Cisco Networking Academy 2023

Module 3 “Protecting your data and

privacy”
Welcome to this module, which explains how to protect yourself online and maintain
your privacy.
Remember, your online data is valuable to cybercriminals. So what can you do to stay
safe?
There are some simple strategies you can use to protect your personal devices and
keep your data safe. Let's take a look at what they are.
Scroll down and select “Protect your devices and network” to get started.

1. Protect your devices and your network

How to Maximize Your Online Security

2. Data maintenance
Protecting and preserving your data

3. Who owns your data?

Laboratory activity

4. Protecting online privacy

Practice ways to protect yourself

5. Discover your own risky online behavior

Laboratory activity

6. Questionnaire
Test your knowledge

1
 Cisco Networking Academy 2023

PROTECTING YOUR DEVICES AND

YOUR NETWORK

You’ve probably heard the term “online security.” It is

about taking the necessary measures to prevent your
personal information from falling into the wrong
hands.
Let's start by looking at what you already know...

3.1.1 What do you think?

Just received a new laptop at @Apollo and is getting ready to set it up. What steps
would you take to secure it before using it?
Write your ideas in the box below, then submit. Once you have entered the steps,

select Show Answer to reveal the comments.

(500 generals remaining)

Computer security measures are actions aimed at safeguarding the integrity,

availability and security of data stored in the digital environment.
 Make backup copies or backups.
 Foster a strong password culture.
 Protecting email.
 Use antivirus.
 Control access to information.

What did you come up with?

To keep your device safe and secure, you should:
 turn on the firewall
 Install antivirus and anti-spyware
 manage your operating system or web browser
 set up password protection
We will analyze each of them in greater detail later.

3.1.2: Protecting Your Computing Devices

2
 Cisco Networking Academy 2023

Your computing devices are the portal to your online life, storing much of your personal
data. Therefore, it is important to protect the security of your devices.
Select the titles for some important tips on how to do it.
Turn on the firewall
You should use at least one type of firewall (either a software firewall or a hardware
firewall on a router) to protect your device from unauthorized access. The firewall must
be activated and constantly updated to prevent hackers from accessing your personal
or organizational data.
You can click here to learn how to turn on the firewall in Windows 10, or click here for
Mac OS X devices.

Turn Microsoft Defender Firewall on or off

Microsoft Defender Windows 11 Windows 10
It's important to have Microsoft Defender Firewall turned on, even if you already have
another firewall turned on. It helps you protect yourself from unauthorized access.
To turn Microsoft Defender Firewall on or off:
Windows 11 / Windows 10
1. Select the Start button > Settings > Update & Security > Windows Security ,
and then select Firewall & network protection. Open Windows Security settings
2. Select a network profile: Domain Network, Private Network, or Public Network.
3. In Microsoft Defender Firewall, change the value to On. If your device is
connected to a network, network policy settings may be preventing you from
completing these steps. For more information, please contact the administrator.
4. To disable it, change the value to Off. Disabling Microsoft Defender Firewall may
make your device (and network, if you have one) more vulnerable to unauthorized
access. If there is an application you need to use but it is blocked, you can allow it
to pass through the firewall, instead of disabling it.
Note: If you encounter errors, or if the option does not activate, you can use the
troubleshooter and try again.
Enable firewall protection (Mac OS x)
1. On your Mac, choose Apple menu > System Preferences, click Network in the sidebar,
then choose Firewall. (you may need to scroll down).
2. Activate Firewall.
3. To specify additional security settings, click Options and do any of the following:
 Allow only specified apps and services to connect: Click the Add button and select
the app or service in the dialog box that appears.

3
 Cisco Networking Academy 2023

 Allow only essential apps and services to connect: Turn on Block all incoming
connections.
 Automatically allow embedded software to receive incoming connections – Enable
Automatically allow embedded software to receive incoming connections.
 Automatically allow downloaded signed software to receive incoming connections –
Turn on Automatically allow downloaded signed software to receive incoming
connections.
 Make it harder for hackers and malware to find your Mac by enabling Turn on
Stealth Mode.

Install Antivirus and Antispyware

Malicious software, such as viruses and spyware, is designed to gain unauthorized
access to your computer and data. Once installed, viruses can destroy data and slow
down your computer. They can even take over your computer and send spam emails
from your account. Spyware can monitor your online activities, collect your personal
information, or send unwanted pop-up ads to your web browser while you are online.
To avoid this, you should only download software from trusted websites. However, you
should always use antivirus software to provide another layer of protection. The
software, which usually includes anti-spyware, is designed to scan your computer and
incoming email for viruses and remove them. Keeping your software up to date will
protect your computer from any new malware.
Manage your operating system or web browser
Hackers are always trying to exploit vulnerabilities that may exist in your operating
system (such as Microsoft Windows or macOS) or web browser (such as Google
Chrome or Apple Safari).
Therefore, to protect your computer and data, you should set the security settings on
your computer or browser to a medium or high level. You should also update your
computer's operating system, including web browsers, and periodically download and
install software patches and security updates from vendors.
Set up password protection
All your computing devices, whether computers, laptops, tablets or smartphones,
should be password protected to prevent unauthorized access. Any stored information
should be encrypted, especially in the case of sensitive or confidential data. You should
only store the necessary information on your mobile device, in case it is stolen or lost.
Remember, if any of your devices are compromised, criminals can access all of your
data through your cloud storage service provider, such as iCloud or Google Drive.

4
 Cisco Networking Academy 2023

IoT (Internet of Things) devices pose an even greater risk

than other electronic devices. While desktop computers,
laptops, and mobile devices receive frequent software
updates, most IoT devices still have their original software.
If vulnerabilities are found in the software, the IoT device is
likely to remain vulnerable. And to make matters worse,
IoT devices require Internet access and, in most cases,
rely on your local network. The result is that when IoT
devices are compromised, they allow hackers to access your local network and data. The
best way to protect against this situation is to have IoT devices with an isolated network.
Check out Shodan, a web-based IoT device scanner that helps you identify any vulnerable
devices on the Internet.

