Exercise: The Security Glossary and Decision Guide

Build the mental model

This is the closing lesson of the Digital Privacy & Modern Security course. Across five chapters — Passkeys & Recovery, Public Wi-Fi & Browser, Developer Auth & API, Privacy, and AI Security — you picked up a substantial new vocabulary.

This glossary collects that vocabulary in one place — it deliberately does not re-teach foundational terms already owned by the prerequisite Cybersecurity Basics course, like Password, 2FA, Phishing, Malware, Encryption, or Backup.

The glossary is ordered the way concepts appeared across the course rather than alphabetically — from account setup, through networking and developer practices, to privacy and AI — so reading it straight through also works as a full-course recap.

The emphasis here is this course's own new terms — Passkey, VPN, Token, Prompt Injection, and the rest
A real scenario often touches two or three chapters at once, not just one
The Security Decision Guide pairs situations with actions so you can reference it quickly later

The point of this lesson

Both the glossary and the decision guide are meant to outlast the course itself as something you keep using, not something read once and forgotten.

text

COURSE CHAPTER MAP
------------------
  SCENARIO TYPE                       COURSE CHAPTER
  --------------                       --------------
  new account, recovery setup    -->   Passkeys & Recovery
  unfamiliar network, extension  -->   Public Wi-Fi & Browser
  API design, token handling     -->   Developer Auth & API
  personal data, tracking        -->   Privacy
  AI-generated code, AI agent    -->   AI Security

  Many real situations touch more than one row at once --
  e.g. "deploy an AI feature that calls a paid API" touches
  both AI Security and Developer Auth & API.

Connect it to a real scenario

New important account setup

Maps to Passkeys & Recovery — prefer a passkey where supported, and set up a recovery method at the same time so losing the device doesn't mean losing the account.

Third-party API integration review

Maps to Developer Auth & API — check for token exposure, per-resource authorization (not just authentication), and rate limiting.

AI-generated feature deployment

Maps to AI Security (often together with the Developer Auth & API checklist) — check prompt injection defenses, that AI agent permissions aren't broader than needed, and run the full checklist rather than assuming it's secure by default.

Don't limit yourself to one chapter

Some scenarios legitimately span more than one chapter — an AI feature that calls a paid API needs both the AI Security and the Developer Auth & API checklists, not just one.

When you meet a real scenario, first identify which chapter — or chapters — of this course it actually calls for
The glossary focuses on this course's own new vocabulary and does not re-explain foundational terms Cybersecurity Basics already owns
The Security Decision Guide is a situation-to-action quick reference meant to keep being useful after the course itself is done

Try the working example

javascript

function mapScenarioToChapter(category) {
  const mapping = {
    "new-important-account": {
      chapter: "Passkeys & Recovery",
      reason: "Strongest available authentication and recovery planning",
    },
    "unfamiliar-network-or-extension": {
      chapter: "Public Wi-Fi & Browser",
      reason: "Network trust levels, VPN limits, and browser/extension permissions",
    },
    "reviewing-third-party-api-integration": {
      chapter: "Developer Auth & API",
      reason: "Token handling, per-resource authorization, and rate limiting",
    },
    "personal-data-handling": {
      chapter: "Privacy",
      reason: "Data minimization and what personal data a service actually needs",
    },
    "deploying-ai-generated-feature": {
      chapter: "AI Security",
      reason: "Prompt injection, vibe-coding risks, and AI agent permissions",
    },
  };

  return (
    mapping[category] || {
      chapter: "Unknown",
      reason: "No matching chapter for this category",
    }
  );
}

const scenarios = [
  "new-important-account",
  "reviewing-third-party-api-integration",
  "deploying-ai-generated-feature",
];

for (const c of scenarios) {
  const result = mapScenarioToChapter(c);
  console.log(c + " -> " + result.chapter + " (" + result.reason + ")");
}

You should see

new-important-account -> Passkeys & Recovery (Strongest available authentication and recovery planning)
reviewing-third-party-api-integration -> Developer Auth & API (Token handling, per-resource authorization, and rate limiting)
deploying-ai-generated-feature -> AI Security (Prompt injection, vibe-coding risks, and AI agent permissions)

5-minute try-it

For each of the three scenarios below, identify which chapter (or chapters) and checklist of this course actually applies, before reading the practical section's answer key.
1. You're setting up a new important account and want the strongest available authentication.
2. You're reviewing a third-party API integration your team built.
3. You're about to deploy an AI-generated feature to production.

One important caution

Assuming a real-world scenario maps to only one chapter and skipping the other checklists it also touches

Assuming AI-generated or vibe-coded code is secure by default instead of running it through the full checklist before deploying

NIST — Digital Identity Guidelines (SP 800-63) — Digital Privacy & Modern Security

Digital Privacy & Security Glossary — Common Terms

Term	Meaning
Passkey	A password-less authentication method built on public-key cryptography, where a private key stored on your device proves your identity instead of a shared secret.
Public-Key Cryptography	An encryption and authentication system using a matched key pair, where the public key can be shared freely but the private key never leaves the owner's device.
Impersonation Attack	An attempt where someone pretends to be a person, company, or service you already trust in order to get you to act on their behalf.
Public Wi-Fi	A wireless network available to the general public at places like cafes, airports, or hotels — often hard to verify the true trust level of.
VPN	A service that encrypts traffic between your device and the VPN provider, protecting against local-network snooping — but not phishing, malware, or full anonymity.
Site Isolation	A browser security mechanism that runs each site in its own process, so a compromise on one site can't reach into another site's data.
Home Network Security	The practice of protecting a home Wi-Fi network — updating router firmware, changing default passwords, and separating a guest network from trusted devices.
Browser Extension Permission	The data or capabilities a browser extension asks to access (browsing history, page content, and so on) — worth reviewing before installing, not after.
Site Permission	A request from a website to access a device capability like the camera, location, or notifications — worth checking against whether it actually matches the site's stated purpose.
Authentication	(Brief refresher) Proving you are who you claim to be — via a password, passkey, 2FA, or similar.
Authorization	The step after authentication that decides which specific resources you're allowed to access — being authenticated does not automatically mean being authorized for everything.
Token	A string issued after authentication or authorization that proves identity or permission on later requests — must never be exposed in client-side code or logs.
Session	The ongoing connection state between a user and a server after login — should have a reasonable timeout rather than staying valid indefinitely.
Rate Limiting	(Brief refresher) Capping how many requests an API endpoint accepts in a given time window, reducing abuse and brute-force attempts.
Response Data Minimization	Returning only the fields an API client actually needs in a response, leaving out unnecessary sensitive fields even if they exist in the underlying record.
Defense in Depth	(Brief refresher) Stacking multiple independent security layers instead of relying on one, so a failure in one layer still leaves others standing.
Privacy	Your ability to control who sees your personal information and how much of it is shared — broader than security, which focuses on protecting access rather than exposure by design.
Data Minimization	Collecting and storing only the data a service or feature genuinely needs to function, not everything that could conceivably be useful later.
Personal Data	Any information that identifies or can be linked back to a specific individual — a name, location, device identifier, and similar.
Tracking	Monitoring a user's activity, often across multiple sites, using mechanisms like cookies or device fingerprinting.
App Permission	A request from a mobile or desktop app to access a device resource like the camera, contacts, or location — worth checking against what the app actually needs to do its job.
Prompt Injection	An attempt to hide instructions inside content fed to an AI model — user text, a document, web content — to override the AI's intended behavior.
Vibe Coding	Rapidly writing code by leaning heavily on AI generation and iteration — functional quickly, but with a higher chance of skipping the security review a hand-written feature would get.
AI Agent Permissions	The scope of actions an AI agent is allowed to take — reading files, running commands, calling APIs — which should never be broader than what the current task actually requires.

Security Decision Guide

Situation	What to do
Setting up a new important account	Use a passkey where supported; otherwise a unique password plus 2FA. Set up a recovery method at the same time, or losing the device can mean losing account access.
Connecting to an unfamiliar network	Verify the network name and avoid auto-join. For sensitive tasks, consider switching to cellular data instead of trusting an unverified network.
Installing a new browser extension	Review the permissions it requests before installing — check they actually match what the extension claims to do.
A site requests a permission (camera/location/etc.)	Check whether the permission matches the site's actual stated purpose — decline it if it doesn't.
Handling a server-only API token	Never expose it to client-side code or logs — keep it in a server-side environment variable only.
Designing an API endpoint	Check authorization per-resource, not just authentication — being logged in should never automatically grant access to every resource.
Reviewing an AI-generated feature before deploying	Run the full security checklist — never assume AI-generated code is secure by default.
Uploading data to an AI tool	Consider whether the data is sensitive or confidential first — and check the AI tool's data retention policy.
Reviewing app permissions	Check that the permissions an app requests match its actual stated purpose — decline any that don't.
Deciding on a VPN	Understand what a VPN actually protects — network privacy — and what it does not: phishing, malware, or full anonymity.
An unfamiliar contact requests urgent action	Verify through a channel you already know independently — a saved phone number, an official app — never through the channel the request itself came from.