Lesson 12 of 12

People, phishing and incident response

The strongest firewall won't help if an employee clicks a link and types a password. Attackers exploit people through social engineering: urgency, fear, curiosity, and pretending to be the boss or the bank.

This is a training email from a made-up bank. Tap everything that looks suspicious:

From: Najma Bank Support

Subject: Urgent: your account will be suspended

We noticed unusual activity on your account.

To confirm, click here:

Regards, the Security Team

Found 0 of 5 signs

And if an incident does happen? Well-run companies follow an incident response plan. The classic NIST cycle:

In 2025 NIST updated its guide (SP 800-61 Revision 3) and tied it to the Cybersecurity Framework 2.0 and its six functions: Govern, Identify, Protect, Detect, Respond, Recover. Same idea: preparing before an incident matters more than reacting after it.

Watch outFirst rule when you suspect a compromised device: disconnect it from the network and report it to IT right away. Don't switch it off or delete anything, because the evidence helps the investigation.

Where can this track take you? Network administrator, security engineer, SOC analyst, or IT audit and GRC. These are the most popular certifications to start with:

The cybersecurity specialist career →