Cyber Security Curriculum — Modules 1–4

CYBER SECURITY CURRICULUM

Detailed Study Notes — Modules 1 to 4
Beginner Phase

Module 1 — Introduction to Cyber Security & Digital Citizenship

Module 2 — Computer & Network Fundamentals
Module 3 — Internet Safety & Cyber Hygiene
Module 4 — Passwords, Authentication & Access Control

Page 1
 Cyber Security Curriculum — Modules 1–4

MODULE 1 — Introduction to Cyber Security & Digital Citizenship

Sessions 1–10 | Duration: 15 hours | Phase: Beginner

1.1 What Is Cyber Security?

Cyber security is the practice of protecting systems, networks, devices, and data from digital attacks,
unauthorized access, damage, or theft. It combines technology, processes, and human behaviour to defend the
confidentiality, integrity, and availability of information.
In simple terms: cyber security is about keeping the digital world — your accounts, devices, and data — as safe
as your front door lock keeps your house safe.

Why It Matters — Real-World Context

• Almost every part of daily life (banking, school records, healthcare, communication) now depends on
digital systems.
• A single security failure can expose personal data, cause financial loss, or disrupt critical services (hospitals,
power grids, schools).
• Attacks are increasing in scale and sophistication — from individual scams to organised cybercrime and
state-sponsored operations.
Example (Age-Appropriate Case Study):
In 2017, the WannaCry ransomware attack spread across 150+ countries in hours, encrypting files on hospital,
business, and government computers because a known Windows vulnerability had not been patched. It
shows how one unpatched system can cascade into a global incident — the same logic behind "why you must
update your device" (covered again in Module 3).

1.2 The CIA Triad

The CIA Triad is the foundational model used to describe the three core goals of cyber security. Every control,
policy, or tool you will study in this course maps back to one (or more) of these three pillars.

Pillar Meaning Real-World Example What Breaks It

Confidentiality Only authorised people can view Your medical records A data breach that
the information are visible only to you leaks passwords
and your doctor or personal data

Integrity Information stays accurate and A bank balance that A malware attack
unaltered unless changed by an cannot be secretly that silently
authorised action edited by a hacker modifies grades in
a school database

Availability Systems and data are accessible to A hospital's patient A Denial-of-

authorised users when needed system stays online Service (DoS)
during an emergency attack that takes a
website offline

Page 2
 Cyber Security Curriculum — Modules 1–4

Memory tip: think of CIA as a triangle — removing any one corner collapses the whole security posture, even if
the other two remain intact.

1.3 Digital Footprint & Online Identity

A digital footprint is the trail of data you leave behind through online activity — every post, like, search,
purchase, and login.

Two Types of Digital Footprint

• Active footprint — data you knowingly share (posts, comments, profile information, uploaded photos).
• Passive footprint — data collected without direct action (IP address logs, browsing history, cookies,
location metadata).

Why Online Identity Matters

• Employers, universities, and even strangers can find and judge you based on your public digital footprint.
• Old posts can resurface years later ('the internet doesn't forget').
• Fragmented identity across many platforms increases exposure to impersonation and identity theft.

Key Concept:
Every account you create, every app permission you accept, and every public post is a permanent data point
that shapes how you are perceived and how easily you can be tracked or targeted.

1.4 Being a Responsible Digital Citizen

Digital citizenship means using technology safely, ethically, and responsibly — treating the online world with the
same standards of conduct expected offline.

Core Principles
1. Respect — Treat others online with the same courtesy shown in person; no harassment, hate speech, or
exclusion.
2. Responsibility — Think before you post, share, or forward; you are accountable for your digital actions.
3. Protection — Safeguard your own privacy and that of others (never share someone else's personal
information without consent).
4. Critical Thinking — Verify information before believing or sharing it; recognise misinformation.
5. Balance — Maintain a healthy relationship with technology and screen time.

Expectations in Practice
• Cite sources and respect copyright/intellectual property when reusing content online.
• Obtain consent before posting photos or information about other people.
• Report harmful content instead of engaging with or amplifying it.

