What you'll learn
- Why you are part of security
- Handling information safely
- Passwords, MFA and your accounts
- Working remotely and travelling
- Using AI tools at work
- Reporting incidents
Lessons
1Why you are part of security
Most breaches start with a person, not a firewall: a convincing email, a reused password, a file shared with the wrong group. Attackers target busy people because one click can open the door to the whole organisation.
Your three habits that stop most attacks: pause before acting on urgent requests, verify through a channel you already trust, and report anything odd straight away. Reporting a mistake quickly is always better than hiding it.
2Handling information safely
- Check the classification label before sharing: Public, Internal, Confidential or Restricted.
- Share files with named people, not "anyone with the link".
- Never send customer or employee personal data to personal email or chat apps.
- Lock your screen (Win+L / Ctrl+Cmd+Q) every time you step away; keep a clear desk.
- Shred printed confidential documents; don't leave them on printers.
Under India's DPDP Act, mishandled personal data can mean penalties of up to ₹250 crore for the organisation.
3Passwords, MFA and your accounts
Use a password manager and a different password for every account. Turn on MFA everywhere, and prefer passkeys or an authenticator app over SMS.
If you get MFA prompts you didn't start, deny them and report: someone has your password. Never share one-time codes with anyone, including people claiming to be IT support.
4Working remotely and travelling
- Use the company VPN or ZTNA on public Wi-Fi; avoid sensitive work on shared computers.
- Use a privacy screen in public places and don't take calls about confidential matters where others can hear.
- Keep devices with you while travelling; report loss or theft immediately so IT can wipe them.
- Only plug in USB devices you trust; never use "found" drives.
5Using AI tools at work
Generative AI is useful, but anything you paste into an unapproved tool may be stored or used for training. Use only company-approved AI tools, never paste confidential, customer or personal data into public chatbots, and always review AI output before you rely on it: it can be wrong or invented.
Watch for deepfake voice or video calls asking for payments or passwords. Verify by calling back on a known number.
6Reporting incidents
Report suspected phishing with the Report button, and report lost devices, wrong-recipient emails, strange account activity or suspicious visitors to the security team at once. In India, CERT-In requires many incidents to be reported within 6 hours, so your speed matters.
No one is punished for reporting honestly. The only bad report is the one that never gets made.
Hands-on lab: Personal security hygiene check (15 minutes)
- Install or open your password manager and find your three most-reused passwords.
- Change one of them to a unique generated passphrase (try Tools → Password Generator).
- Turn on MFA for your work email and one personal account.
- Find the Report Phishing button in your mail client.
- Lock your screen with the keyboard shortcut and set auto-lock to 5 minutes or less.
Outcome: Five habits in place that block the most common attacks against employees.
Practice questions
You receive an urgent email from the 'CFO' asking you to change a supplier's bank details today. First step?
Answer: Verify by calling the CFO on a known number. Verify out-of-band; replying goes to the attacker.
Which is the safest way to share a confidential file with a client?
Answer: Share with the client's named account and set expiry. Named access with expiry limits exposure.
You get MFA prompts you didn't trigger. What does it mean?
Answer: Someone has your password. Deny, report and change your password.
The full graded assessment (7 questions, pass mark 70%) is in the platform.
Key terms
- Security awareness
- Training that helps people recognise and avoid threats and report incidents.
- Clear desk policy
- Keeping papers and devices secured when unattended.
- Information classification
- Labels (Public, Internal, Confidential, Restricted) that tell you how to handle data.
- Shadow AI
- Using unapproved AI tools at work, risking data leakage.
- Deepfake
- AI-generated fake audio or video used to impersonate real people.
- Incident reporting
- Telling the security team quickly about anything suspicious or any mistake.
- Password manager
- An app that creates and stores unique passwords for every account.
- Privacy screen
- A filter that stops people nearby reading your screen.
See the full cyber security glossary →
Official references
Related courses
Social Engineering & Security Awareness
How people are manipulated, how to spot it, and how to build a security culture that works.
Cyber Safety for Students
Age-appropriate online safety: strong passwords, spotting scams, privacy, kindness online and where to get help.