Definition: Cybersecurity (sometimes written "cyber security") is the practice of protecting computers, phones, servers, networks, and the data on them from unauthorized access, damage, theft, or disruption. It's a broad field that includes everything from the password on your phone to the firewalls protecting a hospital's patient records.

Why it matters: Almost every part of daily life now runs through connected devices and accounts — banking, healthcare, communication, work, and shopping. Cybersecurity exists because that convenience creates opportunity for criminals: a single stolen password can lead to drained bank accounts, stolen identities, or a business shutting down entirely.

The three main goals of cybersecurity are usually summarized as protecting confidentiality (keeping information private), integrity (keeping information accurate and untampered), and availability (making sure systems and data are accessible when needed) — this is known as the CIA Triad, covered in its own lesson below.

Main threat categories, explained:

Phishing — fake emails, texts, or messages designed to trick you into giving up passwords, card numbers, or clicking a malicious link.
Malware — an umbrella term for any harmful software, including viruses, spyware, and ransomware.
Ransomware — malware that locks or encrypts your files and demands payment (usually cryptocurrency) to get them back.
Social engineering — psychological manipulation that convinces people to break normal security procedures, often by impersonating someone trustworthy.
Man-in-the-Middle (MitM) attack — an attacker secretly intercepts communication between two parties, often on unsecured public Wi-Fi.
DDoS (Distributed Denial-of-Service) — overwhelming a website or service with traffic so real users can't access it.
Zero-day exploit — an attack that takes advantage of a software vulnerability before the company that made the software even knows it exists (hence "zero days" to fix it).

The most common reasons people get hacked:

1. Reusing passwords across sites — if one site gets breached, attackers try the same password everywhere else.
2. Clicking links without checking them — urgency and curiosity are a scammer's best tools.
3. Downloading files from untrusted sources — pirated software and "free" downloads are a top malware delivery method.
4. Oversharing on social media — birthdays, pet names, and school names are often used as security-question answers.
5. Ignoring software updates — updates frequently patch security holes that attackers actively exploit.
6. Falling for urgency-based messages — "act now or lose access" is designed to make you stop thinking critically.

Studies on real-world breaches consistently find that human error — not sophisticated hacking tools — is behind the large majority of successful attacks.

The CIA Triad is the foundational model used across the entire cybersecurity field to think about protecting information. It has nothing to do with the intelligence agency — CIA here stands for three core principles:

Confidentiality — only authorized people can access certain data. Encryption, passwords, and permissions all exist to protect confidentiality.
Integrity — data hasn't been tampered with or altered without authorization, and can be trusted as accurate.
Availability — systems and data are accessible to authorized users when they're needed, without unnecessary downtime or disruption.

Every security decision, tool, or policy maps back to protecting one or more of these three pillars. When evaluating any security measure, it helps to ask: "which of the three is this protecting?"

Definition: Social engineering is the practice of manipulating people into breaking normal security procedures or giving up confidential information, using psychology rather than technical hacking. Instead of exploiting a flaw in software, the attacker exploits human trust, fear, curiosity, greed, or urgency.

Why it works: Attackers impersonate trusted figures — banks, tech support, government agencies, coworkers, or even friends — because people are naturally inclined to help, comply with authority, and avoid conflict. No software vulnerability is needed; the person themselves is the target, which is why social engineering remains effective even against organizations with strong technical security.

Nearly every scam covered in this module — phishing, vishing, romance scams, tech support scams — is a specific technique built on this same underlying psychological foundation.

Phishing messages pretend to be from real companies — banks, Netflix, Amazon, delivery services — and contain links to fake websites built to look identical to the real ones. When you type your password or card details into the fake page, the attacker captures it instantly.

Two more targeted variants worth knowing:
Spear phishing — a phishing attempt personalized with real details about you (your name, employer, or a recent purchase) to seem far more convincing than a generic mass email.
Whaling — spear phishing aimed specifically at executives or high-value targets, often impersonating a CEO or CFO to authorize a wire transfer.

Vishing ("voice phishing") uses phone calls. Attackers pose as bank fraud departments, government officials, or tech support, often using caller-ID spoofing to display a legitimate-looking number.
Smishing ("SMS phishing") uses text messages containing malicious links, frequently disguised as package delivery notices, toll payment reminders, or bank alerts.
Both rely on creating panic with messages like "Your account has been compromised" or "You owe money to the government" — pressuring you to act before you have time to verify anything independently.

