Unit I Checkpoint: What Would You Do?
Where you are: Unit I — The Security Mindset · Checkpoint · This checkpoint brings together Chapters 1 and 2 of Dr. Al-Doori's Cyber Security Essentials: relative security, the CIA triad and the Honan case.
Unit I Checkpoint: What Would You Do?
You have finished Unit I. This checkpoint gives you three short, realistic situations. For each one, read the scenario, choose what you would do, and then read the model answer. There is no score to record. The goal is to practise the judgment you will use for the rest of the course. Allow about 12 minutes.
Scenario 1: "I Use a Mac, Nobody Targets Me"
Over coffee, your friend Rami says: "I don't bother with any of that security stuff. I use a Mac and an iPhone, and hackers only go after Windows. Anyway, I'm nobody important." He has never turned on a second sign-in step and uses the same password for most of his accounts.
Which response best reflects what Unit I teaches?
Model answer: c. Chapter 1's logic is that attackers go where the people are. Today that includes phones and Macs: Microsoft reported macOS infostealers in 2026. Most attacks on individuals trick the person whatever the device. Because security is relative, a few habits move Rami out of the group of easy targets. Option a is the myth Chapter 1 takes apart. Option b swaps one device for another without changing the habits that actually matter. Option d draws the wrong conclusion from "no system is perfectly secure": you cannot be un-hackable, but you can be much harder to attack than the next person.
Scenario 2: Classify the Damage
A local dentist's appointment system is attacked. Afterwards, the practice finds three things. Patients' names and phone numbers have been posted on a public website. Several appointment times were changed, so patients arrived on the wrong days. And for two days staff could not log in to the system at all.
How would you classify the three effects, in order: details posted publicly, appointments changed, staff locked out?
Model answer: b. Posting private details publicly is a confidentiality failure: people who should not see the information can now see it. Changing appointment times is an integrity failure: the information is no longer accurate. Staff being locked out is an availability failure: authorized people cannot get to the system when they need it. Options a and c mix up the three properties. Option d treats the changed appointments as a confidentiality problem, but nothing was revealed by changing them; the problem is that the data became untrustworthy. Like the Honan case, this one incident broke all three properties at once.
Scenario 3: Break the Chain
Leila runs a popular online shop from home. She notices the following about her accounts:
- Her shop account sends its password-reset links to her personal email.
- Her personal email is protected by a password only. Its recovery option is an old phone number she no longer uses.
- Her cloud photo account is also reset through that same personal email.
She has time for one change today.
Which single change would do most to break this Honan-style chain?
Model answer: b. In this chain, the personal email is the account that unlocks the others, just as Honan's Apple account unlocked his Google account and then his Twitter account. Anyone who takes over that email can reset both the shop and the photos. A second sign-in step makes the email much harder to take over. Fixing the recovery number closes a back door, because an old number may now belong to someone else. Option a protects only one account, and an attacker who controls the email can still reset it. Option c loses her own photos without fixing the weak point. Option d is a reasonable habit, but it does not break the chain. Units IV and V show you how to set up second steps, recovery options and backups properly.
Before You Move On
If any of these felt uncertain, revisit the lesson behind it: Lesson 1.1 for relative security, Lesson 1.2 for the CIA triad and Lesson 1.3 for the Honan chain. Next, Unit II looks at how the digital world actually works, starting with how the Internet moves your data.
Sources
- Microsoft Threat Intelligence — Infostealers without borders: macOS, Python stealers, and platform abuse (February 2026)
- NIST Computer Security Resource Center — Glossary: information security
- Mat Honan, repost of his August 2012 Wired account — seclists.org
- Dr. Tahseen Al-Doori — Cyber Security Essentials (Second Edition, 2026), Chapters 1–2