Quarterly Cybersecurity Awareness Training Guide Introduction Cybersecurity is a shared responsibility. Every employee plays an important role in protecting Crosby Scholars' systems, student data, financial information, and organizational resources. Most cyber attacks do not begin with sophisticated hacking. They begin by tricking a person into clicking a link, sharing information, approving an MFA request, or connecting to an unsafe network. This guide covers the most common cybersecurity threats employees face and how to identify and respond to them.
1. Password Security Why Password Security Matters Passwords remain one of the primary methods used to protect digital accounts. Weak or reused passwords can allow attackers unauthorized access to email, cloud applications, financial systems, and confidential information. Best Practices •
Use long, unique passwords for every account.
•
Avoid using personal information such as birthdays, names, or favorite sports teams.
•
Never reuse work passwords on personal websites.
•
Never share passwords with coworkers, managers, or family members.
•
Change passwords immediately if you suspect they have been exposed.
Real-World Example A popular shopping website experiences a data breach. Attackers obtain usernames and passwords. They then try the same credentials against Microsoft 365 accounts. Employees who reused passwords across multiple sites may unknowingly give attackers access to company systems. Key Principle
A compromised password should impact only one account, not all of them.
Multi-Factor Authentication (MFA) What Is MFA? MFA requires users to verify their identity using more than one factor: •
Something you know (password)
•
Something you have (phone or authenticator app)
•
Something you are (fingerprint or facial recognition)
Why It Matters Even if an attacker obtains a password, MFA helps prevent unauthorized access. Best Practices •
Always review MFA prompts before approving them.
•
Never approve a login request you did not initiate.
•
Report unexpected MFA prompts immediately.
Real-World Example An attacker steals an employee's password through a phishing email and attempts to log in. The employee receives an unexpected MFA prompt. By denying and reporting it, the employee prevents account compromise.
2. Public Wi-Fi & Secure Connectivity Understanding Public Wi-Fi Risks Public Wi-Fi networks are commonly found in airports, hotels, coffee shops, and restaurants. These networks may not provide the same security protections as trusted corporate or home networks. Risks •
Eavesdropping on network traffic
•
Fake wireless networks
•
Session hijacking
•
Data interception
Best Practices •
Use a VPN whenever accessing company resources remotely.
•
Confirm the legitimacy of public Wi-Fi networks before connecting.
•
Avoid accessing sensitive company information on untrusted networks.
•
Disable automatic Wi-Fi connections.
Real-World Example An attacker creates a wireless network named "Airport Free WiFi." Travelers unknowingly connect, allowing the attacker to monitor traffic and collect information. Key Principle Not every network is trustworthy simply because it is available.
3. Email Phishing What Is Phishing? Phishing is a cyber attack where criminals attempt to trick individuals into: •
Clicking malicious links
•
Opening infected attachments
•
Sharing passwords
•
Providing sensitive information
The goal is to manipulate trust and urgency. Common Warning Signs •
Generic greetings
•
Urgent requests
•
Threats or scare tactics
•
Suspicious links
•
Unexpected attachments
•
Requests for credentials
Best Practices •
Verify unusual requests.
•
Hover over links before clicking.
•
Be cautious of unexpected attachments.
•
Report suspicious emails to IT.
Real-World Example An email appears to be from Microsoft and claims your account will be suspended unless you sign in immediately. The provided link directs users to a fake login page designed to steal credentials. Key Principle Pause. Verify. Then act.
4. Smishing (Text Message Scams) What Is Smishing? Smishing is phishing conducted through SMS or text messages. Attackers use text messages because people often trust them and respond quickly. Common Smishing Messages •
Package delivery notifications
•
Banking alerts
•
Prize winnings
•
Account verification requests
•
Security alerts
Warning Signs •
Unexpected messages
•
Shortened links
•
Requests for personal information
•
Urgent deadlines
Best Practices •
Do not click unexpected links.
•
Verify messages through official channels.
•
Report suspicious messages.
•
Delete scam texts after reporting.
Real-World Example A text claims you have an undelivered package and asks you to pay a small fee. The payment website is fraudulent and designed to capture credit card information.
5. Impersonation & Business Email Compromise What Is MFA nation? Impersonation occurs when attackers pretend to be someone you trust, such as: •
Executives
•
Vendors
•
Coworkers
•
IT staff
•
Financial institutions
Business Email Compromise (BEC) BEC attacks are targeted scams that attempt to convince employees to: •
Transfer money
•
Purchase gift cards
•
Change banking information
•
Share confidential data
Best Practices
•
Verify unusual requests through another communication channel.
