Exercises: Preventive and corrective measures

Rank these three passwords from lowest to highest security and explain the criteria you used: 'luna2024', 'Tr3s!TristesTigres', '123456'.

Explain what two-step verification is and why it protects your account even if someone manages to steal your password.

The figure compares the estimated strength of two passwords.

State which of the two is stronger, explain what features make it strong, and explain what decryption time would fill the gap marked with ? by comparison.

The figure explains how a password manager works.

Explain what the safe marked with ? represents, the advantage of memorising a single master password compared to repeating the same password everywhere, and what special precaution that master password requires.

What personal data should never appear in a password (your year of birth, your pet's name, your soccer team)? Explain why these are precisely the first things tested by an attacker who knows you or researches you on social media.

Explain what lockout after failed attempts is on a cell phone or ATM and how it turns a four-digit PIN into reasonable defense even though there are few possible combinations.

Why is email said to be the most important account you must protect? Explain what an attacker controlling your email could do to all your other accounts, thinking about the 'forgot my password' button.

Comment on this practice: 'I write my password on a piece of paper stuck under the keyboard; after all, it's not digital'. Assess its real risk and suggest two safer alternatives to avoid forgetting important passwords.

A four-digit PIN allows $10^4$ possible combinations. Calculate how many combinations a six-digit PIN allows and, if a program tests $1,000$ combinations per second, estimate the maximum time it would take to crack each one. What conclusion do you draw about adding characters to a password?

Your cell phone has been warning you about a system update for months and you always press 'later'. Explain what specific risk you are accepting and the relationship between updates and security vulnerabilities that are already publicly known.

A social network suffers a data breach and your email appears in the list of affected accounts. Describe step by step and in order what you would do from that moment on: which passwords to change, what to check in other accounts, and what additional protection to activate.

Compare these two passwords: 'X7#k9', five very unusual characters, and 'casa verde luna rio', a long passphrase of common words. Explain what matters more in a password's strength — length or character complexity —, which one you would remember better, and what type of attack each one is vulnerable to.

A service alerts you: 'a login from another country has been detected'. Describe step by step and in order what you would do upon receiving this alert: how to confirm if it was you, which credentials to change, where to check active sessions, and what protection to activate afterwards.

Explain what security questions are ('what is the name of your first pet?'), why they are a weak link if the answers can be found on your social media, and what strategy you can use when answering them without forgetting them later.

You are connected to the free Wi-Fi in a coffee shop and need to check your bank account. Explain the risks of a public Wi-Fi network, what technical precautions make it safer (HTTPS, VPN, using cellular data), and what operations are best never performed over it.

An eight-character password uses lowercase letters only, that is, an alphabet of $26$ symbols; another password of the same length uses uppercase letters, lowercase letters, digits, and symbols, an alphabet of about $70$ symbols. Write the possible combinations for each as powers, $26^8$ and $70^8$, and, without calculating the exact value, use powers of ten to explain how many times stronger the second one is. What offers better protection: lengthening the password or expanding the alphabet?

After the database containing emails and passwords of an online clothing store is leaked, several customers suffer unauthorized access to their bank and email accounts, even though those entities did not experience any security breach.

1. a) Justify the automated technical procedure used by attackers to break into the other accounts using the leaked data, explaining why a long and complex password ceases to be secure as soon as it is reused.
2. b) An affected user states: "Just by changing the password of the hacked clothing store, I'm already safe". Rebut their statement by predicting the real risks to which they remain exposed, and design a three-step immediate response protocol to protect their digital identity.

A family stores 400 GB of irreplaceable photos and official documents on their desktop computer. As a precaution, they keep a weekly backup on an external USB hard drive that they leave permanently connected to the computer.

1. a) Justify why this measure is insufficient against two specific threats: a ransomware attack and an electrical power surge in the home.
2. b) Design an effective backup strategy applying the 3-2-1 rule adapted to this family: specify which media to use, where the copies should be physically located, and how often they should be updated, justifying each technical decision.

An acquaintance states: "I have very powerful paid antivirus software installed, so I don't care about using a simple password across all my accounts, and I don't need to waste time installing operating system updates."

1. a) Predict in detail an attack scenario in which a cybercriminal takes control of their computer or their personal accounts without the antivirus ever triggering an alert (for example, via an unpatched system vulnerability or through brute force and social engineering).
2. b) Justify, using the defence-in-depth principle, why a single security mechanism is never enough, explaining how three different defensive layers (system updates, authentication, and active protection) must complement each other to neutralise the threat if one of them fails.

Design a password policy for the website of a sports club storing data on minors: minimum length, two-step verification for coaches and managers, what to do with shared team accounts, and how to help less tech-savvy families comply with it.

When signing up for a free web-based image editing application, the platform offers you to click on "Sign in with Google". Before logging in, a window asks you to authorise access to your name and email, but it also requests permissions to "View, edit, and delete your Google Drive files".

1. a) Interpret the requested permissions and justify why granting them constitutes a violation of the principle of least privilege in this specific case.
2. b) Analyse the risk of a "single point of failure" for a user who relies on their Google account as the login key for more than twenty different online services. Predict the immediate consequences if their main account is compromised, and design a three-step procedure to periodically audit and revoke accesses.

A friend keeps all their passwords in an unlocked note on their cell phone 'because using a password manager is too much effort'. Compare both risks (unencrypted note vs manager with a master password), explain what each option protects and does not protect, and write the advice you would give them.

Fingerprint and facial recognition unlock your cell phone without typing anything. Analyze whether biometrics replaces or complements a password, what problem arises if a fingerprint database is leaked (you cannot change your fingers) and why robust systems combine several factors.

Prioritize this list of accounts to activate two-step verification, from essential to dispensable, and justify your criteria: email, bank, favorite video game, social network, school platform. Finish by reflecting on whether it makes sense to apply maximum security to everything.