Preventive and corrective measures

Rank these three passwords from lowest to highest security and explain the criteria you used: 'luna2024', 'Tr3s!TristesTigres', '123456'.

What personal data should never appear in a password (your year of birth, your pet's name, your football team)? Explain why these are precisely the first things tested by an attacker who knows you or researches you on social media.

A four-digit PIN allows $10^4$ possible combinations. Calculate how many combinations a six-digit PIN allows and, if a program tests $1.000$ combinations per second, estimate the maximum time it would take to crack each one. What conclusion do you draw about adding characters to a password?

The figure explains how a password manager works.

Explain what the safe marked with ? represents, the advantage of memorising a single master password compared to repeating the same password everywhere, and what special precaution that master password requires.

Why is email said to be the most important account you must protect? Explain what an attacker controlling your email could do to all your other accounts, thinking about the 'forgot my password' button.

Comment on this practice: 'I write my password on a piece of paper stuck under the keyboard; after all, it's not digital'. Assess its real risk and suggest two safer alternatives to avoid forgetting important passwords.

Explain what two-step verification is and why it protects your account even if someone manages to steal your password.

An eight-character password uses lowercase letters only, that is, an alphabet of $26$ symbols; another password of the same length uses uppercase letters, lowercase letters, digits, and symbols, an alphabet of about $70$ symbols. Write the possible combinations for each as powers, $26^8$ and $70^8$, and, without calculating the exact value, use powers of ten to explain how many times stronger the second one is. What offers better protection: lengthening the password or expanding the alphabet?

Prioritise this list of accounts to activate two-step verification, from essential to dispensable, and justify your criteria: email, bank, favourite video game, social network, school platform. Finish by reflecting on whether it makes sense to apply maximum security to everything.

Your mobile phone has been warning you about a system update for months and you always press 'later'. Explain what specific risk you are accepting and the relationship between updates and security vulnerabilities that are already publicly known.

You are connected to the free Wi-Fi in a coffee shop and need to check your bank account. Explain the risks of a public Wi-Fi network, what technical precautions make it safer (HTTPS, VPN, using mobile data), and what operations are best never performed over it.

An acquaintance states: "I have very powerful paid antivirus software installed, so I don't care about using a simple password across all my accounts, and I don't need to waste time installing operating system updates."

1. a) Predict in detail an attack scenario in which a cybercriminal takes control of their computer or their personal accounts without the antivirus ever triggering an alert (for example, via an unpatched system vulnerability or through brute force and social engineering).
2. b) Justify, using the defence-in-depth principle, why a single security mechanism is never enough, explaining how three different defensive layers (system updates, authentication, and active protection) must complement each other to neutralise the threat if one of them fails.

A social network suffers a data breach and your email appears in the list of affected accounts. Describe step by step and in order what you would do from that moment on: which passwords to change, what to check in other accounts, and what additional protection to activate.

A service alerts you: 'a login from another country has been detected'. Describe step by step and in order what you would do upon receiving this alert: how to confirm if it was you, which credentials to change, where to check active sessions, and what protection to activate afterwards.

A family stores 400 GB of irreplaceable photos and official documents on their desktop computer. As a precaution, they keep a weekly backup on an external USB hard drive that they leave permanently connected to the computer.

1. a) Justify why this measure is insufficient against two specific threats: a ransomware attack and an electrical power surge in the home.
2. b) Design an effective backup strategy applying the 3-2-1 rule adapted to this family: specify which media to use, where the copies should be physically located, and how often they should be updated, justifying each technical decision.