Lesson 11: Security Basics & Safe Computing
Security is mostly habits. Learn the core security ideas (CIA triad), common threats (phishing/malware), and what you should do FIRST when something looks sketchy.
1) The CIA Triad (Your Security “Compass”)
A huge number of security questions are really asking: “Which part of the CIA triad is being impacted?” If you can spot that, you can choose the right control and the right first action.
| Concept | Meaning | Common Examples |
|---|---|---|
| Confidentiality | Keep data private (only authorized people can see it) | Encryption, permissions, MFA |
| Integrity | Keep data accurate and unaltered | Hashes, access control, change logs |
| Availability | Keep systems usable when needed | Backups, redundancy, DoS protection |
2) Threats You MUST Recognize
Social engineering (most common)
- Phishing: email “bait” to steal credentials or make you click/attach
- Smishing/Vishing: phishing over text / phone
- Pretexting: attacker invents a believable story (“I’m from IT”)
- Tailgating: follows you into a secured area
Malware (common categories)
- Ransomware: encrypts files for money
- Spyware/Keylogger: watches what you do / steals credentials
- Trojan: looks legit but contains a malicious payload
- Worm: spreads itself across systems/networks
3) Safe Habits That Beat Most Attacks
- Use MFA: stops password-only compromise.
- Password manager: unique, long passwords (don’t reuse).
- Update/patch: closes known vulnerabilities.
- Least privilege: users/apps only get what they need.
- Backups (3-2-1): 3 copies, 2 media types, 1 offsite/offline.
4) If You Suspect a Security Incident
Default safe first actions:
- Don’t click links/attachments you don’t trust.
- Isolate the device from the network if you suspect malware.
- Report to IT/security (don’t “dig around” and destroy evidence).
- Change credentials only after you confirm the right process (and from a known-safe device).
Practical: Phish or Legit Simulator
For each message, choose the best classification and the best FIRST action. Messages are hardcoded so they always display.
1) “Your mailbox is full — verify now”
From: it-support@micros0ft-mail.com
“Your mailbox will be disabled in 30 minutes. Click to verify your password.”
Classification
Best FIRST action
Which CIA area is MOST targeted?
2) “Vendor invoice attached”
From: ap@yourvendor.com
Subject: “Invoice #44719” Attachment: invoice_44719.zip
Classification
Best FIRST action
Which CIA area is MOST at risk?
3) “Planned maintenance tonight”
From: noreply@yourcompany.com
“Scheduled network maintenance 11:00 PM–1:00 AM. VPN may disconnect briefly.”
Classification
Best FIRST action
Which CIA area is MOST involved?
4) “Payroll update required”
From: hr-payroll@yourcompany-support.com
“We detected an error. Sign in here to update your direct deposit.”
Classification
Best FIRST action
Which CIA area is MOST targeted?
5) “Password expired” (but you just changed it)
A pop-up appears while browsing: “Your password expired. Re-enter credentials to continue.”
Classification
Best FIRST action
Which CIA area is MOST targeted?
6) “CEO needs gift cards”
From: ceo@yourcornpany.com (note spelling)
“I’m in a meeting. Buy $500 in gift cards and send me the codes ASAP.”
Classification
Best FIRST action
Which CIA area is MOST involved?
7) “MFA prompt you didn’t trigger”
You receive an MFA push notification asking to approve a login… but you aren’t logging in.
Classification
Best FIRST action
Which CIA area is MOST involved?
8) “Files renamed and won’t open”
User reports documents now end in .locked and a note demands payment.
Classification
Best FIRST action
Which CIA area is MOST impacted?
Lesson 11 Quiz (Advanced)
10 questions. Score ≥ 75% to unlock the Next Lesson button.
Next Lesson
Complete the quiz with a score of 75%+ to unlock.