# Security Awareness Protecting your PBR account — recognising phishing emails, completing security training, and staying safe online. # Recognising and Reporting Phishing Emails ## Overview Phishing emails are fraudulent messages designed to trick you into clicking malicious links, downloading harmful files, or revealing your password. They are the most common way attackers gain access to an organisation's systems. At PBR, we also conduct **simulated phishing exercises** through Phriendly Phishing — these look like real phishing emails and are designed to test your awareness. Treat every suspicious email the same way, whether it is real or a simulation. --- ## Warning Signs of a Phishing Email
Warning signWhat to look for
Unexpected urgency"Your account will be closed in 24 hours", "Immediate action required"
Suspicious sender addressThe display name looks legitimate but the actual email address is odd (e.g. support@pbr-helpdesk.net instead of @pbr.org.au)
Generic greeting"Dear Customer" or "Dear User" instead of your name
Unexpected attachmentsYou weren't expecting a file, especially .zip, .exe, or Office files asking you to enable macros
Suspicious linksHover over a link before clicking — the URL shown at the bottom of your screen doesn't match where the link claims to go
Requests for credentialsPBR IT will never ask for your password via email
Too good to be truePrize notifications, unexpected refunds, gift card requests from "management"
--- ## What To Do If You Receive a Suspicious Email 1. **Do not click** any links or open any attachments 2. **Do not reply** to the email or provide any information 3. **Report it** to IT using the Report Phishing button in Outlook (see below) 4. If you accidentally clicked a link or entered your credentials, **contact IT Helpdesk immediately** at --- ## How to Report a Phishing Email in Outlook ### Outlook Desktop (Windows) 1. Select the suspicious email in your inbox (do not open it) 2. In the ribbon at the top, look for the **Report Phishing Email** button (it may be under the "..." more options menu) 3. Click it — a confirmation dialog will appear 4. Click **Report** ### Outlook on the Web (Browser) 1. Open the suspicious email 2. Click the **three dots (...)** menu at the top right of the email 3. Select **Report** then **Report phishing** ### If You Cannot Find the Report Button Forward the email to with a brief note that you believe it is a phishing attempt. --- ## About Phriendly Phishing Simulations PBR uses **Phriendly Phishing** to periodically send simulated phishing emails to staff. These are safe — they do not contain real malware — but they look convincing on purpose. If you click a link in a simulation, you will be redirected to a short awareness page explaining what to look for. This is not a punishment — it is a learning opportunity. The best response to any phishing simulation is to report it using the Report Phishing button in Outlook, just as you would a real one. # Accessing Your Security Awareness Training (Phriendly Phishing) ## Overview PBR uses **Phriendly Phishing** as its security awareness training platform. You may be assigned training modules periodically — you will receive an email notification when a module is assigned to you. Completing assigned training is mandatory for all staff. --- ## Accessing Training via the Email Link 1. Open the training notification email sent to your PBR inbox 2. Click the link in the email to open the Learner Hub 3. Sign in with your PBR email address and password if prompted 4. You may be asked to approve an MFA prompt on your Microsoft Authenticator app 5. Your assigned training modules will be listed — click **Start Course** to begin --- ## Accessing Training via the Learner Hub Directly 1. Open a browser and go to [https://learnerhub.phriendlyphishing.com/login](https://learnerhub.phriendlyphishing.com/login) 2. Enter your PBR email address and click **Next** 3. Sign in with your Microsoft 365 credentials if prompted 4. Your assigned modules will appear under **Assigned Learning** --- ## Managers — Viewing Your Team's Training Progress 1. Log into the Learner Hub as above 2. If you manage staff, you will see a **Team View** button in the top right — click it 3. Click **Course Results** to see who has completed or has outstanding training 4. You can filter by person's name or training status (complete, incomplete, failed) 5. Managers can view up to four levels of staff below them If a staff member you manage is not visible in your Team View, contact IT Helpdesk — their reporting line may need to be updated. --- ## Need Help? Contact IT Helpdesk at # Keeping Your Account Secure ## Overview Your PBR account gives access to email, files, financial systems, and customer data. Keeping it secure is your responsibility — and one of the most important things you can do to protect PBR. --- ## Strong Passwords - Use a **long passphrase** — three or four random words are more secure than a short complex password (e.g. *correct-horse-battery-staple*) - Never use your PBR password on any other website or service - Never share your password with anyone — including IT staff. IT will never ask for your password --- ## Multi-Factor Authentication (MFA) MFA adds a second layer of security to your account. Always approve MFA prompts yourself — if you receive a prompt you did not initiate, **deny it immediately** and contact IT Helpdesk, as someone may be attempting to access your account. See: [Multi-Factor Authentication (MFA)](https://bookstack.pbr.org.au/books/multi-factor-authentication-mfa) --- ## Lock Your Screen Always lock your screen when stepping away from your computer — even briefly. - **Windows shortcut:** Windows key + L - Your screen will also lock automatically after a period of inactivity --- ## If You Think Your Account Has Been Compromised Contact IT Helpdesk **immediately** if you: - Receive MFA prompts you did not initiate - See emails in your Sent folder you did not send - Cannot log in with your normal password - Accidentally entered your password on a suspicious website - Accidentally clicked a link in a suspicious email The faster we know, the less damage can be done. There is no shame in reporting — acting quickly is what matters. **IT Helpdesk:** --- ## Approved Devices Only Only access PBR systems on PBR-issued or IT-approved devices. Do not log into PBR systems on personal computers at internet cafes, libraries, or shared kiosk devices. # Ditch the Password, Own the Passphrase ## Overview Passwords are dying — not because they stopped working, but because computers got terrifyingly good at guessing them. This page explains why PBR is moving to **passphrases**, what the Australian Cyber Security Centre (ACSC) actually recommends, and how to build one in under a minute.