1.5 Overview of Cyber Threat Actors

Not every attacker has the same motive or skill level. Understanding who is behind an attack helps predict their
methods and targets.

Page 3
 Cyber Security Curriculum — Modules 1–4

Threat Actor Primary Motivation Typical Targets

Hackers (generic term) Varies — curiosity, profit, ideology, Any vulnerable system
challenge

Hacktivists Political or social ideology Governments, corporations, media

outlets

Cybercriminals Financial gain (fraud, ransomware, Individuals, businesses, banks

data theft)

Nation-State Actors Espionage, sabotage, geopolitical Critical infrastructure, defence,

advantage government networks

Insider Threats Revenge, negligence, financial gain, or The organisation they belong to
coercion

Script Kiddies Thrill-seeking, low skill, uses existing Soft/undefended targets

tools

1.6 Hands-On Labs & Activities — Module 1

🧪 Hands-On Lab Activities
• Case-Study Breakdown: Analyse a publicly reported data breach and map out what went wrong using
the CIA Triad as a framework (which pillar failed, and why).
• Personal Digital Footprint Self-Audit: Search your own name/usernames and list every publicly visible
piece of information you can find about yourself.
• Role-Play: Act out scenarios (e.g., being asked to share a friend's photo without consent) and practise a
responsible-digital-citizen response.
• Cyber-Hygiene Checklist: Build a personal checklist covering passwords, updates, privacy settings, and
safe browsing — this checklist will be reused and expanded in later modules.
• Reflection Journal: Write a short reflection on the most surprising thing learned in Module 1, followed
by a wrap-up quiz.

Module 1 — Key Takeaways

• Cyber security protects Confidentiality, Integrity, and Availability (CIA Triad) — remember this model; it
reappears throughout the course.
• Every digital action contributes to a permanent digital footprint.
• Responsible digital citizenship is an ethical obligation, not just a technical one.
• Threat actors differ in motivation and sophistication — this shapes the type of defence required.

MODULE 2 — Computer & Network Fundamentals

Sessions 11–25 | Duration: 22.5 hours | Phase: Beginner

Page 4
 Cyber Security Curriculum — Modules 1–4

2.1 How Computers Work: OS, Files, Permissions

The Operating System (OS) is the software layer that manages hardware and provides services to applications.
Understanding it is the foundation for understanding how attacks and defences actually operate on a machine.

Core OS Responsibilities
• Process management — running and scheduling programs.
• Memory management — allocating RAM to running programs.
• File system management — organising data into files and folders/directories.
• Permissions & access control — deciding who/what can read, write, or execute a file.

File Permissions — Example (Linux)

Linux represents permissions as a 10-character string, e.g.:

-rwxr-xr-- 1 user group 4096 Jul 23 10:00 [Link]

• Position 1: file type ( - = file, d = directory)

• Positions 2–4: Owner permissions (r = read, w = write, x = execute)
• Positions 5–7: Group permissions
• Positions 8–10: 'Others' (everyone else) permissions
Changing permissions:

chmod 750 [Link] # owner: rwx, group: r-x, others: ---

chmod u+x [Link] # add execute permission for the owner only

Why this matters for security:

Misconfigured permissions (e.g., a sensitive file that is world-writable) are one of the most common root
causes of privilege-escalation attacks.

2.2 Basics of Networking: IP Address, DNS, Routers, Wi-Fi

IP Address
An IP (Internet Protocol) address is a unique numerical label assigned to each device on a network, used to
identify and locate it.

Type Example Notes

IPv4 [Link] 32-bit, four decimal octets (0–255

each); ~4.3 billion addresses

IPv6 2001:0db8:85a3::8a2e:0370:7334 128-bit, hexadecimal; created

because IPv4 addresses ran out

Private IP [Link]/8, [Link]/12, [Link]/16 Used inside local/home networks,

not routable on the public internet

Public IP Assigned by your ISP Identifies your network on the

internet

Page 5
 Cyber Security Curriculum — Modules 1–4

DNS (Domain Name System)

DNS translates human-friendly domain names (e.g., [Link]) into machine-friendly IP addresses — it
functions like the internet's phonebook.

