Topic Library — Cyber Security Awareness (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Topic Library — Year 1 (Foundations) Founded and presented by: Minister Destiny Marie Morgan, Minister

A note on what this school is: this is community-designed training — Minister Destiny's program, built from lived experience in the neighborhoods being policed. It is not agency policy and does not replace your department's training, general orders, or the law. Where this program proposes new approaches, they are taught and labeled as proposals. Nothing here is legal advice.

Before you start

• This school never collects your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• You are not being trained here as a digital forensic examiner. You are being trained as the person a frightened resident reaches first — at a lobby window, on a porch, in a parking lot — in the hour when the most damage can still be prevented. This unit teaches the public-facing core: the habits that stop account crime, the recognition patterns behind most of your cyber caseload, and the first-hour steps that preserve money, accounts, and evidence at the same time. Protection and recognition only.

The lesson

Part 1. What Cyber Security Awareness Means for Everyday Life

For your residents, cyber security is household habit, not technology: unique passwords, a second factor, verification before action, updated devices, and a backup. For you, awareness means understanding the criminal arithmetic those habits defeat, because you will explain it a hundred times to people who believe they were singled out.

Mostly, they were not. Account crime is an industry of scale: passwords stolen from one breached service are tried automatically against thousands of others; phishing messages are sent by the million; fake "support" operations work scripts from call centers. The individual victim is selected by arithmetic — a reused password, an old device, a rushed evening — not by personal attention. Teaching this fact is itself victim care: it replaces "I was stupid and targeted" with "I was one of ten million, and the fix is mechanical." Shame suppresses reporting and delays the first-hour steps; accurate framing releases both.

Your awareness also protects the institution you serve. Officers and staff are residents too, with the same reused passwords at home — and public-safety organizations are themselves attractive targets, a point Part 3 develops. Model the habits in this unit, teach them in the same plain words everywhere, and your district's most common preventable caseload measurably shrinks.

Begin every public explanation with the unit's organizing principle, the one sentence victims can use under pressure: slow down at the moment of urgency — real institutions can wait for verification; attackers cannot.

Part 2. Passwords and Passphrases That Hold

Teach password doctrine in plain resident terms:

• Length plus uniqueness. A passphrase — several ordinary words together — is long, strong, and memorable. And no password may be reused: when any service is breached, its passwords are tried everywhere else within hours. The email account is the crown jewel — it resets everything else — and deserves the strongest passphrase and first priority.
• Password managers create and store a unique password per account behind one master passphrase; a written list kept safely at home beats reuse for those who will not use one. Say this without condescension — your audience includes elders mocked for notebooks by grandchildren who reuse "their" password everywhere.
• The guessable is forbidden: children's and pets' names, birthdays, teams, addresses — the contents of a social media profile.
• Passwords are never shared by phone, text, or email — not with banks, agencies, companies, or police. Teach residents to hear any password request as a confession: the requester has identified themselves as the criminal. This matters doubly because impersonators of your own department use exactly that ask; give residents the counter-move — hang up, call the department's published number.

When you take a compromise report, the password history is investigative gold: where else was it used, when was it last changed, what breach notices did the victim ignore. Ask without judgment, record precisely, and sequence the victim's changes correctly — email first, then banking — because changing the shopping password while the attacker still holds the email locks a door and leaves the keys outside.

Part 3. Two-Factor Authentication and Account Recovery

Two-factor authentication adds a second proof after the password — a code or approval on the person's own device. It is the highest-value single habit you can teach, because it collapses the breach business model: the stolen password alone stops working. Urge it in this order: email, banking and payment apps, benefits and health accounts, social media.

Then teach the code rule as law of the street: a verification code is for the account owner's eyes only. The most common live attack you will debrief works like this: the criminal, armed with a reused password, triggers the victim's real code, then — posing as bank, marketplace, or support — persuades the victim to read it aloud or type it into a fake page. The genuine code arrives; the victim concludes the whole contact is genuine; the criminal completes the login. Every element of your teaching should drive at breaking that moment: no legitimate caller needs your code; a code read aloud is a key handed over.

Account recovery is the quiet half of the part. Residents should keep account phone numbers and emails current, save recovery codes safely, and treat "new sign-in" alerts as signal, not noise. In your casework, recovery facts matter early: can the victim still reach the email? Who controls the phone number on the account? Those answers decide whether containment is a ten-minute fix or a weeks-long identity case.

Finally, your own house: follow your department's security policies for work systems exactly, keep work and personal credentials separate, and treat an unexpected authentication prompt — a code or approval you did not trigger — as a reportable event, not an annoyance. An approval you did not initiate is someone else holding your password, and the correct response is the same one you teach: stop, deny, report through your channels.

