Domain 2 of 5 · Chapter 3 of 4

Understand Security Awareness

Unlock the complete study guide + 12 practice exams totaling 1,500 questions.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • What security awareness is for
  • Security culture and the role of leadership
  • Who the learning program must reach
  • Keeping learning current
  • Phishing simulations: practice, not punishment
  • The user's role: recognize, respond, report
  • Social engineering: manipulating people
  • Phishing and its variants
  • Recognizing phishing cues that still work
  • Responding to a suspicious message or call
  • When credentials may already be exposed
  • Building strong, unique passwords
  • Password managers
  • Keeping passwords secret from every requester
  • MFA as a backstop for stolen passwords

Phishing, spear phishing, vishing, and smishing compared

FeaturePhishingSpear phishingVishingSmishing
What sets it apartThe base form: a fraudulent message, usually email, posing as a trusted partyTargeting: aimed at specific people or groups using tailored detailsChannel: a phone call or other voice communicationChannel: SMS or other text messages
Typical lureA link to a fake login page, an attachment, or a request for sensitive dataA request that correctly names a real colleague, project, or processA caller posing as the help desk, a bank, or a managerA text pointing to a deceptive website or phone number
Why it seems trustworthyFamiliar branding and a familiar display nameAccurate personal or organizational detailsA familiar caller ID, which can be spoofedIt arrives on a personal phone
What still exposes itThe real sender address and link destinationThe request itself: credentials, payment, or skipping an approvalAn unsolicited request for a password or a sensitive actionAn unexpected link or callback number inside the text

Decision tree

Already clicked a link ordisclosed information?Report the exposure promptlychange any affected password via a trusted processYesNoDoes it ask foryour password?Never share the passworddecline; contact the help desk yourselfYesNoCould a sensitive requestbe genuine?Verify through an independent routeuse contact details you found yourselfYesNoReport without interactingno links, attachments, or unsubscribeAlways: report through the established channel and follow the playbook
Cheat sheet

Cheat sheet

  • Security awareness aims to improve everyday security behavior
  • Visible leadership participation reinforces security culture
  • Security learning includes everyone who uses organizational systems or data
  • Tailored training adds to general awareness for privileged and security roles
  • Security learning must evolve with threats and workplace changes
  • Phishing simulations should support learning rather than public punishment
  • Users need clear expectations for recognizing, responding to, and reporting security concerns
  • AI-assisted identification supports staff reporting under established playbooks
  • Social engineering manipulates people rather than relying only on technical flaws
  • Spear phishing targets particular people or groups
  • Vishing uses voice communication for social engineering
  • Smishing uses text messages to deliver social engineering requests
  • Urgency and emotional pressure are common manipulation cues
  • Verify suspicious requests through an independently trusted contact route
  • Report suspected phishing without interacting with its links or attachments
  • A familiar label or logo does not establish a link's destination
  • AI-generated phishing can be fluent and free of spelling errors
  • Suspected disclosure of credentials requires prompt reporting and protective action
  • Strong passwords combine length with unpredictability
  • Unique passwords limit the spread of a single account compromise
  • A password manager helps users maintain distinct strong passwords
  • A claimed support role does not justify disclosing a password
  • MFA adds protection when a password alone is insufficient

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://csrc.nist.gov/glossary/term/awareness
  2. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-50r1.pdf
  3. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
  4. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
  5. https://csrc.nist.gov/glossary/term/role_based_training
  6. https://csrc.nist.gov/glossary/term/role_based_access_control
  7. https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/phishing
  8. https://nvlpubs.nist.gov/nistpubs/TechnicalNotes/NIST.TN.2276.pdf
  9. https://csrc.nist.gov/glossary/term/social_engineering
  10. https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf
  11. https://csrc.nist.gov/glossary/term/phishing
  12. https://www.nist.gov/blogs/cybersecurity-insights/phishing-resistance-protecting-keys-your-kingdom
  13. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63B-4.pdf
  14. https://csrc.nist.gov/glossary/term/password
  15. https://www.nist.gov/itl/smallbusinesscyber/guidance-topic/multi-factor-authentication
  16. https://csrc.nist.gov/glossary/term/multi_factor_authentication