Cybersecurity Workbook For Grade 12

Why This Matters

Your personal data is valuable. Names, birthdays, school IDs, shopping histories, location logs, and social media posts can be combined to steal identities, open fake accounts, or target you with scams. In real-world terms: a leaked email and password can let someone access your bank app within minutes, or a few location-tagged photos can reveal when your house is empty. Learning to protect personal data now saves time, stress, and money later.

This chapter builds practical habits you’ll use beyond school: creating and managing strong passwords, tightening privacy settings on apps you actually use (Instagram, Snapchat, Google), and spotting when a website or app is collecting more data than it needs. These skills fit into your larger cybersecurity journey by turning passive internet habits into active defenses - and they’re measurable. By the end, you’ll be able to audit three accounts, create a password strategy using a manager (e.g., Bitwarden), and spot at least two data-collection red flags.

Skill Builder

Goal: Audit and secure three online accounts (email, social media, and one shopping/service account) in 45-60 minutes using a password manager and privacy settings.

Materials: device you normally use, access to three accounts, a password manager (e.g., Bitwarden - free plan), and a notebook or digital notes.

Steps:

1. Install and set up a password manager (Bitwarden recommended). Create a strong master password: at least 14 characters, mix of words and symbols, one memorable sentence works.

2. For Account 1 (email): Go to Security or Account settings. Turn on two-factor authentication (2FA) using an authenticator app (Google Authenticator or Authy). Record whether 2FA is enabled.

3. For Account 2 (social media): Open Privacy settings. Set posts to “friends only” or the closest equivalent. Turn off location tagging for new posts. Record what you changed.

4. For Account 3 (shopping/service): Check saved payment methods and active devices/sessions. Remove any unknown devices and delete expired cards. Turn on purchase alerts if available.

5. For each account, generate a new unique password with your password manager and save it there. Use the manager’s generator set to at least 16 characters for banking, 12-16 for other accounts.

6. Run a quick data-collection check: on each account, find the permissions page (apps connected, data shared) and list at least one permission you revoked.

7. Record results in your notes: account name, old password strength (weak/medium/strong), 2FA status, privacy change made, permissions revoked.

Worked example:

> Account: school email

> Action: Enabled 2FA via Authy. Password manager created 18-character password saved to Bitwarden. Removed “Connected App: StudyTracker” which requested contact list. Completed.

What good looks like:

• You enabled 2FA on your email account and authenticated at least once.
• All three accounts use unique passwords stored in the password manager.
• Social media privacy set to restrict public access; location tagging disabled.
• At least one unnecessary third-party permission revoked per account.
• You can log into each secured account using the password manager within 5 minutes.

Going Deeper

Explore variations and advanced options to match different needs:

• Strong Passwords (advanced): Use a passphrase strategy (four unrelated words + symbol + number) for accounts you access frequently. Use 20+ random characters for financial and school portal accounts.
• 2FA Methods (comparison): Authenticator apps (recommended) vs. SMS (less secure) vs. hardware keys (YubiKey-most secure). Choose hardware keys for high-risk accounts like banking or college portals.
• Privacy Settings by Context: For public-facing profiles (artist portfolio), allow more visibility but disable contact info and location. For dating apps, hide work and school.

Adaptation examples:

• If you share a family computer, set 2FA to use an authenticator app on your phone and log out after each session.
• If you organize a student club, use a dedicated email and a password manager entry specifically for club accounts to avoid cross-contamination.

Self-Check

1. Have I enabled two-factor authentication on my primary email account and verified it with an authenticator app?

__________

__________

__________

2. Do all three audited accounts have unique passwords saved in my password manager, and can I log in using it?

__________

__________

__________

3. Did I remove at least one unnecessary third-party permission from each account (name the app/service removed)?

__________

__________

__________

...