People and Planet: Third level

Know

• PP-3-CY-K1

  Old or replaced devices can be vulnerable because they often stop getting security updates.

  Learn card: Old devices, new risks

  Makers send security updates (patches) to fix weaknesses found in their software. After a few years they stop supporting older devices, and the updates end.

  From then on, any new weakness found in that device will never be fixed, and attackers know which old devices are still out there.

  Old devices can still be useful, but they need care: keep them off important networks, use them only for low-risk jobs, or replace them. Repairing and reusing devices is good for the planet, as long as they stay secure.

  Why can an old device be a security risk?

  It is slower It may no longer get security updates The screen is smaller It uses more electricity

  What is a security update (patch) for?

  Adding new games Fixing weaknesses that attackers could use Changing the wallpaper Making the battery bigger

  Check my answers
• PP-3-CY-K2

  A device that is not wiped properly can expose personal, financial or organisation data.

  Learn card: Wiping devices properly

  Deleting a file usually only removes it from the list of files. The data stays on the drive until something new is written over it, so recovery tools can often bring it back.

  If a phone, laptop or USB stick is sold, given away or thrown out without being wiped properly, the next person could find photos, passwords, bank details or an organisation's records.

  Safe methods include factory resetting an encrypted device, secure-erase software that overwrites the whole drive, or physically destroying a drive that can't be wiped.

  When you delete a file and empty the bin, the data is usually...

  gone for ever still on the drive until it is overwritten sent to the manufacturer turned into a backup

  Which old devices might still hold sensitive data?

  Only computers Phones, laptops, tablets, USB sticks and even printers Only devices that still work None of them

  Check my answers
• PP-3-CY-K3

  Attacks often target sensitive information, such as customer and staff data and intellectual property.

  Learn card: What attackers are after

  Attackers usually want something valuable. Sensitive information is often the target: customer details (names, addresses, card numbers), staff records (bank details, health information) and intellectual property (designs, plans, inventions and secret recipes).

  Customer and staff data can be sold or used for fraud. Intellectual property can be sold to rivals or used to copy products.

  When this kind of data is stolen, real people can be harmed, and the organisation may lose trust, money and customers.

  Which of these is intellectual property?

  A company's new product design The office furniture The car park The shop's opening hours

  Why do attackers target customer and staff data?

  It is valuable: it can be sold or used for fraud It is easy to print It makes computers faster They don't

  Check my answers

Do

• PP-3-CY-D1

  Consider measures to keep older devices secure.

  Device Audit

  Builds on: PP-3 Design and Engineering: right to repair, circular life cycle (p.22)

• PP-3-CY-D2

  Explore how data and devices are disposed of securely.

  Wipe Lab

  Foundations: FND-PP-2-1

• PP-3-CY-D3

  Explore real cyber attacks and consider their effects on individuals.

  Case File: individuals

  Foundations: FND-DW-2-4

Reflect