Information Security & Privacy

This module gives learners a working command of information security and privacy as practised in modern organisations. It covers authentication (passwords, MFA, hardware keys, SSO), encryption in transit and at rest, phishing and social engineering, patching, backups, VPNs and zero-trust networking. Learners also study the UK GDPR, Data Protection Act 2018 and least-privilege principles. The goal is a defender's mindset: alert, methodical and able to protect themselves, their colleagues and their data.

Learning Outcomes

Construct strong, unique passwords and manage them in a reputable password manager.

Compare SMS, authenticator-app and hardware security key MFA and choose appropriately.

Identify phishing and social-engineering red flags in email, SMS and voice contact.

Explain how HTTPS, TLS and at-rest encryption protect data and where they fall short.

Describe when and why to use a VPN and the limits of its protection.

Apply the 3-2-1 backup rule to personal and business data.

Summarise the main learner-relevant obligations of the UK GDPR and least-privilege access.

Respond to a suspected security incident using an incident response checklist.

Topics Covered

Password strength, reuse and password managers

Multi-factor authentication: TOTP, SMS, push and hardware keys

Single sign-on and identity providers

Phishing, spear-phishing, smishing and vishing

Social engineering tactics

Encryption at rest and in transit (HTTPS, TLS, disk encryption)

VPNs: what they protect and what they do not

Zero-trust networking principles

Patching, updates and vulnerability management

Backups and the 3-2-1 rule

Ransomware response and recovery

UK GDPR and the Data Protection Act 2018

Least privilege and role-based access control

Incident response and reporting

Mobile device and remote-work security

Skills Developed

Choosing and managing credentials safely Detecting phishing and social-engineering attempts Configuring MFA on key accounts Running trustworthy backup routines Keeping devices patched and up to date Applying least-privilege thinking to access requests Protecting personal data under UK GDPR Reporting and triaging security incidents

Suggested Resources

{'title': 'NCSC Cyber Essentials', 'author': 'UK National Cyber Security Centre', 'source': 'ncsc.gov.uk/cyberessentials'}

{'title': 'NCSC Small Business Guide', 'author': 'UK NCSC', 'source': 'ncsc.gov.uk/collection/small-business-guide'}

{'title': 'NIST SP 800-63B Digital Identity Guidelines', 'author': 'NIST', 'source': 'pages.nist.gov/800-63-3'}

{'title': 'Have I Been Pwned', 'author': 'Troy Hunt', 'source': 'haveibeenpwned.com'}

{'title': 'ICO Guide to the UK GDPR', 'author': "Information Commissioner's Office", 'source': 'ico.org.uk'}

{'title': 'The Art of Deception', 'author': 'Kevin Mitnick', 'source': 'Wiley'}

{'title': 'Zero Trust Networks', 'author': 'Evan Gilman and Doug Barth', 'source': "O'Reilly Media"}

Assessment

Learners complete a personal security audit, a phishing-triage exercise, a short written incident-response plan and a timed final MCQ test.

security_audit25%

phishing_triage25%

incident_response_plan25%

final_mcq_test25%

Practice bank: 197 MCQs · Timed mock & self-paced modes

Start Practice →