Which security practice is most likely to reduce worm infections?

Encryption protects data confidentiality in transit or at rest but does not prevent malicious code from executing on a host.

Many worms propagate through user-initiated actions such as opening malicious email attachments, clicking deceptive links, or running infected removable media. Security awareness training directly addresses these human-layer vectors by teaching users to recognize social engineering and suspicious content, thereby preventing the initial foothold that allows a worm to spread.

Administrative privilege controls limit damage after infection but do not prevent a worm from initially entering the environment through a user action.

Device inventory helps track assets and identify unauthorized devices but does not directly prevent worm propagation.

Patching closes known vulnerabilities exploited by worms but does not address user-driven infection vectors such as opening malicious attachments.