Safe Computing

🔒 Safe Computing

Part 1 of 7 — Privacy, Authentication, and Online Safety

Personal Data and Privacy

What Is PII?

Personally Identifiable Information (PII) is data that can identify a specific individual.

🔑 Indirect PII alone may not identify a person, but combining multiple pieces of indirect PII often can. ZIP code + date of birth + gender can uniquely identify 87% of Americans.

How Data Is Collected

Companies collect this data for targeted advertising, product improvement, and analytics. Users often agree to data collection through Terms of Service agreements that many do not read.

Concept Check 🎯

Authentication and Authorization

Authentication Methods

Multi-Factor Authentication (MFA)

Using TWO OR MORE different factors together. Example: password (know) + phone code (have).

Strong Password Practices

• Use long, unique passwords for each account
• Combine uppercase, lowercase, numbers, and symbols
• NEVER reuse passwords across sites
• Use a password manager to store them securely

Authorization vs Authentication

Digital Footprint

Everything you do online creates a — a trail of data including:

Applied Recall ✍️

1. Data that can identify a specific individual is called Personally _______ Information (PII).

2. Using a password (something you know) PLUS a phone code (something you have) is called _______-factor authentication.

3. The trail of data created by your online activity is called your digital _______.

Classify the Concept 🔍

AP Exam Strategy: Safe Computing

• Know what PII is — and that INDIRECT PII combined can identify someone
• Three auth factors: know (password), have (phone), are (fingerprint)
• Multi-factor = two DIFFERENT factors (password + password is NOT multi-factor)
• Authentication (who are you?) vs Authorization (what can you do?) — know the difference
• Digital footprint is largely permanent — even deleted content may persist
• Cookies track behavior; Terms of Service often grant data collection rights

AP-Style Application 🎯

🔐 Safe Computing

Part 2 of 7 — Key Processes

Safe Computing Is About Personal Practice

CSP's "safe computing" topic focuses on what individuals and organizations DO to protect themselves: choices, habits, and configuration — not just the underlying tech.

Concept Check 🎯

Password Hygiene

🔐 Safe Computing

Part 3 of 7 — Patterns & Examples

Patterns Of Personal Data Risk

Concept Check 🎯

Privacy Settings Are Defaults Worth Reviewing

Defaults often favor sharing. Periodically review:

• Who can see your posts / location / photos.
• What apps have what permissions.
• What third-party logins are connected.
• Which devices are signed in to your accounts.

Public Wi-Fi Caveats

Modern HTTPS protects most traffic on public Wi-Fi. But:

• Some apps still use unencrypted endpoints.
• A malicious access point can present invalid certificates (don't bypass).
• Using a trusted VPN adds an extra layer for higher-risk activities.

Account-Takeover Recovery Plan

🔐 Safe Computing

Part 4 of 7 — Connections & Interactions

Safe Computing Connects Across CSP

Concept Check 🎯

Defense In Depth For Individuals

🔐 Safe Computing

Part 5 of 7 — Change Over Time

How Safe Computing Has Evolved

Concept Check 🎯

Passwordless Future

Industry is moving toward passkeys (FIDO2 / WebAuthn): the user's device holds a private key; the site only ever sees a public key + signed challenge. This is phishing-resistant by design.

Cloud Account Takeover

Modern attackers target the cloud account itself (email, identity provider) because that often unlocks dozens of services. Defenses:

• MFA on the identity provider.
• Audit which services are connected.
• Review session activity.

What Hasn't Changed

• Patches still matter.
• Phishing still works.
• Backups still save you.
• Healthy skepticism still beats most attacks.

Applied Recall ✍️

1. A modern phishing-resistant alternative to passwords is called a _______.

🔐 Safe Computing

Part 6 of 7 — Problem-Solving Workshop

Safe Computing Workshop

Concept Check 🎯

Worked: A Personal Security Checkup

Worked: A Phishing Smell-Test

If a message:

1. Pressures urgency, OR
2. Asks for credentials / MFA codes / money, OR
3. Has a mismatched sender / domain, OR
4. Has a link whose actual destination differs from its text,

…treat as phishing until proven otherwise. Verify out-of-band.

Worked: Recovering A Compromised Account

1. Sign out from all sessions.
2. Change password (long, unique, manager-stored).
3. Reset MFA; remove old factors.

🔐 Safe Computing

Part 7 of 7 — AP Review

AP Exam Recap — Safe Computing

Concept Check 🎯

Final Vocab

Common Pitfalls

• Reusing passwords across sites.
• Skipping MFA on email.
• Sharing MFA codes.
• Ignoring TLS warnings.
• Leaving default device credentials.
• No off-device backups.
• Treating safe computing as one-time, not ongoing.

Applied Recall ✍️