Lesson 2: Protecting Personal Data, Cybersecurity and Digital Citizenship

• Classify the data that must never be published and explain why each item is dangerous in the wrong hands.
• Match each attack type with its technique and with its correct prevention.
• Configure a secure account: password policy, MFA, automatic updates, firewall.
• Act as a responsible digital citizen: privacy of others, truthfulness, polite discourse and respect of copyright.

• PII (Personally Identifiable Information): data that can identify a specific person — full name, mother's name, national ID, address, phone number, account and card numbers, passwords.
• Identity theft: using somebody's personal data fraudulently to open accounts, buy services or commit crimes in his name.
• Phishing / smishing: fake e-mails or SMS messages that imitate trusted institutions to steal credentials.
• Malware: the general name for harmful software — virus, spyware, ransomware.
• MFA (Multi-Factor Authentication): requiring two or more different verification steps to log in.
• Digital citizenship: the responsible, ethical and legal use of the technologies of the digital world.

• PII is the most precious treasure that cybercriminals hunt: full name, mother's name, national ID number, home address, telephone numbers, e-mail and passwords, bank and card numbers, and date of birth.
• With enough of these pieces a criminal can impersonate the victim, open accounts, obtain loans, and commit fraud that is traced back to the victim rather than to himself.
• The strict guidance issued by cybersecurity authorities:

Protection rules

• Never publish sensitive personal data on public social platforms or in unknown-source opinion polls and prize draws.
• Never share one-time codes (OTP) or the card security code (CVV); no serious institution asks for them by phone or message.
• Check the privacy settings of every account, and limit who can see posts, photos and friends lists.
• Use a different strong password per service and keep them in a password manager rather than in a notes file.
• Shred documents that carry personal data before discarding them, and avoid filling in unnecessary fields in online forms.

• Phishing: a fraudulent e-mail that looks as if it came from an accredited bank or a famous world company, urging the user to click a link and "verify" his account; the link leads to a cloned page that captures the login data.
• Smishing: the same trick delivered by SMS, often announcing a fake delivery, prize or blocked card.
• The aim is always the same: make the victim enter credentials on an attacker-controlled page or install a malicious attachment.
• Never log in from a link inside a message; open the site by typing its address or using a saved bookmark.

• Malware is the umbrella term for software built to harm a device or its data. Its main families:

Families

• Virus: attaches itself to files and spreads, corrupting or destroying them.
• Spyware: watches what the user does, records keystrokes (a keylogger) and steals passwords and banking details.
• Ransomware: encrypts the whole machine's files and demands a payment for the decryption key; the defence is regular independent backups, prompt updates and never opening unknown attachments.
• Trojan / fake application: harmless-looking software that opens a back door once installed — the reason downloads must come from official stores only.

• Obvious spelling and grammar mistakes inside the message.
• Pressure and threats: "your account will be closed within 24 hours" — urgency is the attacker's main tool.
• A strange, unofficial sender address that only resembles the real domain.
• A direct request for a password, an OTP code, or card details — banks never ask for these.
• Links whose displayed text differs from the real destination: hover over the link before clicking, and inspect the sender's full address.
• Unexpected attachments, especially executable or office files with macros.

• At least 8 characters, mixing upper and lower case letters, digits and symbols.
• Avoid anything guessable: names, dates of birth, 123456, keyboard sequences — personal data is the first thing an attacker tries.
• Use a unique password per account so that one breach does not open the rest.
• Change a password suspected of exposure, and never share it with anybody, including someone claiming to be technical support.
• A passphrase of several unrelated words is both strong and memorable.

• MFA is currently the strongest line of defence: login requires two different verification factors.
• The factor categories: something you know (the password), something you have (a temporary OTP on the phone or an authenticator app, a hardware key), and something you are (fingerprint, face or iris).
• Even if the password is stolen, the account stays closed because the second factor is not in the attacker's hands.
• Prefer an authenticator application or a hardware key over an SMS code, because SIM-swap attacks can intercept texts.

• Update software and operating systems regularly: each update closes newly discovered security holes — these are the security patches.
• Antivirus: use an original, updated product rather than a cracked one; a cracked scanner may itself carry malware.
• Firewall: keep it enabled so incoming and outgoing traffic is filtered by rule.
• Download applications only from official stores and verify the publisher; do not install unknown browser extensions.
• On public Wi-Fi avoid banking, use HTTPS sites, and turn off auto-connect and file sharing.
• Back up important data on an independent medium so a ransomware attack does not become fatal.

• Digital citizenship is the responsible, ethical and legal use of the technologies of the digital world, and it balances two systems:

Digital rights

• The right to privacy and to the protection of personal data.
• The right of access to information and to digital services without discrimination.
• The right to express an opinion freely and safely, and to report abuse.

Digital responsibilities

• Respect the privacy of others and never publish their pictures without prior permission.
• Commit to honesty and objectivity; do not spread rumours or false news, and verify before sharing.
• Show respect and good manners in discussion and comments, and avoid cyber-bullying.
• Use technology legally and for its proper purpose, and protect your own accounts as part of the collective security.

• The author and the creator have a legal right to protect their literary, artistic or software production.
• It is not permitted for a student or a researcher to copy the content of others and attribute it to himself — that is plagiarism.
• Always cite the source with author, title, publisher or site, and date; quote between quotation marks when the wording is reproduced.
• Respect licences: free or open content still carries its own conditions of use and attribution.
• The same rule applies to material produced by artificial-intelligence tools — disclose it instead of presenting it as your own work.

• "A message from the bank asks to confirm the card number within 24 hours or the account will be closed." → phishing: urgency + request for secret data + unofficial sender; the correct action is to delete and report, never to click.
• "Files on the student's computer were encrypted and a payment is demanded." → ransomware; the prevention asked for is periodic independent backups plus updates and not opening unknown attachments.
• "Why is MFA stronger than a long password alone?" → because it adds a second factor of a different kind, so a stolen password is not enough to log in.
• "A pupil posted a classmate's photo with an insulting comment." → two violations: privacy of others (no permission) and lack of respectful discourse — both are digital-responsibility failures.