# Privacy and Security Runbook # 1. Start Here # 1.1 Overview This is a plain‑English, step‑by‑step runbook introducing general security and privacy concepts and providing guidance on how to protect your computers, phones, and yourself from common threats such as scams, stolen passwords, malware, and lost devices. The focus is on a safe default mindset and simple choices without requiring any advanced knowledge. This guide is for anyone who wants practical protection without having to become a cybersecurity expert, install large amounts of additional software, or make complicated configuration tweaks. The scope is on Windows, macOS, and Linux operating systems, iPhone and Android mobile devices, and identity safety processes for US citizens. All abbreviations are spelled out the first time you encounter them, with full definitions provided in the appendix. This runbook also contains a set of checklists to get started and playbooks if you find your security or privacy has been compromised. # 1.2 Core Concepts Everything in this guide flows from these four concepts. Keep them in mind and most day‑to‑day decisions get simpler. ## Protect Yourself - Be a skeptic. Treat unexpected links, attachments, and “urgent” requests as suspicious; verify using a separate channel you trust. - Use strong, unique passwords for each site and application. - Use a password manager with a long master passphrase, and use it to generate unique passwords everywhere. - Turn on security alerts for new logins and password changes. - Turn on multi‑factor authentication (MFA) wherever possible and store recovery codes safely. - Prefer passkeys where offered (a phishing‑resistant sign‑in method). - Use a virtual private network (VPN) on public or untrusted WiFi networks. ## Protect Your Data - Keep everything updated; your operating system (OS), software, and mobile applications. - Only install software from trusted sources such as official app stores and directly from software vendor websites. - Lock your screen when you step away. - Use encryption. Every modern, major OS has this built-in. Include external drives if they hold sensitive files. - Configure data backups automatically and test restores so you know recovery works. - Secure your home Wi‑Fi with WPA2/WPA3 protocols, using a strong admin password, and segregate less trustworthy devices. ## Minimize Your Exposure - Install less software and keep your browser lean with only a few, trusted extensions. Uninstall unused apps and remove extensions you don’t recognize. Fewer apps = fewer problems. - Don’t overshare. Review application and website permissions, turn off ad and diagnostic sharing you don’t need. - Use standard (non‑administrator) accounts for daily use; approve admin prompts intentionally when making system changes. ## Have a Recovery Plan - Find, lock, and wipe; know how to locate and remotely erase your laptops and mobile devices. Test “Find My Device” features. - Keep an emergency kit with backup codes, recovery emails and phone numbers, know where backups live, and who to call if you need help such as bank fraud reporting numbers. - This runbook provides some printable guides on how to respond and recover from some common incidents in the Incident Playbooks section. Feel free to print them out and keep them in your kit. # 1.3 How to Use This Guide There is a lot of information in this runbook, and at first glance, it might be intimidating. Take it piece-by-piece. This runbook is laid out in a series of topics dealing with a specific security and privacy area, prioritized based on risk, and tiered into: - The Basics - the minimum everyone should do - Better Protection - closes more gaps but requires a little more customization - Extra Credit - more advanced but still user-friendly Plan to dedicate some time each week; it doesn’t have to be much, just 30 minutes will go a long way. I recommend that you go topic-by-topic on your first pass, read the general topic information and apply The Basics. Then go back through and apply Better Protection wherever possible. Finally, take a final pass and apply any Extra Credit you are comfortable with. Don’t worry if you aren’t able to apply everything, every little bit counts. You can always reach out to me if you have any questions. If you’re holding this runbook then you know how to get hold of me. # 2. Accounts and Identity # 2.1 Authentication (passwords, MFA, passkeys, biometrics) *Core Concepts: Protect Yourself, Protect Your Data* When you log into a computer or website with a User ID and password, you are authenticating; proving you are who you claim to be. Get this topic right and you block 90% of account compromises. ## 2.1.1 Understanding Authentication Authentication answers the question "who are you?" A User ID is your unique identifier (often an email address). A password is a single verification factor paired with your User ID. Together, they prove you're the legitimate owner of an account. ## 2.1.2 The Basics - Use a password manager - Create strong passwords - Never reuse passwords - Handle security questions carefully - Set up a recovery email - Enable login alerts ### Use a Password Manager A password manager stores all your login credentials, auto-fills them when you need them, and can generate secure, random passwords for each account. This means you only need to remember one password, the master password for your password manager, or vault. **Why use a password manager?