- [Instructor] In addition to understanding how strong
security habits can improve information security,
users should also understand how attackers target users
to undermine an organization's security.
Security education programs should include coverage
of user-based security threats.
Phishing is one of the most common
user-based threats facing organizations.
In a phishing attack,
attackers send legitimate looking messages
to end users seeking to get them
to disclose sensitive information,
or perform another action that undermines security.
These messages can appear very realistic
using corporate logos and terminology.
The example phishing message shown here
was used to impersonal Citibank.
While phishing uses messages targeted at end users,
it's only one example of a category of attacks
known as social engineering.
In social engineering, attackers attempt
to manipulate individuals into undermining security.
Security awareness efforts
should inform users that social engineering
isn't limited to email and that they should be wary
of suspicious requests that they receive
by telephone, letter, or even in person.
Users should also understand that attackers create
new malicious code every day
and that they may fall victim to these new viruses
and zero-day attacks if they don't properly maintain
their computers and mobile devices,
both at home and in the office.
You'll learn more about this topic
in the Zero-Days and Advanced Persistent Threat video
of the Security + Threats and Vulnerabilities course.
Educating users about the types of threats targeting them
helps limit the effectiveness of user-based attacks.
The more that you can spice this training up
with examples from your own organization,
the more likely it is that the training will be effective.