Online Security Module

Lesson 2: Managing Personal Security

Ready?
Begin Lesson

Part 1

Personal devices

Your personal devices, such as cell phones, laptops and smartwatches are powerful tools for communicating with others, connecting to the internet and engaging in life in the digital age. Because these devices can contain so much personal information, it is important to treat them with care.

Safety and security tips for personal devices: Know what’s on your device

Think about the following:

• Which applications do you have installed and what data do they store about you?
• What permissions do your apps have? Most devices and app stores will let you know what information your apps track, monitor and collect.
• What passwords you have saved and any other personally identifiable information that might be accessible from your device?

Lock your device using whatever security methods are available (for example, face ID, fingerprint, numerical pin, password). And when multiple methods are available to you, be thoughtful when balancing security and convenience to your preferences.

Be careful who you give access to your personal devices

Think about the following:

• Letting other people use your cell phone gives them access to all of the apps, content, information and social media profiles that are on that device.
• Back up your devices regularly. If a device is lost or stolen, you can use the saved backups to restore access to your accounts and information. If your backups contain sensitive data, consider encrypting them.

Part 2

Public and shared devices

Shared devices include devices at home or in an office setting where multiple people use the same device. Public devices include devices in a public location, such as an internet cafe, public library or school computer lab. Shared and public devices require additional safety and security considerations.

Safety and security tips for shared devices:

• Turn off autofill and password-storing features
• If you are accessing a shared device using a separate user profile, be sure to log out of your profile when you are done using the device.
• If users do not have their own unique user profiles, treat the shared device as a public device (see next slide).
• Consider implementing additional security settings to protect young children, such as content filtering

Safety and security tips for public devices:

• Using public devices is similar to using other public resources. It can be convenient, but it may also come with added risks. And just like with other public resources, it is important to be careful while using them and leaving public devices as they were found.
• Consider using private browsing mode, a feature available on most internet browsers. Private browsing mode prevents the browser from permanently storing browsing history, cookies, form inputs and other site data. However, private browsing mode does not hide user activity from your internet service provider or the websites you visit while in private browsing mode.
• If you do not use private browsing mode, consider deleting your browsing history when you are finished browsing the internet
• Avoid banking, paying bills, shopping or other sensitive business on a public device.
• Be sure to log out of all accounts when you are done using a public device or if you leave the device unattended, even for a short time.

Wireless networks

A wireless network is how most people access the internet. It is a computer network that uses wireless data connections between network nodes. Your personal wireless network is a valuable resource for connecting to the internet. However, it also presents additional security considerations.

Safety and security tips for personal wireless networks:

• Change the default name of your wireless network
• Set a Wi-Fi password so that people can’t join your network without permission. Set a strong and unique password (you will learn how to do this later in this lesson).

Encryption scrambles the information you send into a code so that it’s not accessible to others. Using encryption is the most effective way to secure your network from intruders.

Think about the following:

Enable network encryption and ensure your connections to websites are encrypted, too. Secure communications over the internet take place in different ways, but we can simplify them into two categories for purposes of this module:

• Connections between devices within your personal network
• Connections between a given device on your personal network and a resource on the internet

Some may be familiar with the difference between HTTP and HTTPS, namely that the latter is secure and sometimes shows a green lock icon in your browser URL bar, which lets you know your connection is likely safe and secure, whereas the former is not encrypted and anything you send will be in plaintext. But not everything you do on the internet is going to be secure in that way, and sometimes that’s also the case when devices on your home network are communicating with each other.

Keep your router’s software up-to-date. For additional layers of security, practice turning on content filtering or blocking certain downloads

Public wireless networks are convenient, but present additional security risks since they are open to the public.

Consider the following safety and security tips for public wireless networks:

• Avoid banking, paying bills, shopping or other sensitive business on a public wireless network
• Avoid accessing personal accounts, logging in to social media sites or otherwise sharing personally identifiable information (see Privacy Module). There are many ways that public wireless networks can be compromised, and it is important to keep personal and private information safe.

The only true way to be safe on a public wireless network is to utilize a VPN connection, which simulates a private encrypted network.

Public USB charging stations can also be a security risk, as cables and USB charging ports can contain malware and potentially access data on charging devices. This tactic is called juice jacking. You can avoid juice jacking by using a charger supplied by your device's manufacturer (and not a spurious one which could be potentially infected with malware) plugged into an AC power outlet, using a charging cable with no data connection or using a portable charger.