User types: [Link]

DNS resolves to: [Link]
Browser then connects directly to that IP address

Routers & Wi-Fi

• A router directs data packets between your local network (home/school) and the internet.
• Wi-Fi is a wireless technology that lets devices connect to the router/network without cables, using radio
signals (typically the 2.4 GHz and 5 GHz bands).
• Modern Wi-Fi security relies on WPA3 (or WPA2 as the older but still common standard) for encrypting
wireless traffic.

2.3 The OSI Model (7 Layers)

The OSI (Open Systems Interconnection) model is a conceptual framework that standardises how data moves
through a network, split into 7 layers. Understanding it helps pinpoint exactly where a network problem or an
attack occurs.

Layer Name Function Example / Protocol

7 Application Interface for end-user software HTTP, HTTPS, FTP, DNS

6 Presentation Data formatting, encryption, compression SSL/TLS, JPEG, ASCII

5 Session Establishes/manages/ends communication NetBIOS, RPC

sessions

4 Transport Reliable end-to-end delivery, error checking TCP, UDP

3 Network Logical addressing and routing between IP, ICMP, routers

networks

2 Data Link Physical addressing (MAC), frames within Ethernet, Wi-Fi (802.11),
one network switches

1 Physical Raw bit transmission over physical medium Cables, radio signals, hubs
Memory aid (bottom-to-top): 'Please Do Not Throw Sausage Pizza Away' — Physical, Data Link, Network,
Transport, Session, Presentation, Application.

Layers 1–4 (Session 13):

Handle how data physically travels and reaches the right device/program (cabling, MAC addressing, IP
routing, TCP/UDP delivery).

Layers 5–7 (Session 14):

Handle how applications establish sessions, format/encrypt data, and present it to the end user.

Page 6
 Cyber Security Curriculum — Modules 1–4

2.4 How the Internet Works: The Client-Server Model

Most internet interactions follow a client-server model: a client (e.g., your browser) requests a resource, and a
server (a remote computer) responds with that resource.
6. You type a URL into your browser (the client).
7. The client sends a DNS query to resolve the domain name to an IP address.
8. The client opens a connection to the server at that IP (typically via TCP).
9. The client sends an HTTP/HTTPS request for the specific page/resource.
10. The server processes the request and sends back a response (HTML, images, data).
11. The browser renders the response for the user.

2.5 HTTP / HTTPS Explained

Aspect HTTP HTTPS

Meaning HyperText Transfer Protocol HTTP Secure (HTTP + TLS/SSL encryption)

Default Port 80 443

Encryption None — data sent in plain text Encrypted using TLS; data unreadable if
intercepted

Browser Indicator 'Not Secure' warning Padlock icon in the address bar

Risk Vulnerable to eavesdropping, tampering, Verifies server identity and protects data in
and man-in-the-middle attacks transit

Practical rule:
Never enter passwords, card details, or personal information on a site that only uses HTTP or shows a
broken/absent padlock icon.

2.6 Introduction to the Command Line

The command line (or terminal/shell) lets you interact with the operating system by typing text commands
instead of clicking a graphical interface. It is essential for cyber security work because most diagnostic and
security tools are command-driven.

Windows Command Prompt / PowerShell — Basics

dir :: list files and folders in the current directory

cd Documents :: change into the 'Documents' folder
cd .. :: move up one folder level
cls :: clear the terminal screen
mkdir NewFolder :: create a new folder
del [Link] :: delete a file
whoami :: show the currently logged-in user

Linux / macOS Terminal — Basics

ls -la # list all files (including hidden) with details

Page 7
 Cyber Security Curriculum — Modules 1–4

cd Documents # change into the 'Documents' folder

cd .. # move up one folder level
clear # clear the terminal screen
mkdir new_folder # create a new folder
rm [Link] # delete a file
pwd # print current working directory
whoami # show the currently logged-in user
man ls # show the manual/help page for a command

