Security Awareness

Protecting your PBR account — recognising phishing emails, completing security training, and staying safe online.

Recognising and Reporting Phishing Emails

Overview

Phishing emails are fraudulent messages designed to trick you into clicking malicious links, downloading harmful files, or revealing your password. They are the most common way attackers gain access to an organisation's systems.

At PBR, we also conduct simulated phishing exercises through Phriendly Phishing — these look like real phishing emails and are designed to test your awareness. Treat every suspicious email the same way, whether it is real or a simulation.

Warning Signs of a Phishing Email

Warning signWhat to look for
Unexpected urgency"Your account will be closed in 24 hours", "Immediate action required"
Suspicious sender addressThe display name looks legitimate but the actual email address is odd (e.g. support@pbr-helpdesk.net instead of @pbr.org.au)
Generic greeting"Dear Customer" or "Dear User" instead of your name
Unexpected attachmentsYou weren't expecting a file, especially .zip, .exe, or Office files asking you to enable macros
Suspicious linksHover over a link before clicking — the URL shown at the bottom of your screen doesn't match where the link claims to go
Requests for credentialsPBR IT will never ask for your password via email
Too good to be truePrize notifications, unexpected refunds, gift card requests from "management"

What To Do If You Receive a Suspicious Email

  1. Do not click any links or open any attachments
  2. Do not reply to the email or provide any information
  3. Report it to IT using the Report Phishing button in Outlook (see below)
  4. If you accidentally clicked a link or entered your credentials, contact IT Helpdesk immediately at helpdesk@pbr.org.au

How to Report a Phishing Email in Outlook

Outlook Desktop (Windows)

  1. Select the suspicious email in your inbox (do not open it)
  2. In the ribbon at the top, look for the Report Phishing Email button (it may be under the "..." more options menu)
  3. Click it — a confirmation dialog will appear
  4. Click Report

Outlook on the Web (Browser)

  1. Open the suspicious email
  2. Click the three dots (...) menu at the top right of the email
  3. Select Report then Report phishing

If You Cannot Find the Report Button

Forward the email to helpdesk@pbr.org.au with a brief note that you believe it is a phishing attempt.

About Phriendly Phishing Simulations

PBR uses Phriendly Phishing to periodically send simulated phishing emails to staff. These are safe — they do not contain real malware — but they look convincing on purpose.

If you click a link in a simulation, you will be redirected to a short awareness page explaining what to look for. This is not a punishment — it is a learning opportunity.

The best response to any phishing simulation is to report it using the Report Phishing button in Outlook, just as you would a real one.

Accessing Your Security Awareness Training (Phriendly Phishing)

Overview

PBR uses Phriendly Phishing as its security awareness training platform. You may be assigned training modules periodically — you will receive an email notification when a module is assigned to you.

Completing assigned training is mandatory for all staff.

Accessing Training via the Email Link

  1. Open the training notification email sent to your PBR inbox
  2. Click the link in the email to open the Learner Hub
  3. Sign in with your PBR email address and password if prompted
  4. You may be asked to approve an MFA prompt on your Microsoft Authenticator app
  5. Your assigned training modules will be listed — click Start Course to begin

Accessing Training via the Learner Hub Directly

  1. Open a browser and go to https://learnerhub.phriendlyphishing.com/login
  2. Enter your PBR email address and click Next
  3. Sign in with your Microsoft 365 credentials if prompted
  4. Your assigned modules will appear under Assigned Learning

Managers — Viewing Your Team's Training Progress

  1. Log into the Learner Hub as above
  2. If you manage staff, you will see a Team View button in the top right — click it
  3. Click Course Results to see who has completed or has outstanding training
  4. You can filter by person's name or training status (complete, incomplete, failed)
  5. Managers can view up to four levels of staff below them

If a staff member you manage is not visible in your Team View, contact IT Helpdesk — their reporting line may need to be updated.

Need Help?

Contact IT Helpdesk at helpdesk@pbr.org.au

Keeping Your Account Secure

Overview

Your PBR account gives access to email, files, financial systems, and customer data. Keeping it secure is your responsibility — and one of the most important things you can do to protect PBR.

Strong Passwords

Multi-Factor Authentication (MFA)

MFA adds a second layer of security to your account. Always approve MFA prompts yourself — if you receive a prompt you did not initiate, deny it immediately and contact IT Helpdesk, as someone may be attempting to access your account.

See: Multi-Factor Authentication (MFA)

Lock Your Screen

Always lock your screen when stepping away from your computer — even briefly.

If You Think Your Account Has Been Compromised

Contact IT Helpdesk immediately if you:

The faster we know, the less damage can be done. There is no shame in reporting — acting quickly is what matters.

IT Helpdesk: helpdesk@pbr.org.au

Approved Devices Only

Only access PBR systems on PBR-issued or IT-approved devices. Do not log into PBR systems on personal computers at internet cafes, libraries, or shared kiosk devices.

Ditch the Password, Own the Passphrase

Overview

Passwords are dying — not because they stopped working, but because computers got terrifyingly good at guessing them. This page explains why PBR is moving to passphrases, what the Australian Cyber Security Centre (ACSC) actually recommends, and how to build one in under a minute.

Stop using Winter2026!. Start using four random words strung together, like correct horse battery staple. Longer beats clever, every time.

The Maths Is Not on Your Side

Modern cracking rigs can attempt billions of password guesses per second. Short "complex" passwords — the classic capital-letter-number-symbol combo — fall fast because they're short, even with the symbols thrown in. Length, not complexity, is what actually slows an attacker down.

Credential Length Approx. time to crack*
Winter26! 9 characters Minutes to hours
Tr0ub4dor&3 11 characters A few days
correct horse battery staple 28 characters Centuries+

*Illustrative only — actual crack times depend on hashing method and attacker resources, but the pattern holds: length wins.

Password vs Passphrase — What's the Difference?

  Password Passphrase
Structure Short string, mixed characters Several random words, spaces allowed
Example P@ssw0rd1 purple duck potato boat
Easy to remember? Not really Yes
Easy to crack? Yes No, if genuinely random

What the ACSC Actually Says

This isn't a PBR opinion — it's straight from Australia's national cyber security authority (ACSC, part of the Australian Signals Directorate) and the Information Security Manual (ISM):

Further reading: cyber.gov.au – Set secure passphrases

Building a Good One in 60 Seconds

  1. Pick four (or more) words that have nothing to do with each other. Think of the most random things you can — an animal, an object, a colour, a place.
  2. Don't pull them from a well-known quote, lyric, or saying.
  3. String them together with spaces, hyphens, or just jam them together: tractor lemon violin harbour.
  4. Optional: swap a letter for a number or add a symbol somewhere if the system requires it — but don't rely on this for strength, the word count is doing the heavy lifting.
  5. Never reuse it anywhere else, and store it in 1Password rather than memory or a sticky note.

✅ Good Examples

❌ Weak Examples (Avoid These)

Quick Reference Card

Rule Guidance
Minimum length 14–15+ characters
Word count 4 or more random words
Reuse Never — unique per account
Storage 1Password only — not memory, not sticky notes, not a text file
When to change it On suspected compromise — not just because a calendar says so
MFA Always enable where available

Sources