Scammers create attractive, believable fake profiles on dating apps and social media. They invest real time and effort building an emotional connection over weeks or months before ever mentioning money — a slow-build approach specifically designed to establish trust first.

Once trust is established, they introduce a reason for money: a medical emergency, a stuck shipment, travel costs to finally meet in person, or a "can't-miss" investment opportunity. This last version — blending a romantic relationship with a crypto or trading pitch — is sometimes called "pig butchering," since the relationship is deliberately fattened up before the financial loss.

A popup message — often loud, flashing, and hard to close — claims your computer is infected and instructs you to call a phone number immediately. The person who answers claims to be a "technician," walks you through installing remote-access software, and then either installs real malware, steals personal files, or simply charges hundreds of dollars for a "repair" that never happened.

Real companies like Microsoft or Apple do not monitor your computer for viruses and do not show browser popups asking you to call them. Any popup making that specific claim is fake by definition.

Scammers build professional-looking websites and apps offering crypto trading, forex, or other investment opportunities with implausibly consistent, guaranteed returns. The platform shows a dashboard with a steadily growing balance — sometimes even letting you withdraw a small amount early to build confidence. When you try to withdraw a larger sum, the platform suddenly demands additional "taxes," "fees," or "unlocking payments" before releasing funds that, in reality, were never actually invested anywhere.

Never share one-time passcodes (OTPs), passwords, PINs, bank card numbers, CVV security codes, ID or passport numbers, account recovery codes, or cryptocurrency private keys and seed phrases — over email, phone, text message, or social media, regardless of who is asking or how urgent they claim it is.

This single rule defeats the large majority of scams covered in this module, since almost every one of them ultimately needs you to hand over one of these specific pieces of information to actually succeed.

Definition: Malware ("malicious software") is any program intentionally designed to cause harm to a device, network, or the person using it. Malware is a broad umbrella term — viruses, worms, trojans, ransomware, and spyware are all specific categories of malware, each working differently but sharing the same harmful intent.

What malware can do: Steal passwords and financial information, encrypt your files and hold them for ransom, silently spy on your activity, display intrusive advertising, or give an attacker remote control of your device entirely.

How it spreads: Malicious downloads, email attachments, infected or compromised websites, USB drives, and increasingly, malicious QR codes and fake mobile apps.

Viruses attach themselves to legitimate files or programs and only activate once that file is opened — they require a human action (opening the infected file) to spread further.
Worms are more autonomous: they spread automatically across a network by exploiting vulnerabilities, with no user interaction needed at all, which is why worm outbreaks can spread across thousands of devices within hours.

Both can corrupt or delete files, slow systems to a crawl, and quietly open backdoors that let attackers install additional malware later.

Trojans (named after the Trojan Horse) pretend to be a useful, desirable program — a free game, cracked paid software, or a fake system update — while secretly installing malware in the background once you run them.
RATs (Remote Access Trojans) are a particularly invasive category that hand an attacker direct remote control of your device. Once installed, an attacker can watch your screen in real time, silently activate your webcam or microphone, steal files, and record every keystroke you type.

Ransomware encrypts your documents, photos, and databases — scrambling them so they're completely unreadable — then demands payment, almost always in cryptocurrency, in exchange for the decryption key needed to restore access.

Paying the ransom does not guarantee you'll actually get your files back; some victims pay and receive nothing, or receive a decryption tool that only partially works. Ransomware commonly spreads through phishing email attachments, malicious downloads, and unpatched software vulnerabilities that haven't been updated.

Spyware quietly monitors your browsing habits, can capture screenshots without your knowledge, and in some cases tracks your physical location.
Keyloggers are a specific, especially dangerous type of spyware that records every keystroke you type — capturing passwords, private messages, and payment card numbers as you type them, before any encryption on the website itself even applies.

Both are frequently bundled inside untrusted "free" software downloads or installed as the payload of a successful phishing attack.