Stop using `Winter2026!`. Start using four random words strung together, like `correct horse battery staple`. Longer beats clever, every time.

--- ## The Maths Is Not on Your Side Modern cracking rigs can attempt billions of password guesses per second. Short "complex" passwords — the classic capital-letter-number-symbol combo — fall fast because they're short, even with the symbols thrown in. Length, not complexity, is what actually slows an attacker down.
CredentialLengthApprox. time to crack\*
`Winter26!`9 charactersMinutes to hours
`Tr0ub4dor&3`11 charactersA few days
`correct horse battery staple`28 charactersCenturies+
*\*Illustrative only — actual crack times depend on hashing method and attacker resources, but the pattern holds: length wins.* --- ## Password vs Passphrase — What's the Difference?
PasswordPassphrase
StructureShort string, mixed charactersSeveral random words, spaces allowed
Example`P@ssw0rd1``purple duck potato boat`
Easy to remember?Not reallyYes
Easy to crack?YesNo, if genuinely random
--- ## What the ACSC Actually Says This isn't a PBR opinion — it's straight from Australia's national cyber security authority (ACSC, part of the Australian Signals Directorate) and the Information Security Manual (ISM): - **Go long:** aim for a passphrase of **4 or more random, unrelated words** totalling **at least 14–15 characters**. - **Random beats meaningful:** the words should have no logical connection to each other and no connection to you (no pet names, birthdays, football teams). - **Skip the sentences:** a grammatically correct sentence, a movie quote, or a song lyric is easier to guess than it feels — attackers use these exact sources as cracking dictionaries. - **Don't force frequent changes:** the ACSC now recommends **against** mandatory periodic password resets (e.g. every 30 or 90 days) purely for the sake of it, because it pushes people toward small, predictable tweaks (`Summer2025!` → `Summer2026!`). Change your credential when you suspect it's been compromised, not on a fixed calendar. - **Use MFA wherever it's offered** — a great passphrase is still stronger with a second factor behind it. Further reading: [cyber.gov.au – Set secure passphrases](https://www.cyber.gov.au/learn-basics/explore-basics/passphrases) --- ## Building a Good One in 60 Seconds 1. Pick **four (or more) words** that have nothing to do with each other. Think of the most random things you can — an animal, an object, a colour, a place. 2. **Don't** pull them from a well-known quote, lyric, or saying. 3. String them together with spaces, hyphens, or just jam them together: `tractor lemon violin harbour`. 4. Optional: swap a letter for a number or add a symbol somewhere if the system requires it — but don't rely on this for strength, the word count is doing the heavy lifting. 5. Never reuse it anywhere else, and store it in **1Password** rather than memory or a sticky note. ### ✅ Good Examples - `giraffe pixel thunder mango` - `orbit-cactus-ferry-42` - `quiet volcano bicycle jelly` ### ❌ Weak Examples (Avoid These) - `Password123!` — short, predictable pattern - `IloveMyDogRex2026` — personal info, guessable structure - `tobeornottobe` — a real, well-known quote - `correct horse battery staple` — great as a teaching example, but now so famous it's in every cracking dictionary on earth. Use the idea, not this exact phrase! --- ## Quick Reference Card
RuleGuidance
Minimum length14–15+ characters
Word count4 or more random words
ReuseNever — unique per account
Storage1Password only — not memory, not sticky notes, not a text file
When to change itOn suspected compromise — not just because a calendar says so
MFAAlways enable where available
--- ## Related Pages - [Keeping Your Account Secure](https://bookstack.pbr.org.au/books/security-awareness/page/keeping-your-account-secure) - [How To Use 1Password](https://bookstack.pbr.org.au/books/passwords/page/how-to-use-1password) --- ## Sources - Australian Cyber Security Centre – [Set secure passphrases](https://www.cyber.gov.au/learn-basics/explore-basics/passphrases) - Australian Cyber Security Centre – [Why it's time to ditch your one password for passphrases](https://www.cyber.gov.au/about-us/news/ditch-password-for-passphrases) - Australian Government Information Security Manual (ISM) – Guidelines for System Hardening, passphrase control