Certificate Topics — Cybersecurity at Work (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Adult Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Adult track Certificate behind this topic: "Cybersecurity at Work" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 30, 2025) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911.

Before you start

• This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• Most workplace incidents do not begin in a server room. They begin at a regular desk, with a regular person, on a regular Tuesday. This unit is written for that person — which is to say, for you.
• Your employer's own policies always govern your workplace. This unit teaches the widely shared practice underneath those policies, so you can follow yours with understanding instead of by rote.

The lesson

Part 1. The Employee's Share of Security

Organisations buy firewalls, monitoring, and response teams — and still, the deciding moment in most incidents is an employee's ordinary choice: to open or report an attachment, to reuse or resist a password, to mention or ignore something odd. That is not a criticism of employees; it is the design of the attacks. Phishing, payment fraud, and social engineering are aimed at desks, not data centres, because desks hold the keys, the payments, and the trust.

Part 2. Clean Desk, Locked Screen — the Physical Basics

Information leaks off paper and glowing screens as reliably as from any network. A clean desk practice means sensitive papers — client files, payroll sheets, passwords on sticky notes (the classic, still found everywhere) — are locked away when you step away and shredded, not binned, when finished. Printouts are collected from shared printers promptly; a surprising amount of real-world exposure happens in output trays, read by whoever passes next. Visitors are signed in, escorted, and never left alone among other people's information.

Lock your screen every time you leave it — every time, however short the absence, however trusted the room. Make it a reflex tied to standing up, and use the keyboard shortcut until it is one. An unlocked screen is an open, signed-in session with your access and your name on its actions; “I was only gone a minute” is also how long misuse takes. The same principle travels: position screens so passers-by and windows cannot read them, be thoughtful about sensitive work in public places, and treat a colleague's unlocked screen as a thing you lock for them, kindly, rather than a joke opportunity.

Part 3. Handling Other People's Data With Care

At work you hold information that is not yours: customers' names, addresses, payment details, health and family circumstances; coworkers' personal data; the organisation's own plans and finances. Care has a practical grammar. Collect and keep the minimum: if your task does not need it, do not copy it, download it, or carry it home “just in case.” Use approved places: records live in the organisation's systems, not in personal email, personal cloud drives, or a USB stick in a coat pocket — those copies escape every protection and every deletion rule the organisation promises its customers. Send with a second look: most “data breaches” by insiders are accidents of addressing — the wrong recipient, the autocomplete trap, the reply-all. Before sending anything sensitive, pause on the recipient line and the attachment name; that two-second check prevents a category of incident that no software can. Respect retention and disposal: keep records for the period your policy sets, then destroy them the approved way. And when a customer or coworker trusts you with something verbally — a circumstance, a diagnosis, a difficulty — carry it only to the people whose work genuinely requires it. Discretion is a security control, and it is also simply professional dignity in practice.

Part 4. The Phishing Email That Targets Money — Business Email Compromise at Your Desk

The workplace-specific phishing you must know is business email compromise (BEC) and its invoice cousins. Patterns: a message appearing to be from a senior leader asks you — with urgency and confidentiality — to change a supplier's bank details, pay an invoice outside the usual process, buy gift cards, or send payroll or tax documents. A genuine supplier's account may actually be compromised, making thread and history real; or a look-alike domain carries the whole deception. The amounts are chosen to hurt, and the timing is chosen for Fridays, holidays, and staff absences, when verification feels hardest.

The defence is procedural and it protects you as much as the organisation: money instructions that arrive by email get verified by voice, through a number already on file, before payment — no exceptions for rank, urgency, or “the director asked me not to bother anyone.” New or changed bank details for any payee are treated as guilty until that call proves them innocent. If you handle payroll, invoices, or tax documents, assume you are personally on a target list, because attackers build those lists from public staff pages and professional profiles. And know this in advance: following the verification procedure and being wrong costs a ten-minute delay; skipping it and being wrong can cost your organisation its quarter and you your peace for a year. No legitimate executive punishes the check. If yours would, that is information about the executive, not about the procedure.

