Security Fundamentals // Lesson 02

Security Programs.

Describe how awareness, training, policy and physical access control reduce human and environmental risk.

AwarenessTrainingPolicyPhysical accessIncident reporting
01 // Mental model

Start with the big picture.

Regular reminders help users recognise phishing, unsafe handling and suspicious behaviour.

CCNA focus: Technology cannot compensate for every process or physical failure. Treat people, policy, facilities and technical controls as one security system.
02 // Building blocks

Know what each part does.

01

Awareness

Regular reminders help users recognise phishing, unsafe handling and suspicious behaviour.

02

Training

Role-specific practice teaches people how to perform security-sensitive tasks correctly.

03

Policy

Defines expected behaviour, ownership, exceptions and consequences.

04

Physical control

Locks, badges, guards, cameras and environmental systems protect facilities and equipment.

03 // Compare and recognise

Read the clues.

ItemWhat to remember
Awareness campaignBroad, recurring and behaviour-focused.
Administrator trainingDeep, role-specific and skills-focused.
Tailgating preventionBadges, mantraps, guards and a challenge culture.
Clean desk/media handlingReduces exposure of printed, removable and unattended sensitive data.
04 // Program cycle

Program cycle.

1. Identify risks and required behaviours
2. Publish clear policy and ownership
3. Train users and privileged roles
4. Exercise phishing and incident reporting
5. Measure outcomes and investigate patterns
6. Improve controls and repeat

Read the example from top to bottom, then verify the resulting state. Configuration is only complete when the output matches the intended design.

05 // Exam and troubleshooting

Turn facts into a method.

  • Broad, recurring and behaviour-focused.
  • Deep, role-specific and skills-focused.
  • Badges, mantraps, guards and a challenge culture.
  • Reduces exposure of printed, removable and unattended sensitive data.
Exam checkpoint: Technology cannot compensate for every process or physical failure. Treat people, policy, facilities and technical controls as one security system.
06 // Check yourself

Security Programs quiz.

1. What is the main difference between awareness and role training?

2. Which control directly reduces tailgating risk?

3. What should a useful security policy include?

4. Why run phishing simulations?

5. Who owns security outcomes?

Score: 0 / 5