Security awareness fundamentals

• QuestionWhat is "Recognising phishing in 30 seconds"?Tap to revealAnswerSlow down. Domain, link target, urgency, ask — check all four.
• QuestionIn "Recognising phishing in 30 seconds", explain:Tap to revealAnswerFour checks: sender domain · urgency · link target · credential ask.
• QuestionIn "Recognising phishing in 30 seconds", explain:Tap to revealAnswerHover before you click; type domains by hand if uncertain.
• QuestionIn "Recognising phishing in 30 seconds", explain:Tap to revealAnswerWire-transfer / gift-card / MFA-code asks → call the person on a known number.
• QuestionWhat is "Password hygiene + MFA"?Tap to revealAnswerUse a password manager for every account, generate unique high-entropy passwords (16+ chars, random), and never reuse them
• QuestionIn "Password hygiene + MFA", explain:Tap to revealAnswerPassword manager + unique random passwords for every account.
• QuestionIn "Password hygiene + MFA", explain:Tap to revealAnswerMFA via app or hardware key; SMS only as last resort.
• QuestionIn "Password hygiene + MFA", explain:Tap to revealAnswerNever read an MFA code aloud or paste it into an unfamiliar form.
• QuestionWhat is "Data tiers — public, internal, confidential, restricted"?Tap to revealAnswerMost companies classify data into four tiers
• QuestionIn "Data tiers — public, internal, confidential, restricted", explain:Tap to revealAnswerFour tiers: Public · Internal · Confidential · Restricted.
• QuestionIn "Data tiers — public, internal, confidential, restricted", explain:Tap to revealAnswerTier determines storage + sharing — match the rule to the tier.
• QuestionIn "Data tiers — public, internal, confidential, restricted", explain:Tap to revealAnswerWhen unsure, ask before sending. Asking is cheap; rework is not.
• QuestionWhat is "Reporting a suspected incident"?Tap to revealAnswerIf you suspect an incident — clicked a phishing link, mis-shared restricted data, lost a device, saw something off in a colleague's account — report it immediately
• QuestionIn "Reporting a suspected incident", explain:Tap to revealAnswerReport fast; IR prefers false alarms to delayed real reports.
• QuestionIn "Reporting a suspected incident", explain:Tap to revealAnswerUse the documented channel; include what + when + data + your contact.
• QuestionIn "Reporting a suspected incident", explain:Tap to revealAnswerDon't investigate or delete; preserve evidence for IR.

1. 1Diagram the core idea

   Analyse~10 min

   In your own words, diagram the central idea of "Recognising phishing in 30 seconds". Aim for one paragraph, no jargon you haven't earned.

   Done when: A non-expert could read your paragraph and explain it back to you.

   Re-read the source concept

2. 2Translate it to a real situation

   Apply~15 min

   Find a real situation from your own work / life where "Reporting a suspected incident" applies. Translate the idea — describe the situation, the move you'd make, and the alternative you considered first.

   Done when: You can name a specific situation (not a hypothetical), state your move, and explain the trade-off in one paragraph.

   Re-read the source concept

3. 3Teach it back

   Evaluate~5 min

   Pick someone (a colleague, a peer, a rubber duck) and explain the section to them in under 5 minutes. Use your own example, not the one from the lesson.

   Done when: Your listener can repeat the core idea + the trade-off back to you without prompting.

Why this matters. Reading + quizzing prove recall; applying it in a real situation is the only evidence of transfer. Treat at least one of these as non-negotiable before you move on.