Essential Knowledge:

**IOC-2.A.5** Technology enables the collection, use, and exploitation of information about, by, and for individuals, groups, and institutions. **IOC-2.A.6** Search engines can use search history to suggest websites or for targeted marketing. **IOC-2.A.7** Disparate personal data, such as geolocation, cookies, and browsing history, can be aggregated to create knowledge about an individual. **IOC-2.B** Explain how computing resources can be protected and can be misused. **IOC-2.C** Explain how unauthorized access to computing resources is gained.

Safe Computing

**IOC-2.A.5** Technology enables the collection, use, and exploitation of information about, by, and for individuals, groups, and institutions. **IOC-2.A.6** Search engines can use search history to suggest websites or for targeted marketing. **IOC-2.A.7** Disparate personal data, such as geolocation, cookies, and browsing history, can be aggregated to create knowledge about an individual.

Personal Identifiable Information (PII)

Personal Identifiable Information (PII): Information about someone that can be used to identify them.

  • Name

  • Race

  • Age

  • Phone number

  • DOB

  • Email

  • Address

  • Credit Card

  • Medical Information

  • Biometric Data

Credit card, medical, and biometric information can not be shared without your consent.

Others can use it to steal your identity, money, or other personal information.

Search engines collect information without you knowing. They collect information about a user’s devices, networks, and websites visited and often use it to suggest things for you. The information we put out there is often there permanently.

Good and bad things about PII

Good:

  • It can be used to enhance user experience by suggesting things that you like

  • The user can access websites and other info by looking at their history

Bad:

  • Others can exploit it to access a user’s personal information

  • Ex: If you book a trip to another country, this is what happens

    • The search engine knows all the details of your trip, such as dates, places, hotels, etc.

    • The second you search something up, it knows your IP address and email (from your user info)

    • Your internet service provider provides your name and address

    • The federal government has access to where you are traveling

    • Dozens of sites are tracking your information via your use of cookies

    • And even when you don’t have a device, cameras might be tracking you

Risk to Privacy

  • Information you put online is very difficult to delete

  • Information that you put online, knowingly or unknowingly can be used to know very personal information that you might not intend to share.

Popcorn Hack 1:

List at least three apps or websites that might use PII:

  • 1: Tik Tok
  • 2: Spotify
  • 3: Instagram

Authentication

**IOC-2.B** Explain how computing resources can be protected and can be misused.

Authentication measures protect devices and information from unauthorized access

Authentication measures:

  • Strong passwords

  • Multi-factor authentication

Strong Passwords:

  • 10 or more characters

  • Must contain a symbol

  • Must contain a number

  • Must contain lowercase and uppercase letters

Multi-Factor Authentication

  • Types of Authentication:

    • What You Know (IE: Your Password)

    • What You Have (IE: Personal Information)

    • What You Are (IE: Fingerprint)

  • Why Use?
    • Multi-Factor Authentication ensures that there’s two steps before gaining access to personal or important information instead of strictly using a password. Examples of this are connecting phone numbers to accounts or connecting emails to accounts.

  • Viruses and Malware:

    • Viruses: Malicious programs that can copy themselves and gain access to systems that they are not supposed to be allowed in

    • Malware: Often intended to damage a computing system or take partial control over its operation

      • It can infiltrate a system by posing as legitimate programs or by attaching itself to legitimate programs, like an email attachment

    • Virus scans can help to prevent malicious code from getting into and affecting your system

Encryption and Decryption:

  • Once legitimate access to a system is gained, it is important to ensure data sent to and from the system remains uncompromised

  • Encryption: The process of encoding data to prevent unauthorized access

  • Decryption: The process of decoding data

    • Two Types

      • Symmetric Encryption: one key used to both encrypt and decrypt data (IE: Caesar Cipher)

      • Asymmetric encryption

        • Public Key Encryption: uses two keys

          • A public key for encrypting

          • A private key for decrypting

        • A sender does not need the receiver’s private key to encrypt a message

        • The receiver’s private key IS required to decrypt the message

Digital certificates:

A certificate authorities issue digital certificates that validate the ownership of encryption keys used in secure communication and are based on a trust model. It makes sure that the decryption key that people recieve are issued by users or owners that own a true trusted key.

Popcorn Hack 2:

Create an encrypted code using symmetric encryption, and provide the code, and the actual message:

origional message - purple encrypted message - lurppe

Risk Factors

**IOC-2.C** Explain how computing resources can be protected and can be misused.

  • Phishing: Tricking a user into giving personal information such as usernames, passwords, account numbers, or social security numbers.

    • Phishing emails: These emails look like companies you know and trust. These fake emails will trick you into clicking a link or an attachment

      • These links will either put a virus on your computer, send you to a website that looks like the real thing, or a keylogger.

  • Keylogger: records keys typed on the keyboard to gain access to a username, password, or any other personal information.

    • How do keyloggers get onto your computer?

      • One way is by plugging in a physical device to your computer.

      • Phishing emails through links

      • Clicking on a bad website

  • Rogue access point: wireless network giving unauthorized access to secure networks

    • People intercept data traveled as it travels through networks.

      • Ex: A router installed in a secure network within an organization. A person could easily access the network and install any software, intercept communication, or steal network information.

    • Normal people trying to access their computers more easily leads to a lack of security. This makes it easy for other people to access the network.

Popcorn Hack 3:

Go to a website that checks your password and make a strong password.

DKRO5Z]aiLL”‘O)

Homework

Please answer these questions and send them to Daniel Lee on Slack. Graded on accuracy.

What is Personal Identifiable Information (PII), and list three examples of it?

  • PII (personal identifiable information) is information about someone that can be used to identify them. Three examples of it are: phone number, age, and address

    What is a possible risk or cons to using PII?

  • A risk of PII is that someones personal infomration could be used to exploit that person. With PII, you are also sometimes putting things on the internet that you did not intend to.

    What are traits of a strong password?

  • strong passwords have: 10 or more characters, must contain a symbol, must contain a number, and must contain lowercase and uppercase letters

    What does having a strong password prevent?

  • Strong passwords are a form of authentification measure which protect devices and information from unauthorized access.

    What are the two types of decryption and what is the difference between the two?

  • The two types of decryption are Symmetric Encryption and Asymmetric encryption. Symmetric is one key used to both encrypt and decrypt data while Asymmetric encryption uses a public key for encrypting and a private key for decrypting. Also with asymmetric encryption a sender does not need the receiver’s private key to encrypt a message and the receiver’s private key IS required to decrypt the message.

    What is phishing?

  • Phishing is tricking a user into giving personal information such as usernames, passwords, account numbers, or social security numbers. This can be done through emails that prompt you to click links that can put a virus on your computer.

    What is a way a keylogger can get into your computer?

  • Keyloggers can get into your computer if you click on a bad website link.

    What is a rogue access point and how is it used?

  • A rogue access point is a wireless network giving unauthorized access to secure networks. They can be used when a router is installed in a secure network within an organization, which allows a person to easily access the network and install any software, intercept communication, or steal network information.