You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Passwords, passphrases, and secure storage of credentials
5
5
description: Passwords, passphrases, and secure storage of credentials
6
-
ms.date: 04/26/2023
6
+
ms.date: 05/29/2025
7
7
author: rmcmurray
8
8
ms.author: robmcm
9
9
ms.topic: unit
@@ -22,13 +22,13 @@ quiz:
22
22
explanation: "This password is too simple and can be easily guessed or cracked."
23
23
- content: "The word *password* with special characters and numbers mixed in."
24
24
isCorrect: false
25
-
explanation: "This is a common password variation that should never be used for any account."
25
+
explanation: "This password is a common variation that should never be used for any account."
26
26
- content: "A five-word passphrase with some numbers mixed in."
27
27
isCorrect: true
28
28
explanation: "Great! Having five different, unrelated words in a passphrase provides enough complexity to keep it from being guessed or cracked."
29
29
- content: "Your birthday in numbers followed by your name."
30
30
isCorrect: false
31
-
explanation: "You should avoid creating a password that contains information that can be guessed, is associated with a social media account, or might already be available in other leaked account data."
31
+
explanation: "You should avoid creating a password that contains information that can be guessed. You should also avoid a password associated with a social media account, or one that might already be available in other leaked account data."
32
32
33
33
- content: "What is the most secure approach to create a password when you're creating a new account?"
34
34
choices:
@@ -37,10 +37,10 @@ quiz:
37
37
explanation: "Though better than using the same password, simple passwords are easy to guess and can be easily cracked."
38
38
- content: "Create a unique, long, complicated password or passphrase."
39
39
isCorrect: true
40
-
explanation: "Good job. The more complex your password is, the harder it will be for hackers to crack it."
41
-
- content: "Reuse your favorite password, as long as you know it has not been exposed in a breach."
40
+
explanation: "Good job. The more complex your password is, the harder it is for hackers to crack it."
41
+
- content: "Reuse your favorite password, as long as you're sure it wasn't exposed in a breach."
42
42
isCorrect: false
43
-
explanation: "Never reuse any of your passwords, because one or more of them have already been stolen in a breach."
43
+
explanation: "Never reuse any of your passwords, because chances are that one or more of them is already stolen in a breach."
44
44
- content: "Use *correct horse battery staple*."
45
45
isCorrect: false
46
46
explanation: "Don't use any examples you read about. Always come up with your own, and make them as random as possible."
title: Improve account security with multifactor authentication
5
5
description: Understand the basics of multifactor authentication, and how to use it for securing your identity.
6
-
ms.date: 04/26/2023
6
+
ms.date: 05/29/2025
7
7
author: rmcmurray
8
8
ms.author: robmcm
9
9
ms.topic: unit
@@ -22,23 +22,23 @@ quiz:
22
22
explanation: "As implied by *multifactor*, more than one factor is required."
23
23
- content: "Two"
24
24
isCorrect: True
25
-
explanation: "Yes, this is the minimum number of factors required for supporting multifactor authentication."
25
+
explanation: "Yes, two is the minimum number of factors required for supporting multifactor authentication."
26
26
- content: "Three"
27
27
isCorrect: false
28
-
explanation: "Though this makes accessing your account more secure, the minimum number of factors needed for multifactor authentication is two."
28
+
explanation: "Using three factors makes accessing your account more secure, but the minimum number of factors needed for multifactor authentication is two."
29
29
- content: "Zero"
30
30
isCorrect: false
31
31
explanation: "At least two factors are needed for multifactor authentication. Zero factors means you don't have a password."
32
32
33
33
- content: "When should you use multifactor authentication?"
34
34
choices:
35
-
- content: "Only for securing financial accounts"
35
+
- content: "Only for securing financial accounts."
36
36
isCorrect: false
37
-
explanation: "You should not restrict use of multifactor authentication to just one type of account."
38
-
- content: "Only for securing access to a password manager"
37
+
explanation: "You shouldn't restrict use of multifactor authentication to just one type of account."
38
+
- content: "Only for securing access to a password manager."
39
39
isCorrect: false
40
-
explanation: "Though this is probably the most important thing to secure by using multifactor authentication, you should consider even more options."
