1 / 30
Digital Literacy & Cybersecurity · Grade 10 · Chapter 1

Digital Citizenship & Online Safety

Threat modeling, digital footprints, modern authentication, and ethical computing in an interconnected world.

Threat Modeling Digital Footprint Authentication & 2FA Social Engineering Encryption
Chapter Roadmap

Learning Objectives

1. Security & Threat Modeling

Analyze how personal data is harvested via active/passive footprints, metadata, and data brokers.

2. Social Engineering & Scams

Identify sophisticated phishing, spear-phishing, smishing, and generative AI voice cloning tactics.

3. Cryptography & Defense

Understand entropy, MFA/FIDO2 hardware keys, TLS/HTTPS, and end-to-end encryption fundamentals.

4. Ethics & Digital Legacy

Examine digital rights, Creative Commons, algorithmic echo chambers, and incident response.

Real-World Case Study

The OSINT Investigation

In 2023, a cybersecurity researcher demonstrated how 4 casual social media posts from a high school student allowed him to reconstruct their home address, bus route, gym lock combination, and mother's maiden name in under 15 minutes.

Open-Source Intelligence (OSINT)

Attackers rarely hack firewall systems directly—they gather publicly available puzzle pieces across TikTok, Instagram, Strava fitness maps, and school sports rosters to construct targeted exploits.

Discussion: What seemingly harmless detail have you shared online that could connect to another account?
Core Concept 1

Your Dual Digital Footprint

Every digital action leaves an immutable trace. Computer scientists categorize footprints into two distinct vectors:

Active Digital Footprint

Data you intentionally submit: social media posts, comments, uploaded photos, blog posts, and public profile bios.

Examples: Forum posts, Discord messages, YouTube uploads

Passive Digital Footprint

Data collected without direct user intent: IP addresses, browser fingerprinting, geolocation pings, session cookies, and typing cadence.

Examples: Server access logs, ad tracking pixels, telemetry
Data Pipeline Architecture

How Your Passive Data Is Monetized

Data doesn't stay on the website where you generate it. It flows through an automated profiling pipeline:

1

Telemetry

Apps record app opens, battery levels, Wi-Fi SSIDs, and scroll velocity.

2

Aggregation

Data brokers purchase telemetry from thousands of apps and merge datasets.

3

Fingerprinting

Cross-device profiles link your laptop, phone, console, and home IP address.

4

Targeted Action

Predictive AI algorithms serve tailored ads, adjust insurance risk scores, or feed scams.

Security Engineering

Threat Modeling for Individuals

In cybersecurity, threat modeling evaluates what you are protecting, who you are protecting it from, and how likely an attack is.

1. Assets

What has value? Passwords, email access, bank accounts, academic credentials, identity numbers, biometric scans.

2. Adversaries

Who wants it? Automated credential stuffers, phishing bots, cyberbullies, malicious Wi-Fi snoops, rogue advertisers.

3. Attack Vectors

How could they get it? Reused passwords, unencrypted Wi-Fi, malicious USB drives, phishing links, social engineering.

Cryptographic Foundations

Password Entropy: Math vs Complexity

Password strength is measured in entropy (bits), representing how many guesses a brute-force algorithm must make.

Short & "Complex" (Tr0ub4dor&3)

  • Length: 10 characters
  • Entropy: ~36 bits
  • Crack time on modern GPU cluster: < 3 minutes
  • Hard for humans to remember; easily cracked by pattern dictionaries.

Passphrase (correct horse battery staple)

  • Length: 28 characters (4 random words)
  • Entropy: ~58 bits (from 7,776-word dictionary)
  • Crack time on GPU cluster: > 500,000 years
  • Easy for humans to visualize and memorize; mathematically resilient.
Identity Defense

Multi-Factor Authentication (MFA) Tiers

MFA requires proof across at least two independent authentication factors:

Factor 1: Knowledge

Something you know: Password, PIN, passphrase, security questions (weakest factor).

