Cyber Security: Protecting Your Accounts, Devices and Identity

The lessons at a glance

1. How accounts really get hacked: a calm threat model

Most account takeovers are not the work of a movie-style genius. They rely on a handful of ordinary tricks that work again and again. Once you know the main routes in, you can close them calmly, one at a time.

• Most hacks use ordinary tricks: reused passwords, phishing, leaked data, SIM swaps and bad apps.
• Protect your email first: it is the key to resetting everything else.
• Never sign in from a link in a message; go to the app or site yourself.
• Never approve a login request you did not start.
• Install apps only from official stores.

2. Passwords, passphrases and password managers

You do not need to memorise forty impossible passwords. Modern advice is simpler: long, unique passwords, a manager to remember them, and one strong passphrase you actually know by heart.

• Length beats complexity: random words, not 'P@ssw0rd' tricks.
• NIST now asks for at least 15 characters where a password is used alone.
• One unique password per account, starting with email.
• A password manager remembers the rest and will not autofill on fake sites.
• Never save passwords on shared or public computers.

3. Two-step verification and passkeys: which kind is strongest

Any second step is far better than a password alone, but not all second steps are equal. Knowing the difference between a text code, an app, a security key and a passkey lets you choose the strongest option your accounts offer.

• Any 2SV beats none; text codes are better than nothing.
• Strongest: passkeys and security keys, because they resist phishing.
• Never approve a request you did not start, and never share a code.
• Create passkeys only on devices you own.
• Keep recovery details and backup options up to date.

4. Keeping devices safe: updates, backups, permissions and theft protection

Your phone is the remote control for your whole digital life. A few settings, switched on today, mean that an old flaw, a stolen handset or a ransomware attack becomes an inconvenience rather than a disaster.

• Turn on automatic updates and replace devices that no longer get them.
• Back up anything you value, and unplug backup drives after use.
• Give apps the fewest permissions they need.
• Switch on theft protection before you need it.
• After a loss, change key passwords and remove that device's passkeys.

5. Public Wi-Fi, QR codes, fake apps and browser safety

Cafés, malls, airports and campuses are full of convenient shortcuts: free Wi-Fi, a QR code menu, a handy app. Most are fine. A few habits help you spot the ones that are not.

• Public Wi-Fi is usually fine, but use mobile data for banking and email.
• Only use a VPN provided or approved by your school, employer or a trusted adult, and never to get round blocks.
• Every QR code could be fake: check the address first.
• Install apps only from official stores and read permission requests.
• A padlock means encrypted, not trustworthy.

6. Privacy settings, location sharing and blackmail awareness

Good privacy settings stop most problems before they start. This lesson goes beyond the basics in Personal Safety (ps-08): what default protections exist for teens, how to control who knows where you are, and exactly what to do if anyone ever tries to pressure or blackmail you.

• Private by default is a start: check every app's settings yourself.
• Share your location on purpose, with people you know in person.
• Blackmailers want money and move fast; it is never your fault.
• Do not pay, stop contact, keep evidence, tell a trusted adult, report.
• Take It Down and Report Remove can help remove images taken under 18.

7. If you are hacked: step-by-step recovery and reporting

Getting hacked feels personal and frightening, but recovery follows a clear order. Work through it calmly: regain control, lock the doors, check for damage, then report. This lesson focuses on accounts; for lost money, see the Scams and Fraud module (sc-08).

• Order matters: regain access, kill forwarding rules, change passwords, log out everywhere.
• Then remove unknown devices and apps, and turn on strong 2SV.
• Warn your contacts and check your money.
• Report through official UAE channels and keep evidence.
• If recovery fails, start a new account and tell everyone.

8. Being a good digital citizen: other people's data, images and the law

Cyber security is not only about protecting yourself. Every time you screenshot, forward, tag or post, you are handling someone else's privacy too. In the UAE, some of these choices are also legal matters.

• Ask before photographing, filming or posting anyone.
• In the UAE, sharing others' images, chats or location without consent can be a crime.
• Never film accidents or victims for social media.
• Check before forwarding; insults and false information online have legal consequences.
• Support targets of bullying and report through official channels.

Talk about it, then try it

The real-life practice tasks from each lesson. Pick one or two a week and agree when you will check in.