How many IPs can I monitor?

Shodan Monitor supports everything from individual IP addresses to tracking events
across the entire Internet. To see how many IP addresses or networks you can
currently monitor, visit the Shodan Developer Dashboard.

Do I need to send scans?

No, Shodan Monitor automatically and continuously scans the network ranges being
monitored. If you would like to request an immediate scan, you can do so by visiting the
Manage Networks page.
Can I access raw events from my program?
Yes, Shodan Monitor is based on the existing Shodan API. Specifically, we are
leveraging the network alert stream which contains all events for your specified network
range(s). Please refer to the official streaming documentation for more information:
Streaming API Documentation

3.1.3 Home Wireless Network Security

Wireless networks allow Wi-Fi enabled devices, such as laptops and tablets, to connect
to the network using a network identifier known as a service set identifier (SSID). While
a wireless router can be configured not to broadcast the SSID, this should not be
considered adequate security for a wireless network.
Hackers will know the preset SSID and default password. Therefore, these details must
be changed to prevent intruders from entering the home wireless network. Additionally,
you should encrypt wireless communication by enabling wireless security and the

5
 Cisco Networking Academy 2023

WPA2 encryption feature on the wireless router. But keep in mind that even with WPA2
encryption enabled, a wireless network can still be vulnerable.
Select the image to learn more about the discovery of a security flaw in the
WPA2 protocol in 2017.

This vulnerability can be exploited using the Key

Reinstallation Attack (KRACK) by attackers. In
simple terms, attackers break the encryption
between a wireless router and a wireless
device, giving them access to network data.
This flaw affects all modern, protected Wi-Fi
networks.

To mitigate this situation, you should:

 Update all affected products such as wireless routers, laptops and mobile
devices as soon as security updates become available.
 use a wired connection for any device with a wired network interface card (NIC)
 Use a trusted virtual private network (VPN) service when accessing a wireless
network
Click here for more information about KRACK.

KRACK: Introduction
We discovered serious weaknesses in WPA2, a protocol that protects all modern
protected Wi-Fi networks. An attacker within range of a victim can exploit these
weaknesses using key reinstallation (KRACK) attacks. Specifically, attackers can use
this new attack technique to read information that was previously assumed to be
securely encrypted. This can be abused to steal sensitive information such as credit
card numbers, passwords, chat messages, emails, photos, etc. The attack works
against all modern protected Wi-Fi networks. Depending on the network
configuration, it is also possible to inject and manipulate data. For example, an attacker
could inject ransomware or other malware into websites.
The weaknesses are in the Wi-Fi standard itself, and not in individual products or
implementations. Therefore, any correct implementation of WPA2 is likely affected. To
avoid the attack, users should update affected products as soon as security updates
are available. Please note that if your device supports Wi-Fi, it is most likely
affected. During our initial investigation, we discovered that Android, Linux, Apple,

6
 Cisco Networking Academy 2023

Windows, OpenBSD, MediaTek, Linksys, and others are affected by some variant of
the attacks. For more information on specific products, please consult the CERT/CC
database or contact your vendor.
The research behind the attack will be presented at the Computer and
Communications Security (CCS) conference and the Black Hat Europe conference.
Our detailed research paper is now available for download.

October 2018 Update: We have a follow-up paper in which we generalize the attacks,
look at more handshakes, bypass official Wi-Fi defense, audit patches, and improve
the attacks using implementation-specific bugs.

3.1.4 Risks of public Wi-Fi

When you're away from home, you can access your online information and surf the
Internet through public wireless networks or Wi-Fi hotspots. However, there are some
risks involved, which means it's best not to access or
send any personal information when using a public Wi-
Fi network.
You should always check that your device is not set to
share files and media data, and requires user
authentication with encryption.
You should also use an encrypted VPN service to
prevent others from intercepting your information (known
as “snooping”) over a public wireless network. This service provides you with secure
access to the Internet by encrypting the connection between your device and the VPN
server. Even if hackers intercept a data transmission in an encrypted VPN tunnel, they
will not be able to decrypt it.
Click here for more information about personal protection when using wireless
networks.

Don't forget that the Bluetooth wireless protocol, found in

many smartphones and tablets, can also be exploited by
hackers to spy, set up remote access controls, distribute
malware and drain batteries.
So my top tip is to keep Bluetooth off when you're not
using it.

7
 Cisco Networking Academy 2023

3.1.5 Password Security

You have logged into your new laptop and it has asked you to change the network
password. You already have a hard time remembering the few passwords you use for
your personal online accounts.
He asks one of his colleagues for advice. They tell you to use one of the passwords
you use for your personal accounts, that's what they do! They keep their personal
passwords written at the back of their diary, in case they forget them.
How would you rate your colleague's attitude towards password security on a scale of
1 (bad practice) to 5 (good practice)?
Make your choice by sliding the marker on the scale and then click Submit.

It's right!
You have correctly identified that your colleague advocates poor password practices
and have improved your privacy settings. Check your progress by clicking on the icon
in the top right corner of the screen.
It is important that all of your online accounts have a unique password. Using the same
passwords leaves you and your data vulnerable to cybercriminals.
And if it becomes too complicated to remember all these passwords, you should use a
password manager. This tool stores and encrypts all your passwords and helps you log
in to your accounts automatically.

3.1.6 A Secure Password

Here are some simple tips to help you choose a strong password.

8
 Cisco Networking Academy 2023

3.1.7 Using a Passphrase

To prevent unauthorized access to your devices, you should consider using
passphrases instead of passwords. A passphrase typically takes the form of a
sentence ('Acat th @tlov3sd0gs. '), which makes it easier to remember. And because
it's longer than a typical password, it's less vulnerable to dictionary or brute-force
attacks.
Here are some tips for creating a good passphrase.