Factor 2: Possession

Something you have: Time-based OTP app (TOTP), SMS code, FIDO2 USB Security Key (YubiKey).

Factor 3: Inherence

Something you are: Fingerprint scan, facial geometry (FaceID), iris scan, voice print.

Security Ranking: Hardware FIDO2 Keys (Phishing-resistant) > Authenticator App (TOTP) > SMS Codes (Vulnerable to SIM swapping).
Human Vulnerabilities

The Anatomy of Social Engineering

Attackers exploit human psychology rather than software bugs. Common social engineering vectors:

Phishing vs Spear-Phishing

Phishing: Mass, automated generic emails pretending to be banks, Netflix, or Apple.
Spear-Phishing: Highly customized attacks targeting you specifically using your name, school, and friends.

Smishing & Vishing

Smishing (SMS Phishing): "Delivery failed, click to reschedule".
Vishing (Voice Phishing): Urgent phone calls from "Tech Support" or "Law Enforcement" demanding gift cards or wire transfers.

Next-Gen Vectors

Generative AI & Deepfake Social Engineering

Artificial intelligence has lowered the cost of executing indistinguishable social engineering attacks.

Voice Cloning (3-Second Sample)

AI models can clone a family member's voice using audio extracted from a TikTok or Instagram clip, calling parents in simulated distress.

Hyper-Personalized LLM Phishing

Automated scrapers feed your public profiles into LLMs to generate grammatically flawless, highly contextual deceptive emails at zero marginal cost.

Class Countermeasure: Establish a secret family verbal "safe word" that AI cannot guess to verify distress calls.
Interactive Smartboard Activity

Spot the Red Flag in this Communication

SMARTBOARD VOTING

Urgent Message: "School Portal Security Alert"

From: admin@portal-district8-verify.com
Subject: "URGENT: Your student account will be terminated in 2 hours unless you confirm your password."
Body: "Dear Student, click here to log into the identity verification portal immediately."

Flag A: Lookalike domain (not official .edu or district domain)
Flag B: Artificial urgency & panic inducement ("2 hours!")
Flag C: Direct credential request via external link
Network Fundamentals

Public Wi-Fi & Man-in-the-Middle (MitM) Attacks

When connecting to open cafe or airport Wi-Fi, you share a local broadcast network with potential adversaries.

1

Rogue AP

Attacker sets up "Starbucks_Free_WiFi" (Evil Twin hotspot).

2

Packet Sniffing

Device auto-connects; attacker inspects unencrypted packets.

3

DNS Spoofing

Attacker redirects requests for bank.com to a cloned malicious server.

Cryptography in Practice

HTTP vs HTTPS & TLS/SSL Handshake

Transport Layer Security (TLS) ensures that data in transit cannot be read or altered by intermediaries.

HTTP (Port 80) — Plaintext

  • Data sent as unencrypted ASCII text.
  • Anyone on the same Wi-Fi router can read passwords, session cookies, and chat messages via Wireshark.
  • Zero server identity verification.

HTTPS (Port 443) — Encrypted

  • Data encrypted via symmetric keys (AES-256) negotiated via asymmetric public/private keys.
  • Confidentiality + Integrity + Certificate Authority verification.
  • Intermediaries see only domain and packet size, not contents.
End-to-End Cryptography

Transit Encryption vs End-to-End Encryption

Not all "encrypted" services protect your privacy from the service provider itself.

Encryption in Transit (Standard)

Data encrypted between your device and the cloud server. The company holds the decryption key and can read your data, train AI on it, or hand it to law enforcement.

Examples: Standard Email, Instagram DMs, Discord

End-to-End Encryption (E2EE)

Data encrypted on sender's device and decrypted only on recipient's physical device. The server acts as a blind courier and cannot read contents even if subpoenaed.