2.7 Essential Networking Commands (Lab Reference)

ping — Testing Connectivity
ping sends small ICMP 'echo request' packets to a target and measures whether/how quickly it replies. It is the
first tool used to check if a host is reachable.

ping [Link] # Windows & Linux/macOS

ping -c 4 [Link] # Linux/macOS: send exactly 4 packets then
stop
ping -n 4 [Link] # Windows: send exactly 4 packets then stop

Sample output (trimmed):

Pinging [Link] [[Link]] with 32 bytes of data:

Reply from [Link]: bytes=32 time=14ms TTL=115
Reply from [Link]: bytes=32 time=13ms TTL=115
Ping statistics: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

• time = round-trip latency in milliseconds — lower is better.

• TTL (Time To Live) = number of hops remaining before the packet would be discarded; helps estimate
distance/OS.
• Packet loss indicates network congestion, a firewall block, or an unreachable host.

tracert / traceroute — Tracing a Network Path

This command reveals every router ('hop') a packet passes through on its way to the destination — useful for
locating where a connection slows down or fails.

tracert [Link] :: Windows

traceroute [Link] # Linux/macOS

Sample output (trimmed):

1 1 ms <1 ms <1 ms [Link] (home router)

2 9 ms 8 ms 9 ms [Link] (ISP gateway)
3 14 ms 13 ms 14 ms [Link]
4 15 ms 14 ms 14 ms [Link] ([Link])

• Each numbered line is one 'hop' (router) along the path.

• A hop showing '* * *' (request timed out) may indicate a firewall silently dropping the probe, not
necessarily a broken path.
Page 8
 Cyber Security Curriculum — Modules 1–4

ipconfig / ifconfig / ip a — Viewing Network Configuration

ipconfig /all :: Windows — full network adapter configuration

ifconfig # Linux/macOS (legacy)
ip a # Linux (modern replacement for ifconfig)

Sample output (trimmed, Linux 'ip a'):

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500

inet [Link]/24 brd [Link] scope global eth0
ether 3c:97:0e:6a:11:9d

• inet = the device's current IPv4 address and subnet mask.

• ether = the device's MAC (hardware) address.

nslookup — Manual DNS Lookup (supporting command)

nslookup [Link]

Returns the IP address that a domain name currently resolves to — useful for verifying DNS behaviour discussed
in Section 2.2.

2.8 Hands-On Labs & Activities — Module 2

🧪 Hands-On Lab Activities
• Use ping to test connectivity to several websites and interpret latency/packet-loss results.
• Use tracert/traceroute to trace the path a packet takes to reach a chosen destination and identify the
number of hops.
• Use ipconfig/ifconfig to record your own device's IP address, subnet mask, and MAC address.
• Safely explore a home router's admin/settings panel (read-only exploration — no configuration
changes) to identify connected devices and Wi-Fi security settings.
• Practise command-line file navigation: create folders, move between directories, and list contents using
only the terminal.
• Map your own home/school network topology on paper, showing the router, connected devices, and
internet connection.

Module 2 — Key Takeaways

• The OS enforces permissions that decide who can read, write, or execute files — misconfigured
permissions are a major attack surface.
• DNS translates domain names to IP addresses; routers and Wi-Fi connect local devices to the wider
internet.
• The OSI model's 7 layers describe exactly where in the communication stack a fault or attack occurs.
• HTTPS encrypts data in transit; HTTP does not — always check for the padlock before entering sensitive
data.
• ping, tracert/traceroute, and ipconfig/ifconfig are the three foundational diagnostic commands every
security practitioner uses daily.

Page 9
 Cyber Security Curriculum — Modules 1–4

MODULE 3 — Internet Safety & Cyber Hygiene

Sessions 26–40 | Duration: 22.5 hours | Phase: Beginner

3.1 Safe Browsing Habits & Recognizing Suspicious Websites

Safe browsing means recognising the warning signs of a malicious or fraudulent website before interacting with
it.

