IGCSE, Edexcel, IB and AP Science Courses | Dr Dabour Hub Academy

Overview

Identify personally identifiable information (PII) and explain how identity theft happens and how to prevent it.
Describe the main attack methods — phishing, smishing and malware — and list the signs that expose a fraudulent message.
Apply the protective measures of cybersecurity strong passwords, multi-factor authentication, updates, antivirus and firewall.
State the rights and responsibilities of digital citizenship and the rules of intellectual property and referencing.

Protecting Data, Cybersecurity and Digital Citizenship
├── First: personal identity information (PII) and identity theft
├── Second: the methods of hackers
│   ├── phishing and smishing
│   ├── malware: viruses, spyware, ransomware
│   └── how to detect a fraudulent message
├── Third: preventive measures
│   ├── strong passwords
│   ├── multi-factor authentication (MFA)
│   └── updates, antivirus and firewall
└── Fourth: digital citizenship
    ├── rights and responsibilities
    └── intellectual property and plagiarism

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 1 / 14

Learning outcomes

Classify the data that must never be published and explain why each item is dangerous in the wrong hands.
Match each attack type with its technique and with its correct prevention.
Configure a secure account password policy, MFA, automatic updates, firewall.
Act as a responsible digital citizen privacy of others, truthfulness, polite discourse and respect of copyright.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 2 / 14

Key terms

Comparison aspect	Main idea	Keywords
PII (Personally Identifiable Information)	data that can identify a specific person — full name mother’s name national ID address phone number account and card numbers passwords	dataidentifyspecificfull
Identity theft	using somebody’s personal data fraudulently to open accounts buy services or commit crimes in his name	usingsomebodypersonaldata
Phishing / smishing	fake e-mails or SMS messages that imitate trusted institutions to steal credentials	fakemailsmessagesimitate
Malware	the general name for harmful software — virus spyware ransomware	generalnameharmfulsoftware
MFA (Multi-Factor Authentication)	requiring two or more different verification steps to log in	requiringdifferentverificationsteps
Digital citizenship	the responsible ethical and legal use of the technologies of the digital world	responsibleethicallegaltechnologies

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 3 / 14

First: protecting PII and the risk of identity theft

PII is the most precious treasure that cybercriminals hunt full name, mother’s name, national ID number, home address, telephone numbers, e-mail and passwords, bank and card numbers, and date of birth.
With enough of these pieces a criminal can impersonate the victim, open accounts, obtain loans, and commit fraud that is traced back to the victim rather than to himself.
The strict guidance issued by cybersecurity authorities:

Never publish sensitive personal data on public social platforms or in unknown-source opinion polls and prize draws.
Never share one-time codes (OTP) or the card security code (CVV); no serious institution asks for them by phone or message.
Check the privacy settings of every account, and limit who can see posts, photos and friends lists.
Use a different strong password per service and keep them in a password manager rather than in a notes file.
Shred documents that carry personal data before discarding them, and avoid filling in unnecessary fields in online forms.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 4 / 14

Second: phishing and smishing

Comparison aspect	Main idea	Keywords
Phishing	a fraudulent e-mail that looks as if it came from an accredited bank or a famous world company urging the user to click a link and “verify” his account the link leads to a cloned page that captures the login data	fraudulentmaillookscame
Smishing	the same trick delivered by SMS often announcing a fake delivery prize or blocked card	sametrickdeliveredoften
The aim is always the same	make the victim enter credentials on an attacker-controlled page or install a malicious attachment	makevictimentercredentials
•	Never log in from a link inside a message open the site by typing its address or using a saved bookmark	Neverlinkinsidemessage

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 5 / 14

Third: malware — viruses, spyware and ransomware

Malware→is the umbrella term for software built to harm a device or its data. Its main families:

Comparison aspect	Main idea	Keywords
Virus	attaches itself to files and spreads corrupting or destroying them	attachesitselffilesspreads
Spyware	watches what the user does records keystrokes (a keylogger) and steals passwords and banking details	watcheswhatuserdoes
Ransomware	encrypts the whole machine’s files and demands a payment for the decryption key the defence is regular independent backups prompt updates and never opening unknown attachments	encryptswholemachinefiles
Trojan / fake application	harmless-looking software that opens a back door once installed — the reason downloads must come from official stores only	harmlesslookingsoftwareopens

