5.6b user training

Pre-connection security training

Ideally, users receive security training before they ever connect to the network for the first time.

Role-specific training

Security requirements and training differ by department, e.g. accounting vs shipping and receiving have different needs.

Third-party training scope

Contractors, partners, and suppliers connecting to the network also require appropriate security training.

Training tracking

Maintaining records of who has and hasn't completed required security training.

Accessible policy documentation

Security policies should be available on the intranet and included in the employee handbook.

Situational awareness

Users staying alert to threats at all times: phishing emails, unusual URLs, suspicious text messages, suspicious physical items like an unsolicited USB drive.

Insider threat mitigation

Multi-factored approach: requiring multiple approvals for critical changes, active file monitoring, and making it difficult to bypass these controls.

User password management guidance

Standard requirements (length, complexity) often enforced administratively via Group Policy rather than left to user discretion.

Removable media/cable risks

Unknown USB drives can carry malware; unknown charging cables pose similar risk when traveling or away from home/office.

Juice jacking

The real-world name for the risk of using unknown public charging cables/ports, which can be used to steal data or install malware through the same USB connection used for power.

Social engineering awareness training

Users should recognize common social engineering techniques and know how to report them to IT security.

Operational security (user-level)

Encouraging users to think from an attacker's perspective, understanding what data is sensitive and treating it accordingly. A mindset shift, not a formal process.

Remote work security concerns

No family or friends accessing work systems, additional endpoint security for off-site devices, increased VPN access security for remote connections.

Insider threat defense logic

Insiders already have legitimate access, so defense shifts toward process friction (multiple approvals) and detection (file monitoring) rather than prevention alone.