Part 4. Phishing — Fake Messages and Fake Sites

Phishing is the delivery system for most of your cyber caseload: fake messages and calls impersonating banks, delivery companies, agencies, grandchildren — and police departments. Teach residents its visible anatomy, drawn from public alerts:

• Urgency and threat — account frozen, warrant claimed, package held, payment failed. Manufactured emergency is the signature; real processes do not demand gift cards or codes in the next ten minutes.
• Almost-right senders and copied logos. Proximity is not authenticity.
• Unexpected links and attachments leading to fake websites — copied login pages that record credentials. A polished page proves nothing.
• Forbidden requests — passwords, verification codes, gift-card or wire payment, remote access "to fix it." No legitimate institution, including yours, makes these asks.

The counter-procedure to drill until residents can recite it: stop — don't click — verify independently through the real app, the address they type themselves, or the number on their card. For claimed family emergencies, call the family member at a trusted number. For claimed law-enforcement contact — and this one you must teach personally and repeatedly — the resident should end the contact and call the department's published number. Publish that number everywhere your community actually looks.

In reports, capture the phishing artifact properly under your procedures: the message content, sender as displayed, links as shown, timestamps, and what the victim did in sequence — clicked, typed, read a code aloud, paid. Those details, preserved per department policy, connect your victim to the pattern files at ic3.gov and ftc.gov, where these operations are actually mapped. Encourage every victim to file at ic3.gov — and take your own report with the same care.

Part 5. Updates, Public Wi-Fi, and Backups

Three background habits decide how much of your caseload becomes catastrophe:

Updates repair known security flaws. Devices and apps left un-updated carry publicly described weaknesses. Residents should enable automatic updates on phones, computers, browsers, and apps — and treat "my computer is old and can't update" as a risk fact worth a referral conversation, especially for elders banking on unsupported machines.

Public Wi-Fi is convenient and unprivate: unknown operators, unknown fellow users, imitated network names. Teach the field rules: prefer the phone's mobile connection for banking; avoid sensitive logins on public networks; never install anything a network prompt unexpectedly demands. Home Wi-Fi needs its own strong, unique password — the shared front door of every device in the house.

Backups — a separate, current copy of irreplaceable files — are the difference between ransomware and device loss being a crime report and being a life disaster. When you debrief a ransomware victim (malicious software holding files for payment, covered at alert level in the Hackers unit), the first question after safety is whether a backup exists; it decides the recovery conversation. Teach residents to automate backups and verify one actually ran.

These three habits are also your prevention curriculum in miniature: a school visit, a senior-center talk, a thirty-second answer on a call — each installs them in households you will otherwise meet later, as victims.

Part 6. If Something Goes Wrong — Contain, Report, Recover

Coach victims through the first hour in this order, and take reports that reflect it:

1. Contain the accounts. From the real app or site — never a link from the suspicious message — change passwords, email first, then banking; enable two-factor authentication; end other sessions where offered.
2. Protect the money. Victim calls the bank or card issuer at the number on the card — now, from the scene if willing. Freezes and disputes all have clocks.
3. Preserve, then clean. Before devices are wiped or discarded in disgust, preserve what your procedures require: the messages, the fake pages as displayed, receipts, call logs, transaction records. Then updates and reputable security scans; strange device behavior goes to a professional the victim chooses — never the "support" that initiated contact.
4. Report on every track. Your report; the victim's ic3.gov filing for internet crime; ftc.gov for fraud and identity theft; consumerfinance.gov guidance when accounts need longer protection. Explain honestly what each track does, without promising recovery or arrest.
5. Stop the second wave. A compromised account will be used against its contact list. Help the victim warn their circle plainly: ignore money and code requests from my accounts; verify by another channel.
6. Document the timeline for the next hands. Amounts, times, sequence of disclosures, institutions notified, case and report numbers exchanged. Follow-up officers and bank investigators inherit your timeline — its quality is the case.

Close the encounter as this school always asks: the victim of a professional, mass-tested deception is not a cautionary tale about foolishness. Say so. The residents who were treated with that respect are the ones who call early next time — for themselves, and as witnesses for their neighbors — and early calls are the whole game in cyber crime.

Words to know — Cyber Security Awareness

• Cyber security awareness — the everyday habits and recognition skills that protect accounts, devices, money, and information online.
• Passphrase — a password built from several ordinary words together — long, strong, and memorable.
• Password manager — a tool that creates and stores a different strong password for every account, unlocked by one master passphrase.
• Two-factor authentication — a second proof of identity after the password, such as a code on your own device. Never shared.
• Phishing — a fake message impersonating a real institution to trick the recipient into clicking or revealing information.
• Fake website — a copied page imitating a real login page, built to record what visitors type.
• Software update — a fix issued by a maker; security updates repair weaknesses attackers already use.
• Public Wi-Fi — a shared wireless network in a public place, convenient but not private and sometimes imitated.
• Backup — a separate, current copy of important files kept elsewhere, so loss or lock-out cannot destroy them.
• Account compromise — an account taken over by an unauthorized person, typically through a stolen or tricked password and code.
• Incident report — the factual record of a cyber incident — timeline, artifacts, losses — prepared so other agencies can act on it.

