Key idea

In a modern organization, security is shared between the cloud provider, the organization, IT/security teams, managers, and employees. A provider may secure the cloud infrastructure, but the organization must configure access properly, and employees must use accounts and data safely.

Exam focus

• Employees must protect passwords, devices, and sensitive files.
• IT/security teams define policies, monitoring, response, and controls.
• Managers help make sure teams follow policy and complete training.
• Cloud providers protect the platform, but they do not stop every unsafe user action.

Reader-friendly explanation

Security awareness is the habit of noticing suspicious activity, understanding company rules, and avoiding risky behavior. Accountability means each employee is responsible for how they use company systems and data.

Examples of good behavior

• Complete required security training.
• Report suspicious emails instead of ignoring them.
• Use company-approved storage instead of personal drives.
• Ask before sharing sensitive data with a new tool or vendor.
• Follow clean desk, screen lock, and remote work rules.

Key idea

A strong password is long, unique, and hard to guess. A password manager helps users create and store unique passwords, so they do not reuse the same password across many services. Multifactor authentication, or MFA, adds another check beyond the password.

Exam focus

• Password reuse is risky because one breach can expose many accounts.
• MFA reduces risk when a password is stolen.
• Password managers reduce weak password habits.
• Users should never share passwords or MFA codes.

Reader-friendly explanation

Employees should not paste sensitive data into unapproved AI tools. AI tools may store, process, or expose information depending on the service and company settings. The safe action is to use only approved AI tools and follow the organization’s data policy.

Data you should not share with unapproved AI tools

• Customer records and support conversations.
• Personal data, such as names, addresses, IDs, or contact details.
• Financial data, invoices, payroll, and bank information.
• Source code, API keys, passwords, tokens, and recovery codes.
• Legal documents, contracts, unreleased strategy, and internal reports.

How it works

Phishing can come through email, SMS, chat, social media, or fake login pages. The message usually tries to make the user click a link, open an attachment, approve a login, send money, or share sensitive information.

Common warning signs

• Urgent, threatening, or emotional language.
• Unexpected invoice, file, password reset, or delivery notice.
• Sender address or domain looks slightly wrong.
• Link text looks normal, but the destination is suspicious.
• Attachment type is unexpected or unusual.
• Request for password, MFA code, payment, or confidential file.

Types to know

• Pretexting: attacker creates a fake story, such as pretending to be IT support.
• Baiting: attacker offers something tempting, such as a free download, prize, or file.
• Impersonation: attacker pretends to be a manager, vendor, customer, or coworker.
• Business email compromise: attacker uses or imitates a business email account to request payments or data.

How infection can happen

Malware may enter through infected attachments, fake updates, unsafe downloads, compromised websites, removable devices, or stolen credentials.

Indicators of infection

• Device becomes slow or unstable.
• Unknown apps, pop-ups, or browser redirects appear.
• Files are missing, renamed, encrypted, or locked.
• Security tools are disabled unexpectedly.
• System settings change without user action.

Risks to understand

• Fake Wi-Fi hotspots can trick users into connecting.
• Attackers may try to intercept data on unsafe networks.
• Shared devices can expose company files.
• Shoulder surfing can expose screens in public places.
• Personal cloud storage can leak company data.

Safer behavior

• Use approved secure access methods.
• Avoid sensitive work on unknown networks.
• Lock the device when away.
• Keep devices updated and encrypted if required.

Reader-friendly explanation

An insider threat may be intentional or accidental. It can involve employees, contractors, vendors, or partners. Not every insider threat is malicious. A careless employee can also create risk by sending data to the wrong place.

Possible indicators

• Accessing unusual files or systems without business need.
• Copying large amounts of data unexpectedly.
• Trying to bypass approval or security controls.
• Using personal accounts to move company files.
• Repeated policy violations.

Verification checklist

1. Pause before acting on urgent requests.
2. Check sender address, domain, links, and attachment type.
3. Do not use phone numbers or links inside the suspicious message.
4. Contact the person through a known trusted channel.
5. Report suspicious requests for payments, access, or sensitive data.

Safe practices

• Use screen lock, passcode, or biometric sign-in.
• Keep devices updated with required security patches.
• Use approved apps, browsers, storage, and collaboration tools.
• Do not leave work devices unattended in public places.
• Do not let others use your work account or work device.
• Keep printed sensitive documents away from public view.
• Report lost or stolen devices immediately.

Common sensitive data

• Personal data: names, addresses, IDs, phone numbers, email addresses.
• Financial data: bank details, card data, invoices, payroll, tax records.
• Business confidential data: contracts, strategy, pricing, product plans, internal reports.
• Credentials: passwords, MFA codes, API keys, tokens, recovery codes.
• Customer data: customer records, support details, files, and private communication.

Label examples

• Public: safe to share openly.
• Internal: for employees only.
• Confidential: limited to specific teams or people.
• Highly Confidential: very restricted, often for legal, executive, financial, or sensitive customer data.

Rights management controls

Rights management can restrict who can open, edit, copy, print, download, forward, or share a file. It is useful when sensitive files need strong protection even after they are sent.

Data lifecycle

• Collect: collect only what is needed for a valid business reason.
• Use: use data only for the approved purpose.
• Transfer: send data only through approved secure methods.
• Store: keep data in approved protected locations.
• Retain: keep data only as long as policy requires.
• Destroy: delete or dispose of data safely when it is no longer needed.

Situations that require reporting

• Phishing attempt or suspicious message.
• Lost or stolen work phone, laptop, badge, or storage device.
• Unauthorized access to an account, file, or system.
• Accidental sharing of sensitive information.
• Malware signs or ransomware warning.
• Policy violation involving customer or company data.
• Suspicious payment or access request.

Incident report details

• Date and time of the incident.
• Type of incident, such as phishing, lost device, malware, or data exposure.
• Affected data, account, device, system, or person.
• Evidence, such as screenshots, sender address, file name, or link.
• What action was already taken.
• How urgent or sensitive the situation is.