Cybersecurity Awareness Training: Everyday Habits for Every Employee

Your path

10 steps · 2 quizzes · about 50 minutes · open any step, or read it here

1. 1
   Cybersecurity awareness training: seven everyday habitsStart hereIn this cybersecurity awareness training for employees you practise the everyday habits that keep a company safe: locking your screen, installing updates, choosing safe Wi-Fi, leaving found USB sticks alone, keeping the door closed to strangers, keeping work…InteractiveHands-on · 4 min

   Read this step

   In this cybersecurity awareness training for employees you practise the everyday habits that keep a company safe: locking your screen, installing updates, choosing safe Wi-Fi, leaving found USB sticks alone, keeping the door closed to strangers, keeping work files in work tools and reporting mistakes fast. Each step starts with a situation from a normal working day, and you decide what to do before you see why.

   Most attacks on companies don't need a genius. They need one open door: a screen nobody locked, a laptop that skipped an update, a door held open out of politeness. Each habit below closes one of those doors, and each takes a few seconds.

   Interactive · A working day, seven small habits — try it in the lesson

   In this lesson you'll:

   • decide what to do in seven everyday situations, then see what each choice leads to
   • learn the one habit that handles each situation, and why it works
   • practise with new situations and check your answers
   • leave with a short list of habits to start this week

   It takes about 50 minutes. Nothing you do here touches a real system: every network, file and message is made up.

   Try it: press Play the day, then press any tile to read its habit again.

   Takeaway: security at work is mostly seven small habits, repeated.

2. 2
   Lock your screen every time you stand upAn unlocked computer is you, signed in to everything: email, customer data, the payroll system, chat. Anyone who sits down at it can read, copy, delete or send as you, and the records will say you did it.InteractiveHands-on · 4 min

   Read this step

   An unlocked computer is you, signed in to everything: email, customer data, the payroll system, chat. Anyone who sits down at it can read, copy, delete or send as you, and the records will say you did it.

   Auto-lock helps, but it waits several minutes on purpose, so it doesn't lock while you read. That wait is exactly the time you're away.

   Interactive · Four minutes away from your desk — try it in the lesson

   The habit, every time you stand up, even for a minute:

   Computer	Lock it with
   Windows	Windows key + L
   Mac	Control + Command + Q
   Phone or tablet	the side or top button

   Try it: pick an answer, then move the sliders. How long would the break have to be before auto-lock helps at all?

   Takeaway: two keys before you stand up, every time.

3. 3
   Install security updates the same dayA security update fixes a flaw that someone found in your laptop, your phone, your browser or an app.InteractiveHands-on · 4 min

   Read this step

   A security update fixes a flaw that someone found in your laptop, your phone, your browser or an app. Once the fix is published, the flaw is public too: attackers compare the new version with the old one to see what changed, and build an attack for the devices that haven't updated yet.

   So the risky time isn't before the update arrives. It's the days after it arrives, on a device where someone keeps pressing "Remind me later".

   Interactive · How long can an update wait? — try it in the lesson

   What counts as an update: the computer's own (Windows Update, macOS Software Update), your phone's, your browser's and your apps'. A real update comes from those settings, never from a pop-up on a website that says your software is out of date. Close that kind of pop-up and update from the settings instead.

   Try it: pick an answer, then slide the delay. After how many days does the red start to overlap the striped zone?

   Takeaway: install security updates the day they arrive; schedule the restart if you must, but for today.

4. 4
   Public Wi-Fi: use your hotspot or the VPNIn a café, a hotel or an airport you share the network with strangers, and you can't see who runs it. Anyone can set up a hotspot and give it any name, including a name one letter away from the real one. A fake network like that is called an evil twin.InteractiveHands-on · 4 min

   Read this step

   In a café, a hotel or an airport you share the network with strangers, and you can't see who runs it. Anyone can set up a hotspot and give it any name, including a name one letter away from the real one. A fake network like that is called an evil twin.

   Most websites use https today, so a stranger on the network can't read the pages themselves. A fake network can still see which sites you visit, show you a fake sign-in page, and reach your laptop if file sharing is switched on.

   Interactive · Pick a network at the airport — try it in the lesson

   Away from the office:

   1. Use your phone's hotspot, or the network whose name you've checked on a sign or with staff.
   2. Turn on the company VPN if you have one: it encrypts everything between your laptop and the company.
   3. Never type your work password into a Wi-Fi sign-in page.
   4. Switch off "connect automatically" for open networks, so your laptop doesn't join a twin by itself next time.

   Try it: pick each network in turn, with the VPN on and off. Which choices stay safe either way?

   Takeaway: a network you can't name is someone else's; bring your own hotspot or switch the VPN on.

5. 5
   Found a USB stick? Don't plug it inA USB stick is a small computer. It can carry malware that runs when a file is opened, and some are built to pretend to be a keyboard and type commands the moment they're connected. Cables and chargers can be built the same way.InteractiveHands-on · 4 min

   Read this step

   A USB stick is a small computer. It can carry malware that runs when a file is opened, and some are built to pretend to be a keyboard and type commands the moment they're connected. Cables and chargers can be built the same way.

   Attackers leave sticks where staff will find them because it works. In 2016, researchers dropped 297 USB drives around the University of Illinois campus to see what people would do. Before you look, decide what you would do.

   Interactive · 297 USB sticks dropped on a campus — try it in the lesson

   The habit:

   • Never plug in a stick, cable or charger you found or were handed by a stranger, at work or at home.
   • Give it to IT or security, unplugged, and say where you found it.
   • Charge your phone with your own charger in a wall socket.