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 6 / 14

Fourth: how to detect a fraudulent message

Obvious spelling and grammar mistakes inside the message.
Pressure and threats “your account will be closed within 24 hours” — urgency is the attacker’s main tool.
A strange, unofficial sender address that only resembles the real domain.
A direct request for a password, an OTP code, or card details — banks never ask for these.
Links whose displayed text differs from the real destination hover over the link before clicking, and inspect the sender’s full address.
Unexpected attachments, especially executable or office files with macros.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 7 / 14

Fifth: strong passwords

At least 8 characters, mixing upper and lower case letters, digits and symbols.
Avoid anything guessable names, dates of birth, 123456, keyboard sequences — personal data is the first thing an attacker tries.
Use a unique password per account so that one breach does not open the rest.
Change a password suspected of exposure, and never share it with anybody, including someone claiming to be technical support.
A passphrase of several unrelated words is both strong and memorable.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 8 / 14

Sixth: multi-factor authentication (MFA)

MFA is currently the strongest line of defence login requires two different verification factors.
The factor categories something you know (the password), something you have (a temporary OTP on the phone or an authenticator app, a hardware key), and something you are (fingerprint, face or iris).
Even if the password is stolen, the account stays closed because the second factor is not in the attacker’s hands.
Prefer an authenticator application or a hardware key over an SMS code, because SIM-swap attacks can intercept texts.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 9 / 14

Seventh: updates, antivirus and firewall

Update software and operating systems regularly each update closes newly discovered security holes — these are the security patches.
Antivirus use an original, updated product rather than a cracked one; a cracked scanner may itself carry malware.
Firewall keep it enabled so incoming and outgoing traffic is filtered by rule.
Download applications only from official stores and verify the publisher; do not install unknown browser extensions.
On public Wi-Fi avoid banking, use HTTPS sites, and turn off auto-connect and file sharing.
Back up important data on an independent medium so a ransomware attack does not become fatal.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 10 / 14

Eighth: digital citizenship — rights and responsibilities

Digital citizenship is the responsible, ethical and legal use of the technologies of the digital world, and it balances two systems:

The right to privacy and to the protection of personal data.
The right of access to information and to digital services without discrimination.
The right to express an opinion freely and safely, and to report abuse.

Respect the privacy of others and never publish their pictures without prior permission.
Commit to honesty and objectivity; do not spread rumours or false news, and verify before sharing.
Show respect and good manners in discussion and comments, and avoid cyber-bullying.
Use technology legally and for its proper purpose, and protect your own accounts as part of the collective security.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 11 / 14

Ninth: intellectual property and publication rules

The author and the creator have a legal right to protect their literary, artistic or software production.
It is not permitted for a student or a researcher to copy the content of others and attribute it to himself — that is plagiarism.
Always cite the source with author, title, publisher or site, and date; quote between quotation marks when the wording is reproduced.
Respect licences free or open content still carries its own conditions of use and attribution.
The same rule applies to material produced by artificial-intelligence tools — disclose it instead of presenting it as your own work.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 12 / 14

Worked model items

“A message from the bank asks to confirm the card number within 24 hours or the account will be closed.” → phishing: urgency + request for secret data + unofficial sender; the correct action is to delete and report, never to click.
“Files on the student’s computer were encrypted and a payment is demanded.” → ransomware; the prevention asked for is periodic independent backups plus updates and not opening unknown attachments.
“Why is MFA stronger than a long password alone?” → because it adds a second factor of a different kind, so a stolen password is not enough to log in.
“A pupil posted a classmate’s photo with an insulting comment.” → two violations: privacy of others (no permission) and lack of respectful discourse — both are digital-responsibility failures.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 13 / 14

Exam traps and key takeaways

💡 High-yield traps

Malware is the general term; virus, spyware and ransomware are its types — answering “virus” when the question asks the umbrella term loses the mark.
Phishing targets credentials; ransomware targets files. Keep the two purposes separate.
A keylogger belongs to spyware, not to a virus.
The golden rule the exam expects no bank or official institution ever asks for your password or your OTP/CVV.
MFA means factors of different categories, not two passwords.
A password of 8 characters must also mix cases, digits and symbols; length alone is not “strong”.
Updates matter because they are security patches, not only new features.
An intranet being “private” does not make it immune — internal policy and access control still apply.
Plagiarism includes un-cited AI-generated text, not only copied human writing.
Digital citizenship = rights and responsibilities in balance; naming only one side is an incomplete answer.

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship · 14 / 14

Curriculum

ICT (Information and Communication Technology)

Unit 1

Unit 2

Unit 3

Unit 4

Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship