Safe Computing

🔒 Safe Computing

Part 1 of 7 — Privacy, Authentication, and Online Safety

Personal Data and Privacy

What Is PII?

Personally Identifiable Information (PII) is data that can identify a specific individual.

🔑 Indirect PII alone may not identify a person, but combining multiple pieces of indirect PII often can. ZIP code + date of birth + gender can uniquely identify 87% of Americans.

How Data Is Collected

Companies collect this data for targeted advertising, product improvement, and analytics. Users often agree to data collection through Terms of Service agreements that many do not read.

Concept Check 🎯

Authentication and Authorization

Authentication Methods

Multi-Factor Authentication (MFA)

Using TWO OR MORE different factors together. Example: password (know) + phone code (have).

Strong Password Practices

• Use long, unique passwords for each account
• Combine uppercase, lowercase, numbers, and symbols
• NEVER reuse passwords across sites
• Use a password manager to store them securely

Authorization vs Authentication

Digital Footprint

Everything you do online creates a digital footprint — a trail of data including:

• Posts, comments, and likes on social media
• Websites visited and searches made
• Emails sent and received
• Files uploaded and downloaded

⚠️ Your digital footprint is largely permanent. Deleted posts may still exist in backups, screenshots, or cached versions. Future employers and colleges may review it.

Applied Recall ✍️

1. Data that can identify a specific individual is called Personally _______ Information (PII).

2. Using a password (something you know) PLUS a phone code (something you have) is called _______-factor authentication.

3. The trail of data created by your online activity is called your digital _______.

Classify the Concept 🔍

AP Exam Strategy: Safe Computing

• Know what PII is — and that INDIRECT PII combined can identify someone
• Three auth factors: know (password), have (phone), are (fingerprint)
• Multi-factor = two DIFFERENT factors (password + password is NOT multi-factor)
• Authentication (who are you?) vs Authorization (what can you do?) — know the difference
• Digital footprint is largely permanent — even deleted content may persist
• Cookies track behavior; Terms of Service often grant data collection rights

AP-Style Application 🎯

🔐 Safe Computing

Part 2 of 7 — Key Processes

Safe Computing Is About Personal Practice

CSP's "safe computing" topic focuses on what individuals and organizations DO to protect themselves: choices, habits, and configuration — not just the underlying tech.

Concept Check 🎯

Password Hygiene

Phishing And Social Engineering

Most modern breaches start with a person, not a zero-day. Recognize warning signs:

• Urgency / threats ("Your account will be locked in 24 hours").
• Mismatched sender / domain.
• Generic greetings.
• Asking for credentials, MFA codes, or money.
• Links that don't match where they claim to go.

Personal Data Footprint

Every account is a target. Reduce risk by:

• Closing unused accounts.
• Limiting what each app can access (permissions).
• Reviewing privacy settings periodically.

Applied Recall ✍️

1. Reusing the same password across sites is risky because of the _______ stuffing attack.

2. A separate device or app providing a one-time code is the second _______ in MFA.

3. A common starting point of attacks targets users via _______ (deceptive emails, texts, or calls).

Targeted Practice 🔍

AP Exam Strategy: Safe Computing Basics

• Unique strong passwords + password manager + MFA = the modern baseline.
• Don't share MFA codes; legitimate services never ask.
• Patch promptly; phishing is the most common entry point.

AP-Style Application 🎯

🔐 Safe Computing

Part 3 of 7 — Patterns & Examples

Patterns Of Personal Data Risk

Concept Check 🎯

Privacy Settings Are Defaults Worth Reviewing

Defaults often favor sharing. Periodically review:

• Who can see your posts / location / photos.
• What apps have what permissions.
• What third-party logins are connected.
• Which devices are signed in to your accounts.

Public Wi-Fi Caveats

Modern HTTPS protects most traffic on public Wi-Fi. But:

• Some apps still use unencrypted endpoints.
• A malicious access point can present invalid certificates (don't bypass).
• Using a trusted VPN adds an extra layer for higher-risk activities.

Account-Takeover Recovery Plan

Applied Recall ✍️

1. A device shipped with "admin/admin" credentials uses a _______ password.

2. Public Wi-Fi is much safer when sites use _______ rather than HTTP.

3. After an account compromise, you should also check connected apps and the recovery _______.

Targeted Practice 🔍

AP Exam Strategy: Personal Data Risks

• Defaults favor sharing; review privacy settings.
• Default device passwords are widely known and scanned.
• Don't bypass TLS warnings.