   Try it: pick an answer, then step through Dropped, Picked up and Files opened. Out of 297, how many ended up plugged in with a file opened?

   Takeaway: found it? Hand it in, don't plug it in.

6. Check: the first four habitsFour questions on locking, updates, Wi-Fi and USB sticks.Quiz · 4 questions

   Read the questions

   Four questions on locking, updates, Wi-Fi and USB sticks.

   Question 1. Auto-lock is set to 10 minutes. You leave your desk for 4 minutes without locking. How long is the screen open with nobody there?

   • No time: auto-lock covers it
   • All 4 minutes
   • 10 minutes

   Question 2. Why is a security update most urgent in the days after it's published?

   • The fix shows attackers where the flaw is, and they target devices that haven't updated
   • Updates stop working if you wait too long
   • Old versions are switched off by the vendor after a day

   Question 3. A Wi-Fi page at a hotel asks for something. Which request is a red flag?

   • Your room number
   • Accepting the terms of use
   • Your work email password

   Question 4. In the 2016 campus study, files were opened on how many of the 297 dropped drives?

   • About 2%
   • About 18%
   • About 45%
   • All of them
7. 6
   Keep the door closed to people without a badgeNot every attack comes through a computer. Someone who walks in behind you, which is called tailgating, can reach unlocked screens, printers, network sockets and papers on desks.InteractiveHands-on · 4 min

   Read this step

   Not every attack comes through a computer. Someone who walks in behind you, which is called tailgating, can reach unlocked screens, printers, network sockets and papers on desks. It works because people are polite, and because a confident person with a good story rarely gets asked a question.

   Interactive · One badge, two people — try it in the lesson

   The habit, said kindly:

   • "Reception will sort you a visitor pass, it's just here." Then walk them over or call reception.
   • Delivery people, contractors and visitors go through reception, every time.
   • If someone without a badge is already inside and nobody is with them, ask if you can help them find someone, and tell reception or security.

   Try it: pick each answer and watch the two counters. When do they stop matching?

   Takeaway: one badge, one person; badge-less visitors go to reception, with a smile.

8. 7
   Keep work files in work toolsEvery copy of a work file in a personal place is a copy the company can't back up, protect or take back. If a personal email or cloud account is broken into, the customer's file goes with it, and nobody at work finds out.InteractiveHands-on · 4 min

   Read this step

   Every copy of a work file in a personal place is a copy the company can't back up, protect or take back. If a personal email or cloud account is broken into, the customer's file goes with it, and nobody at work finds out.

   It usually starts with a good intention: finishing something at home, sending a file that's too big, using a tool you know from home.

   Interactive · Where does the file end up? — try it in the lesson

   The habit:

   • Work files stay in the company's own tools: the shared drive, work email, the work laptop.
   • Need to work from home or share something big? Use the work tools from home, or ask IT for the approved way.
   • Never forward work email to a personal address, and never paste customer or company text into a personal AI chatbot account.

   Try it: pick each answer and count the dashed boxes that get a copy.

   Takeaway: one copy, in work tools; if they don't fit the job, ask IT, not Gmail.

9. 8
   Report a mistake within minutesEveryone clicks something they shouldn't, sooner or later. What decides how much it costs is how fast someone who can act finds out.InteractiveHands-on · 4 min

   Read this step

   Everyone clicks something they shouldn't, sooner or later. What decides how much it costs is how fast someone who can act finds out. With your password, an attacker can start within minutes; IT can reset it, sign out every device and remove hidden mailbox rules, but only once they know.

   Interactive · What happens while nobody knows — try it in the lesson

   How to report:

   1. Use your company's report button or IT's number. Say what you clicked, what you typed and when.
   2. Don't delete the message: IT may need it to protect everyone else.
   3. Report strange things too: a login alert you didn't cause, a mailbox rule you didn't make, a colleague's message that doesn't sound like them.

   Try it: pick an answer, then slide from 5 minutes to Monday morning. Which steps can still be stopped at 30 minutes?

   Takeaway: report within minutes, even your own mistake; speed turns an attack into a near miss.

10. 9
    Practice: what would you do?Six new situations. Pick an answer and check it. A wrong answer costs nothing, and each has a hint.Practice · 6 exercises

    Read this step

    Six new situations. Pick an answer and check it. A wrong answer costs nothing, and each has a hint.

    A colleague has gone to lunch and left their laptop open on the customer list. What do you do?

    • Leave it, it's their laptop
    • Lock it for them and mention it later
    • Send a joke email from it so they learn

    A website you're reading shows a pop-up: "Your browser is out of date. Download the update here." What do you do?

    • Download it, updates are important
    • Close the pop-up and update from the browser's own settings
    • Ignore all updates until IT asks

    In a hotel, the Wi-Fi page asks for your room number, then a second page asks for your Microsoft 365 password. What do you do?

    • Type it in, the hotel needs to know who you are
    • Stop, use your phone's hotspot, and change the password if you typed it
    • Type it in, then change it the next morning

    After a meeting, someone has left a USB-C charging cable on the table. Your phone is at 5%. What do you do?

    • Use it, a cable is just a cable
    • Hand it to reception or IT, and charge from your own charger
    • Use it, but only in a laptop

    A courier at reception asks you to let them up to your floor to hand a parcel to the recipient in person. What do you do?

    • Ask reception to sign for it, or call the recipient to come down
    • Badge them in, couriers are always in a hurry
    • Take them up yourself and leave them by the desks

    Yesterday you forwarded a client file to your personal email by mistake. What do you do?

    • Delete it and say nothing
    • Tell your manager or IT today, and follow what they say
    • Nothing, it's in your own account so it's safe