Red Flags of a Suspicious Website

• Misspelled or lookalike domain names (e.g., '[Link]' instead of '[Link]').
• No HTTPS/padlock icon, or a certificate warning shown by the browser.
• Excessive pop-ups, forced redirects, or urgent 'you have won!' banners.
• Requests for unnecessary personal or payment information.
• Poor design, broken links, or inconsistent branding.
Quick check:
Hover over a link (without clicking) to preview the real destination URL shown in the browser's status bar —
this reveals many disguised/malicious links.

3.2 Social Media Privacy

Social media platforms collect and expose large amounts of personal data by default. Privacy settings determine
who can see your posts, profile, and activity.

Key Concepts
• Default privacy settings on most platforms are broad ('Public') — they must be manually tightened.
• Metadata (location tags, timestamps) attached to photos can reveal more than the photo itself.
• Friend/follower lists, tagged photos, and check-ins can expose your routine and location patterns.
• Third-party apps linked to a social account often request broad data-access permissions.

Good Practice
12. Set profiles to private/friends-only where possible.
13. Review and remove old, unused connected apps periodically.
14. Turn off location tagging for posts unless necessary.
15. Think before posting — assume anything shared could become permanently public.

3.3 Cyberbullying: Recognition, Impact & Prevention

What Is Cyberbullying?
Cyberbullying is the use of digital technology (messaging, social media, gaming platforms) to repeatedly harass,
threaten, humiliate, or target another person.

Common Forms
• Harassment — repeated offensive messages or comments.

Page 10
 Cyber Security Curriculum — Modules 1–4

• Exclusion — deliberately leaving someone out of online groups/chats.

• Impersonation — creating fake accounts to damage someone's reputation.
• Outing/Doxxing — publicly sharing private information without consent.
• Cyberstalking — persistent monitoring or unwanted contact.

Impact
Cyberbullying can cause anxiety, depression, social withdrawal, and academic decline. Unlike in-person bullying,
it can follow a victim beyond school hours and be witnessed by a large audience, which can intensify its effect.

Prevention & Reporting Mechanisms

16. Do not respond or retaliate — this often escalates the situation.
17. Save evidence: screenshots, timestamps, usernames.
18. Block and report the account through the platform's built-in reporting tool.
19. Inform a trusted adult, teacher, or school counsellor.
20. Escalate to the platform provider or, where laws apply, to local authorities for serious/persistent cases.

3.4 Safe Online Gaming & App Permissions

Online games and mobile apps often request access to contacts, camera, microphone, location, and storage —
sometimes beyond what the app actually needs to function.

Safe Gaming Practices

• Use a gamer tag/username, never your real name, in public games.
• Avoid voice chat with strangers where possible; disable it by default.
• Never share account credentials, even with people claiming to be 'support staff'.
• Be cautious of in-game links/offers promising free currency or items — a classic phishing/malware vector.

App Permissions — The Principle of Least Privilege

A user (or an app) should only be granted the minimum access needed to perform its function — nothing more.

App Type Permission That Makes Sense Permission That Is a Red Flag

Calculator app None required Camera, contacts, or location access

Messaging app Contacts, camera, microphone Access to unrelated files or call logs
without reason

Flashlight app Camera (for the LED flash) Location, contacts, or microphone
access

3.5 Public Wi-Fi Risks

Public Wi-Fi (cafés, airports, libraries) is often unencrypted or shared with unknown users, making it a prime
location for interception attacks.

Key Risks
• Man-in-the-Middle (MITM) attacks — an attacker intercepts traffic between your device and the access
point.

Page 11
 Cyber Security Curriculum — Modules 1–4

• Evil twin networks — a fake hotspot named to look like the legitimate one (e.g., 'Airport_WiFi_Free').
• Packet sniffing — capturing unencrypted data travelling over the network.

Safe Practices on Public Wi-Fi

21. Avoid logging into banking or sensitive accounts on public networks.
22. Only visit sites using HTTPS (see Module 2, Section 2.5).
23. Use a reputable VPN to encrypt traffic when public Wi-Fi is unavoidable.
24. Turn off auto-connect to open/unknown Wi-Fi networks in device settings.

