Internet security awareness

A cyber security risk mitigating end user program could consist of a combination of multiple approaches including cyber security awareness, cyber security training, and cyber security education. The below table that provides a comparison of the approaches.^[1]

	Awareness	Training	Education
Attribute	“What”	“How”	“Why”
Level	Information	Knowledge	Insight
Objective	Recognition	Skill	Understanding
Delivery Method	Media Including: video, newsletters, posters	Practical Instruction Including: lecture, case study workshop, hands-on	Theoretical Instruction Including: discussion seminar, background reading
Impact Timeframe	Short-term	Intermediate	Long-term

Cyber threat awareness does not necessarily lead users to applying threat protections.^[5] Research on cybersecurity awareness education has shown inconsistent results, with some studies suggesting limited effectiveness and experts advocating for the customization of training programs to enhance awareness.^[6]

There are several different delivery methods that can be taken to provide cyber security awareness,^[4] including posters, guides, tips,^[7] videos, and newsletters.^[1] Game-based training may be effective for young people.^[8] A mixed approach, applying multiple methods, may be more effective than a single approach.^[9]

Summarize Top Qs Fact Check

Some possible cyber security awareness topics include but are not limited to the following.^[10][11][12]

Anti-Malware Protection: Security end user awareness guidelines include device scans for malware and updating the anti-malware application definitions.^[10]

Data Protection and Privacy: There are various types of data that might be mandated to be protected from unauthorized disclosure, including personally identifiable information (PII), protected health information (PHI), intellectual property (IP), and other sensitive information.  Security awareness guidelines include teaching related to data classification, encryption, data anonymization, and data masking or data obfuscation.  Permissions and who can access data, which includes file sharing via email attachments, are additional safeguards that could be discussed. Another data protection control that could be included is backing up data^[10] as it could be restored if the original becomes unavailable.

Device Management: involves knowing how to protect mobile devices and computers.  Device Management is also concerned with security related to Bring Your Own Device (BYOD).  Security awareness guidelines include encryption, protecting the system with a password, PIN, or multi-factor authentication, and other forms of credential.  Additional awareness tips include end-users downloading, installing, and reviewing applications and the requested permissions from unknown sources.^[11][13]  According to,^[11] another awareness tip is to read reviews and comments about the application before installing it.  Additionally, the use of public WIFI is another discussion point.^[11]  Device management also relates to maintaining an accurate inventory of assets from purchase to disposition. This includes knowing when to wipe a device and media sanitization.

Incident Response: An incident is any observable event of malicious intent.  Security awareness guidelines for end-users include what types of events are considered suspicious or malicious, who should be contacted if an incident occurs, and what actions should be taken in the event of an incident.^[10]

Internet of Things Security: are remotely controlled capable, resource constrained devices with embedded sensor chips that interact with people and objects to collect data and provide it to remote sources on the Internet for additional analysis in an effort to personalize and customize a user's experience. These devices include but are not limited to smart speakers, wearable devices like smart watch, surveillance cameras, lights, door locks, thermostats, appliances and cars.  Guidelines include maintaining an asset inventory, patch control, and changing default credentials.^[14]

Insider threats in cybersecurity (internet security) are security risks that come from individuals within an organization, such as employees or contractors, who have access to its systems and data.^{[15][16][17][18]} These threats can include data theft, sabotage, fraud, or espionage, posing significant risks due to the insider's knowledge and access.^[15][16]

Password Management: A password is a string of secret characters used to authenticate a user's account. Security awareness guidelines suggest presenting requirements for creating a strong password or Passphrase, how frequently passwords should be changed, and how to protect passwords.^[10]  Additionally, guidelines suggest the need to change all default passwords and to not share passwords with others.^[19]  Additional protection options could include making end-users aware of using multi-factor authentication, password managers, and awareness of various password-related threats like password cracking.

Patching: Software and system changes to update, improve, or resolve weaknesses are usually released via a patch.  Security awareness guidelines include the timely installation of security patches ^[10] as well as implementing vulnerability assessment and vulnerability management.

Removable Media: are storage devices that could be added or removed from a running computer, such as CDs, DVDs, removable SD cards, and USB drives (including flash drives, thumb drives, external hard drives). Security awareness guidelines include drive encryption and following the policy and guidelines presented at the organizational level regarding the use of personal removable media on organizational systems.^[19]

Safe Web Browsing: Security awareness guidelines regarding securely navigating websites include looking for the padlock icon on the URL bar before entering sensitive information like credentials, credit card information, or personally identifiable information.^[11]   Another visual indicator is "https" reflecting in the web address.^[11]  The padlock and "https" indicate that the entered information will be secure while data is in transit.^[11] It is paramount to also understand that valid TLS connection ("https" / padlock) does not indicate trustworthiness as also malicious actors utilize secure connections. Lastly, guidance could be shared to set privacy options on the browser or use the incognito option to limit the information shared.^[20] Yet another guideline is to consider using a virtual private network (VPN).^[20]

Scareware is another type of social engineering ploy that displays a pop-up alert that attempts to create a sense of urgency and panic by notifying the user that viruses have infected their computer or has been hacked. The alert instructs the user to click on its link to enter information or download software that will remedy the issue when, in reality, this very action is what will compromise the user’s device. The consequences can vary from having sensitive data stolen from the user’s machine, preventing access to certain files, shifting the social engineering tactic to ransomware, or coercing the user into providing credit card payment information to authorize fraudulent transactions.^[21][22]

Social Engineering involves interacting with humans in hopes that they will disclose sensitive information, including phishing attacks.^[23] Security awareness guidelines include not opening suspicious emails from unrecognized senders, not clicking on suspicious links in emails or on websites, not opening attachments in emails, not disclosing information, and not responding to suspicious emails or contacts provided therein.^[10][19]

National Cyber Security Awareness Month is observed in October in the United States.^[24] Microsoft is a partner in the event.^[25]

• Cybersecurity standards
• Cybercrime
• Countermeasure (computer)
• Social engineering (security)
• Threat (computer)
• Malware