9
 Cisco Networking Academy 2023

3.1.8 Password Guidelines

The United States National Institute of Standards and Technology (NIST) has
published enhanced password requirements. NIST standards are intended for
government applications, but can also serve as standards for other applications.
Select the image for a summary of these guidelines.

These guidelines aim to place the responsibility for user verification on service
providers and ensure a better experience for users overall. They state:
 Passwords must be at least 8 characters, but no more than 64.
 Do not use common or easily guessed passwords, for example, “password”,
“abc123”.
 There should be no rules of composition, such as including numbers and upper and
lower case letters.
 Users should be able to see the password as they type, to help improve accuracy.
 All printing characters and spaces must be allowed.
 There should be no password hints.
 There should be no password expiration period.
 There should be no knowledge-based authentication, such as having to provide
answers to secret questions or verify transaction history.

10
 Cisco Networking Academy 2023

Click here for more information on these NIST

password requirements.

11
 Cisco Networking Academy 2023

3.1.9 Password verification

Based on all this information, you are ready to update your network password. You are
considering several possible options.
Take a look at each of the passwords and decide whether you think it is a strong or
weak choice. Do it right and you'll improve your privacy settings.
Select Start to begin.

12
 Cisco Networking Academy 2023

13
 Cisco Networking Academy 2023

That's right, well done!

By identifying and choosing strong passwords, you have improved your privacy
settings. Click the icon in the top right corner to see how it's going.
Don't forget that passwords are widely used to prevent unauthorized access to your
data and resources. So, to protect yourself and stay ahead of attackers, be sure to
always follow the instructions provided in this topic and create strong, unique
passwords for all of your online accounts.

Next...
While access to your computers and network devices is secure, it's also important to
protect and preserve your data.

14
 Cisco Networking Academy 2023

DATA MAINTENANCE

Are you ready to show all your photos and documents to

strangers? Your financial information with your friends?
Do you share your email passwords with the general
public? No? So your data must be encrypted.

3.2.1 What is encryption?

Encryption is the process of converting
information into a format that cannot be
read by an unauthorized party. Only a
trusted person authorized with the
password or secret key can decrypt the
data and access it in its original format.
Note that encryption itself does not prevent
someone from intercepting the data. It can
only prevent an unauthorized person from viewing or accessing the content. In fact,
some criminals may decide to simply encrypt your data and make it unusable until you
pay a ransom,

3.2.2 How is your data encrypted?

Expandable section list. Select each button to expand the content.
Software programs are used to encrypt files, folders, and even entire drives.
The Encrypting File System (EFS) is a Windows feature that allows you to encrypt
data. It is directly linked to a specific user account and only the user who encrypts the
data will be able to access it after it has been encrypted using EFS.
Select the headings to find out how to encrypt data using EFS on all versions of
Windows.

Step 1

15
 Cisco Networking Academy 2023

Step 2

Step 3

Step 4

16
 Cisco Networking Academy 2023

Step 5

Consider how much valuable data you have stored on

your mobile phone or laptop. You probably have important
documents, contact information, and family photos!
Imagine if your mobile phone was stolen or your laptop
was lost. All that information would be lost... unless you
back it up!

3.2.3 Backup your data

Image with selectable areas. Select each button to display more information.
Having a backup can prevent the loss of irreplaceable data, such as family photos. To
properly back up your data, you will need an additional storage location for your data
and you will need to copy your data to that location periodically and automatically.
Select the pins to explore some of these additional storage locations.
Home network

17
 Cisco Networking Academy 2023

Storing your data locally means you have complete

control over it.

Secondary location
You can copy all your data to a network attached storage
(NAS) device, a simple external hard drive, or you can
select just a few important folders to back up to USB flash
drives, CD/DVDs, or even tapes. In such a scenario, you
own and are fully responsible for the cost and
maintenance of the storage device equipment.
The cloud
You can subscribe to a
cloud storage service, such as Amazon Web Services
(AWS). The cost of this service will depend on
how much storage space you need, so you may
need to be more selective about what data you back
up. You will have access to the backup as long as you
have access to your account.
One of the benefits of using a cloud storage service is
that your data is safe in case a storage device fails or if you experience an extreme
situation, such as a fire or theft.

3.2.4 Are they really gone?

This is a multiple choice question. Once you have selected an option, select the Submit
button below.
You've logged into your laptop but it contains some photos belonging to the previous
user, who no longer works at @Apollo. Your line manager asks you to delete them.
You drag the photos to the Recycle Bin, open the Recycle Bin, select them, and click
“Delete” again. That should do it!
Do you think the photos are gone from your laptop?
Select the correct answer and then Submit.

18
 Cisco Networking Academy 2023

 Yes, the photos can no longer be recovered.

No, the photos are simply inaccessible from the operating system

It's right!
When you move a file to the Recycle Bin and permanently delete it, the file cannot be
accessed from the operating system alone. Anyone with the right forensic tools can
recover the file because of the magnetic trail it leaves on the hard drive.
So how do you ensure that deleted data can no longer be recovered? Let's see!

3.2.5 How is your data permanently deleted?

Have you ever had to delete data or get rid of a hard drive? If so, have you taken any
precautions to protect the data and prevent it from falling into the wrong hands?
Select the images to learn what you need to do to ensure your files are safely
and permanently deleted.

To erase data so that it is not recoverable, the data

must be overwritten with ones and zeros multiple times,
using tools specifically designed to do just that.
Microsoft's SDelete program (for Vista and later) claims
to have the ability to completely delete sensitive files.
Shred for Linux and Secure Empty Trash for Mac OS X
claim to provide a similar service.

To erase data so that it is not recoverable, the data must

be overwritten with ones and zeros multiple times, using
tools specifically designed to do just that. Microsoft's
SDelete program (for Vista and later) claims to have the
ability to completely delete sensitive files. Shred for
Linux and Secure Empty Trash for Mac OS X claim to
provide a similar service.
The only way to be sure that data or files are not
recoverable is to physically destroy the hard drive or storage device. Many criminals
have taken advantage of files that are considered impenetrable or unrecoverable!