3.6 Device Hygiene: Updates, Antivirus & Backups

Updates & Patching
Software updates ('patches') fix known security vulnerabilities. Delaying updates leaves a device exposed to
publicly known exploits — this was the exact cause of the WannaCry incident referenced in Module 1.

Windows Update check: Settings > Windows Update > Check for updates
macOS update check: Apple menu > System Settings > General > Software
Update
Android update check: Settings > System > System update
iOS update check: Settings > General > Software Update

Antivirus / Anti-Malware
• Detects and removes known malicious software using signature and behaviour-based scanning.
• Should be kept updated, since new malware signatures are released constantly.
• Real-time protection scans files as they are opened/downloaded, not just on manual scans.

Backups
A backup is a separate copy of important data, kept so it can be restored after loss, corruption, or a ransomware
attack.

Backup Strategy Description

3-2-1 Rule Keep 3 copies of data, on 2 different media types, with 1 copy stored
off-site/off-line

Full Backup Complete copy of all selected data every time

Incremental Backup Only backs up data changed since the last backup — faster, smaller

Cloud Backup Automatic off-site storage (e.g., Google Drive, iCloud, OneDrive)

Why backups matter:

A reliable backup is the single most effective defence against ransomware — if your files are encrypted by an
attacker, a clean backup lets you recover without paying.

3.7 Hands-On Labs & Activities — Module 3

🧪 Hands-On Lab Activities

Page 12
 Cyber Security Curriculum — Modules 1–4

• Privacy-Settings Audit: Review and tighten the privacy settings on a personal or demo social media
account.
• App Permissions Review: Go through installed apps on a mobile device and identify any permission that
doesn't match the app's purpose.
• Set up a safe-browsing tool or browser extension that flags malicious/suspicious sites.
• Hands-on backup exercise: back up a set of sample files using at least two different methods (e.g., local
drive + cloud).
• Identify suspicious websites from a provided sample list, explaining the red flags spotted in each.
• Role-play: practise responding appropriately to a cyberbullying scenario, including reporting steps.

Module 3 — Key Takeaways

• Suspicious websites can usually be identified by domain spelling, missing HTTPS, and manipulative urgency
tactics.
• Social media privacy settings default to broad sharing and must be actively managed.
• Cyberbullying should be documented, reported, and escalated to a trusted adult — never ignored or
retaliated against.
• Apply the principle of least privilege when granting app permissions.
• Public Wi-Fi requires HTTPS and/or a VPN; device hygiene (updates, antivirus, 3-2-1 backups) is the
baseline defence against most common threats.

MODULE 4 — Passwords, Authentication & Access Control

Sessions 41–48 | Duration: 12 hours | Phase: Beginner

4.1 Password Strength, Entropy & Common Mistakes

Password strength is measured by how difficult a password is to guess or crack — technically expressed as
entropy, the number of possible combinations an attacker would need to try.

What Is Entropy?
Entropy (in bits) is calculated roughly as: length × log2(character set size). A larger character set and greater
length both increase entropy exponentially.

Password Example Length Character Set Approx. Entropy Crack-Time

Estimate*

password123 11 lowercase + digits ~40 bits Instant – minutes

P@ssw0rd! 9 upper+lower+digit+symbo ~59 bits Minutes – hours

l

Tr0ub4dor&3xplor3 17 upper+lower+digit+symbo ~100+ bits Centuries

l

correct-horse-battery-staple 29 lowercase words + ~80–100 bits Centuries

hyphens
*Estimates vary with attacker hardware; the table shows relative order of magnitude, not exact figures.

Page 13
 Cyber Security Curriculum — Modules 1–4

Common Mistakes
• Reusing the same password across multiple accounts (one breach compromises all of them).
• Using predictable substitutions only (e.g., 'P@ssword1') — attackers' dictionaries already include these
patterns.
• Including personal information (birthdays, pet names, own username) that can be guessed or found via
social media.
• Choosing short passwords even when a system technically allows longer ones.