Myths vs facts — Cyber Security Awareness

• Myth: Victims of account crime were careless people who deserved a lesson. Fact: These operations are industrial and tested on millions. Nearly anyone can be caught on a tired evening — which is why we teach habits, not blame.
• Myth: A resident's small account loss is unreportable noise. Fact: Small reports are the pattern. Aggregated through your reports and ic3.gov filings, they map the operations that victimize whole districts.
• Myth: If the code really arrived from the bank, the caller must be genuine. Fact: The genuine code is the attack's central prop — triggered by the criminal's login attempt and harvested from the victim. A code shared is a key handed over.
• Myth: Teaching prevention is soft work, separate from enforcement. Fact: Every household that installs unique passwords and two-factor authentication exits the victim pool. Prevention measured in caseload is enforcement that happened early.

Think it through — Cyber Security Awareness

A resident, Ms. Alvarez, comes to the lobby at 8 p.m., phone in hand, near tears. An hour ago she received a text that her bank account would be frozen, clicked through to a page with her bank's logo, entered her password, and then — when a "bank fraud officer" called moments later — read aloud the six-digit code texted to her. Her banking app now shows a transfer she did not make. She keeps saying, "I gave them everything. There's no point now, is there?" Walk her — and your report — through the hour.

Walk it through: (1) Start with the framing from Part 1: she was processed by an industrial operation — reused-password login, genuine code harvested exactly as Part 3 describes — and there is absolutely a point: containment now decides whether tonight is a bad transfer or a drained identity. (2) Contain in Part 6 order, with her, at the counter: from the bank's real app or the number on her card — not the caller's number — the bank freezes activity and starts the dispute clock; then the email password is changed on the real service and two-factor authentication enabled, because the email is the reset key to everything else. (3) Preserve before cleaning: the text, the page as displayed, the caller's number, transaction details — captured per your evidence procedures, because this artifact set connects her case to the pattern at ic3.gov. (4) File on every track: your report, her ic3.gov filing (help her complete it), ftc.gov for the fraud record. (5) Stop the second wave: she warns her contacts that her accounts may send false requests. (6) End with the teaching that prevents her next case and her neighbors': the code rule, verification by independent channel, and the fact that her bank will never call asking for either — delivered to a woman who will repeat it to everyone she knows.

Try this — Cyber Security Awareness

• ☐ I can teach the two-minute password doctrine: passphrases, uniqueness, email first, managers or a safe list, never shared.
• ☐ I can state and explain the code rule — and why a genuine code proves nothing about a caller.
• ☐ My compromise debrief follows contain (email, then banking) → protect money → preserve artifacts → report → warn the circle.
• ☐ I steer every internet-crime victim to ic3.gov and every fraud victim to ftc.gov, and I help when the portal is a barrier.
• ☐ My own accounts model the habits I teach: unique passphrases, two-factor authentication, updates, verified backup.

Resources to keep — Cyber Security Awareness

• 911 — if a cyber incident involves threats, a crime in progress, or a person in crisis.
• FBI Internet Crime Complaint Center — ic3.gov — victims file here; these filings map the operations behind local cases.
• Federal Trade Commission — ftc.gov — fraud and identity-theft reports and victim guidance.
• Cybersecurity & Infrastructure Security Agency — cisa.gov — the Secure Our World guidance you can hand to residents.
• National Cybersecurity Alliance — staysafeonline.org — plain-language guidance for community teaching.
• Consumer Financial Protection Bureau — consumerfinance.gov — account-protection guidance for victims whose money was reached.
• mass.gov — Massachusetts consumer and reporting information.

What you earned / what's next — Cyber Security Awareness

✅ Topic Library — Cyber Security Awareness complete (quiz score 80% or higher): You can teach the habits that defeat breach arithmetic, explain the harvested-code attack, coach a victim through a first hour that protects money, accounts, and evidence together, and write reports that feed the national pattern files.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Topic Library: Cyber Security Awareness

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You carry sentences that save savings: slow down, verify independently, never share a code. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or legal training for representing anyone. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Topic Library — Hackers: the people behind the attacks, and your role between them and the community.

Sources

• cisa.gov — Cybersecurity & Infrastructure Security Agency, "Secure Our World" program
• ic3.gov — FBI Internet Crime Complaint Center, annual reports and public alerts
• ftc.gov — Federal Trade Commission, "How to Recognize and Avoid Phishing Scams"

Minister Destiny Testimony Schools — Law Enforcement. Educational information only, not legal advice. Help lines: 911 in an emergency · 988 Suicide & Crisis Lifeline (call/text 988).