Part 3

Applications

An application is “a program that performs a particular task or set of tasks.” Applications can be for desktop or laptop computers, tablets and mobile devices.

1.Apps

An app is an application as downloaded by a user to a mobile device. To be safe, only download applications from reputable vendors.

Pay close attention to privacy and security settings for any new applications that you install.

• Does the application ask to access your location, contact list or calendar?
• Does the application ask for permission to send messages or post to your social media profiles?
• Carefully consider how your information will be used. If you are unsure, consult the privacy policy. In some cases, data needs to be shared in order for an application to perform its intended function(s).

Some applications may allow third-party applications access to your account information. This can make your experience online more integrated and convenient but can potentially compromise your privacy. If you do not want third-party applications to access your information, you can opt out, but you may lose access to features and functions.

2.Web Browsers

A web browser (such as Chrome, Firefox, Safari) is an application that gives you access to the internet. There are many considerations to think about when browsing the web.

Some safety and security considerations when browsing the web:

• Check the domain name of websites to ensure that you are on the correct website.
• Taking things a step further, hackers may also play with domains and subdomains (i.e., the part before the domain name but after the protocol). For example, in ”https://facebook.notfacebook.com,” the actual domain here is NOT “facebook”—it’s actually “notfacebook,” which is an imposter site hoping that we’ll think Facebook owns it.

If you see https:// at the beginning of a web address (instead of http://), this means the session between the browser you are using and the web server is encrypted. Some web browsers also include a padlock icon at the beginning of an encrypted web address.

When a website is encrypted, that means the data and information on the site is protected from being viewed by third parties. However, an encrypted website does not mean the website itself is legitimate, so you should always carefully review the content of a website before sharing any personally identifiable information (see Privacy Module).

Be sure to update your web browser(s) regularly to help protect against security risks from outdated software.

If you are in doubt about whether a website is legitimate,
it is better to be safe. Try doing a web search for that website to find out more information about whether or not it is a legitimate or reliable website before deciding what to do next.

3.Cookies

Cookies are small text files that uniquely identify your browser or device. Cookies allow an application or website to know specific information about your browser or device, including if you have previously visited the site or used the service.

Applications and websites use cookies for a variety of purposes, including: 

• Authentication (staying logged in to a site
  as you navigate)
• Security
• Site features and performance (such as optimizing graphics, recognizing preferred language)
• Analytics and research
• Advertising and product recommendations

Your web browser may offer settings that allow you to choose browser-based cookie settings.

Note that browser cookie controls may impact your ability to interact with certain sites, especially if you have disabled cookies.

Part 4

Passwords

A password is a sequence of characters which may include letters, numbers or symbols used to access a device or personal account on a website.

A passphrase is a longer sequence of characters, numbers or symbols, often crafted as a phrase or complete sentence, used to access a device or personal account on a website.

Some tips for creating strong passwords:

1. Create a separate password or passphrase for every account. If you use the same password for multiple accounts and that password is compromised, then all of the accounts that use the same password will also be compromised.
2. Never use personal information, like birthdays, email addresses or usernames, that are publicly available in, for example, your social media profiles and posts or other online information about you. This makes it easier to guess passwords.
3. Avoid using words that can be found in the dictionary.
4. Try to include lowercase and uppercase letters, numbers and symbols.
5. Use a longer password with at least eight characters. In general, the more characters in a password, the harder it is to guess or crack.'

Other safety tips related to passwords:

1. Never share your passwords with anyone
2. Do not post your passwords in an easy-to-find location
3. When available, set up alerts when someone tries to log in to your account from a new device or web browser. These alerts can give you device and location information for the attempted login.
4. When available, set up multi-factor authentication (includes two-factor authentication and two-step verification).
   • Multi-factor authentication requires users to provide multiple information types to log in to an account or access an application or website
   • This often includes providing knowledge unique to a user (e.g., password, pin, security questions) or inherent uniqueness like biometrics, such as face recognition, fingerprint or voice recognition

Two-factor authentication

Two-factor authentication is a security feature that helps protect your accounts and your passwords.

Congrats!
You've finished the lesson

Previous Lesson Next Lesson