41
-
- content: "For all your accounts, and wherever you can use multifactor authentication"
40
+
explanation: "A password manager is probably the most important thing to secure by using multifactor authentication, but you should consider even more options."
41
+
- content: "For all your accounts, and wherever you can use multifactor authentication."
42
42
isCorrect: true
43
43
explanation: "The best option is to use multifactor authentication wherever it's available."
Copy file name to clipboardExpand all lines: learn-pr/security/securing-you-basics-beyond/includes/1-introduction.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,17 +3,17 @@ Staying secure online is a challenge. The internet and the devices connected to
3
3
Think about the internet as a neighborhood where you do common tasks such as email, banking, or shopping. Then think about who your neighbors are. Some of these neighbors are dangerous. They include:
4
4
5
5
- Organized crime gangs intent on stealing personal account information.
6
-
- Hackers who will use your computer to attack other victims.
6
+
- Hackers who use your computer to attack other victims.
7
7
- Automated downloads that install ransomware to keep you from using your computer until you pay (or until you restore from a backup).
8
8
- Government-backed hackers who might be on a mission to steal intellectual property or destabilize governments.
9
9
10
-
Most of your online activity probably doesn't directly expose you to crime. But odds are good that you know someone who's been a victim of some kind of computer-related crime, like computer viruses, malware, identity theft, or data breaches. If it hasn't happened to you and if you don't protect yourself, it's just a matter of time before you'll be directly affected. What can you do to keep yourself safe, without having to be a cybersecurity expert?
10
+
Most of your online activity probably doesn't directly expose you to crime. But the odds are good that you know someone who was a victim of some kind of computer-related crime, like computer viruses, malware, identity theft, or data breaches. If you don't protect yourself, it's just a matter of time before you're directly affected. What can you do to keep yourself safe, without having to be a cybersecurity expert?
11
11
12
-
Securing your passwords, account information, and other sensitive data might be easier than you think. We'll show you techniques and tools that you can use to protect yourself from the most common threats.
12
+
You might find that keeping your passwords, account information, and other sensitive data secure is easier than you think. We show you techniques and tools that you can use to protect yourself from the most common threats.
13
13
14
14
## Learning objectives
15
15
16
-
By the end of this module, you'll be able to:
16
+
By the end of this module, you're able to:
17
17
18
18
- Identify common threats to your online identity and account data.
19
19
- Apply techniques to recognize and avoid phishing.
Copy file name to clipboardExpand all lines: learn-pr/security/securing-you-basics-beyond/includes/2-phishing.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
Imagine you're looking through your email and you see what looks like an alert from one of your social media accounts. Everything looks official. It asks you to sign in to your account and verify that your contact information is correct. You click the link in the email and sign in to what looks like your account.
2
2
3
-
Unfortunately, in that moment, an attacker has successfully stolen your account sign-in information.
3
+
Unfortunately, in that moment, an attacker successfully steals your account sign-in information.
4
4
5
5
This email-based *social engineering* technique is called *phishing*. Attackers use this technique often, sending [over a billion phishing emails every year.](https://www.microsoft.com/security/blog/2018/10/17/how-office-365-learned-to-reel-in-phish/?azure-portal=true)
6
6
@@ -14,21 +14,21 @@ Phishing email is written to convince you to do one of two things:
14
14
- Open an attachment that runs a dangerous program.
15
15
16
16
> [!NOTE]
17
-
> In this training, the term *click a link* is used to represent clicking a link with a mouse, tapping a link on a phone, or using any other type of assistive or other device to activate a link.
17
+
> In this training, the term *click a link* is used to represent clicking a link with a mouse, tapping a link on a phone, or activating a link on any other type of device.
18
18
19
19
One of the most common phishing goals is to collect your personal information, such as your username and password. If the attacker is successful, they'll use your stolen information to access your account and any other accounts where you use that same username and password.
20
20
21
21
Another common phishing goal is to deliver malicious software, called *malware*. Opening one of these dangerous attachments can result in running a program that harms your computer. Such a program might even lock you out of your computer unless you pay a ransom. This malware is known as *ransomware*.
