🔒 Lesson 1.3: The Internet & Working Safely Online

The Internet at Work

The internet is a core work tool. On the job you'll use the web to check a company website, look up a policy or a "how-to," fill out an online form, submit a timesheet, sign in to systems your employer uses, and find quick answers when you're stuck. Being comfortable and quick on the web saves time every single day — and employers notice.

But there's a second half to this skill that matters just as much: security is part of the job. When you sign in to a company account, you're holding a key to your employer's information — and sometimes to customers' private data too. That's why nearly every workplace now expects employees to use strong passwords, verify their identity with a second step, and know how to spot a scam. This isn't about being paranoid; it's about being trustworthy and professional.

Good news: the safety habits in this lesson are simple and completely learnable. You don't need to understand how the internet works under the hood. You just need a handful of reliable habits — and once they're habits, they protect you automatically. This is workplace-focused online safety; if you'd also like a gentle tour of personal online safety (phones, personal accounts, bills, government and health services), the Digital & Life Skills course covers that. Here, we focus on company accounts, company data, and phishing at work.

Browsers & Searching Effectively

A web browser is the program you use to visit websites. The common ones at work are Google Chrome, Microsoft Edge, Safari (on Apple computers), and Firefox. They look a little different, but they all work the same way, so the skills transfer from one to the next.

Here are the parts of a browser you'll use constantly:

One point that trips people up: the address bar versus searching. In most modern browsers the same bar does both. If you know the exact web address, type it (for example, your company's website) and press Enter to go there directly. If you don't know the address, type words — a question or keywords — and press Enter to search. When in doubt, searching is fine; you'll usually find what you need in the first few results.

🔎 Searching smartly

Good searching is a real work skill. A few habits make a big difference:

• Use specific keywords. Instead of "help," search "how to add a signature in Outlook." The more specific your words, the better your results.
• Read the results before clicking. Each result shows a title, a web address, and a short description. Skim these to pick the most relevant, trustworthy one — don't just click the very first thing.
• Prefer official and reputable sources. For rules, benefits, or forms, government sites (ending in .gov) and the official company's own website are the most reliable. For how-to steps, the software maker's own help pages (for example, Microsoft or Google support) are excellent.
• Refine and try again. If the results aren't helpful, change your words and search again. Searching is a conversation, not a one-shot.
• Watch for ads. The top results are sometimes labeled "Sponsored" or "Ad." They're paid placements, not always the best answer — glance for that label.

Telling reliable sources from unreliable ones is a skill of its own, called information literacy. We'll go deeper on evaluating sources and solving problems at work in Lesson 4.2: Information Literacy & Problem-Solving at Work. For now, the rule of thumb is: prefer official sites, cross-check anything important, and be skeptical of results that seem too dramatic or want you to pay or sign in unexpectedly.

Strong Passwords & Multi-Factor Login

Your password is the key to your work accounts. If it's weak or reused, an attacker can walk right in — and once they're in a company account, they can reach data, email coworkers pretending to be you, or cause real damage. The good news is that strong login habits are easy once you know them.

🔑 What makes a password strong

• Long. Length matters most. A passphrase of several words — like PurpleCactusRiverStapler — is both strong and easier to remember than a short jumble.
• Unique. Use a different password for every account. If you reuse one and any single site is breached, every account with that password is suddenly at risk.
• Not guessable. Avoid your name, birthday, "password," "123456," or "Password123." These are the first things attackers try.
• Not shared. Never share your work password — not with a coworker, and never in reply to an email or phone call. Real IT departments don't ask for your password.

You might be thinking, "How am I supposed to remember a different long password for every account?" You don't have to — that's what a password manager is for.

🗝️ Password managers

A password manager is a secure app that creates strong, unique passwords for you and remembers them all. You memorize just one strong master password (or unlock it with your fingerprint or face), and it fills in the rest automatically. Many workplaces provide one; popular options you may hear of include Bitwarden, 1Password, and the password features built into your browser or phone. Ask your employer whether they have a preferred tool — using it is a mark of a careful employee.

📱 Multi-factor authentication (MFA / 2FA)

Even a great password can sometimes be stolen. That's why workplaces add a second step called multi-factor authentication (MFA), also known as two-factor authentication (2FA). It means proving who you are with two things: something you know (your password) plus something you have (usually your phone).

In practice, after you type your password, the system asks for a second proof — for example:

• A one-time code texted to your phone or shown in an app (like Microsoft Authenticator, Google Authenticator, or Duo).
• A "Was this you?" tap that pops up on your phone for you to approve.
• A physical security key or your fingerprint/face.

MFA is powerful because even if a thief steals your password, they still can't get in without also having your phone. It takes just a few extra seconds and blocks the vast majority of account break-ins. If your workplace offers or requires MFA, turn it on and keep it on — it's one of the best protections there is.