Part 5. Remote and Hybrid Work — the Office Is Where You Are

Remote work moved the office network into kitchens and cafés, and the security boundary moved with it. The core practices travel well. Your home router is now office infrastructure: keep its software updated, change its default password, and use a strong Wi-Fi password — the IoT unit's lessons apply to your employer's data too. Separate work and personal where you can: use the work device for work, keep family members — however beloved and trustworthy — off it, and do not move work files into personal accounts “to finish tonight.” Public Wi-Fi in cafés and airports is a shared, untrusted network: prefer your phone's own connection or hotspot for sensitive work, use your organisation's VPN if one is provided (it encrypts the road between you and the office), and be aware of who can see your screen and overhear your calls. A customer conversation at full volume in a coffee shop is a disclosure, not an ambience. Video calls deserve the same care as documents: know what is on the screen and behind you before you share, and treat meeting links and recordings as work records, not social posts. The principle underneath all of it: the data's sensitivity does not change with your location, so your care cannot either.

Part 6. The First Minutes When Something Looks Wrong — and Reporting Without Shame

Something will, one day, look wrong on your watch: you clicked a link and the page felt off; a payment you processed now seems strange; a file went to a recipient it should not have; a caller knew too much. What you do in the first minutes decides how large the story becomes. Stop the action if you can — do not send the second payment, do not delete the evidence, do not “fix it quietly.” Note what happened while it is fresh: times, addresses, amounts, what you clicked or sent. Report immediately through your organisation's channel — IT, security, your manager — with those facts, plainly. Speed is worth more than completeness; a rough report in minute five beats a polished one on Friday.

Words to know — Cybersecurity at Work

• Clean desk — the practice of locking away sensitive papers and devices whenever you step away, and shredding what is finished.
• Screen locking — securing a signed-in device the moment you leave it, so your access cannot be used under your name.
• Business email compromise (BEC) — impersonation of, or intrusion into, a business account to redirect payments or extract documents.
• Data minimisation — collecting, copying, and keeping only the information a task genuinely requires.
• Retention — how long a record must be kept before approved destruction; both keeping too long and destroying too early can be violations.
• VPN (virtual private network) — an encrypted connection between your device and your organisation's network across an untrusted network.
• BYOD — “bring your own device”: using personal phones or computers for work, under an employer's policy and safeguards.
• Incident report — the prompt, factual notice to IT or security that something may be wrong — the act that starts help.
• Look-alike domain — a sender address crafted to resemble your organisation's or a supplier's real domain.
• Escalation — passing a suspicious matter upward, quickly and with facts, to the people equipped to act on it.

Myths vs facts — Cybersecurity at Work

• Myth: IT and security software handle workplace security; my habits are a small extra. Fact: Attacks are aimed at desks. Your verification, handling, and reporting decisions are where most incidents are decided.
• Myth: Locking my screen in a trusted office is insulting to my coworkers. Fact: It protects you — everything done on your unlocked session carries your name — and it protects colleagues from suspicion if anything ever happens.
• Myth: An urgent payment request from a senior leader should not be questioned. Fact: Verification by voice, on a known number, is the professional standard BEC defences rely on — and legitimate leaders expect it.
• Myth: If I report a click, I will be in more trouble than if I stay quiet. Fact: Quiet is what lets incidents grow. Organisations punish concealment; honest, immediate reporting is what responders ask for by name.
• Myth: Working from home relaxes the rules because I am in my own space. Fact: The data's sensitivity does not change with location. Router, device, and disclosure care travel with the work.

Think it through — Cybersecurity at Work

On a Friday at 4:40 p.m., Priya, who processes supplier payments, receives an email in an existing thread with a regular supplier: “Please update our bank details to the attached before today's run — our old account is being closed in an audit.” The attachment shows new details on the supplier's letterhead. The amount scheduled today is large. Her manager has left; Priya wants the supplier paid on time, as always.