AP-Style Application 🎯

🔐 Safe Computing

Part 4 of 7 — Connections & Interactions

Safe Computing Connects Across CSP

Concept Check 🎯

Defense In Depth For Individuals

Threat Modeling For Yourself

Different people face different threats:

• General public: opportunistic phishing, scams.
• High-profile: targeted phishing, account takeover.
• Activists / journalists: state-level adversaries; need stronger ops.

Match your defenses to your realistic threat model.

Applied Recall ✍️

1. Personal full-disk encryption on macOS / Windows is provided by _______ / BitLocker.

2. A useful exercise to identify YOUR specific risks is personal _______ modeling.

3. Restoring a lost laptop's data depends on having _______ off the device.

Targeted Practice 🔍

AP Exam Strategy: Personal Defense In Depth

• Layer defenses: identity + device + app + network + backups + awareness.
• Match defenses to your real threat model.
• Personal lapses can harm your network of contacts.

AP-Style Application 🎯

🔐 Safe Computing

Part 5 of 7 — Change Over Time

How Safe Computing Has Evolved

Concept Check 🎯

Passwordless Future

Industry is moving toward passkeys (FIDO2 / WebAuthn): the user's device holds a private key; the site only ever sees a public key + signed challenge. This is phishing-resistant by design.

Cloud Account Takeover

Modern attackers target the cloud account itself (email, identity provider) because that often unlocks dozens of services. Defenses:

• MFA on the identity provider.
• Audit which services are connected.
• Review session activity.

What Hasn't Changed

• Patches still matter.
• Phishing still works.
• Backups still save you.
• Healthy skepticism still beats most attacks.

Applied Recall ✍️

1. A modern phishing-resistant alternative to passwords is called a _______.

2. A single account that grants access to many services is often the user's _______ provider.

3. Despite new attacks, _______ patches remain essential.

Targeted Practice 🔍

AP Exam Strategy: Modern Safe Computing

• Passkeys are the modern direction.
• Identity providers are high-value targets — protect them.
• AI raises the floor of phishing quality.

AP-Style Application 🎯

🔐 Safe Computing

Part 6 of 7 — Problem-Solving Workshop

Safe Computing Workshop

Concept Check 🎯

Worked: A Personal Security Checkup

Worked: A Phishing Smell-Test

If a message:

1. Pressures urgency, OR
2. Asks for credentials / MFA codes / money, OR
3. Has a mismatched sender / domain, OR
4. Has a link whose actual destination differs from its text,

…treat as phishing until proven otherwise. Verify out-of-band.

Worked: Recovering A Compromised Account

1. Sign out from all sessions.
2. Change password (long, unique, manager-stored).
3. Reset MFA; remove old factors.
4. Audit recovery email + phone — change if compromised.
5. Audit connected apps and revoke unknown ones.
6. Notify contacts.
7. Run an antivirus / malware scan if you suspect device compromise.

Applied Recall ✍️

1. After a compromise, after changing the password you should reset _______.

2. You should audit connected _______ to revoke anything unfamiliar.

3. If you suspect device-level compromise, run an _______ scan.

Targeted Practice 🔍

AP Exam Strategy: Workshop

• Personal security checkup as a habit, not a one-time event.
• Phishing smell-test = urgency + creds/codes/money + mismatched sender + suspicious link.
• Account recovery = sign out + reset password + reset MFA + audit recovery channels + audit connected apps.

AP-Style Application 🎯

🔐 Safe Computing

Part 7 of 7 — AP Review

AP Exam Recap — Safe Computing

Concept Check 🎯

Final Vocab

Common Pitfalls

• Reusing passwords across sites.
• Skipping MFA on email.
• Sharing MFA codes.
• Ignoring TLS warnings.
• Leaving default device credentials.
• No off-device backups.
• Treating safe computing as one-time, not ongoing.

Applied Recall ✍️

1. Sharing the same password across sites enables _______ stuffing.

2. A modern alternative to passwords that resists phishing is the _______.

3. Backups stored off the device protect against device loss, theft, and _______.

Targeted Practice 🔍

Final Exam Tips

• Personal safe computing = unique passwords + MFA + patches + backups + skepticism.
• Email is the master account — protect it first.
• Passkeys are the future of authentication.
• Safe computing affects others connected to you.

AP-Style Application 🎯