Page plan · 28 pages

Written for: Newly hired staff in any office job

1. 1

   Information security for new starters

   • Welcome: this course covers the security habits every new employee needs from day one
   • Security is part of everyone's job, whatever your role or team
   • By the end you will know what to do and who to call
2. 2

   How this course works

   • The course is split into short chapters you can complete at your own pace
   • Each chapter ends with practical rules you can apply immediately
   • A quiz at the end lets you check what you have learned
   • Ask questions at any point; nobody is expected to know this already
3. 3

   Five chapters, from passwords to the law

   • Chapter 1 explains why security matters and what attackers want
   • Chapter 2 covers passwords and accounts, Chapter 3 covers email and phishing
   • Chapter 4 covers handling data, including files, desks and remote work
   • Chapter 5 covers incidents and what the law expects of us
4. 4

   Chapter 1: why security matters

   • Security protects customers, colleagues and the organization's ability to work
   • A single careless click can affect many people, not just you
   • This chapter shows who attacks us and how they usually succeed
5. 5

   What attackers want

   • Attackers often want money, through fraud, extortion or stolen payments
   • They also want data such as customer records, credentials and internal documents
   • Access to your account can be a stepping stone to larger systems
   • Most attacks target people rather than technology
6. 6

   Phishing tops the FBI's 2025 complaint list

   • Phishing and spoofing led all reported crime types with 191,561 complaints in 2025
   • Extortion followed with 89,129 complaints, then investment fraud with 72,984
   • Personal data breach drew 67,456 complaints and non-payment/non-delivery 56,478
   • Tech and customer support scams added 47,794 complaints
   • Phishing is the most common threat you are likely to meet

   Bar chart: Top crime types reported to the FBI's IC3, 2025 (complaints). Source: Internet Crime Report 2025 · checked 2026-10-10

7. 7

   Your part in the chain

   • Think of security as a chain: every employee is one link
   • Attackers look for the weakest link, often a rushed or unaware person
   • Following the basics and reporting early keeps the chain strong
8. 8

   Chapter 2: passwords and accounts

   • Accounts are the front door to our systems and data
   • Strong passwords and a second sign-in step block most easy attacks
   • This chapter covers passphrases, multi-factor sign-in and account sharing
9. 9

   Building a strong passphrase

   • A passphrase is a string of several unrelated words, long and easy to remember
   • Length matters more than clever symbol substitutions
   • Use a different passphrase for every account
   • Never reuse your work password on personal sites
   • A password manager approved by IT can store them safely
10. 10

    Multi-factor sign-in

    • Multi-factor sign-in asks for something you know plus something you have
    • Even if a password is stolen, the attacker still needs the second factor
    • Never approve a prompt you did not trigger yourself
    • Report unexpected sign-in prompts to the security team
11. 11

    Sharing accounts is not allowed

    • Each person must use only their own account
    • Shared logins make it impossible to trace who did what
    • Never lend your password, even to a manager or colleague you trust
    • If someone needs access, request an account for them through IT
12. 12

    Chapter 3: email and phishing

    • Email is the most common way attackers reach employees
    • This chapter teaches you to spot fake messages and handle risky links
    • It also covers scams by phone and text message
13. 13

    Spotting a phishing message

    • Check the sender's address, not just the display name
    • Be wary of urgency, threats or unexpected requests for money or credentials
    • Look for odd greetings, spelling errors or a request that breaks normal process
    • When unsure, verify through a separate, known channel
14. 14

    Suspicious links and attachments

    • Hover over a link to see where it really goes before you click
    • Do not open unexpected attachments, even from known senders
    • Be careful with files that ask you to enable macros or content
    • Report the message rather than forwarding it to colleagues
15. 15

    Phone and message scams

    • Scammers phone or text pretending to be IT, banks or senior managers
    • Never give passwords or codes to a caller, whoever they claim to be
    • Hang up and call back using an official number
    • Treat unexpected messages with links the same way as suspicious email
16. 16

    Chapter 4: handling data

    • Data is only as safe as the habits of the people who handle it
    • This chapter covers classifying, storing, sending and protecting information
    • It also covers keeping data safe at your desk and while remote
17. 17

    Classifying information

    • Classification labels tell you how carefully information must be handled
    • Typical levels run from public through internal to confidential
    • Personal data and financial records usually need extra protection
    • If you are unsure of the level, ask the data owner or treat it as more sensitive
18. 18

    Storing and sending files

    • Store work files only in approved locations, not on personal drives or accounts
    • Send sensitive files using approved, secure sharing tools
    • Double-check recipients before sending, especially with autocomplete
    • Do not plug in unknown USB sticks
19. 19

    Clean desk and screen locking

    • Lock your screen whenever you step away, even briefly
    • Clear sensitive papers and devices from your desk at day's end
    • Collect printouts promptly and shred confidential paper
    • Do not leave passwords written on sticky notes
20. 20

    Working away from the office

    • Use only approved devices and keep software updates current
    • Avoid public Wi-Fi for work, or use the company VPN if you must
    • Keep screens out of view of strangers in cafes or on trains
    • Never leave laptops or phones unattended in cars or public places
21. 21

    Chapter 5: incidents and the law

    • Even careful people have incidents, so quick reporting matters
    • This chapter explains what counts as an incident and how to report it
    • It also outlines what data protection law expects of us
22. 22

    What counts as an incident

    • An incident is any event that may harm the confidentiality, integrity or availability of data
    • Examples: a clicked phishing link, a lost laptop or an email sent to the wrong person
    • Suspected incidents count too; you do not need proof
    • Malware warnings or unusual account activity should be reported
23. 23

    How to report it

    • Report immediately through the official channel, such as the security team or helpdesk
    • Say what happened, when, and which systems or data may be involved
    • Do not try to fix it or hide it yourself
    • Quick reporting limits damage, and honest reports are never penalized for good faith
24. 24

    What data protection law expects

    • Data protection law requires personal data to be handled lawfully and kept secure
    • Organizations must protect personal data and may have to report certain breaches to regulators
    • Individuals have rights over their own data, such as access to it
    • Failing to protect data can bring fines and reputational harm
25. 25

    What a breach costs: business email compromise losses

    • Reported business email compromise losses were US$2,946.8 million in 2023
    • They dipped to US$2,770.2 million in 2024
    • They rose to US$3,046.6 million in 2025, the highest of the three years
    • Verifying payment requests by a second channel helps prevent these losses

    Column chart: Reported losses to business email compromise (US$ million). Source: Internet Crime Report 2025 · checked 2026-10-10

26. 26

    The key rules on one page

    • Use long, unique passphrases and turn on multi-factor sign-in
    • Never share accounts or approve prompts you did not start
    • Check senders and links before clicking, and verify unusual requests
    • Handle data by its classification and lock your screen when away
    • Report anything suspicious immediately
27. 27

    Quiz: test yourself on the five chapters

    • The quiz covers all five chapters, from passwords to the law
    • Use it to find topics worth revisiting
    • Questions reflect everyday situations you may meet in your role
    • Review any wrong answers before moving on
28. 28

    Who to contact when something looks wrong

    • Contact the security team or helpdesk first if something looks wrong
    • Report suspicious emails using the report button or the official mailbox
    • Tell your manager about lost devices straight away
    • When in doubt, ask; a quick question is better than a late report