Walk it through: (1) Name the pattern with Part 4: an existing thread and real letterhead make it convincing, but bank-detail changes are the single most abused move in BEC — and Friday late-afternoon timing is chosen precisely because verification feels hardest now. The thread being real may mean the supplier's account is compromised, which changes nothing about the defence. (2) Apply the procedure: payments never move on email instruction alone. Priya calls the supplier's number from the existing contract file, not from the email, and reaches their accounts lead — who knows nothing about any account change and confirms their real details are unchanged. (3) Escalate in the first minutes per Part 6: Priya forwards the message to IT/security with a note of times and the invoice affected, holds today's payment to the long-standing verified details, and documents the call. (4) See what the procedure just bought: the organisation kept its money, the supplier learned their account may be compromised — a gift to them too — and Priya's “delay” becomes the story her manager tells at training. She wanted the supplier paid on time. She also wanted them actually paid. Verification served both.

Try this — Cybersecurity at Work

• ☐ Make screen-locking a standing reflex today: learn your keyboard shortcut and use it every time you stand up
• ☐ Clear your desk and printer habits once: lock sensitive papers, shred what is finished, collect printouts promptly
• ☐ Write down, before you need them, your workplace's incident-report route and your key suppliers' verified phone numbers
• ☐ Review one recent “urgent” request you handled and ask how it would have fared under voice verification on a known number
• ☐ If you work remotely, update your home router, confirm its password is not the default, and check that your work device is for work only

Resources to keep — Cybersecurity at Work

• Cybersecurity and Infrastructure Security Agency (CISA) — cisa.gov — workplace phishing, ransomware, and incident-response guidance for organisations of every size.
• Federal Trade Commission — Cybersecurity for Small Business — ftc.gov — plain-language employer and employee guidance on handling data, phishing, and remote work.
• FBI Internet Crime Complaint Center (IC3) — ic3.gov — reporting business email compromise and other internet crime, with BEC recovery information.
• National Cybersecurity Alliance — staysafeonline.org — employee training habits and reporting-culture resources.

What you earned / what's next — Cybersecurity at Work

✅ Cybersecurity at Work complete (quiz score 80% or higher): You can carry the employee's share of security: a clean desk and locked screen, careful handling of other people's data, voice-verified payments, safe remote work, and a fast, shameless report when something looks wrong.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Cybersecurity at Work

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You have learned that protection lives at ordinary desks, in ordinary moments — and you are now one of the people it lives through. Report fast, verify kindly, and carry other people's trust with care. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• Cybersecurity guidance for organisations and ransomware response — Cybersecurity and Infrastructure Security Agency (cisa.gov) — employee roles, reporting, and incident basics.
• Cybersecurity for Small Business — Federal Trade Commission (ftc.gov) — data handling, phishing, vendor, and remote-work practice.
• Business email compromise reporting and recovery — FBI Internet Crime Complaint Center (ic3.gov) — BEC patterns and reporting routes.
• Employee cybersecurity education resources — National Cybersecurity Alliance (staysafeonline.org) — training and reporting culture.

Course Record — Cybersecurity at Work

• Learning outcomes: On completing this unit, the student can:
• describe the employee's specific share of workplace security and why attacks target desks rather than data centres
• apply clean-desk practice and automatic screen-locking habits, including care with shared printers and visitors
• handle customer and coworker data with minimisation, approved storage, recipient checks, and correct retention and disposal
• recognise business email compromise patterns and verify payment and bank-detail changes by voice on a known number
• practise safe remote and hybrid work: router care, device separation, public Wi-Fi caution, VPN use, and call discretion
• carry out the first-minutes response to a suspected incident and report immediately, factually, and without shame
• Study time: Approximately 1.5 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Adult school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Adult. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).