Introduction to security
Recognize risk and social engineering
Separate assets, threats, vulnerabilities, and controls in an everyday login scenario.
Work through defensive scenarios and explain the evidence behind each decision.
Describe the risk precisely
An asset is something worth protecting, such as an account or a customer database. A threat is a possible cause of harm. A vulnerability is a weakness that can be exploited. Risk depends on both the likelihood of harm and its impact; a vulnerability list alone is not a risk assessment.
A forged password-reset message targets a person's trust rather than breaking encryption. Check the real destination and use a known route to the service instead of the supplied link. AI-generated text or a convincing voice is not proof of identity.
Choose layers of protection
For a stolen password, multifactor authentication can reduce account takeover risk, while login alerts help detect misuse. A public Wi-Fi network also changes what you trust: check the network, use encrypted services, and avoid accepting unexpected certificate warnings.
Explain what each control prevents or detects, and what risk remains. In a tabletop exercise, record the asset, threat, weakness, proposed control, and evidence that would show an attack. Use fictional accounts and authorized training environments.
Check yourself
Is a login alert preventive or detective?Show answer
Detective. It reports suspicious activity; it does not itself stop someone from signing in.
References used to build these lessons
We used these official documents as references when building this course's lessons. They are the sources for the syllabus structure and course requirements.
College Board · Effective fall 2026