Every control in this module assumes the attacker has to break something technical. Most intrusions don't bother — they ask a person, or they walk up to the console port. This chapter covers the human and physical half of security: awareness training, physical access control, modern password policy, multi-factor authentication, certificates, and biometrics.
Port security, ACLs, IPsec, WPA3 — every control in this module assumes an attacker has to defeat something technical. A large share of real intrusions never try. They send a convincing email and let an employee open the door from the inside, where no firewall rule applies.
That matters for how you choose controls. A control only works where the failure actually happens. If someone was persuaded to type their password into a look-alike page, the failure was in judgement and process — so the control has to be training and procedure, not another ACL.
| Metric | What it tells you | Healthy direction |
|---|---|---|
| Click rate | How persuadable the population is right now | Down over time |
| Report rate | How many people actively raise the alarm | Up — this is the one that shortens a real incident |
| Median time-to-report |
5 more sections in this chapter, plus a 5-question quiz.
You can see the title, summary, and learning objectives. To read the chapter, build the labs, and chat with ARIA, create a free account — Module 1 is fully readable on the free plan.
NetForge-AI is an independent educational platform and is not affiliated with, endorsed by, or sponsored by any networking vendor or certification body. All product names, protocols, and standards referenced are the property of their respective owners and are used for descriptive, educational purposes only.
| How quickly the security team learns a campaign is live |
| Down, ideally to minutes |
| Repeat clickers | Who needs targeted coaching rather than another slide deck | Down, tracked per person, handled privately |
Free account · no card required · upgrade to Pro any time