Security Awareness Training

Phishing awareness, social engineering defense, and security culture.

Overview

Human因素是安全中最薄弱的环节。

Training Topics

Phishing Recognition

Red Flags:
✗ Urgent language
✗ Unexpected attachments
✗ Suspicious links
✗ Request for credentials
✗ Poor grammar/spelling

Password Security

Strong Password:
✓ 12+ characters
✓ Mix of letters, numbers, symbols
✓ No dictionary words
✓ Unique per account
✓ Password manager usage

Social Engineering Types

Phishing Simulation

# Simple phishing detection
def check_email(email):
    red_flags = []
    
    if "urgent" in email.subject.lower():
        red_flags.append("Urgent language")
    
    if email.sender not in trusted_senders:
        red_flags.append("Unknown sender")
    
    if any(link in email.links for link in suspicious_domains):
        red_flags.append("Suspicious links")
    
    return red_flags

Security Culture

1. Leadership Buy-in — Management support
2. Regular Training — Ongoing education
3. Positive Reinforcement — Reward good behavior
4. Incident Reporting — Safe reporting culture
5. Continuous Improvement — Update training

Metrics

Practice

Conduct a phishing simulation and analyze results.