Spotting Phishing & Scams at Work

Phishing is when someone sends a fake email, text, or link pretending to be a real person or company — your bank, your boss, IT, a delivery service — to trick you into giving up a password, clicking a harmful link, or sending money or gift cards. It's the most common way workplaces get attacked, precisely because it targets people, not machines. Learning to spot it is one of the most valuable safety skills you can have.

🚩 Common red flags

• Urgency and pressure. "Act now or your account will be closed!" Scammers rush you so you won't stop to think.
• An odd or mismatched sender. The name says "IT Support," but the actual email address is a random string or a misspelled company name. Always check the real address, not just the display name.
• Links that don't match. The text says one thing, but hovering over the link shows a different, strange web address. Don't click — inspect first.
• Requests for secrets or money. Asking for your password, a verification code, gift cards, or a wire transfer. Legitimate employers and IT never ask for your password.
• Unexpected attachments or messages you weren't expecting at all, especially ones that want you to "enable" something or sign in.
• Odd wording. Awkward grammar, generic greetings ("Dear User"), or a tone that doesn't sound like the real person.

When something feels off, walk through a simple safety check before you act. Here's the flow to follow:

graph TD
    A["You get a message with a link or request"] --> B{"Were you expecting it?"}
    B -->|"Yes, expected"| C["Check the sender's real email address"]
    B -->|"No, unexpected"| D["Be cautious — slow down"]
    D --> C
    C --> E{"Does the address look right?"}
    E -->|"Looks wrong or odd"| H["Do NOT click"]
    E -->|"Looks okay"| F["Hover over links to inspect the real address"]
    F --> G{"Pressure, or asks for password / money?"}
    G -->|"Yes"| H
    G -->|"No, seems safe"| I["Proceed carefully"]
    H --> J["Report to IT & verify another way"]

The two most important steps in that flow: never click when something feels suspicious, and verify through a separate channel. If an email claims to be from your boss asking for gift cards, don't reply to the email — call or message your boss directly using a number you already trust. If it claims to be IT, contact IT through your normal help channel, not the email's links or phone number.

Protecting Data & Privacy at Work

Beyond passwords and phishing, a big part of working safely online is protecting the information you handle — your company's data and, often, your customers' private details. Much of this is just common-sense care, done consistently.

• Guard company and customer data. Don't share confidential information, send it to personal accounts, or copy it onto random USB drives. Treat customers' details (names, addresses, payment info, health info) as private — handle only what your job requires.
• Lock your screen when you step away. A quick Windows key + L (Windows) or Ctrl+Cmd+Q (Mac) locks the computer so no one can use your open accounts while you're gone. Make it a reflex whenever you leave your desk.
• Be careful on public Wi-Fi. Free Wi-Fi at a café or airport can be watched by others. Avoid signing in to work accounts on it unless you're using a company VPN (a secure, private connection your employer may provide).
• Don't install unknown software. Only install programs your employer approves. Random downloads and "free" tools can hide malware. If you need software, ask IT.
• Follow the acceptable-use / IT policy. Most workplaces have a written policy on how to use company computers, email, and the internet. Read it, and when unsure, ask. Following it protects you as much as the company.

None of this requires technical expertise — it's about steady, respectful care with information that isn't only yours. Employers trust people who handle data carefully, and that trust opens doors.

Practice & Project

Tips & Common Mix-Ups

✅ Do's

• Search with specific keywords. The clearer your words, the better and faster the results.
• Prefer official, reputable sources. Government .gov sites and the software maker's own help pages are reliable.
• Use long, unique passwords. A passphrase and a password manager beat memorizing jumbles.
• Turn on MFA. The second step blocks most account break-ins — especially for work email.
• Report suspicious messages to IT. When in doubt, don't click; verify another way.
• Lock your screen and follow the IT policy. Small habits protect real people's data.

❌ Common Mix-Ups

📓 Learning Journal

📝 Lesson Summary

🎉 What You've Accomplished

You've built the online-safety foundation that every modern job depends on: you can browse and search effectively, build strong login habits with passwords and MFA, spot and report phishing, and handle company data with care. You also added a "My Online Safety at Work" page to your toolkit — a plan you can actually use starting today. That's a genuinely valuable, employer-trusted skill set. 🎉

❓ Common Questions at This Stage

🔭 Looking Ahead

With computers, email, and safe internet habits behind you, you're ready to start creating. In Lesson 2.1: Word Processing, you'll open a word processor (like Microsoft Word or Google Docs), type and format a document, and produce clean, professional-looking work — the kind of documents nearly every job asks for. It's hands-on and satisfying, and you already have the file-saving skills it builds on.

✅ Before the Next Lesson

• Finish your "My Online Safety at Work" toolkit page and keep it with your folder.
• Turn on MFA for at least one important account (start with your email) if you haven't yet.
• Practice: search for one thing with specific keywords and bookmark a reputable page.
• Write your Learning Journal entry for this lesson.
• Optional: skim your workplace's IT / acceptable-use policy, or note to ask about it on your first day.