19
 Cisco Networking Academy 2023

Don't forget about the data that can be stored online in

the cloud. Such copies must also be deleted.

Next...
Take a moment to consider where you store your data. Is it backed up and encrypted?
Why not put some of the information in this topic into practice and keep your valuable
information safe and secure?
You should also be aware of how your personal data will be handled when you enter
into a service agreement with an online service provider.

20
 Cisco Networking Academy 2023

LAB
Who owns your data?

3.3.1 Terms of Service

You have been asked to set up an online photo
storage and sharing account to use for creative
collaboration with the design department and other
@Apollo teams.
When you register, you will be asked to sign a
service agreement with the provider. You don't think
about it too much and agree to all the terms without
reading them.
You just signed a Terms of Service agreement. But do you know what this is? Consider
the following options and choose the one you think best describes a Terms of Service
agreement.
Select the correct answer and then Submit.

A contract that describes the services you expect to receive from the service
provider and how you will use their service

An informal agreement that sets out the rules of the relationship between you, the
service provider, and other people who use the service

A legally binding contract that governs the rules of the relationship between
you, the service provider, and others who use the service.

21
 Cisco Networking Academy 2023

It's right!
Terms of Service, also known as Terms of Use or Terms and Conditions, are a legally
binding agreement that governs the rules of the relationship between you, your
provider, and others who use the service.
Scroll down to learn more about what is included in the Terms of Service.

3.3.2 Understand the terms

Slideshow. Select the Next button to proceed.
The Terms of Service will include a number of sections, from user rights and
responsibilities to disclaimers and account modification terms.
Select the arrows for more information.
Data Use Policy
The data usage policy describes how the service provider will
collect, use and share your data.

Privacy Policy
Privacy settings allow you to control who sees information
about you and who can access your profile or account data.

Data Use Policy

The security policy describes what the company is doing

to protect the data it collects from you.

3.3.3 What are you agreeing to?

22
 Cisco Networking Academy 2023

You have successfully created the @Apollo account and agreed to the online photo
sharing company's Terms of Service. But do you really know what you've signed up
for?
Let's look at this in more detail.

3.3.4 Data Usage Policy

The data usage policy of the company you used to set up your account states that for
any content you post: “you grant us a non-exclusive, transferable, sublicensable,
royalty-free, worldwide license to host, use, distribute, modify, perform, copy, publicly
perform or display, translate, and create derivative works of your content (in
accordance with your privacy and application settings).”
What does this statement really mean?
Select the correct answer and then Submit.

You no longer own your content and the photo sharing company can reuse any of
your content, but only under specific circumstances.

The content is yours, but the company may reuse any of your content for any
purpose.

You own your content and the photo sharing company must obtain permission to
reuse your content.

That's how it is.

This means that while you own the content, the company may reuse any content you
have shared for any purpose.

3.3.5 Privacy Settings

Since you did not set any privacy settings before accepting the terms, the default
settings were applied.
Which of the following options do you think is most likely?
Select the correct answer and then Submit.

No one will be able to see information about you or access your profile until you
change your preferences in your privacy settings.

23
 Cisco Networking Academy 2023

Anyone will be able to see information about you and access your profile
until you change your privacy settings.

That's how it is.

Accepting the default privacy settings usually means that anyone can see information
about you and access your profile.

Now that you've looked at it more closely, do you still agree with all of these terms?

3.3.6 Before registering

What factors should you consider before subscribing to an online service?
Select the image to find out.

Have you read the terms of service agreement?

What are your rights in relation to your data?
Can you request a copy of your data?
What can the provider do with the data you upload?
What happens to your data when you close your account?

3.3.7 Protect your data

You should always take appropriate steps to protect your data and safeguard your
account.
Thinking about the Terms of Service examples described above, what can you do to
protect yourself when entering into an agreement with an online service provider? What
can you do to protect your account and data?
Write your ideas in the box below, then submit. Select Show Answer to check
your answer.

How to protect yourself from a supplier agreement

 Put it in writing. Include security provisions in your supplier contracts
 Establish processes that allow you to confirm that suppliers comply with your
rules
 Make sure your vendors keep their security up to date.

24
 Cisco Networking Academy 2023

How to protect my account and data

 Control access
 Safeguard your data
 Protect your network. Require strong passwords.
 Use a multi-factor authentication system

Answer. To protect your data and secure your account, you must:
 Always read the Terms of Service when signing up for a new service and
decide whether it is worth giving up your rights to your data for the service.
 select your privacy settings instead of accepting the default settings
 limit the group of people you share content with
 Review the service provider's security policy to understand what they are doing
to protect your data
 change your passwords periodically, use a complex password and two-factor
authentication to protect your account.

Next...
Paying attention to the Terms and Conditions before signing up is just one way to
protect your data. Let's look at what else you can do to help protect your privacy online.

25
 Cisco Networking Academy 2023

PROTECTING ONLINE PRIVACY

3.4.1 Two-Factor Authentication
Popular online services, including Google, Facebook,
Twitter, LinkedIn, Apple, and Microsoft, use two-factor
authentication to add an extra layer of security for
account logins.
In addition to your username and password, or a
pattern or personal identification number (PIN), two-
factor authentication requires a second token to verify
your identity. This could be:
 physical object such as a credit card, cell phone or key chain
 Biometric scanning such as fingerprints or voice or facial recognition
 verification code sent by SMS or email.
Click here to learn more about two-factor authentication.

Be careful!
Even with two-factor authentication, hackers can still
gain access to your online accounts through attacks
such as phishing, malware, and social engineering.

3.4.2 Open Authorization

Open Authorization (OAuth) is an open standard protocol that allows end-user
credentials to be accessed by third-party applications without exposing users'
passwords.
Select the arrows to see what this means in practice.

