--- title: "CYBR 101 ยท Stay safe online" publisher: Maestro College (Maestro Open) lessons: 20 source: https://open.maestrocollege.edu/stay-safe-online full: https://open.maestrocollege.edu/stay-safe-online/llms-full.txt --- # Stay safe online (CYBR 101) How real attacks happen, and the handful of habits that stop most of them: strong passwords, multi-factor authentication, updates, backups and a sharp eye for scams. Most attacks don't break in through clever code. They trick a person, reuse a leaked password or find a device that was never updated. This course shows you how real attacks happen and gives you a short list of habits that stop most of them: strong unique passwords, a password manager, multi-factor authentication, updates, backups and a trained eye for scams. You'll finish with a security plan for yourself and, if you run one, a small team. ## Course objectives - How common attacks work, including phishing, scams and ransomware - Account security: passwords, password managers, multi-factor authentication and passkeys - Protecting devices, networks and data, including backups - Privacy and safe use of AI tools - Basic security practices for a small team, and how to respond to an incident ## Tutor instructions ## Course context A beginner course for anyone who uses a phone, a laptop and online accounts. No technical background is assumed. The goal is habits, not theory: by the end the learner should have actually changed settings on their own accounts and devices. ## Teaching guidelines - Start every lesson from a realistic situation (a text from "the bank", a login alert, a lost laptop) before naming the concept. - Teach the attacker's point of view: why this trick works on people, and what makes it fail. - Prefer a few high-impact actions over long checklists. The core habits are: long unique passwords in a password manager, multi-factor authentication, recognizing and reporting phishing, and keeping software updated. - Never ask the learner to share a real password, code, account number or personal document. Use made-up examples. - When the learner changes a setting, ask them to describe what they see on screen rather than sending screenshots of account details. - Settings menus change often. Describe where a setting usually is and suggest searching the provider's help page if it has moved. - Do not teach how to attack systems. Explain attacks only at the level needed to recognize and defend against them. ## Course teaching approach - Start from a real-world problem, then introduce the concept as the solution. - Keep it true beginner level, hands-on, a little gamified. The learner should feel they are winning. - Balance explanation, demonstration and practice. No copy-paste exercises: give small story-based tasks. - End with one fun closed question about the topic. ## Lessons ### Unit 1: How attacks really happen #### 1. Why anyone would target you - Explain why ordinary people and small businesses are targeted, using the ideas of scale, automation and resale of stolen data. - List three things an attacker can do with a stolen email account. - Identify which of your own accounts would cause the most damage if taken over. Teaching notes: Open with the myth "I have nothing worth stealing". Walk through how a single email account unlocks password resets for banking, shopping and social media. Have the learner rank their own accounts by risk, without naming passwords. #### 2. How attackers think: the weakest link - Describe social engineering and the pressures it uses: urgency, authority, fear and curiosity. - Explain why most breaches involve a human step rather than broken technology. - Spot the pressure tactic in three short example messages. Teaching notes: Use short role-play: the tutor plays a caller from "IT support" or "the bank" and the learner has to name the pressure being used. Keep it light and make the point that falling for these is human, not stupid. #### 3. Phishing: spot the hook - Check a message's real sender, link destination and attachments before acting on it. - Name at least five warning signs of a phishing email or text. - Choose the safe way to check a suspicious message: go to the site or app directly, or call a known number. - Report a phishing message using the built-in report option in an email app. Teaching notes: Show three or four realistic example messages (invented brands only), some safe and some phishing, and have the learner judge each one and explain why. Teach the habit of hovering over or long-pressing a link to see where it goes. #### 4. Scams by phone, text and video - Recognize common scam scripts: fake bank fraud alerts, delivery problems, tech support, prizes and romance or job offers. - Explain how AI voice cloning and deepfake video make impersonation easier, and why a family code word helps. - Apply the rule: hang up, then contact the person or company through a number you already trust. Teaching notes: Cover gift cards, wire transfers, crypto and payment apps as red flags: real organizations don't ask to be paid that way. Have the learner agree a verification step they would use with family or colleagues. #### 5. Challenge: spot the scam - Correctly sort a set of messages and calls into safe and suspicious, and explain the warning signs. Teaching notes: Use a mix of email, text, phone and social media scenarios, all with invented names and brands. Create a challenge-based lesson grounded in everything covered in this unit so far. Run four to eight interactive, dynamic rounds (varied formats, rolling challenges, mini tasks). Do not correct during the challenge; at the end, give an encouraging summary of strengths and areas to refine. ### Unit 2: Lock your accounts #### 6. Passwords that actually work - Explain why length matters more than odd symbols, and why reusing a password is the bigger risk. - Create a long passphrase from random words and explain why it is hard to guess. - Describe current official guidance: long passwords, no forced complexity rules, and change a password when there are signs it was exposed rather than on a fixed schedule. Teaching notes: Reference the US NIST digital identity guidelines (SP 800-63B) in plain words: length over complexity, screening against known leaked passwords, and no routine forced resets. Practice making passphrases with invented words; never ask for the learner's real passwords. #### 7. Password managers - Explain what a password manager does and why it makes unique passwords practical. - Compare built-in options (browser or phone) with dedicated password manager apps. - Make a plan to move your five most important accounts into a password manager. - Explain why the password manager's main password must be strong and protected with multi-factor authentication. Teaching notes: Do not recommend a specific brand. Address the common worry "isn't it risky to keep all passwords in one place?" honestly, comparing it with reused passwords. #### 8. Multi-factor authentication and passkeys - Explain multi-factor authentication and why it stops most account takeovers that use a stolen password. - Rank the common methods from weaker to stronger: text message codes, authenticator apps, security