more useful?
- A. Percentage of staff who completed the annual awareness video.
- B. Credential submission rate in phishing simulations over the last 6 months.
- Reflect: Which one directly measures the risky behavior?
- Goal: Show auditors that your organization is taking data classification seriously.
- Which metric is more convincing?
- A. Number of posters about data classification in the office.
- B. Percentage of sampled documents correctly labeled according to the classification policy.
- Reflect: Which one ties directly to the control requirement?
- Goal: Improve the culture of "see something, say something".
- Which metric tells you more?
- A. Number of user‑reported suspicious emails and security concerns per month.
- B. Number of security team meetings per month.
- Reflect: Which one reflects user engagement?
Self‑check explanations (do not peek until you answer):
- #1: B is better. Credential submission rate shows real behavior under realistic conditions.
- #2: B is better. Correct labeling directly measures adherence to the classification policy.
- #3: A is better. User‑reported issues show that staff are noticing and speaking up.
Building and Reinforcing a Security Culture
What Is Security Culture?
Security culture is the shared values and habits that make secure behavior the default. It goes beyond training to how people think and act every day.
Leadership and Safety
Leaders must model secure behavior and encourage non‑punitive reporting so staff feel safe admitting mistakes early, enabling faster incident response.
Make Security Part of Work
Embed security into daily processes, keep policies simple, and recognize good behavior. Exams favor answers that strengthen culture, not just scold users.
Quiz: Awareness, Training, or Culture?
Decide which option best addresses the described issue.
A company notices that employees often ignore the "Report Phishing" button and instead delete suspicious emails silently. The security team wants to know about these events. Which action BEST supports long-term improvement?
- Send an email threatening disciplinary action for anyone who deletes suspicious emails without reporting
- Add a slide to the annual training that lists the steps for using the report button
- Launch a campaign where managers thank staff who report suspicious emails, and share monthly stats on how reports helped stop real attacks
- Disable the delete function in email so users must either open or report every message
Show Answer
Answer: C) Launch a campaign where managers thank staff who report suspicious emails, and share monthly stats on how reports helped stop real attacks
Option 3 builds positive reinforcement and integrates reporting into culture, showing impact and recognition. Threats and technical force (1 and 4) damage trust and usability. A single extra slide (2) may help awareness slightly but does not strongly shift culture or behavior.
Key Term Review: Security Awareness and Culture
Use these flashcards to reinforce core concepts before moving on.
- Security awareness
- High‑level understanding and attitudes about security for all users, aimed at helping people recognize risks and make safer everyday choices.
- Training (in security context)
- Role‑based, skill‑building activities that teach people how to perform specific security‑relevant tasks or follow procedures correctly.
- Education (in security context)
- Deeper, often long‑term learning for security professionals, building broad conceptual understanding (for example, full courses, professional certifications).
- Phishing simulation
- A controlled test where realistic but safe phishing emails are sent to users to measure behavior (clicks, credential entry, reporting) and provide targeted coaching.
- Security culture
- The shared values, norms, and everyday behaviors in an organization that support secure actions by default and encourage responsible reporting.
- Governance, risk, and compliance
- Governance, risk, and compliance refers to operating with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance when securing enterprise environments.
- Awareness effectiveness metric
- A measurable indicator, such as phishing click rate, report rate, or time to report, that shows whether awareness efforts are changing user behavior and reducing risk.
- Non‑punitive reporting
- An approach where staff are encouraged to report mistakes and incidents without fear of punishment, focusing on rapid response and learning rather than blame.
Key Terms
- training
- Role‑based, skill‑building activities that teach people how to perform specific security‑relevant tasks or follow procedures correctly.
- education
- Deeper, often long‑term learning for security professionals, building broad conceptual understanding.
- security culture
- The shared values, norms, and everyday behaviors in an organization that support secure actions by default and encourage responsible reporting.
- security awareness
- High‑level understanding and attitudes about security for all users, aimed at helping people recognize risks and make safer everyday choices.
- phishing simulation
- A controlled test where realistic but safe phishing emails are sent to users to measure behavior and provide targeted coaching.
- non‑punitive reporting
- An approach where staff are encouraged to report mistakes and incidents without fear of punishment, emphasizing rapid response and learning.
- awareness effectiveness metric
- A measurable indicator that shows whether awareness efforts are changing user behavior and reducing risk, such as phishing click rate or report rate.
- governance, risk, and compliance
- Governance, risk, and compliance refers to operating with an awareness of applicable regulations and policies, including principles of governance, risk, and compliance when securing enterprise environments.