Aha Trivia Stuff Everyone Should Know

Study guides · Stuff Every Cyber Scout Should Know

Stuff Every Cyber Scout Should Know: the Study Guide

Practice facts for the Cybersecurity merit badge. Not an official Scouting America credential. Grab a snack: this guide is the friendly version, with the answers explained and a groan-worthy joke waiting at the end of most cards.

Knowing Cyber Scout saves you money, time and the occasional embarrassment.

▶ Play the game About this deck

Chapter 1: Phishing and Scams

What is an exploit?

Short answer: A working method to abuse a vulnerability

An exploit is a technique or tool that takes advantage of a specific vulnerability.

Groan of the day: An exploit is the key cut to fit a weak lock.

Sources: Computer security

What is phishing?

Short answer: Tricking people into giving sensitive information

Phishing uses fake messages or sites to deceive people into sharing passwords or data.

Groan of the day: Don't take the bait in a phishy email.

Sources: Computer security

What is spoofing?

Short answer: Pretending to be a trusted entity by falsifying data

Spoofing fakes an address or identity so an attacker looks like someone you trust.

Groan of the day: Spoofing is a costume party for criminals.

Sources: Computer security

What does ransomware do?

Short answer: Encrypts files and demands payment

Ransomware locks your files with encryption and asks for money to unlock them.

Groan of the day: Ransomware holds files hostage, no ransom note needed.

Sources: Computer security

What is a keylogger?

Short answer: Spyware that records your keystrokes

Keyloggers record what you type, letting attackers harvest usernames and passwords.

Groan of the day: A keylogger listens to every tap you make.

Sources: Computer security

What is a Trojan horse program?

Short answer: Malware hidden inside something that looks useful

Trojans pretend to be helpful or hide in legitimate software to trick users into installing them.

Groan of the day: A Trojan is a surprise gift with a bite.

Sources: Computer security

What is a man-in-the-middle attack?

Short answer: An attacker intercepts communications between two parties

MITM attackers secretly intercept or modify traffic between two parties by spoofing identities.

Groan of the day: Don't let a stranger stand in your data's middle.

Sources: Computer security

How can a VPN help on public Wi-Fi?

Short answer: It encrypts data between your device and the VPN

A VPN encrypts traffic between two points, making eavesdropping much harder.

Groan of the day: A VPN is a private tunnel through a crowded room.

Sources: Computer security

What is an attack surface?

Short answer: All the ways someone could try to access your information or devices

Your attack surface includes accounts, apps, and networks that could be entry points.

Groan of the day: Your attack surface is your digital front yard.

Sources: Scouting America: Cybersecurity

What is spear-phishing?

Short answer: Phishing aimed at a specific person using personal details

Spear-phishing uses personal details to make the attacker look like a trusted source.

Groan of the day: Spear-phishing is a custom-made con.

Sources: Computer security

What is defense in depth?

Short answer: Using multiple layers of security

Defense in depth means more than one layer must fail before a system is compromised.

Groan of the day: Layers of defense are like wearing a raincoat and carrying an umbrella.

Sources: Computer security

What is cyber hygiene?

Short answer: Routine habits that reduce cyber risk

Cyber hygiene includes updates, backups, strong passwords, and firewalls as routine habits.

Groan of the day: Cyber hygiene is brushing your teeth for your data.

Sources: Computer security

What does a firewall do for a network?

Short answer: Filters incoming and outgoing traffic

A firewall monitors and controls network traffic, creating a barrier between trusted and untrusted networks.

Groan of the day: Firewalls are great at filtering out bad traffic and bad puns.

Sources: Computer security

What is a computer virus?

Short answer: A program that spreads by attaching to other files

Viruses are malicious code that hijack software and spread copies of themselves to other programs.

Groan of the day: A computer virus is nothing to sneeze at, but it might make your PC wheeze.

Sources: Computer security

What is spyware designed to do?

Short answer: Secretly gather information and send it to an attacker

Spyware secretly collects data from your device and transmits it back to the attacker.

Groan of the day: Spyware is a sneaky little snoop that needs to be shown the door.

Sources: Computer security

What is scareware designed to do?

