Which of the following is an example of an effective practice to enhance end-user cybersecurity awareness?

An effective cybersecurity awareness program relies on continuous reinforcement to be successful. Sending monthly newsletters is a method of ongoing communication that keeps security top-of-mind for employees. This approach provides timely updates on new threats, reinforces best practices, and offers actionable prevention tips relevant to current events. Unlike a one-time event, this sustained engagement helps to build a lasting security-conscious culture. Regular, digestible updates are more effective at influencing long-term user behavior than infrequent, intensive training sessions or impractical memorization tasks.

A. One-time training is ineffective because knowledge retention declines over time, and it fails to address the constantly evolving threat landscape.
C. Memorizing specific malware names is impractical and does not teach the underlying principles needed to recognize and avoid various types of threats.
D. Training without deadlines lacks the necessary structure and accountability, leading to procrastination and low completion rates, thus undermining the program's effectiveness.

1. National Institute of Standards and Technology (NIST) Special Publication 800-50, Building an Information Technology Security Awareness and Training Program. Section 4.3, "Awareness," explicitly states that awareness is a continuous process and suggests using tools like "newsletters, posters, and logon screen messages" to reinforce security principles. This supports the idea of regular communication over one-time events.

2. Wilson, M., & Hash, J. (2003). Building an Information Technology Security Awareness and Training Program (NIST SP 800-50). National Institute of Standards and Technology. Page 13, Section 4.3 discusses using various methods for reinforcement, stating, "Awareness is not a one-time event; it needs to be reinforced."

3. University of California, Berkeley, Information Security Office. Security Awareness & Training. The university's official guidance emphasizes that "Security awareness is a continuous process." It outlines a program that includes ongoing activities like newsletters and phishing simulations, directly contrasting with the ineffectiveness of a single, initial training session.

4. Al-Shehri, S., & Al-Alawi, A. (2018). The Impact of Information Security Awareness on Employees’ Behavior: A Case Study of a University in Saudi Arabia. International Journal of Computer Science and Network Security, 18(1), 1-10. This study highlights that "continuous awareness programs are more effective than one-time training sessions" (p. 8) in changing employee behavior and fostering a security-positive culture.