Facilitator Notes & Model Answers — Lesson 04
For instructors and self-study · Model reasoning and reference baseline
The reference hardening baseline
| Area | Baseline state |
|---|---|
| Phone | Encrypted/locked with PIN, short timeout, auto-updates, remote wipe, biometric + strong fallback |
| Laptop | Full-disk encryption, auto-updates, screen lock, separate personal/corporate profiles |
| Accounts | Password manager, MFA everywhere, phishing-resistant factor on email, hardened recovery, no SMS 2FA where avoidable |
| Connectivity | Power-only charging cable, trusted connection for sensitive work, verify QR codes, Bluetooth off when unused, no found media |
Why the poll answer is C (hardware key / passkey)
- A — authenticator app code: better than SMS, but still typed into a page and therefore relayable by a fake site.
- B — SMS code: phishable and additionally vulnerable to SIM-swapping.
- C — FIDO2 key / passkey: origin-bound; nothing for a fake page to capture. The only phishing-resistant option here.
- D — a long password: not a second factor at all.
Common misconception to correct: many leaders believe authenticator apps are immune to phishing. They resist replay better than SMS but are still defeated by real-time relay; only cryptographically origin-bound factors are truly phishing-resistant.
Homework — model answers
Task 1
A complete attestation marks every item as done, delegated with a date, or knowingly accepted. Knowing your own posture — including the gaps — is the objective.
Task 2
Email first is the right instinct: it is the recovery channel for everything else. A named owner and date is acceptable where the participant cannot self-serve.
Task 3
Strong wording is concrete and blame-free, e.g. "If you ever think you clicked something wrong, tell us straight away — you'll get a thank-you, never a telling-off. The only mistake is staying quiet." Generic "be vigilant" messaging fails the test.