Short answer: Scare you into buying or installing unwanted software

Scareware uses alarming pop-ups to manipulate users into installing unwanted software or paying for fake fixes.

Groan of the day: Scareware tries to give you a fright, but you can just say boo and close it.

Sources: Computer security

What is email spoofing?

Short answer: Forging the sender address to make an email look like it came from someone else

Email spoofing falsifies the From address so the message appears to come from a trusted source.

Groan of the day: Spoofing is like wearing a disguise, but for email addresses.

Sources: Computer security

What is a direct-access attack?

Short answer: An attacker gains physical access to a computer to steal data

Direct-access attacks involve physical access to a device, often to copy data or install malicious software.

Groan of the day: Keep your laptop close, or a direct-access attacker might give it a new home.

Sources: Computer security

What is a botnet used for in a DDoS attack?

Short answer: A large number of compromised computers sending traffic to overwhelm a target

Botnets are networks of compromised devices that attackers use to launch large-scale attacks, like DDoS.

Groan of the day: A botnet is like a zombie army, but for computers.

Sources: Computer security

What is privilege escalation?

Short answer: Gaining higher access rights without authorization

Privilege escalation is when an attacker with limited access gains more permissions to access restricted data or systems.

Groan of the day: Privilege escalation is like sneaking into the VIP section without a ticket.

Sources: Computer security

What is a side-channel attack?

Short answer: Gathering information about a system from its physical effects, like electromagnetic radiation

Side-channel attacks use physical clues, such as electromagnetic emissions, to guess a system's internal state.

Groan of the day: Side-channel attacks are like reading a book by its cover, but with physics.

Sources: Computer security

The cheat sheet

The whole guide on one screen. Screenshot it, print it, stick it on the fridge.

  • A vulnerability is a weakness in how a system is built or run that can be exploited.
  • A threat is something that could negatively affect hardware, software, or data.
  • An exploit is a technique or tool that takes advantage of a specific vulnerability.
  • Antivirus tools find and remove malware, helping protect your device and data.
  • Longer passwords with mixed characters are harder for attackers to guess or crack.
  • MFA requires something you know plus something you have, like a code from an app.
  • Phishing uses fake messages or sites to deceive people into sharing passwords or data.
  • Spoofing fakes an address or identity so an attacker looks like someone you trust.
  • Phishing often pressures you to act fast and click links to imitation websites.
  • Worms self-replicate across programs and devices without a user opening a file.
  • Ransomware locks your files with encryption and asks for money to unlock them.
  • Keyloggers record what you type, letting attackers harvest usernames and passwords.

Pop quiz

Think of your answer first, then peek.

  1. What is a vulnerability in computer security?
    • A flaw that compromises security
    • A type of antivirus
    • A fast internet plan
    Show the answer

    A flaw that compromises security. A vulnerability is a weakness in how a system is built or run that can be exploited.

  2. What does ransomware do?
    • Cleans your hard drive
    • Encrypts files and demands payment
    • Speeds up your computer
    Show the answer

    Encrypts files and demands payment. Ransomware locks your files with encryption and asks for money to unlock them.

  3. What is end-to-end encryption?
    • Only the app company can read it
    • Anyone on the network can read it
    • Only sender and receiver can read the message
    Show the answer

    Only sender and receiver can read the message. End-to-end encryption keeps messages private between the people communicating.

  4. Why is backing up data important?
    • It helps you recover files after loss or ransomware
    • It makes your computer faster
    • It blocks all malware
    Show the answer

    It helps you recover files after loss or ransomware. Backups let you restore data if files are deleted, damaged, or encrypted by ransomware.

  5. Why should you install software updates promptly?
    • They add new emojis to your device
    • They fix security holes that attackers could use
    • They make your battery last longer
    Show the answer

    They fix security holes that attackers could use. Updates patch vulnerabilities, reducing the chance attackers can exploit known flaws in your software.

Now make it stick

Read a chapter, then play the deck and see how much stuck.

This guide covers the 50 free cards. The other 20 are in the game for members.

▶ Play Stuff Every Cyber Scout Should Know Find another deck Founding Members: spots are open

Teacher or trainer? It's free for teachers, and you can embed this deck on your own site.