After a number of highly publicized and embarrassing customer data leaks as a result of social engineering attacks by phone, the Chief Information Officer (CIO) has decided user training will reduce…

Social engineering attacks exploit human psychology rather than technical vulnerabilities. Information Security Awareness training specifically teaches employees to recognize social engineering tactics (pretexting, vishing, impersonation), understand verification procedures before disclosing sensitive data, and follow proper protocols when receiving unsolicited phone requests - directly targeting and reducing the risk vector responsible for the data leaks.

Social Media and BYOD training addresses risks related to personal devices and social media usage, which is not directly relevant to phone-based social engineering attacks on customer data.

Data Handling and Disposal training covers proper management of physical and digital data assets, not the recognition and resistance of social engineering manipulation by phone.

Acceptable Use of IT Systems training defines proper use of company technology resources and does not address the human behavioral factors exploited in social engineering phone attacks.