22
22
23
-
Phishing is one of the most common threats on the internet. In 2019 alone, the [FBI's Internet Crime Complaint Center (IC3) reported more than 450,000 complaints and more than $3.5 billion in losses to individuals and businesses](https://www.fbi.gov/news/stories/2019-internet-crime-report-released-021120?azure-portal=true). This data represents only a small number of the actual cases. In other words, phishing is a popular and successful way for a criminal to steal your data.
23
+
Phishing is one of the most common threats on the internet. In 2019 alone, the [FBI's Internet Crime Complaint Center (IC3) reported more than 450,000 complaints and more than $3.5 billion in losses to individuals and businesses](https://www.fbi.gov/news/stories/2019-internet-crime-report-released-021120?azure-portal=true). This data represents only a few of the actual cases. In other words, phishing is a popular and successful way for a criminal to steal your data.
24
24
25
25
:::image type="content" source="../media/2-phishing-stats.png" alt-text="Diagram that shows phishing statistics: 92.4% of malware is delivered via email, 30% of received phishing messages are opened, and 12% of those users click the malicious link or open the attachment.":::
26
26
27
27
## Why does phishing work so often?
28
28
29
29
Phishing is designed to be believable. Attackers have been using the same approach since the first phishing emails were sent in the 1990s. They often try to take advantage of your good nature, your desire to help, or your desire to solve a problem.
30
30
31
-
Attackers know what emotions get people to respond. For example, they might send an email to get you to click a link by telling you something needs to happen urgently. One common example is an email that says your account has been closed. Although this might seem like something serious at first, remember that most businesses won't send you an email that says they've closed your account with no warning.
31
+
Attackers know what emotions get people to respond. For example, they might send an email to get you to click a link by telling you something needs to happen urgently. One common example is an email that says your account has been closed. Although this message might seem like something serious at first, remember that most businesses won't send you an email that says they've closed your account with no warning.
32
32
33
33
Another common approach is to offer something too good to be true. Attackers will tell you that you've won an award or that they need you to manage their large sums of money.
34
34
@@ -45,16 +45,16 @@ First, recognize phishing! The following video has some guidance on what to look
45
45
Here are some common features of phishing attacks:
46
46
47
47
-**Attachments**: If your email has an attachment that you don't expect, it might be phishing, and that attachment might be dangerous.
48
-
-**Unusual hyperlinks**: Be aware of any links in emails. If you hover over a link and the destination looks odd, it might be a dangerous website. A website might look just like a legitimate one, but be designed to capture your login information or run malware.
48
+
-**Unusual hyperlinks**: Be aware of any links in emails. If you hover over a link and the destination looks odd, it might be a dangerous website. A website might look just like a legitimate one, but be designed to capture your sign-in information or run malware.
49
49
-**Urgency**: If a message says you need to do something *right now*, it might be a phishing email. Remember, your bank usually doesn't reach out to you with no warning by using an email subject about canceling your accounts.
50
50
-**Bad spelling or grammar**: Phishing emails are often full of unusual writing, spelling errors, and grammar errors. If the email looks suspicious, you should avoid interacting with it.
51
51
-**Fake sender**: If the email address looks unusual or is someone you don't recognize, you should treat it as a phishing email.
52
52
53
53
The following example email has all of these features.
54
54
55
-
:::image type="content" source="../media/2-phishing-email.svg" alt-text="Sample email that shows common signs of phishing, including fake email addresses, unexpected attachments, urgent messaging, bad links, and poor grammar.":::
55
+
:::image type="content" source="../media/2-phishing-email.svg" alt-text="Sample email that shows common signs of phishing. Including, fake email addresses, unexpected attachments, urgent messaging, bad links, and poor grammar.":::
56
56
57
-
Now that you can recognize phishing email and you know not to click any links or open any attachments, let's talk about what else you can do. Your email application or website probably has the *report phishing* feature. Using this feature will notify the email provider and help prevent similar email in the future. Of course, you can delete phishing email too.
57
+
Now that you can recognize phishing email and you know not to click any links or open any attachments, let's talk about what else you can do. Your email application or website probably has the *report phishing* feature. Using this feature will notify the email provider and help prevent similar email in the future. Or, you can delete phishing email yourself.
58
58
59
59
If you aren't sure about an email from a friend or family member, you still don't need to click any links or open any attachments. You can give them a call or send a text message and ask if they sent you anything.
0 commit comments