C69 · Topic 5.6 · 40 minutes · IOC-2.A, IOC-2.B, IOC-2.C
Personal data and attack scenarios
By the end you can:
- Identify direct and indirect personal information.
- Explain phishing, malware and untrusted-network risks.
- Connect a threat to an attack mechanism.
Before this lesson: topics 4.1, 5.1.
- Authentication
- Checking a claimed identity before granting access.
- Confidentiality
- Keeping information from parties not authorised to read it.
- Data minimisation
- Collecting or retaining only the information needed for a justified purpose.
Understand
Personal information includes more than names. Precise locations, repeated times, identifiers and combinations of otherwise ordinary data can expose identity or routines. Removing a direct identifier does not guarantee anonymity. Limit collection, precision, retention and access when the purpose can be met with less information.
Attackers may use deceptive messages/sites to obtain credentials, malicious software such as keyloggers to capture activity, or untrusted network equipment to observe or alter unprotected traffic. Describe what is attacked and how. A familiar logo or a successful download does not establish trust; updates and protective tools help but do not guarantee the absence of malware.
Worked example
An unexpected email links to a password page that resembles a school service.
- The message may be phishing; visual familiarity is not proof of a trusted destination.
- Navigate independently to the known official service instead of relying on the unexpected link.
- A stolen password may enable account access; MFA can reduce password-only risk but stolen factors or sessions remain possible.
Explore each concept
Choose a concept, change its inputs and follow the explanation. Each example models the stated rule or scenario; completing it is practice rather than evidence of mastery.
- Encryption versus authentication
- Shared-key versus key-pair roles
- Certificate trust and endpoint limits
Change it · step through · explain
Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.
Ready · Make a prediction
- ApproachsymmetricWaiting
- Attempted decrypt keyrecipient-privateWaiting
Ready to explore: Symmetric keys, public keys and certificates
Why: Change an input, predict the first effect, then advance one step.
Try this: Change one input or choose another listed case. Predict the effect, reset and compare the states and governing rule.
Step through and experiment
Change it · step through · explain
Change an input, predict what will happen, then advance one step. Read why the state changes, reset and experiment. This fixed teaching model does not save progress or award XP.
Ready · Make a prediction
- Input 1phishingWaiting
- Input 2mfaWaiting
Ready to experiment
Why: Predict the first change, then advance one step.
Try this: Keep the threat fixed and compare safeguards. Which mechanism directly addresses it?
Check a misconception
Claim: No name column means a location history cannot identify anyone.
Repeated places/times can link with other sources and reveal a person or sensitive routine.
Guided practice
Explain a keylogger risk without entering any real password into the classroom tool.
Work with a partner. Make a prediction, compare your reasoning, then identify the rule that supports your answer.
Independent transfer
An app needs an approximate area to show local resources. Propose a minimisation decision.
Exit check
Why can a malicious access point remain risky even when its network name looks familiar?
Write your reasoning before comparing with a classmate. If your teacher assigned this task, submit it through My classes to save your work and receive feedback.
Check yourself
Your practice so far
Check an answer to see its rationale.