Chapter 5 — Security literacy | Bachelor's Privacy and data protection

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Threats to schools"]
  N2["5.2 Explaining protections"]
  N3["5.3 Incidents are data protection events"]
  N4["5.4 Culture"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Threats to schools"]
  N2["5.2 Explaining protections"]
  N3["5.3 Incidents are data protection events"]
  N4["5.4 Culture"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Threats to schools]
    |
    v
[5.2 Explaining protections]
    |
    v
[5.3 Incidents are data protection events]
    |
    v
[5.4 Culture]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) recognise common threats to school data; (2) explain basic protections to staff; (3) relate security incidents to data protection.

5.1 Threats to schools

Elena studies threats that schools face: phishing emails pretending to be from parents or suppliers, ransomware that encrypts records, lost devices and misdirected emails. She reads that schools are attractive targets because they hold valuable data and often have limited security staff. She lists the trust's most likely incidents and finds that misdirected emails, such as sending one family's report to another, are the most frequent, even though ransomware gets more attention in the news. Her incident log review supports this ranking clearly.

5.2 Explaining protections

Elena prepares a short session for teachers. She explains strong passwords with a password manager, multi-factor authentication for email, checking recipients before sending and locking screens. She uses examples from schools rather than banks. She avoids blaming staff for mistakes, explaining that systems should make the safe choice easy, for instance by warning when an email is sent to an external address. Teachers respond better to practical advice than to warnings about hackers. One example: confirm attachments before sending externally. Teachers adopt them quickly.

5.3 Incidents are data protection events

Elena learns that a security incident involving personal data may be a personal data breach under the GDPR. Sending a pupil's report to the wrong parent is a breach, even if accidental. The trust must assess the risk and, unless the breach is unlikely to result in a risk to individuals, notify the supervisory authority within 72 hours under Article 33. She notes that many staff think breaches are only about hackers, so training must cover everyday mistakes. A wrong email can be a breach.

5.4 Culture

Elena reflects on security culture. Staff who fear punishment hide mistakes, which delays response. She recommends a reporting process that thanks staff for reporting quickly and focuses on fixing problems. Dr. Asante agrees, noting that fast reporting is essential when the 72-hour clock applies. Elena writes a one-page guide titled What to do if you send something to the wrong person, which tells staff to report immediately to the data protection lead and not to try to fix it alone. Speed matters most.

Worked example

Elena identifies misdirected emails as the most frequent threat, trains teachers with school examples, explains that accidental disclosures are breaches under Article 33 and promotes a no-blame reporting culture.

Synthetic case. Incidents are synthetic; GDPR Article 33 is real.

Errors and limits

No-blame does not mean no accountability; repeated careless behaviour still needs management.

Exercises

EX013 — Most frequent incident. Which incident is most frequent for the trust?
Show marking criteria
Rubric: 3 = misdirected emails;; 2 = mentions email;; 1 = ransomware;; 0 = none.
EX014 — Accidental breach. Is sending a report to the wrong parent a breach?
Show marking criteria
Rubric: 3 = yes; accidental disclosure counts;; 2 = yes;; 1 = no;; 0 = none.
EX015 — Reporting culture. Why thank staff for reporting mistakes quickly?
Show marking criteria
Rubric: 3 = fear delays reporting, and the 72-hour clock needs speed;; 2 = mentions speed;; 1 = punish;; 0 = none.

Synthesis

Chapter 5 builds security literacy. Chapter 6 introduces discrete structures.

Continue studying — chapter 05 of 40

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →