Many systems' security properties only hold when users follow certain rules. User education is aimed at making users aware of these rules. For example,
- Letting managers know how to delegate enough authority without delegating all or without muddying audit logs by sharing their login credentials.
- Preventing social-engineering by letting employees know how to verify that the person on the other end of the phone is an employee with access rights or making it clear that all info requests go through the system.
- Ensuring strong passwords and making sure employees know not to share them with tech support.