1. How accounts really get hacked: a calm threat model
   • Write your own five-line threat model in your notes app: your three most important accounts, who might want them, and the single biggest weak spot you can fix this week.
   • Check your main email address on haveibeenpwned (or your password manager's breach check) with a parent or trusted adult, and change any reused password it reveals.
   • Ask your mobile provider, or check its app, whether you can add a PIN or password to your account to make SIM swaps harder.
2. Passwords, passphrases and password managers
   • Choose and set up a password manager this week, with a parent if you share devices, and protect it with a passphrase of at least four random words.
   • Give your email account a brand new passphrase that you have never used anywhere else.
   • Log out of any browser on a shared or school computer that has your passwords saved, and remove the saved passwords.
3. Two-step verification and passkeys: which kind is strongest
   • Open the security settings of your email account and check which 2SV options it offers. Move up one rung of the ladder if you can, for example from text codes to a passkey or an authenticator app.
   • Create a passkey for one important account on a phone or laptop that only you use, then test signing in with it.
   • Check that your account recovery email and phone number are correct on your three most important accounts.
4. Keeping devices safe: updates, backups, permissions and theft protection
   • Turn on automatic updates for your phone, laptop and browser, and check whether each device still gets security updates.
   • Switch on Stolen Device Protection (iPhone) or Theft protection (Android).
   • Spend ten minutes in your permission settings and switch location, camera and microphone to 'only while using' or 'don't allow' for any app that does not need them.
5. Public Wi-Fi, QR codes, fake apps and browser safety
   • On your phone, turn off Wi-Fi auto-connect for public networks and 'forget' any public network you no longer use.
   • Review your browser extensions on every device and remove any you do not recognise or no longer use.
   • Next time you see a QR code, practise checking the full web address before you open it.
6. Privacy settings, location sharing and blackmail awareness
   • Do the 15-minute privacy audit on your two most-used apps, and set messaging and tagging to people you follow.
   • Check your location sharing: on Snapchat, choose Ghost Mode or Select Friends; on iPhone, open Safety Check and review who can see your location.
   • Save the Aman number (8002626) and the name of the MOI UAE app in your phone, and agree with a parent or trusted adult that you can always come to them without being judged.
7. If you are hacked: step-by-step recovery and reporting
   • Make a 'hacked plan' card in your notes: the recovery page links for your email and main social account, your bank's official number and the UAE reporting channels.
   • Check your email settings for forwarding rules and filters today, even if nothing seems wrong.
   • Review the list of devices signed in to your Google, Apple or Microsoft account and remove any you do not recognise.
8. Being a good digital citizen: other people's data, images and the law
   • Go through your camera roll and recent posts. Delete or archive anything showing other people that they might not want shared, and ask before posting next time.
   • Before forwarding any 'urgent' news message this week, check it against an official source first.
   • Help one family member switch on 2-step verification or tighten their privacy settings.

Quiz

Name: ______________________ Date: ____________ Circle one answer for each question.

Answer key

1. B: OWASP: credential stuffing is the automated injection of stolen username and password pairs into other sites' login forms, and it works because people reuse passwords.
2. A: CISA: poor grammar used to be a common sign, but AI tools can now produce flawless messages, so it is no longer reliable on its own.
3. D: NCSC: complexity rules lead to predictable habits such as swapping letters for numbers, which attackers know about.
4. D: Enzoic summary of NIST SP 800-63B Revision 4: a 15-character minimum applies when a password is the only authenticator, replacing the old 8-character habit.
5. C: FIDO Alliance: device-bound passkeys in modern hardware security keys offer the highest security assurance.
6. C: FIDO Alliance: passkeys are tied to a user's account on a specific website or app, and with no password to type there is nothing for a phishing site to capture.
7. A: NCSC: viruses and other malware such as ransomware can move to attached media automatically, so disconnect removable media when not in use.
8. A: Apple: away from familiar locations, actions such as using saved passwords or passkeys need Face ID or Touch ID with no passcode alternative.
9. C: Gulf News (August 2025): the Council advised avoiding sensitive accounts such as banking or email on public Wi-Fi and using a reliable VPN.
10. B: FTC: encryption does not protect you from scammers operating the site itself.
11. B: NCA: do not pay, stop contact and block, avoid deleting anything, and tell a trusted adult or the police. You are not to blame.
12. B: NCA (2024): offenders may claim to have hacked the young person, whether or not that is true. Do not pay, stop contact, keep evidence and tell a trusted adult.
13. C: NCSC: a common tactic is to set up a forwarding rule so the criminal receives your emails and can reset your passwords.
14. D: NCSC: log out all devices and apps so anyone using the account must enter the new password.
15. B: Hadef and Partners: Article 44 covers using technology to invade privacy without consent, including taking photos of third parties in any public or private place.
16. C: Hadef and Partners: publishing photos of injured people or accident victims without permission is covered by Article 44 of the UAE cybercrime law.

General information only, written from the sources listed in each online lesson. Laws, numbers and services change, so check official sources. Life-Ready Society, https://lifereadysociety.com/cyber/