Why Security Matters to Everyone

A first morning at the help desk

The town library has a new sign by the front door: Digital Help Desk: bring your phone, your laptop and your questions. Behind the desk, Grace Holloway is hanging up her coat. It is her first morning as a volunteer, and she is nervous.

“I'm not a computer expert,” she tells Nina Wells, the librarian who runs the desk. “I just use my phone like everybody else. What if someone asks me something I don't know?”

“Then you'll learn it together,” says Nina, smiling. “That's the whole idea. And you won't be on your own.” She nods towards an older man setting out chairs. “Arthur spent thirty years in charge of computer security for a big company. Now he's retired, and he'd rather help real people than read reports.”

Arthur Pembridge shakes Grace's hand. “Here's a secret,” he says. “Most of what keeps people safe online isn't technical at all. It's a few good habits and knowing what to look out for. If you can explain those in plain words, you'll be more useful here than any expert.”

This course follows Grace as she learns. Everything she learns, you will learn too, in the same plain words, with plenty of practice along the way.

What “cyber security” means

Cyber security sounds like something for large companies with rooms full of computers. In fact it simply means keeping your digital life safe: your accounts, your devices, your money, your photos and your good name.

“Cyber” is simply a label people attach to anything to do with computers and the internet. “Security” means protection. So cyber security is protecting the things you care about that live on phones, computers and the internet, in the same way that you already protect the things in your home with locks, a safe place for important papers and a sensible caution about who you let in.

You already have most of the instincts you need. You would not hand your house keys to a stranger who knocked on the door claiming to be from “the council”. You would not sign a cheque because a letter said you must do it by five o'clock. Online, the same instincts apply. The tricks simply look different, and this course will teach you to recognise them.

What can go wrong

It helps to be honest about the risks, without being frightened by them. Here are the four kinds of trouble that bring people to the help desk most often.

Notice the right-hand column. In every case, something simple would have stopped the problem. That is the most important thing to take away from this lesson.

A message that arrived this morning

Grace's very first visitor is Florence Baker, who is eighty-one and comes in every week. She has a message on her phone and a worried look on her face.

“It says my account's been stopped,” she says. “Is it real?”

Read the message, then press the button to see what Arthur pointed out. Do not worry if you cannot spot everything yet. By the end of Module 3 you will find these signs at a glance.

“So it's a fake?” asks Florence.

“It is,” says Arthur. “But the important thing is what you did. You didn't tap the link. You came and asked. That's exactly right.” Together, they open the real Brackwell app on Florence's phone. Her account is perfectly normal, with no warnings at all.

The good news: a handful of habits stop most problems

Online criminals mostly rely on the same few openings, again and again: a guessable or reused password, an out-of-date device, and a moment of panic that makes someone click, pay or share a code. Close those openings and you have prevented most of the trouble people ever meet.

Arthur keeps a list of six habits pinned above the help desk. You will learn each of them properly in this course:

1. Slow down when a message surprises you. Stop, check through a way you already trust, and ask someone. (Modules 1 and 3)
2. Use long passwords, a different one for every account, and let a password manager (an app that remembers them for you) keep track of them. (Module 2)
3. Turn on two-step sign-in (a second check, such as a code sent to your phone, on top of your password), especially for your email and your bank, and never share a sign-in code with anyone. (Module 2)
4. Keep your devices up to date, and install apps only from the official app store on your phone or computer. (Module 4)
5. Back up your photos and important files, so that nothing can take them away from you. (Module 8)
6. Think before you share personal details and photos publicly. (Module 7)

None of these takes long. Most of them you set up once and then forget about.

Try it: how strong is a password?

This is the password tester, one of the practice tools you will use in this course. It estimates how long a password-guessing program would take to find a password. It works entirely on this page: nothing you type is sent anywhere. Even so, never type a real password into any tester, here or elsewhere. Make up examples instead.

It starts with the kind of password many people use: a name, a year of birth and an exclamation mark. Look at what the tester says, then try replacing it with four random words separated by spaces, such as kettle orbit lantern velvet.

The first example is rated Weak: a criminal with a fast computer would find it in less than a second, because names and years are among the first things guessing programs try. The four random words are rated Very strong, and they are easier to remember. You will find out exactly why in Lesson 2.1.

Try it: where does a link really go?

The second tool is the link inspector. A web address (the text beginning https://) says where a link will take you, but criminals are good at making addresses look official. The inspector picks out the part of the address that really decides where it goes.

Try the three example links. The first is Brackwell Bank's real address. The other two only pretend to be.

The third link is the sneakiest: it starts with the bank's real name, but the part that decides where it goes is further along. You will learn to read addresses like this with confidence in Lesson 3.3.

How the course works

Each lesson follows the same pattern, so you always know where you are:

• A short scene at the help desk introduces a real problem that a visitor brings in.
• Plain explanations, with tables, worked examples and notes, teach you what you need to know.
• Pretend messages and screens (emails, texts, calls, web pages and pop-ups) let you look closely at real-life tricks in complete safety. Press “Show the warning signs” to see the explanations.
• Practice tools, such as the password tester and link inspector you have just tried, let you experiment for yourself.
• Five exercises in each lesson from Lesson 1.2 onwards give you practice on the visitors' problems. You might choose the best answer, tap the warning signs in a message, put steps in order, match things up, set the switches on a settings screen or make up a strong password. Every exercise is checked instantly, with helpful feedback if you are not quite right, and you can always press “Show the answer”.
• A quick check of four questions and a summary end each lesson.

Take your time. There are no marks to lose and no penalty for trying again. Most lessons take between 25 and 40 minutes.

The course map

The course has ten modules. They are arranged so that each one builds on the last, starting with the habits that protect you most.

Meet the people at the help desk

You will get to know these people well over the coming lessons.

At the end of her first morning, Grace looks at Arthur's list of six habits. “Is that really most of it?” she asks.

“Most of it,” says Arthur. “The rest is practice. Shall we begin?”

Quick check

Choose an answer to see whether you are right and why.

Found a mistake on this page, or something unclear? Report a problem and mention “Cyber Safety Lesson 1.1”.