ICDL Cyber Security (ICDL) common mistakes
ICDL Cyber Security · Understand the traps and how to avoid them.
Treating 'cyber security' as only an IT-department concern and answering questions about personal responsibility as if the user has no role.
Candidates memorise technical controls (firewalls, antivirus) but miss that the syllabus frames security as shared responsibility requiring safe user behaviour.
What to do instead
For every scenario question, ask 'what should the individual user do?' before selecting a purely technical answer; learn the shared-responsibility principle explicitly.
Confusing the three components of the CIA triad, labelling confidentiality as integrity or availability.
The terms sound similar and candidates learn definitions by rote without anchoring each to a concrete example.
What to do instead
Attach one fixed example to each: confidentiality = only authorised people can read it; integrity = data is accurate and unaltered; availability = data/services are accessible when needed.
Mixing up malware types, e.g. calling a worm a virus or a Trojan a worm, in classification questions.
All are 'bad software', and candidates rely on vague impressions rather than the defining propagation behaviour.
What to do instead
Learn the single distinguishing trait for each: virus needs a host file and user action; worm self-replicates across networks without a host; Trojan disguises itself as legitimate software; ransomware encrypts and demands payment.
Failing to identify phishing hallmarks in a described message, such as urgency, mismatched sender address, generic greeting, or suspicious links.
Candidates read the scenario for content plausibility instead of scanning for structural red flags.
What to do instead
Use a checklist on every phishing item: sender domain, urgency/threat, generic salutation, unexpected attachment or link, request for credentials or payment.
Choosing a weak or reused password as acceptable, or thinking complexity alone makes a password strong.
Candidates equate 'has a number and symbol' with secure, ignoring length, reuse, and predictability.
What to do instead
Prefer passphrases, unique per account, managed by a password manager; recognise that reuse is the failure that turns one breach into many.
Treating HTTPS, a padlock icon, or a familiar-looking URL as proof a site is trustworthy.
Candidates over-trust browser security indicators and do not check the actual domain spelling.
What to do instead
State that HTTPS only encrypts the connection, not the site's honesty; verify the exact domain and look for lookalike or misspelled names.
Not recognising the need to back up data, or describing backup as a substitute for antivirus rather than a recovery measure.
Candidates focus on prevention and forget resilience and recovery in the security picture.
What to do instead
Frame backup as protection against loss from ransomware, theft, or hardware failure; know the 3-2-1 idea (multiple copies, different media, one off-site).
Posting or sharing personal information online without recognising privacy risk, or accepting default privacy settings.
Candidates separate 'being polite online' from 'being secure' and miss that oversharing enables identity theft and social engineering.
What to do instead
Before answering, ask what an attacker could do with the disclosed detail (full name, address, school, location, birthday); treat default settings as public until changed.
Ignoring or misjudging the risks of public Wi-Fi and unknown USB devices, assuming they are harmless if they work.
Convenience bias: if a connection or device functions, candidates assume it is safe.
What to do instead
Learn the specific risks: unencrypted public networks allow interception, so use a VPN and avoid sensitive logins; unknown USB drives can carry malware or be bait.
Responding to cyberbullying or suspicious contact by engaging, retaliating, or deleting evidence instead of reporting and preserving it.
Emotional-response answers feel natural, and candidates do not know the correct procedural steps.
What to do instead
Memorise the sequence: do not respond, save evidence (screenshots), block/report to the platform, and tell a trusted adult or authority.