Award in Cyber Security Awareness — The Learning Machine Essential Digital Skills Digital Skills & IT Revision
This element introduces learners to the fundamentals of cyber security awareness, focusing on identifying common threats such as phishing, malware, and soc
Topic Synopsis
This element introduces learners to the fundamentals of cyber security awareness, focusing on identifying common threats such as phishing, malware, and social engineering, and their potential impacts on individuals and organisations. It emphasises the crucial role of personal behaviour in safeguarding digital assets and provides practical guidance on implementing safe cyber practices in daily work. Learners will also gain understanding of the proper procedures for promptly reporting suspected cyber incidents to mitigate damage.
Key Concepts & Core Principles
- Phishing: A type of cyber attack where attackers send fraudulent messages (often via email) to trick recipients into revealing sensitive information like passwords or credit card details. Always check the sender's address and avoid clicking on suspicious links.
- Malware: Malicious software designed to damage or gain unauthorised access to a computer system. Examples include viruses, worms, and ransomware. Use antivirus software and keep it updated to protect against malware.
- Social Engineering: Manipulating people into divulging confidential information or performing actions that compromise security. This can happen over the phone, in person, or online. Be cautious of unsolicited requests for personal information.
- Strong Passwords: A combination of uppercase and lowercase letters, numbers, and special characters that is difficult for others to guess. Use different passwords for different accounts and consider using a password manager.
- Data Protection: The legal and ethical obligation to keep personal information secure. In the UK, the Data Protection Act 2018 governs how personal data should be handled, including obtaining consent and ensuring data is stored securely.
Exam Tips & Revision Strategies
- In assessments, always relate your answers to real-world scenarios; use examples from common workplace situations to demonstrate understanding.
- When explaining how to raise an incident, ensure you mention the specific protocols: who to contact first (e.g., IT support, line manager), what information to provide (time, nature, potential cause), and why prompt reporting matters.
- For questions on safe practices, don't just list rules—explain the reasoning behind each practice to show deeper comprehension.
Common Misconceptions & Mistakes to Avoid
- Confusing different types of social engineering, such as mixing up phishing with vishing or smishing.
- Underestimating the impact of personal actions, thinking that only large-scale attacks are threats, ignoring everyday risky behaviours.
- Failing to recognise that reporting an incident immediately is critical; delaying or trying to fix it themselves before notifying proper authorities.
Examiner Marking Points
- Demonstrate understanding of common cybersecurity threats, including social engineering, by accurately describing at least two threat types and their potential impacts on individuals and organisations.
- Provide concrete examples of how personal actions, such as using weak passwords or falling for phishing scams, can expose organisational systems to risk.
- Show evidence of applying basic safe cyber practices, such as verifying email senders and not sharing credentials, and describe the appropriate steps to raise a suspected cyber incident promptly.