Advanced Cyber-security
AdvancedAdvanced cyber-security means knowing four common threats — phishing, password theft, malware and social-engineering scams — and answering them with strong unique passwords, two-factor authentication, link caution, updates and backups. Your digital footprint lasts and may one day be seen by schools and employers. Facing cyber-bullying, keep evidence and seek help. Safe habits let you enjoy the digital world with peace of mind.
- Four threats online: phishing, password stuffing, malware and social-engineering scams.
- Strong mixed passwords, unique per account, plus two-factor authentication — the basic armoury.
- Tap no dubious links, install nothing of unknown origin, update and back up regularly — keep risk outside.
文體小知識：網絡安全指南按威脅類型逐一講解防範方法，令讀者上網時有章法、有警覺。
§Text Passage
1Primary pupils now hold a string of accounts: the school learning platform, online games, video calls and social apps. More accounts, more risk — Hong Kong's fraud figures keep rising, and scammers target teenagers with fake free-game-credit sites, messages posing as classmates borrowing money, and 'guess who this is' calls. Once an account is stolen, at best virtual property is lost; at worst personal data are used for loans or crimes. Protecting yourself is lesson one of going online.
2Learn the four common threats. Phishing: fake sites and messages imitating banks, schools or game offices to harvest passwords — checking the web address's domain is the first line of defence. Password theft: use one password everywhere and a single site's leak lets thieves 'stuff' it into your other accounts (credential stuffing). Malware: viruses and ransomware lock your files and demand money to release them. Social engineering: not attacking computers but minds — posing as a teacher or classmate to demand verification codes, or pressing transfers with fake emergencies.
3Six defences. One, strong passwords: at least twelve characters mixing upper and lower case, digits and symbols, one per account, with a password manager for the vital ones. Two, two-factor authentication: a phone code beyond the password keeps the account safe even if the password leaks. Three, tap no suspicious links or attachments; verify senders and addresses first. Four, update systems and apps promptly to patch holes. Five, back up files regularly to the cloud or an external drive so recovery stays possible. Six, never handle banking or passwords over public Wi-Fi.
4Finally, two advanced habits. Manage your digital footprint: every post and photo you leave is findable by search engines and may one day be seen by schools and employers — before posting ask 'would I want this seen in ten years?', and set privacy controls. And know how to face cyber-bullying: do not answer taunts, screenshot the evidence at once, block and report on the platform, then tell parents or teachers — call the police if serious, for evidence is the key to protection. Online as offline, mutual respect and shared responsibility keep the space safe for all.
1Summary 重點摘要
Advanced cyber-security means knowing four common threats — phishing, password theft, malware and social-engineering scams — and answering them with strong unique passwords, two-factor authentication, link caution, updates and backups. Your digital footprint lasts and may one day be seen by schools and employers. Facing cyber-bullying, keep evidence and seek help. Safe habits let you enjoy the digital world with peace of mind.
2Vocabulary cards Vocabulary
The measures and habits protecting devices, accounts and data from online attack.
Fake sites or messages luring users into handing over passwords and personal data.
A tool storing all account passwords securely behind one master password.
A second check beyond the password at login, such as a phone code.
Programs such as viruses and trojans built to damage or steal data.
Malware locking files and demanding payment to release them.
Tricks impersonating others or exploiting trust and pressure to extract data.
The traces we leave online, lasting long and hard to erase.
Hurting, threatening or humiliating others online through messages, images or words.
Copying data to the cloud or an external drive against loss or locking.
3Step by step Steps
- Step 1: Test your password's strengthA password is the first lock on an account, and its length and mix decide whether cracking programs can beat it. Example: '123456' or a birthday falls in seconds; 'Sunny2026!hk' — twelve characters mixed — takes years. A strong password has at least twelve characters mixing upper and lower case, digits and symbols; long and mixed is the floor of safety.
- Step 2: One account, one passwordReusing one password everywhere means one leak opens every door — the credential-stuffing attack. Example: a game password leaks and, if the school platform shares it, thieves try their way in; give every account its own password and let a password manager carry the vital ones. One account, one password keeps the damage small; changing the vital passwords regularly makes the shield stronger still.
- Step 3: Turn on two-factor authenticationTwo-factor authentication adds a dynamic code on top of the password — the cheapest protection with the biggest effect. Example: with it on, a stolen email password still needs the six-digit code on your phone — a second lock outside the door. Every important account should have this switched on today; the code is a key, and no one who asks for it should ever receive it.
- Step 4: Spot phishingPhishing messages disguise themselves as official notices to steal passwords or personal data. Example: 'You've won — tap to claim' points to abc-prize.xyz, not the official domain; watch for urgency, misspellings and pages asking for passwords. Before typing anything into a link, verify the domain first; when in doubt, open the official app yourself to check, and never use the link inside the message.
- Step 5: Guard against malwareMalware covers viruses, trojans and ransomware, which steal data or lock files for money. Example: never install 'free game coins' from unofficial channels; update monthly to patch holes; back up to cloud plus external drive — ransomware loses its power over you. Never handle banking or passwords over public Wi-Fi; that too is a basic rule of the road.
- Step 6: Unmask social engineeringSocial engineering attacks the person rather than the computer, exploiting trust and fear to extract secrets. Example: 'I'm your teacher — send the code now' — real teachers never ask for codes; verify through official channels or in person before responding. One extra question often breaks the scam; an urgent push to transfer money or hand over data deserves an extra calm check first.
- Step 7: Manage your footprint, answer bullyingOnline footprints are hard to erase, and old posts can affect study and jobs years later, so think before publishing. Example: before posting ask 'would I want this seen in ten years?'; facing bullying, screenshot, block, report, and tell parents and teachers — evidence is the key to protecting yourself. Set privacy controls, never answer taunts, and call the police if it turns serious; that is how the online space stays safe.
4Diagrams Diagrams
5Worked example Example
Example: Chor receives a private message: 'Your account will be blocked. Confirm your password at this link within two hours.' Identify three suspicious signs and write the correct response.
- Suspicion one: the message manufactures urgency — a 'within two hours' deadline is how scammers rush people into losing their cool; the harder the push, the more reason to pause.
- Suspicion two: the message asks for the password — no official platform ever requests passwords or verification codes by private message, so such a demand is nearly proof of fraud.
- Suspicion three: the link is of unknown origin — the web address may imitate the official domain, and one tap with details entered could hand the account to thieves.
- Correct response: tap no link and enter nothing; open the official app yourself to check the account; report the message on the platform and warn classmates about the trick.
- Answer: The three signs — deadline pressure, a demand for the password and an unknown link — together mark classic phishing. Do not tap, verify through the official app, report it and alert classmates, remembering that no official body ever asks for passwords by private message.
6Common mistakes Mistakes
7Quick check Quick check
Q1Name three conditions of a strong password.
Q2What is two-factor authentication and what does it do?
Q3Name three signs of a phishing message.
Q4What is a digital footprint and why manage it?
Q5What should be done when facing cyber-bullying?
8Recap Recap
- Four threats online: phishing, password stuffing, malware and social-engineering scams.
- Strong mixed passwords, unique per account, plus two-factor authentication — the basic armoury.
- Tap no dubious links, install nothing of unknown origin, update and back up regularly — keep risk outside.
- Footprints last: think before posting, manage privacy settings, guard personal data.
- Facing bullying, keep evidence and seek help; with mutual respect and shared law, the digital space stays safe.