He is looking forward to enrolling in Cisco’s

“Cybersecurity Essentials,” the next course in this

26
 Cisco Networking Academy 2023

series, which will help him develop his career. However, you must log in to the
eLearning portal to do so.

You can't remember your login details, but that's

okay. The portal gives you the option to log in with
your credentials from a social networking website
like Facebook or through another account like
Google.

So, instead of having to reset your login

details, you log in to the e- learning portal
with your existing social media accounts
and register for your next course with
ease. Can't wait to get started!

3.4.3 Social Sharing

This is a multiple choice question. Once you have selected an option, select the Submit
button below.
He decides to update his new job position on his social networks. In doing so, one of
the sites asks you to update your profile information to ensure you receive the content
you really don't want to miss.
Please take a look at the missing fields. Which ones does it fill? Remember that
responding correctly will improve your privacy settings, so think carefully about the
information you want to share online.
Select the two correct answers and then Submit.

Birthdate

Your profile picture

Name and contact information of your manager

27
 Cisco Networking Academy 2023

Cell phone number

Name of the organization

The names and contact information of your colleagues

Email address

It's right!
She shared just the right amount of information and improved her online privacy
settings. Click the icon in the top right corner to check your progress.
To protect your privacy on social media, it is important to share as little personal
information as possible. You should check your social media settings to allow only
people you know to see your activities or participate in your conversations.
The more personal information you share online, the easier it is for someone to build a
profile of you and take advantage of you online or off.

3.4.4 Don't be fooled

This is a media player component. Select the play/pause button to watch or listen.
A simple spoofed email can lead to a massive data breach and possibly cause
irreversible damage to your reputation.
Press the play button to find out how

How did you decide to become a hacker?

(Laughs) Well, I'm not really sure what hacker means. It's like a guy in a hoodie who
types really fast and stays up all night typing codes and cracking passwords. That's not
me. I just spy on people and see what makes them click. Not a bad job.
[Male News Anchor 1] Marck Hanning, CEO of Qualicart is said to be reporting profits
after his blockbuster IP
So, do you consider it a job?
I've been working hard on this. I'm not lazy. Research is needed to determine the key
players and learn everything about them, their families, their friends, what interests
them. You have to understand the organization of the company. I get a lot of my
information from the sales department because they are always faster and more eager,
they have a desire to achieve more. People trust too easily. They don't look at the
details. I know. Details matter, that's what I'm good at. They have to seem completely
credible. They have to look familiar. This is where research is important. This is not a

28
 Cisco Networking Academy 2023

generic piece of spam, it is an email from your boss with your company's signature. It is
written in the voice of the boss. This is what he would say if he wrote this.
What about the malware itself? How does that work?
Someone else out there has already written the code that performs the attack. I only
use it in the attachment. My skill is in my ability to get a lot of people to click on that
attachment. I always wonder what it's like when everything starts happening from the
other side, when the panic begins.
[Answering Machine] Please leave your message after the beep. (The machine
beeps.) Hi, this is Rajeed from finance, call me as soon as you get this, something is
wrong with my laptop. I can't— Hey, are you on your way to the office? Something's
going on with our file servers. I'm Karen from HR, our monitoring panel is very slow, we
are receiving calls from users on it. Can you call me when you hear this? Joining the
conference now. Apparently, there is a malware patch targeting our headquarters – It’s
ransomware, they are holding us hostage. We're all locked down, I can't even check
my phone.
What about backups?
That will take days. We need you to fix it now! Just pay the ransom, we have no choice.
We are reporting earnings in two hours. But how do we know it's going to— Just pay it!
Put each person in charge to get us back up and running. Now it is the only priority.
Okay, it's done. I have the decryption key. Mark, we have a big problem. The
ransomware was just there to distract us. They came in, they have everything.
Customer data, finances, everything!
[Male News Anchor 2] Qualicart is reeling today from news that hackers have
published the personal information of nearly two million ---
[Female News Anchor] The NASDAQ closed lower today, led by Qualicart, which fell
14% on news that its recent data breach may be much worse than the company
originally acknowledged.
[Male News Anchor 3] Shares fell to a new all-time low on news that CEO Mark
Hanning is stepping down, following what turns out to be one of the worst breaches of
personal information in recent history.
Do you feel bad about disclosing personal information?
All the finances, all the money was lost. All I did was get the files. I'm not the one who
decided to release them, I'm not the one who shorted the shares. Someone else has
their reasons for that, it's above my pay grade. I was paid to do a job and I did it well.
And that's what's expected of everyone, isn't it? The markets are rebounding anyway.

29
 Cisco Networking Academy 2023

The Internet is a great tool not only for accessing

information quickly and easily, but also for
communicating with friends, family and colleagues.
But did you know that anyone with physical access to
your device or router can see the websites you've
visited? And that every time you send an email, it can
be read by anyone who has access to the digital chain
between you and your recipient?
So what can you do?

3.4.5 Email Privacy and Web Browsers

These problems can be minimized by enabling private browsing mode in the web
browser. Most popular web browsers have a specific name for private browsing mode:
 Microsoft Internet Explorer: InPrivate
 Google Chrome: Incognito
 Mozilla Firefox: Private Tab or Private Window
 Safari: Private Browsing
Select the image to learn how private mode works.

When private mode is enabled, cookies (files saved on

your device to indicate which websites you have visited)
are disabled. Thus, all temporary Internet files are
deleted and browsing history is removed when you
close the window or program. This can help prevent

30
 Cisco Networking Academy 2023

others from collecting information about your online activities and trying to tempt you
into purchasing something with targeted ads.
Even with private browsing enabled and cookies disabled, companies develop different
ways to identify users to collect information and track user behavior. For example,
intermediary devices, such as routers, may have information about the user's web
browsing history.

Next...
Finally, it is your responsibility to protect your data, your identity and your computing
devices. So, next time you're sending an email or surfing the Internet, why not check
that you're following all the guidelines outlined in this module? Just a few precautions
can save you trouble in the future.
Let's see if you can spot risky online behavior.

