Unit 6 showed that your data crosses machines owned by people you’ll never meet. This unit asks the follow-up: who else is looking — and what can they do with what they see?
Ten minutes. Read it before class; we start from it. Enrolled in our Runestone course? Open it from there so your progress counts.
Security lights up. It wraps around the Internet region — and reaches back toward People, because most of security is about people.
What would be bad if someone read it? What would be bad if someone changed it? Those two questions organize this whole unit.
Personally identifiable information (PII) is information that can identify a specific person: name, address, phone number, birthday, school, face, fingerprint — or a combination of ordinary details that together point to one person.
Aggregation is Unit 5’s metadata lesson with the stakes revealed: one fact is harmless; ten facts combine into an identity someone can impersonate. A data breach — when a company’s stored data is stolen — hands attackers thousands of these combinations at once.
Threat modeling, in plain language, is three questions:
| Ask | Example: your school account |
|---|---|
| Who would want this? | a classmate playing a prank; a scammer who wants a working login |
| What could they do with it? | read your email, send messages as you, change grades-related forms |
| What would stop them? | a strong unique password, multifactor (7.6), not clicking the fake login link (7.7) |
Meet Jordan, a made-up student. Each fact below was posted somewhere public, at a different time, and seemed harmless. Click the facts an attacker could find in five minutes and watch what they add up to.
Five scenarios. Every one has a person in it — that’s how the exam asks.
Pick one account that uses security questions. Change one answer to something true only to you — a “wrong” answer you’ll remember, or a random phrase stored in a password manager. Your real pet’s name is public. Your made-up answer isn’t.