Best-practice guideline:
Prefer a long passphrase (4+ random unrelated words, 16+ characters) over a short complex password —
length contributes more to entropy than complexity alone, and passphrases are easier to remember.

4.2 Multi-Factor Authentication (MFA)

MFA requires two or more independent forms of proof ('factors') before granting access, so a stolen password
alone is not enough to breach an account.

Factor Type Description Example

Something you know A secret only you should know Password, PIN, security question

Something you have A physical or digital item you Phone (OTP app/SMS code),
possess hardware security key, smart card

Something you are A biological trait unique to you Fingerprint, face scan, voice pattern

Typical MFA Login Flow

25. User enters username and password (Factor 1: something you know).
26. System sends/generates a one-time code (Factor 2: something you have) via an authenticator app, SMS, or
hardware key.
27. User enters the code within a short validity window (usually 30–60 seconds for app-based codes).
28. Access is granted only if both factors are verified successfully.

Security note:
Authenticator apps (e.g., TOTP-based apps) are generally more secure than SMS codes, since SMS can be
intercepted through SIM-swapping attacks.

4.3 Password Managers

A password manager securely stores and auto-fills unique, complex passwords for every account, protected
behind one strong master password (and ideally MFA).

Why Use One?

• Removes the need to memorise dozens of passwords — enables a unique password per site without reuse.
• Generates long, random, high-entropy passwords automatically.
• Many managers flag reused, weak, or breached passwords automatically.
• Encrypts the password vault locally/in the cloud, typically using strong encryption (e.g., AES-256).

Page 14
 Cyber Security Curriculum — Modules 1–4

Setting Up a Password Manager — General Workflow (Demo Account)

29. Choose a reputable password manager (built into the browser/OS, or a dedicated app).
30. Create a master password that is long, unique, and not reused anywhere else.
31. Enable MFA on the password manager account itself — this is the single most important account to
protect.
32. Import or manually add existing account credentials into the vault.
33. Use the built-in password generator to replace weak/reused passwords with strong, unique ones.

Important:
The master password must never be stored anywhere else (written down insecurely, saved in a plain text file,
or reused) — it is the single key protecting every other credential.

4.4 Biometrics: Pros and Cons

Biometrics authenticate a person using unique physical or behavioural traits — fingerprint, facial recognition, iris
scan, or voice pattern.

Advantages Disadvantages

Convenient — nothing to remember or type Cannot be changed if compromised (unlike a

password, you cannot 'reset' your fingerprint)

Difficult to share or forget (unlike a password) Can potentially be spoofed (e.g., high-resolution
photos fooling weak facial recognition)

Fast authentication — often under one second Raises privacy concerns over biometric data storage
and misuse

Hard to guess remotely (unlike a password) Requires specific hardware (fingerprint sensor,
camera) to function

Best practice:
Biometrics work best as one factor within MFA (something you are), combined with a password or PIN — not
as the sole method of protecting highly sensitive accounts.

4.5 Hands-On Labs & Activities — Module 4

🧪 Hands-On Lab Activities
• Password-Strength Testing: Use an offline/local password-strength estimation tool to compare the
entropy of different password styles from Section 4.1.
• Set up a free password manager using a demo account, generate several strong passwords, and
organise a small credential vault.
• Enable MFA on a demo or personal account using an authenticator app, and observe the full login flow
described in Section 4.2.
• Module 4 recap activity and quiz covering passwords, MFA, password managers, and biometrics.

Module 4 — Key Takeaways

• Password strength depends on entropy — length and unpredictability matter more than complexity alone.

Page 15
 Cyber Security Curriculum — Modules 1–4

• MFA combines something you know, something you have, and/or something you are, so a leaked
password is not enough to compromise an account.
• Password managers make unique, high-entropy passwords practical across dozens of accounts — protect
the master password above all else.
• Biometrics are convenient but irreversible if compromised, and work best as one factor in a layered
authentication strategy.

Page 16