Module 10 — Internet Privacy, Internet Security, Netiquette

Module 10 · week of 11/02/2026 · Tech+: Security — the CIA triad, authentication and multifactor, passwords, malware and phishing, encryption (HTTPS), backups, privacy settings and your digital footprint, and respectful online conduct. · Download .docx

Objectives

Describe risk management strategies that address information systems security threats.

Key terms

CIA triad: The three goals of information security: confidentiality, integrity, availability.
Confidentiality: Only authorized people can see the information.
Integrity: The information has not been altered without permission.
Availability: The information and systems are there when needed.
Risk management: Identifying threats to assets, weighing likelihood and impact, and choosing controls to reduce the risk.
Authentication: Proving who you are — something you know, have, or are.
Multifactor authentication (MFA): Using two or more proofs of identity, such as a password plus a code from your phone.
Passphrase: A long password made of several words plus numbers and symbols — stronger than a short clever one.
Password manager: An app that creates and stores a different strong password for every site.
Malware: Software designed to damage, spy on, or take control of a computer.
Virus / worm / trojan: Malware that attaches to files / spreads on its own across networks / pretends to be a useful program.
Ransomware: Malware that encrypts your files and demands payment for the key.
Phishing: A fake message that pretends to be from someone you trust to steal passwords or install malware.
Social engineering: Tricking people, rather than computers, into giving access or information.
Encryption: Scrambling data so only someone with the key can read it.
HTTPS: The encrypted web protocol — the padlock in the address bar.
Firewall: Hardware or software that filters network traffic in and out.
Patch (update): A software fix that closes a security hole; install updates promptly.
Backup: A second copy of your data kept in a separate place so it can be restored.
Least privilege: Giving people and programs only the access they need to do their job.
Cookie: A small file a website stores on your device to remember you.
Digital footprint: The trail of information you leave online through posts, searches, and purchases.
Netiquette: Respectful, clear conduct online — address ideas not people, no ALL CAPS, proofread, keep private matters private.

The concept

Information security protects three things — the CIA triad: confidentiality (only the right people can see it), integrity (it has not been changed without permission), and availability (it is there when you need it). Every security control protects one of the three.

Risk management is deciding which threats matter and what to do about them: identify the asset (your Canvas account, the school's student records), the threat (phishing, ransomware, a lost laptop), the likelihood and the impact, then reduce the risk with controls — or accept it, or transfer it (insurance, cloud provider).

Authentication proves who you are with something you know (password), something you have (phone, security key), or something you are (fingerprint, face). Multifactor authentication (MFA) uses two or more — a password plus a code from your phone — and stops most account takeovers even when the password leaks.

Passwords: long beats clever. A passphrase of four or more unrelated words with numbers and symbols is stronger than P@ssw0rd. Never reuse a password across sites; use a password manager; never share a password, including with a friend.

Malware is software built to damage, spy, or take control: viruses (attach to files), worms (spread on their own across networks), trojans (pretend to be useful), spyware (watches you), ransomware (encrypts your files and demands payment). Keep software updated, run antivirus, and do not install what you did not go looking for.

Phishing is a message that pretends to be from someone you trust (bank, school, a friend) to get you to click a link, open an attachment, or enter a password. Signs: urgency, threats, prizes, a sender address that is slightly off, a link whose real address does not match. Slow down. Verify by going to the site yourself, not through the link. Report it.

Social engineering is tricking people instead of computers — a phone call from 'IT' asking for your password, someone tailgating through a locked door. No real IT department asks for your password.

Encryption scrambles data so only someone with the key can read it. https:// and the padlock mean the connection between your browser and the site is encrypted; VPNs encrypt your traffic on public Wi-Fi; encrypted drives protect a lost laptop.

Backups protect availability: a second copy in a second place (cloud drive, external drive) on a schedule. Ransomware and a dead hard drive both become minor problems when a backup exists. Test that you can restore it.

Firewalls filter network traffic in and out; updates (patches) close holes attackers use; least privilege means people and programs get only the access they need. Together with MFA, backups, and awareness training, these are the controls organizations use to manage risk.

Internet privacy: websites and apps collect data through cookies, trackers, location, and what you post. Your digital footprint is the trail of everything you have posted, searched, and bought — it lasts, and colleges and employers look. Use privacy settings, think before posting, and know what an app's permissions ask for.

Netiquette — respectful conduct online, and the rule for every Canvas discussion: address the idea, not the person; use complete sentences and proofread; no ALL CAPS (it reads as shouting); no sarcasm that cannot be heard; keep private matters (grades, personal questions) out of public threads; give credit when you use someone's idea.

Module 10 items: Cybersecurity Assignment (20) and Module 10 Quiz (20) — 40 points, the week of Nov 2. After Module 10: Career Project prep (11/9), Final Career Project Presentations (11/16–11/24, 25 points), last day of regular classes 11/24, and Exam 2 – Chapters 6–10 in the final examination period 12/01–12/07 (100 points).

Worked examples

Example 1: An email says 'Your PGCC account will be deleted in 24 hours — click here to verify your password.' Name three signs this is phishing and the two correct actions. — Signs: urgency and a threat, a request for your password, a link whose real address does not match PGCC (and often a slightly-off sender). Actions: do not click — go to my.pgcc.edu yourself to check the account — and report the message to IT. No real IT department asks for your password.

Example 2: A student's Canvas password is 'largo2030' and it is the same as their game login. Rewrite it as a strong passphrase and name the one setting that protects the account even if the password leaks. — Something like 'purple-tuba-river-42!' — four unrelated words, numbers, a symbol, and used on no other site (a password manager makes that easy). Turn on multifactor authentication so a leaked password alone cannot open the account.

Example 3: Ransomware hits a school laptop on a Friday. Which CIA goal was attacked, and which single control turns this from a disaster into an inconvenience? — Availability (the files are encrypted and unusable) — and integrity, since the files were changed. A tested backup in a separate place: wipe the laptop, restore the files, no payment. Patches, antivirus, and phishing awareness reduce the chance it happens again.

Common mistakes

"A clever short password like P@ssw0rd is strong." Length wins: a long passphrase is far stronger, and MFA protects the account even if it leaks.
"The padlock means the website is safe." It means the connection is encrypted. A phishing site can have a padlock too — check the address.
"Backups are only for businesses." A backup in a second place is what turns ransomware or a dead drive into an inconvenience for anyone.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Which password is the strongest?

2. What is multifactor authentication?

3. An email claims to be from your bank and asks you to click a link and enter your password. What is this?

4. Software designed to damage, spy on, or take control of a computer is called:

5. What does the padlock icon and https:// in a browser address bar indicate?

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top