31
 Cisco Networking Academy 2023

LAB
Discover their risk-taking behavior
online

3.5.1 Scenario 1
This is a media player component. Select the play/pause button to watch or listen.
Do you know what information is safe to share on social media sites?
Press the play button to watch the video.
Description: A computer screen shows a social media website with a picture of a
beach and a "post" button. The words “Finally on vacation!!!” are written as a caption
above the image.
Narrator: Always limit the amount of information you share online.
Description: A red triangle containing an exclamation point appears, giving a
"danger" warning signal.
Narrator: Think about what data you are going to share about yourself. Could it be a
threat?
Description: The camera zooms out to show the entire team. A loading progress line
connects the computer to a World Wide Web (www) icon and then connects to a
hooded character sitting in front of a laptop with a "skull and crossbones" symbol.

32
 Cisco Networking Academy 2023

Narrator: Posting something containing your address along with a recent vacation
photo of yourself could be an invitation for criminals to target your home.
Description: The view returns to the computer still showing the social media website
with the beach image and the title “Finally on vacation!!!”. The mouse pointer clicks on
the “Publish” button and it loads on the web page.
Narrator: Remember that a social media post can spread quickly because it can be
shared over and over again with people you don't know.

It's amazing what people post on social media without thinking! Which of the following
options do you think represents a risk if posted on social media?
Select three correct answers and then Submit.

33
 Cisco Networking Academy 2023

It's right!
Photos that show bank details or valuable information about assets and vacations
always put you at risk, especially when you have already given clues about where you
live or where you are going to visit. Always stop and think about what you are about to
post, would you say it to a complete stranger?

3.5.2 Scenario 2
When creating a new account on an online service, what password do you use? Is it
safe?
Press the play button to watch the video.
Description: A computer screen appears showing different login screens. A hidden
password is entered in each login box.
Narrator: For every online service you use, you should use a unique, strong password.
Description: Mouse cursor clicks on the “Login” button on the @Apollo login screen.
The hidden password turns red and an error message appears saying “It appears this
data is incorrect. Please try again."
Narrator: Memorizing a lot of passwords can be a challenge, but writing them down
would be a security nightmare if someone had access to them.
Description: The camera zooms in on the @Apollo login screen, which resets and a
"Password Manager" dialog box appears next to a lock icon at the top right of the
computer screen.
Narrator: Instead, you should start using some password management apps.

34
 Cisco Networking Academy 2023

Description: The mouse cursor clicks on an arrow symbol next to the word @Apollo in
the Password Manager dialog box. Username and password information is seen by
filling in the login fields.

In your own words, describe what a password manager app is, how they work, and why
they are beneficial. If you have already used a password manager, please describe
some details and share your experience.
Type your ideas in the box and then submit. Select Show Answer to check your
answer. (500 Characters remaining)

A password manager is an encrypted platform that stores all your Internet

access credentials. The advantage is that you can set different combinations
with a variety of characters and truly robust keys for each website, as the
platform will automatically remember them for you.
If you decide to use a manager, you should know that the only password you will
have to remember is that of that platform, that is the way to verify that it is you
who wants to log in.

Answer. Password management applications can protect passwords by storing them

in a secure encrypted format. They allow you to easily generate and manage random
passwords, avoiding the need for users to have the same password for multiple
accounts, which presents a security risk.

3.5.3 Scenario 3
This is a media player component. Select the play/pause button to watch or listen.
Connecting to an open Wi-Fi hotspot can make your system and data vulnerable to
attack.
Press the play button to watch the video.
Description: Three circles appear containing images of hands using a mobile phone,
a woman sitting in front of a computer, and hands typing on a keyboard.
Narrator: Being online has become an essential part of our daily lives.
Description: The camera zooms in on the woman sitting in front of a computer. The
screen displays a “Connect to Wifi” login box for the CoffeshopWiFi network. A hidden
password is entered and the mouse cursor clicks on the “Connect” button.

35
 Cisco Networking Academy 2023

Narrator: However, we should all think twice before connecting to the Internet through
an open public Wi-Fi hotspot.
Describer: Camera pans out to show woman sitting in a coffee shop setting while
accessing the @Apollo website. A hooded figure sits in front of a computer at a nearby
table. The screen moves to focus on the hooded figure and a “Sensitive Information
Download” box appears with a loading bar showing the progress of the download.
Narrator: It may be hosted by an attacker who will have access to the data you are
transferring.
Description: The screen is split into four sections as the progress bar in the
“Downloading Confidential Information” box turns red before completing and says
“FAILED.” In the other areas of the screen, the hooded figure can be seen, along with
the woman in the cafe and a “Connect to VPN” login box.
Narrator: Try using a VPN to provide a layer of security over insecure open Wi-Fi and
only access websites via HTTPS.
Description: The mouse cursor clicks to connect to the VPN and the screen returns to
the woman sitting in the cafe once again as she accesses the @Apollo website as a
VPN user. The URL address https://www.apollo.com can be clearly seen.
@Apollo sales manager travels to meet a client. He forgot to download the

contract from the @Apollo server to take to the meeting with her. The train has
an open WiFi network. He contacts you to ask what he should do. What would
you advise?

You should use your phone's 4G connection to find an alternative open Wi-Fi
network.

You should access the train's open Wi-Fi network and connect to the @Apollo
servers using the VPN connection on your work laptop.

36
 Cisco Networking Academy 2023

You must wait until you arrive at the client's office and request the access
code to their Wi-Fi network, then access the @Apollo service directly on your
work laptop.

You should forget about the contract for the meeting and catch up on other work
online by using the train's open Wi-Fi to access the https websites you need.

It's right!
The sales manager can use the VPN connection on his laptop to create a secure,
encrypted channel back to @Apollo, in addition to the untrusted open Wi-Fi network.
This way, all your laptop traffic will be safely transferred through the secure VPN
tunnel.