Examples: Signal, WhatsApp, Apple iMessage (with recovery off)
Hidden Data Vectors

EXIF Data in Digital Photos

Every photo taken on a smartphone embeds hidden Exchangeable Image File (EXIF) metadata into the file header.

--- Sample EXIF Header from Raw Image --- Camera Model: "iPhone 15 Pro" Date/Time: "2026-08-15 16:42:11" GPS Latitude: 37.7749 N # Exact coordinate GPS Longitude: 122.4194 W # Reveals home / bedroom Altitude: 14.2 meters Lens Serial: "SN-998231-X"
Lesson: Sharing original image files via email, AirDrop, or Discord can disclose your exact geographic location unless stripped!
Mobile Operating Systems

Permission Models & Principle of Least Privilege

Modern operating systems (iOS / Android) isolate apps in sandbox containers. Apps must explicitly request capabilities.

High-Risk Permissions

Background Precise Location, Full Photo Library, Microphone, Local Network Scanning, Contacts.

Least Privilege Rule

Only grant the minimum permissions necessary for an app's primary function. (Does a flashlight app need contacts?)

One-Time Permissions

Use "Ask Every Time" or "While Using App" to prevent background telemetry logging.

Debunking Tech Myths

Misconception: "I Have Nothing to Hide, So Privacy Doesn't Matter"

The Flawed Assumption

"Only criminals or people doing illegal things need privacy. I'm just a student, no one cares about my data."

The Computer Science Reality

Privacy is about asymmetric power, financial security, and consent. Your data is used to calculate your loan rates, manipulate your voting decisions, price-discriminate against you, and clone your identity for financial fraud.

Classroom Discussion

Think-Pair-Share: The Internet Archive & Ephemeral Posts

Snapchat stories expire in 24 hours, and Instagram allows un-sending DMs. But does content ever truly disappear from the web?

Mechanisms of Permanence

  • Automated screenshot bots & device screen recorders
  • Web crawlers (Wayback Machine, Common Crawl)
  • Database backups stored across distributed cloud servers

Prompt for Pairs (2 Mins)

Imagine a university admissions officer or employer runs an OSINT check on your online handles 5 years from now. What assumptions would they form?

Legal & Ethical Computing

Copyright, Fair Use & Open Licensing

Understanding the legal frameworks governing software, media, and code sharing.

Traditional Copyright

All Rights Reserved. You cannot reproduce, distribute, or adapt work without explicit permission.

Fair Use Doctrine

Allows limited use for critique, parody, news reporting, teaching, and scholarship without permission.

Creative Commons & MIT

Open licenses specifying allowed uses (e.g. CC-BY attribution, MIT open-source software license).

Behavioral Computing

Algorithmic Engagement Loops

Social media feeds use reinforcement learning algorithms optimized for a single metric: Time on App.

1

Trigger

Notification badge or curiosity creates craving.

2

Action

Infinite vertical scroll with zero friction.

3

Variable Reward

Dopamine hit from unpredictable novel content (slot-machine effect).

4

Investment

Likes and comments feed more data back into the recommender model.

Guided Practice

Personal Cybersecurity Audit Checklist

Evaluate your personal setup against industry baseline defense standards:

Access Control

  • [ ] Password manager used (Bitwarden, 1Password, etc.)
  • [ ] Zero reused passwords across email, school, and banking
  • [ ] TOTP Authenticator app enabled on primary accounts

Device Hygiene

  • [ ] Automatic OS & security patch updates enabled
  • [ ] Full disk encryption enabled (FileVault / BitLocker)
  • [ ] Location services disabled for camera and social apps
Incident Response Protocol

Scenario: Compromised Account Playbook

You receive an email alert: "New login from Moscow, Russia on your primary Google account." What do you do?

1

Isolate

Log out all active web and mobile sessions via account security dashboard.

2

Rotate Key

Change master password to a 20+ char random passphrase immediately.

3

Audit Tokens

Revoke third-party OAuth app authorizations linked to the account.

4

Check Backup

Verify recovery email and phone number were not altered by the attacker.

