TXT

Cybersecurity Awareness

Practical, plain‑English guidance to help your staff spot threats, protect data, and respond quickly when something goes wrong. Use the sections below as a starter kit for an internal security microsite or awareness campaign.

What Everyone Should Know

Cybersecurity is a team sport. Most attacks start with a single click, reused password, or unpatched device.

The goal isn’t perfection—it’s reducing easy wins for attackers and catching issues early.

• Think before you click: Pause on unexpected emails, links, QR codes, and attachments.
• Verify out‑of‑band: If a message asks for money, passwords, or MFA codes—call the sender using a known number.
• Update & restart: Enable auto‑updates on computers, phones, and browsers.
• Use MFA everywhere: Prefer app‑based authenticators or passkeys over SMS where possible.
• Report fast: If you clicked or shared data, tell IT immediately—speed limits damage.

Common Threats

Know the patterns so you can spot them in the wild.

• Phishing & QRishing: Emails, texts, or QR codes that impersonate trusted brands or coworkers.
• Business Email Compromise (BEC): Spoofed invoices, gift‑card requests, or “urgent” payment changes.
• Malware & Ransomware: Delivered via attachments, drive‑by downloads, or exploited vulnerabilities.
• Account Takeover: Weak/reused passwords and leaked tokens let attackers impersonate you.
• Data Leakage: Mis‑sent emails, public links, or lost devices exposing sensitive info.

Prevention Playbook

Simple controls that deliver outsized protection.

• Passwords & Passphrases: Use a password manager. Make each password unique. Prefer passphrases (e.g., four random words).
• Multi‑Factor Authentication: Turn on MFA for email, finance, HR, and admin tools.
• Least Privilege: Use standard accounts for daily work; elevate only when needed.
• Patching: Update OS, browsers, plugins, and firmware. Reboot weekly.
• Browser Hygiene: Limit extensions, set download prompts, and block pop‑ups where practical.
• Secure Wi‑Fi: Use WPA2/WPA3 with a strong passphrase; avoid unknown public networks.

Policies that Matter (Plain English)

Policies don’t have to be scary. Here are the essentials most organizations adopt:

• Acceptable Use: Defines what’s appropriate on corporate devices and networks.
• Data Handling: Labels (Public/Internal/Confidential) and rules for storage and sharing.
• Access Control: Joiner‑Mover‑Leaver process; periodic access reviews.
• Incident Reporting: How and when to report security issues (ASAP—even “just in case”).
• Vendor Management: Baseline security for third parties handling your data.

Training & Simulations

Short, frequent training beats annual marathons. Mix awareness tips with hands‑on simulations.

• Micro‑Lessons: 2–5 minute modules focused on one topic (MFA, phishing tells, secure sharing).
• Phishing Drills: Run periodic simulations with clear coaching—no shaming.
• Tabletop Exercises: Quarterly incident dry‑runs with IT, HR, Legal, and Comms.
• Just‑in‑Time Tips: Add banners/tooltips in apps that remind users at the moment of risk.

If Something Goes Wrong (Quick Steps)

Don’t panic—act. Early reporting often prevents real damage.

• Disconnect: Unplug network or turn off Wi‑Fi on the affected device.
• Report Immediately: Email or call the help desk; provide screenshots if you can.
• Preserve Evidence: Don’t delete suspicious emails or wipe the device.
• Change Passwords: Prioritize email and high‑risk accounts, then enroll in MFA.
• Notify Stakeholders: Follow your escalation path; legal/compliance may be required.

Helpful Resources

Use or adapt these references for internal docs and onboarding.

• CISA Stop Ransomware: Guidance for prevention and response.
• NIST Cybersecurity Framework (CSF): High‑level control families and outcomes.
• Have I Been Pwned: Check if work or personal email addresses appeared in breaches.
• OWASP Top 10: Top web risks for devs and product teams.

Contact & Reporting

See something, say something—right away.

• Report Security Issues: security@yourorg.example or x1234 (help desk).
• Non‑Emergency Questions: security‑awareness@yourorg.example.
• Anonymous Tips: Use the internal hotline or form if available.