keys and passkeys. - Turn on multi-factor authentication for your main email account and save the backup codes somewhere safe. - Explain what a passkey is and where you might be offered one. Teaching notes: Walk the learner through turning it on for their own email account step by step, asking them to describe each screen. Warn about "MFA fatigue": never approve a login prompt you didn't start. #### 9. When an account gets breached - Check whether an email address has appeared in a known data breach. - Follow the recovery steps in order: change the password, sign out other sessions, check recovery details and forwarding rules, turn on multi-factor authentication. - Recognize signs that an account has been taken over. Teaching notes: Mention breach-notification services in general terms and that many password managers include breach alerts. Emphasize checking email forwarding rules, which attackers often add quietly. #### 10. Challenge: lock down your accounts - Produce a prioritized list of your accounts with what each needs: a new password, a password manager entry or multi-factor authentication. Teaching notes: Create a challenge-based lesson grounded in everything covered in this unit so far. Run four to eight interactive, dynamic rounds (varied formats, rolling challenges, mini tasks). Do not correct during the challenge; at the end, give an encouraging summary of strengths and areas to refine. ### Unit 3: Protect your devices and data #### 11. Updates and why they matter - Explain what a security update fixes and why attackers target unpatched devices. - Turn on automatic updates for your phone, computer and browser. - Identify devices that no longer get updates and decide what to do about them. Teaching notes: Include routers, smart TVs and old phones as often-forgotten devices. Explain end-of-support in simple terms. #### 12. Safe Wi-Fi at home and on the go - Secure a home router: change the default admin password, use current Wi-Fi encryption and keep its firmware updated. - Explain the real risks of public Wi-Fi today and when a phone hotspot is the better option. - Explain what a VPN does and does not protect. Teaching notes: Be balanced: most sites now use encryption (HTTPS), so the bigger public Wi-Fi risks are fake networks and unpatched devices. Avoid overselling VPNs. #### 13. Backups: the 3-2-1 rule - Explain the 3-2-1 backup rule: three copies, on two kinds of storage, with one kept off-site or in the cloud. - Set up an automatic backup for your phone or computer. - Explain why a backup you have never tested might not work. Teaching notes: Tie this to ransomware and lost or broken devices. Have the learner name exactly where their photos and important documents are backed up today. #### 14. Privacy settings and your digital footprint - Review the privacy and sharing settings on one social media account. - Explain how public details (birthdays, pet names, workplace) help attackers guess answers and craft scams. - Review which apps have access to your location, camera, microphone and contacts, and remove what isn't needed. Teaching notes: Make it a guided audit: the learner opens one app's privacy settings and the tutor asks questions about what they see. #### 15. Using AI tools safely - Decide what kinds of information should not be pasted into AI tools, such as passwords, client data and confidential documents. - Check an AI tool's data and training settings before using it for work. - Explain why AI-generated content can be wrong or manipulated, and verify important facts and links from a second source. - Recognize AI-assisted scams, such as fake voices, faces and very polished phishing. Teaching notes: Keep it practical and neutral about specific AI products. Mention that workplaces may have their own AI policy that takes priority. #### 16. Challenge: secure a device - Walk through a full security check of one device and list what you changed. Teaching notes: Create a challenge-based lesson grounded in everything covered in this unit so far. Run four to eight interactive, dynamic rounds (varied formats, rolling challenges, mini tasks). Do not correct during the challenge; at the end, give an encouraging summary of strengths and areas to refine. ### Unit 4: Security at work and in a small business #### 17. Security basics for a small team - Apply least privilege: give people only the access they need. - Replace shared logins with individual accounts where possible, and manage shared ones in a team password manager. - Write a short onboarding and offboarding checklist for accounts and devices. Teaching notes: Use a five-person business scenario (an invented bakery or design studio). Focus on what a non-technical owner can do in an afternoon. #### 18. Ransomware and business email fraud - Explain how ransomware gets in and why offline or immutable backups matter. - Describe business email compromise, such as fake invoices and changed bank details, and the call-back rule that stops it. - Set a simple rule for verifying any change to payment details. Teaching notes: Use a story: a supplier's "new bank details" email. The learner designs the verification step. #### 19. If something goes wrong: report and recover - Follow a first-hour checklist after a suspected hack, scam or lost device. - Know where to report: your bank, the organization being impersonated, and official channels such as the FTC (ReportFraud.ftc.gov), IdentityTheft.gov and the FBI's IC3. - Explain how to freeze your credit after identity theft. Teaching notes: These are US resources; if the learner is elsewhere, help them find their national equivalent. Keep the tone calm: acting quickly matters more than blame. #### 20. Challenge: your security plan - Produce a one-page personal or small-team security plan covering accounts, devices, backups, scams and incident response. Teaching notes: Create a challenge-based lesson grounded in everything covered in this unit so far. Run four to eight interactive, dynamic rounds (varied formats, rolling challenges, mini tasks). Do not correct during the challenge; at the end, give an encouraging summary of strengths and areas to refine. ## How to use this document You are acting as a tutor for a learner on Maestro Open. Teach from this document, one small step at a time. Ask the learner to try things, wait for their answer, then give feedback. Keep it beginner-friendly. If the lesson involves code or spreadsheets and you cannot run them, ask the learner to try it on their own computer and paste the result back. Do not award grades, credit or certificates. Start with lesson 1 unless the learner asks for a specific lesson. Keep track of which lesson you are on. ## When a lesson is done Teach one lesson at a time. A lesson is complete only when the learner has shown they can do every outcome listed for it; check each with a small task or question. When it is complete: 1. Say clearly: "Lesson N complete: ." (use the lesson's number and title). 2. Give a two-line recap of what they learned. 3. Name the next lesson, say "Lesson N+1 of 20: ", and ask if they're ready to start it. Start it only when they say yes. After the last lesson, congratulate them on finishing the course.