Chapter 10 — Keeping data secure
Lesson map
Lesson 10 published. Map, example, EX037.
flowchart TD
N0["Learning outcomes"]
N1["10.1 Accounts and passwords"]
N2["10.2 Access by need"]
N3["10.3 Phishing"]
N4["10.4 Devices"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX037"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["10.1 Accounts and passwords"]
N2["10.2 Access by need"]
N3["10.3 Phishing"]
N4["10.4 Devices"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX037"]
[Learning outcomes]
|
v
[10.1 Accounts and passwords]
|
v
[10.2 Access by need]
|
v
[10.3 Phishing]
|
v
[10.4 Devices]
|
v
[Worked example] --> [Exercise EX037]
Learning outcomes
You will (1) use passwords and access controls properly; (2) recognise phishing; (3) protect data on devices.
10.1 Accounts and passwords
Marta learns that each person should have their own account, never shared, so that actions can be traced. Passwords should be long and unique, ideally managed with a password manager, and multi-factor authentication should be used where available. At Linkway, depot staff shared one login for the roster system. Mr. Hughes replaces it with individual accounts. Marta notes that shared accounts make it impossible to know who changed a roster. Depot staff receive their accounts within a week, and the old shared login is switched off.
10.2 Access by need
Staff should see only data they need. Marta reviews who can open the roster spreadsheet and finds that all office staff can, including people in marketing. Mr. Hughes restricts it to depot managers and payroll. Marta learns that access should be checked regularly, especially when people change jobs, and that the data owner, not the technician, decides who needs access. Mr. Hughes asks Marta to check the roster access list again every quarter, and to report any names that have been added since the previous check, so that he can decide whether each one still needs it.
10.3 Phishing
Mr. Osei shows examples of phishing emails pretending to be from IT asking staff to confirm passwords. Marta learns to check the sender address, look for urgent threats and never enter passwords through email links. During the course, Linkway runs a practice phishing email; Marta reports it instead of clicking. Mr. Hughes notes that reporting suspicious emails helps protect everyone, because one click can expose the whole company's data. Marta records the exercise in her workbook as an example of good practice.
10.4 Devices
Laptops and phones holding Linkway data must be encrypted and locked with a PIN. Data should not be copied to personal memory sticks. Marta notices a memory stick labelled rosters left in a depot office and hands it to Mr. Hughes, who checks it, finds old rosters and destroys it. Mr. Osei explains that small portable devices are easily lost, and that encrypted, approved storage prevents loss turning into a breach. Linkway reminds all staff that only encrypted company storage may be used for data.
Worked example
Marta learns individual accounts, strong passwords and MFA, sees roster access restricted to depot managers and payroll, reports a practice phishing email and hands in an unlabelled roster memory stick.
Synthetic case. Events are synthetic.
Errors and limits
Shared logins make it impossible to trace who changed data.
Exercises
- EX037 — Shared login fix. What replaced the shared roster login? Rubric: 3 = individual accounts;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX038 — Roster access. Who can now open the roster spreadsheet? Rubric: 3 = depot managers and payroll;; 2 = both;; 1 = one;; 0 = none.
- EX039 — Phishing response. What did Marta do with the practice phishing email? Rubric: 3 = reported it;; 2 = partly correct;; 1 = clicked;; 0 = none.
- EX040 — Memory stick. What was on the found memory stick? Rubric: 3 = old rosters;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 10 (chapter 10 of 18)
← Chapter 09 · Course chapter index · Chapter 11 →
Continue to the next authored lesson.