3.5.4 Scenario 4
This is a media player component. Select the play/pause button to watch or listen.
Do you know the risks of downloading a trial version of a program?
Press the play button to watch the video.
Description: A computer screen appears showing a progress loading bar titled "Test
Install." A red triangle containing an exclamation point appears indicating a hazard
warning,
Narrator: Installing apps on your device from untrusted sources is a huge security risk.
Description: A gremlin icon appears in the center of the computer screen and
several folder icons on the left side start displaying "No Entry" symbols.
Narrator: How do you know the app doesn't come with malware?
Description: A pop-up appears in the top right corner of the screen that says “You
have 5 new messages.”
Narrator: Can you take the risk?
Description: A mouse cursor clicks on the pop-up window and a mailbox opens
displaying several emails with subject lines related to hacking and data security
breaches:
URGENT: Your online bank account has been hacked.
URGENT: Your social media accounts have been closed.
IMPORTANT: Your fraudulent activity is being investigated.
URGENT: Please contact regarding your online account.
EMERGENCY ACTION REQUIRED: You are a victim of identity theft!
Narrator: Can your organization afford the risk?

37
 Cisco Networking Academy 2023

A designer at @Apollo needs to install some image manipulation software. The

core app is really expensive and is only needed for a small part of a one-time
project. The design manager says it would not be a cost-effective purchase and
mentions installing an alternative free app; the manager doesn't care if it comes
from an untrusted source as he believes the risks are low. Should the designer
follow the manager's advice?
Select the correct answer and then Submit.

Of course, the manager has given instructions to the designer, so it is okay to

install the free app. It will save the company some money!

No, the designer should consult with a member of the IT team before
installing any application from an untrusted source.

Yes, the design manager considers the risk to be low, so it must be correct!

No, the designer must purchase the trusted application from the conventional
software vendor and pay for it with his own money.
It's right!
The designer should consult with a member of the IT team before installing any
application from an untrusted source, even if a manager recommended it. No
organization can afford to risk a cyberattack by installing applications from an untrusted
source.

3.5.5 Scenario 5
This is a media player component. Select the play/pause button to watch or listen.
Have you ever received a warning message telling you to download a diagnostic
program to ensure the safety of your computer? You must be aware of the risks.
Press the play button to watch the video.
Description: A computer screen appears displaying a pop-up box with the message:
'Your computer has been infected with a virus and your computer is at risk. Download
A++ Premium Antivirus Software Now to Prevent Damage to Your Files. Red warning
triangles containing exclamation marks are placed next to the text to create a sense of
danger.
Narrator: You may have seen them before; you're browsing the web and suddenly a
pop-up appears with a scary warning...
Description: The camera zooms in on the pop-up message and the mouse cursor
clicks on the “Download Now” button.

38
 Cisco Networking Academy 2023

Narrator: He says that your computer is infected with a virus and recommends
downloading special antivirus software.
Description: The screen changes to show a larger pop-up window containing a
gremlin icon and a "Downloading" progress bar, which begins to fill. The mouse cursor
clicks on “Cancel” and the pop-up window closes and returns to the desktop view of the
computer screen.
Narrator: You must never follow any of these instructions! Most of these pop-ups are
just trying to convince you to download a new, potentially malicious application on your
computer.
Description: The mouse cursor clicks on an “Antivirus Software” icon in the top left
corner and an application window appears displaying a progress bar and the message
“Running a security scan.”
Narrator: Instead, simply close the pop-up or browser and, to be safe, run a system
security scan with your trusted antivirus software on your computer.
Description: The progress bar fills and the message changes to “System Security
Scan Complete.” You have accessed a website that poses a security risk. We are
scanning your system and will remove all harmful files.

This message appears while you are

online. Which of the following measures
should you take?
Select the correct answer from each
drop-down list, then Submit.

1. Close the pop-up window or browser:

Clicking on “X”
2. Protect your system, which has not yet been damaged, as follows:
Running a system security scan with your trusted antivirus software
3. Check if a legitimate application update is needed from a trusted source:
Checking if you have the ACCESOSOCIALAHORA app and if so, visit their
official website

It's right!

39
 Cisco Networking Academy 2023

Clicking anything other than the close icon could put your system at risk.
To be safe, you should run a system security scan with your trusted antivirus software
on your computer. And you should always decline or cancel update reminders unless
you are sure they come from an official, trusted source.

3.5.6 Scenario 6
This is a media player component. Select the play/pause button to watch or listen.
Clicking on links in an email may seem safe, but often not everything is as it seems.
Make sure you know the signs to look out for!
Press the play button to watch the video.

Description: The camera zooms into an office environment to an employee sitting in

front of a computer. A “You have new email” message appears on your screen.
Narrator: You just received an email that appears to be from your IT department.
Description: The camera zooms in as the mouse cursor clicks to open the mailbox.
The email containing the text opens:
Subject: Everyone please click this link quickly
Greeting team,
You must click this link quickly to reactivate your account.
Sincerely, from your IT team.
Narrator: It's written in broken English and asks you to click a link to reactivate your
account.
Description: Mouse cursor highlights email address: From: itdepartment <
[email protected] >
Then the mouse cursor clicks to delete the email.
Narrator: Sounds pretty suspicious. If the link URL is outside your organization's
domain, it is most likely a phishing email; delete it.
Description: The mouse cursor clicks to view the following email, which displays the
message:
From: IT
Subject: Measures are needed. Read and confirm when finished
Hi guys!
Could you please click on this link and follow the instructions to reactivate your
account? Please reply to notify us once you have taken action.
Good luck,
Matt

40
 Cisco Networking Academy 2023

Matt Smith
IT Manager | Ext: 3400 | Mobile: 07000 800900
@Apollo
Narrator: However, even if it looks okay, before you click on any link, you should first
check with your IT department to make sure they actually sent this email.

You should check with your IT department to make sure they

actually sent this email.
@Apollo has seen an increase in the number of phishing emails received by its staff.
They decide to implement a quick training exercise to help employees spot the signs of
an insecure email. Try it yourself!
When you click Home, you will be presented with a few different sections of
emails claiming to come from @Apollo. For each one, click “SURE” if you think it
indicates the email is safe, or click “NOT SAFE” if you think the email is
suspicious.

NOT SURE NOT SURE

NOT SURE SURE

UNSURE

41
 Cisco Networking Academy 2023

It's right!
Key signs of a potential phishing email are signs that it was sent from outside the
organization.
Remember that even if you think the email is safe, you should always check with your
IT department before clicking on links to download anything.

Next...
This module is almost complete. But before you go any further, let's check your
knowledge with a quick quiz.

42
 Cisco Networking Academy 2023

QUESTIONNAIRE
The following quiz is based on what you have just learned. There are 12
questions in total and you must score at least 70% to pass.
Luck!

Question 1
Why do IoT devices pose a greater risk than other computing devices on a
network?

IoT devices cannot operate in an isolated network with a single Internet

connection.

Most IoT devices do not require an Internet connection and therefore cannot
receive new updates.

Most IoT devices do not receive frequent software updates.

IoT devices require unencrypted wireless connections.

Question 2
What should you do to ensure that people you live with do not have access to
your secure data?

Install and update antivirus software.

Activate the firewall

Increase your browser's privacy settings

Setting up password protection

Question 3
What type of technology can prevent malware from monitoring user activities,
collecting personal information, and delivering unwanted mobile ads to a user's
computer?

Two-factor authentication

Anti-spyware technology

43
 Cisco Networking Academy 2023

Firewall

Password Manager

Question 4
You want to print photos you've saved to a cloud storage account using a third-party
online printing service. After successfully logging into the cloud account, the customer
automatically receives access to the online printing service. What allows this automatic
authentication to occur?

The user is on an unencrypted network and the cloud storage service password is
visible to the online printing service.

Your account information for the cloud storage service was intercepted by a
malicious application.

The password entered by the user for the online printing service is the same as the
password used in the cloud storage service.

Cloud storage service is an approved application for online printing service.

Question 5
Which of the following is an example of two-factor authentication?

Your account number and your name

Your fingerprint and your password

Your answer to a general knowledge question and your password

Your username or password

Question 6
How can users working on a shared computer keep their personal browsing
history hidden from other workers who may use the same computer?

Use the private mode of the web browser

Restart your computer after closing your web browser

Use only an encrypted connection to access websites

Move downloaded files to the recycle bin

44
 Cisco Networking Academy 2023

Question 7
Which of the following is a requirement for a strong password?

Use at least eight characters

Use special characters like ! @ or $

Use a dictionary word or a common statement that you remember

Question 8
Which password will take the longest for a malicious user to guess or "crack"?

10 characters

super3secret2password1

drninjaphd

mk$$cittykat104#

Question 9
How can a user prevent others from intercepting network traffic when operating
a computer at a public wireless access point?

Connect to a VPN service.

Disable Bluetooth

Create strong and unique passwords

Use WPA2 encryption

Question 10
What is the best method to prevent Bluetooth attacks?

Always turn off Bluetooth when not actively used

Always use a VPN when connecting to Bluetooth

Use only Bluetooth to connect to another smartphone or tablet

Only use Bluetooth when connecting to a known SSID

Question 11
Which technology eliminates direct user maintenance and equipment costs for
data backup?

45
 Cisco Networking Academy 2023

A ribbon

An external hard drive

A cloud service

Network Attached Storage

Question 12
What is the only way to ensure that files deleted from your computer are
unrecoverable?

Use a software program like SDelete or Secure Empty Trash

Physically destroy the computer's hard drive

Empty the recycle bin on your computer

Description: A red target symbol randomly moves over various people icons on the
screen.
Narrator: We are all targets!
Description: The target symbol stops and approaches one of the person icons. It links
to a smartphone which then links to the hooded hacker character working on a laptop
with a skull and crossbones on the other side.
Narrator: Cybercriminals want our personal information...

46
 Cisco Networking Academy 2023

Description: A small white circle is placed over an empty input field on the smartphone
screen. It is filled with four asterisks and a red line strength indicator appears below it.
Narrator: ...and will exploit any weaknesses in our computing devices or online
accounts to obtain it.
Descriptor: One of the asterisks disappears and two more are entered into the field.
The force line indicator below turns green. The hooded hacker character disappears
and a green login button appears on the smartphone screen. The little white circle
moves and presses the login button.
Narrator: Making some small changes to your online behavior can reduce your
chances of becoming a victim of cybercrime.
Description: A Module 3 knowledge check activity titled “Are They Really Gone?”
appears on screen. The cursor clicks on the correct answer and then on the "Submit"
button. The privacy settings indicator turns red and then turns blue when all knowledge
check questions have been answered correctly.
Narrator: You're off to a good start! Responding correctly to the activities throughout
this module has improved your privacy settings.
Description: The cursor points to the defensive shield icon in the upper right corner of
the module. The shield icon flashes.
Narrator: Be sure to check your settings by clicking the icon in the top right corner of
the screen.
Description: The smartphone reappears. It has a blue shield with a green check mark
in the center of the screen. The green check mark on the shield changes to a question
mark.
Narrator: Now that you know how to protect yourself from cyberattacks, you're ready
for the next step.
Description: A blue ribbon banner appears with '@Apollo' written on it. It moves to
the left side of the screen and the hooded hacker character working on a laptop with a
skull and crossbones appears on the right, with a close-up of the @Apollo website
below.
Narrator: It's time to look at what you can do to protect @Apollo from cybercrime.
Description: Four puzzle pieces come onto the screen and fit together at the top of the
@Apollo website to form an image of a closed padlock.
Narrator: Can you help protect the business before it's too late?
Description: A cursor clicks the exit icon on the Module 3 menu screen and the
Module 4 menu screen appears.
Narrator: Let’s move directly to the next module, “Protecting the Organization.”

47