Spot the Flaw

Find the 3 Fatal Security Flaws

Student Setup Log:

"I use the same awesome 14-character password (P@ssword2024!) for all my school and gaming accounts so I never forget it. When I'm at the coffee shop, I connect to their open Wi-Fi to do my online banking without a VPN. To save time, I keep my 2FA codes set to SMS on my phone."

Analyze: Identify the 3 distinct attack vectors an adversary could exploit here.
Analysis & Solution

Deconstructing the Security Flaws

1. Password Reuse

If a single low-security gaming forum gets breached, automated bots will test those credentials on Google, Steam, and banking (Credential Stuffing).

2. Unencrypted Public Wi-Fi

Using open networks exposes local DNS requests and session metadata to packet sniffing or evil-twin rogue access points.

3. SMS-Based 2FA

SMS is vulnerable to SIM Swapping (social engineering telecom carriers) and SS7 cellular protocol interception.

Knowledge Check 1 / 4

Which of the following represents a PASSIVE digital footprint?

APosting a comment on a classmate's TikTok video
BYour IP address, device model, and OS version logged by a web server
CUploading your resume as a PDF to LinkedIn
DFilling out an online registration form for a coding tournament
Click to reveal answer
Explanation: A passive footprint is metadata collected automatically in the background (IP, telemetry, server logs) without the user actively typing or submitting content.
Knowledge Check 2 / 4

Why is a 4-word random passphrase safer than an 8-character complex password?

APassphrases don't contain numbers so hackers ignore them
BPassphrases are automatically encrypted by operating systems
CLength exponentially expands the search space (entropy), making brute-force mathematically unfeasible
DComplex passwords cannot be stored in password managers
Click to reveal answer
Explanation: Brute force time grows exponentially with length ($O(k^n)$). A 25+ character passphrase has dramatically higher computational entropy than a short 8-character string with symbols.
Knowledge Check 3 / 4

How does End-to-End Encryption (E2EE) differ from standard HTTPS encryption?

AE2EE only works over cellular data, not Wi-Fi
BE2EE prevents the service provider/server itself from reading message contents; only endpoints hold keys
CHTTPS encryption encrypts hardware, while E2EE encrypts software
DE2EE makes it impossible for the recipient to screenshot messages
Click to reveal answer
Explanation: With standard HTTPS, the server decrypts messages in transit. With E2EE, only the communicating endpoints have private decryption keys; intermediate cloud servers see only cipher text.
Knowledge Check 4 / 4

What is the most secure form of Multi-Factor Authentication against phishing?

ASMS text verification codes
BSecurity questions (e.g. "Mother's maiden name")
CEmail confirmation links
DHardware security keys (FIDO2 / WebAuthn standard)
Click to reveal answer
Explanation: FIDO2 hardware keys bind authentication cryptographically to the exact domain in the browser address bar, making them immune to proxy-based phishing sites.
Chapter 1 Review

The 5 Pillars of Digital Defense

1. Assume Zero Trust

Verify identities out-of-band; never click urgency-driven links in messages.

2. Maximize Entropy & Use MFA

Use long, unique passphrases stored in a password manager backed by hardware/app 2FA.

3. Minimize Passive Footprint

Audit permissions, disable telemetry, strip EXIF metadata, and use E2EE services.

4. Ethical Stewardship

Respect intellectual property, recognize algorithmic manipulation, and protect peers' privacy.

Wrap-Up & Next Session

Exit Ticket: 3-2-1 Reflection

3 Key Concepts

Write down 3 technical concepts learned today (e.g. Entropy, E2EE, Passive footprint).

2 Security Actions

List 2 immediate changes you will make to your accounts or devices before tomorrow.

1 Question

One question you have about computer hardware, architecture, or binary logic for Chapter 2!

Next Up in Chapter 2: What is a Computer? Von Neumann Architecture, CPU Cycles & Binary Logic!