If you believe a device is infected, work through these steps in order:

Step 1: Disconnect the device from the internet (Wi-Fi and any cables) immediately, to stop the malware from communicating with the attacker or spreading further.
Step 2: Boot into Safe Mode if your device supports it — this loads only essential system processes, which can prevent some malware from actively running and hiding itself.
Step 3: Run a full scan using trusted, reputable antivirus or anti-malware software.
Step 4: Remove or quarantine everything the scan flags as suspicious.
Step 5: Change your important passwords, but do this from a different, clean device — changing them from the still-possibly-infected device could hand the new password straight to a keylogger.
Step 6: Update all software and your operating system, since malware often exploits outdated software with known, already-patched vulnerabilities.
Step 7: Monitor your accounts closely for any unusual or unauthorized activity over the following weeks.

A strong password is primarily defined by length and unpredictability, not complexity for its own sake. Length matters more than most people expect: a longer password is exponentially harder to guess than a shorter one, even one packed with symbols.

Avoid anything based on personal information — names, birthdays, pet names, or your favorite team — since these are exactly what someone who knows a little about you (or can find it on your social media) would try first.

Passphrases — several unrelated random words strung together — are often both stronger and easier to remember than a short string of symbols, since length adds far more real security than substituting "a" with "@".

A password manager stores all your passwords inside a single encrypted vault, protected by one strong master password that only you know. Instead of trying to remember dozens of different passwords, you remember just one, while the manager generates and securely stores a genuinely random, unique password for every single account.

This solves the single biggest password-security problem most people have: reusing the same password across multiple sites. If one site gets breached and passwords leak, a password manager ensures that breach doesn't automatically compromise your other accounts too. Many password managers also actively warn you if a stored password has appeared in a known data breach.

Two-factor authentication (2FA), sometimes called multi-factor authentication (MFA), adds a required second proof of identity after your password — something you have (like your phone) or something you are (like a fingerprint), in addition to something you know (your password).

This second factor commonly takes the form of a time-based code from an authenticator app, a physical hardware security key, or a code sent via SMS text message. The key security benefit: even if an attacker steals or guesses your password, they still can't get into your account without also having that second factor.

Brute force — systematically trying every possible character combination until one works. Longer passwords make this dramatically slower, sometimes to the point of being impractical.
Dictionary attack — trying common real words, phrases, and known-popular passwords first, since most people don't choose truly random passwords.
Credential stuffing — taking passwords leaked from one breached website and automatically trying them on many other websites, betting that people reuse passwords (which is exactly why reuse is so dangerous).
Phishing — simply tricking you into typing your password directly into a fake login page.
Keylogging — malware that records every keystroke you type, capturing your password the moment you type it, regardless of how strong it is.

HTTPS encrypts the information traveling between your browser and a website, so anyone intercepting the connection (for example, on shared Wi-Fi) sees only scrambled data rather than your actual password or messages.

The important limitation: HTTPS only proves the connection itself is encrypted — it says nothing about whether the website is legitimate or trustworthy. Scam and phishing websites can, and routinely do, obtain the same padlock certificate as any real website. Seeing "https://" and a padlock icon means your connection to that site is private; it does not mean the site is who it claims to be.

Public Wi-Fi networks — at coffee shops, airports, and hotels — are often unencrypted or poorly secured, meaning anyone else on that same network can potentially intercept unencrypted traffic passing through it. On a compromised or malicious public network, an attacker sharing that connection with you could capture login credentials, inject malicious content into web pages you load, or silently redirect you to fake versions of real websites.

This risk is specific to the network layer — even a strong password doesn't help if the connection itself is being intercepted before your data is properly protected.

A VPN (Virtual Private Network) creates an encrypted tunnel between your device and the VPN provider's own server, routing your internet traffic through that tunnel before it reaches its final destination. This is genuinely useful on untrusted networks (like public Wi-Fi), since it prevents others sharing that same local network from intercepting your traffic, and it also hides your browsing from your local network operator.

What a VPN does not do: It does not make an unsafe or scam website suddenly safe to use — if a site is phishing you, a VPN encrypts the connection to that phishing site just as readily as to a legitimate one. It's also not a replacement for antivirus software, since it doesn't scan for or remove malware.