•
Review email addresses carefully.
•
Do not rely solely on a display name.
•
Be cautious of requests involving urgency or secrecy.
Real-World Example An employee receives an email appearing to be from the CEO requesting gift cards for a special event. The sender's address differs slightly from the real address. Key Principle Trust should never replace verification.
6. Social Engineering Understanding Human Manipulation Social engineering is the practice of manipulating people into revealing information or performing actions that compromise security. Unlike technical attacks, social engineering exploits human emotions such as: •
Trust
•
Fear
•
Urgency
•
Curiosity
•
Helpfulness
Common Social Engineering Tactics Pretexting Creating a believable story to gain information. Phishing Using fraudulent communications to obtain sensitive data. Impersonation Pretending to be a trusted individual.
Tailgating Gaining access to secure areas by following authorized individuals. Best Practices •
Verify identities before sharing information.
•
Challenge unfamiliar visitors politely.
•
Never share credentials.
•
Follow access control procedures.
Real-World Example Someone calls claiming to be from IT Support and asks for your password to troubleshoot an issue. Legitimate IT staff should never require your password.
7. Physical & Device Security Why Device Security Matters Devices often contain confidential information that can be exposed if lost, stolen, or left unattended. Best Practices •
Lock your screen whenever you step away.
•
Protect laptops and mobile devices during travel.
•
Store devices securely.
•
Report lost or stolen devices immediately.
•
Avoid sharing corporate devices.
Working in Public When working in airports, coffee shops, or public areas: •
Be aware of people looking over your shoulder.
•
Secure devices when not in use.
•
Avoid discussing confidential information in public spaces.
Real-World Example
An unattended laptop in a conference room provides an opportunity for someone to access company data.
8. Software Updates & Vulnerability Management Why Updates Matter Software vulnerabilities are weaknesses that attackers can exploit. Updates and patches often contain security fixes that protect systems from newly discovered threats. Best Practices •
Install updates promptly.
•
Restart devices when required.
•
Avoid postponing security updates indefinitely.
•
Keep browsers and applications current.
Real-World Example Many ransomware attacks target organizations that failed to apply available security patches. Key Principle Known vulnerabilities are often the easiest for attackers to exploit.
9. Ransomware What Is Ransomware? Ransomware is malicious software that encrypts files and demands payment to restore access. Common Infection Methods •
Malicious attachments
•
Phishing links
•
Unpatched software
•
Compromised credentials
Warning Signs •
Files becoming inaccessible
•
Unusual file extensions
•
Ransom notes appearing on screen
•
Sudden inability to access systems
What To Do •
Disconnect from networks if instructed by IT.
•
Report immediately.
•
Do not attempt to negotiate with attackers.
•
Follow incident response procedures.
Key Principle Early reporting can significantly reduce damage.
10. Emerging Threats QR Code Phishing (Quishing) Attackers use QR codes to direct users to malicious websites. Best Practices •
Verify the source of QR codes.
•
Check website URLs after scanning.
•
Avoid entering credentials without confirming legitimacy.
Example A flyer contains a QR code claiming to provide access to a benefits portal but instead directs users to a fake login page.
AI-Generated Cyber Attacks
Artificial intelligence allows attackers to create increasingly convincing scams. How Attackers Use AI •
Personalized phishing emails
•
Realistic fake messages
•
Automated scams
•
Enhanced impersonation attacks
What This Means for Employees Grammar and spelling are no longer reliable indicators of legitimacy. Always verify: •
Who is making the request
•
What information is being requested
•
Whether the request is expected
What To Do if You Think You've Made a Mistake If you: •
Click a suspicious link
•
Open a suspicious attachment
•
Enter your password on an unfamiliar site
•
Approve an MFA request accidentally
•
Send information to the wrong person
Immediately 1. Stop what you're doing. 2. Report the incident to IT/Security. 3. Provide as much information as possible. 4. Follow guidance provided by IT. Remember
Reporting quickly is far more important than avoiding embarrassment. Many successful security incidents are contained because employees report mistakes immediately.
The Crosby Scholars Cybersecurity Mindset Before responding to any email, text, phone call, QR code, attachment, or request, ask yourself: Is this expected? Do I recognize the sender? Can I verify this request another way? Does this create urgency or pressure? Am I being asked for sensitive information? Golden Rule Verify Before You Trust. This single principle helps protect against phishing, smishing, impersonation attacks, ransomware, business email compromise, social engineering, and many emerging cyber threats.