ICDL Cyber Security (ICDL) common mistakes
ICDL Cyber Security · Understand the traps and how to avoid them.
When asked to identify which pieces of information are sensitive, the candidate only flags passwords and ignores personal data such as date of birth, home address, or ID numbers.
Candidates equate 'secret' with 'sensitive' and treat ordinary personal details as harmless because they are shared casually in daily life.
What to do instead
Before answering, classify each data item against two tests: could it identify a person, and could it enable fraud or impersonation if disclosed? Flag anything passing either test.
The candidate selects 'a strong password' as the best defence against phishing emails or malicious attachments.
Password advice is over-learned from earlier IT literacy material, so it is recalled reflexively whenever 'defence' appears, even when the attack vector is social engineering.
What to do instead
First name the attack vector (email lure, attachment, link, phone call), then pick the control that acts on that vector, such as verifying the sender or not opening unexpected attachments.
The candidate treats HTTPS and the padlock icon as proof that a website is trustworthy and safe to enter payment details into.
Training material often says 'look for the padlock', which creates a false equivalence between encrypted connection and legitimate operator.
What to do instead
State explicitly that HTTPS only encrypts traffic; legitimacy must be judged separately by checking the exact domain name, spelling, and certificate holder.
When asked to distinguish a virus, worm, and Trojan, the candidate defines them by the damage they cause rather than by how they spread and whether they need a host or user action.
Everyday usage treats 'virus' as a generic word for any malware, so the candidate never learned the propagation-based distinction.
What to do instead
Memorise each type by two attributes: does it self-replicate, and does it require a host file or user action? Apply those two questions to the named example.
The candidate recommends 'just delete the suspicious email' as the correct response to a phishing attempt at work, omitting reporting it.
Personal email habits dominate, and reporting procedures are organisation-specific knowledge the candidate has not rehearsed.
What to do instead
Recall the standard sequence: do not click or reply, report to the IT or security contact, then delete; select the option that includes reporting.
The candidate describes a firewall as software that removes viruses, confusing it with antivirus software.
Both are 'security software' in popular descriptions, and the candidate has no mental model of what each actually inspects.
What to do instead
Anchor each tool to its object: firewall filters network traffic by address and port; antivirus scans files and processes for malicious code. Match the tool to the thing being controlled.
The candidate identifies public Wi-Fi as risky but then chooses 'use the network as normal because the site has a login page' as the safe behaviour.
The presence of a login screen is mistaken for protection, and the candidate lacks the concept of an untrusted network segment.
What to do instead
Treat any open network as hostile: require a VPN or encrypted HTTPS connection for sensitive activity, and avoid entering credentials on captive-portal-style pages.
The candidate backs up data to a second folder on the same drive, or to a synced cloud folder, and calls that a complete backup.
Convenience drives the choice, and the candidate has not considered that ransomware or drive failure affects both copies.
What to do instead
Apply the separation test: the backup must survive loss of the original device, so require a different physical location or offline/immutable copy, and check restore capability.
The candidate treats two-factor authentication as unnecessary when the password is long, or selects SMS as equally strong as an authenticator app without reasoning.
The candidate sees authentication as one control rather than layers, and has not learned that a stolen password defeats password-only protection.
What to do instead
Reason in terms of what an attacker still lacks: with 2FA they need a second factor; rank app or hardware tokens above SMS because SMS can be intercepted or SIM-swapped.
The candidate answers questions about social engineering by focusing on technical controls and misses that the attack targets human trust and urgency.
Security is mentally filed as a technical subject, so non-technical attacks are underestimated and the human element is not considered.
What to do instead
For any scenario involving a person being persuaded, pressured, or offered something, identify the manipulation tactic (urgency, authority, fear) and choose the response that verifies identity through an independent channel.