An "evil twin" is a fake Wi-Fi access point set up by an attacker with a name identical or very similar to a legitimate network nearby — for example, "Airport_Free_WiFi" instead of the airport's real "Airport-WiFi". When your device connects to the fake network instead of the real one, the attacker sits directly in the middle of your connection, able to monitor or even actively manipulate the traffic passing through.

Personal data (sometimes called personally identifiable information, or PII) is any information that can identify or describe a specific individual. This includes obvious examples like your name, phone number, email address, and home address, but also extends to your precise location, photos, birth date, government ID or passport numbers, financial account details, biometric data (fingerprints, face scans), and your browsing or search history.

Understanding what counts as personal data matters because it's exactly this category of information that scammers, data brokers, and attackers are trying to collect — often piece by piece from multiple sources, then combined into a fuller profile of you than any single source reveals on its own.

Every permission you grant an app is a door you're opening into part of your device or data — access to your camera, microphone, contacts list, precise location, file storage, or phone/SMS functions. Once granted, most apps can use that access far more broadly than the single feature that prompted the request in the first place.

The core question worth asking for every permission request is simple: does this app's actual, real purpose genuinely require this? A flashlight app requesting access to your contacts and microphone has no legitimate functional reason to need either.

A data breach happens when unauthorized parties gain access to information a company was storing about its users — often through a hacked database, a misconfigured server, or a successful attack on the company's own systems. The exposed data can include email addresses, passwords, names, phone numbers, and sometimes full financial or medical details, depending on what that company held.

Breaches happen to companies of every size, including large, well-resourced ones — being affected by a breach isn't a sign you personally did anything wrong, but it does require action once you know about it.

Your digital footprint is the accumulated trail of data left behind by everything you do online — social media posts, search history, likes, purchases, comments, and general account activity. Individually, most of these pieces seem harmless; combined over time, they can reveal a surprisingly detailed picture of your habits, relationships, location patterns, and even your likely answers to common security questions.

This is also exactly the raw material scammers use for spear phishing and romance scams — the more specific, personal detail an attacker can reference, the more convincing their approach becomes.

Good cybersecurity isn't one big action — it's a small set of habits repeated consistently. Organized by frequency:

Daily: Pause before clicking unexpected links, and lock your devices when you step away from them.
Weekly: Review app permissions you may have granted without thinking, and install any pending software updates.
Monthly: Check your account activity for anything unfamiliar, and look for breach notifications tied to your email.
Always, as standing habits: Use a unique password for every account, enable two-factor authentication wherever it's offered, keep regular backups of important files, and think for a moment before sharing personal information, even with people who seem trustworthy.

If you believe an account or device has been compromised, work through these steps in order — the sequence matters, since later steps depend on earlier ones being done first:

1. Change passwords immediately, starting with your main email account — since email is usually the recovery method for everything else, securing it first prevents the attacker from locking you out of other accounts too.
2. Enable two-factor authentication on that account if it isn't already on.
3. Sign out of all unknown devices and active sessions from the account's security settings.
4. Check bank and payment accounts for any unauthorized transactions.
5. Scan your devices for malware, in case the compromise started with an infected device rather than a stolen password.
6. Notify your bank directly if any financial information was exposed.
7. Warn your contacts if the compromised account may have been used to send scam messages to people who trust you.
8. Report the incident through the appropriate channel for what happened.

Report phishing attempts directly to the real organization being impersonated (most banks and major companies have a dedicated address for this), and report financial scams or fraud to your local cybercrime reporting authority.

Before you take any action that might delete evidence, preserve what you have: save screenshots of the messages, keep the original emails (not just a screenshot of them, since headers matter), note down any phone numbers or web addresses involved, and save transaction records if money was involved. This evidence is often what makes a report actionable rather than just a description of what happened.

Software updates frequently repair specific, known security vulnerabilities — flaws that attackers actively try to exploit, often within days of a fix becoming public, betting that many people delay installing it. Postponing an update doesn't just delay a feature; it can leave a documented, exploitable hole open on your device.

Enable automatic updates wherever available — for your operating system, web browser, individual applications, and any dedicated security software you use. Cybersecurity isn't a one-time setup either; scam techniques and malware constantly evolve, so staying reasonably informed about current threats (which is exactly what this Learn section is for) is itself part of an ongoing defense, not a box you check once.