** - Creates strong, unique passwords for every account automatically - Bypasses the clipboard, protecting against keyloggers - Detects when you change passwords and can automatically update them - Can store payment cards and bank accounts ("wallet" feature) - Allows secure password sharing with family without revealing the actual password - Provides emergency access features if you're hospitalized or otherwise incapacitated - Can store additional information as notes, like answers to your security questions **NEVER use your browser's built-in password storage.** While modern browser password managers have improved, dedicated password managers offer superior security features including cross-platform sync, security audits, secure sharing, and breach monitoring. Browser-based storage also creates a single point of failure if your browser is compromised. **Important:** DO NOT FORGET YOUR MASTER PASSWORD! You can share this with a friend or family member who can store it in their vault in case you forget. If you use a password manager which offers account recovery, set it up and carefully protect the recovery information. **Recommended: Bitwarden** (https://bitwarden.com/). It's web-based so you can access it anywhere, has browser plugins, mobile apps, and offers both free and premium service. It includes all the features mentioned above. If you want, you can use my self-hosted Bitwarden service at [https://pass.landisfam.org.](https://pass.landisfam.org./ "https://pass.landisfam.org.") This offers the same protections as Bitwarden’s official service, but less likely to be targeted by attackers. However, I still cannot recover your account if you forget your master password. Once enrolled, install the applications in your browsers and on your mobile devices. Enable auto-fill, and start populating your vault by logging into each email, financial, and health related accounts, since those contain your most sensitive information. When doing this, I recommend you reset each password, most password managers have a password generator, and secure them in your password manager. If you use a browser extension, most password managers prompt you to automatically add information for websites not already in the vault. While going through this process, I also recommend you go through each site’s security settings. Review your security questions (see that topic below) and force logout of all devices. Note that afterward you will have to log in again on all devices. ### Create Strong Passwords Passwords that are easy to remember tend to be easy to guess. The solution is to make them long, using a phrase you can remember, but would take an attacker a very long time to guess or to use brute-force methods to crack your account. Follow this link and experiment with different passwords: [https://www.security.org/how-secure-is-my-password/](https://www.security.org/how-secure-is-my-password/ "https://www.security.org/how-secure-is-my-password/") **How to Create a Strong Password:** There is an adage in Bridge (a card game for old people), “length over strength.” A long, simple password is more secure than a short, complex password. Think of a line from your favorite song, poem, or quote. Take a few words from that line, capitalize some letters, mix in numbers, and add a special character or two. *Example:* From Robert Frost's "The Road Not Taken": - Simple version: Tw0r04ds! (would take 1 hour to brute force) - Strong version: tworoadsdivergedinayellowwood (85 sextillion years) Email accounts deserve the highest level of protection. When you forget a password, most sites send a reset link to your email. This means if someone gains access to your email, they can potentially reset passwords for all your other accounts. I recommend 16+ characters for email passwords. **Recommended password lengths:**
**Account Type** **Password Length**
Password Manager 20+ characters
Email 16+ characters
Everything else 12+
Of course, if you use a password vault, you can have the best of all words, and use unique, 20+ character, complex passwords for all your accounts without ever having to worry about forgetting them. Again, just make sure the password for your password manager is also strong, and have a recovery method in case you do forget it. ### Never Reuse Passwords Use a unique password for every account. If one site gets breached, attackers will try that password on other popular sites. Reused passwords mean one breach potentially compromises all other accounts which use that same password. Your password manager, once populated, can verify that all your accounts have unique credentials. ### Handle Security Questions Carefully Security questions are a weak way to verify your identity. The answers are often public information or easy to find through social media. When forced to use them: - Don't pick anything that could be public record (first car, school names, family names) - Consider using false or ironic answers. The system only compares how you answer when prompted with what you entered when you created the answer; it cannot validate if the answer you provided is actually true - Example: "What was your first car?" Answer: "Matchbox" Your password manager likely has a “notes” section for each item in your vault, or a separate “notes” folder. You can put your security questions in one of those. ### Set Up a Recovery Email Create a secondary email account to use as a recovery address for your primary email. If you can't access your main email, you can use the recovery email to regain access to your primary email account. Keep this secondary email account highly protected too, and only use it as a recovery account; do not use it for any other purpose. ### Enable Login Alerts Turn on notifications for new logins. Most services offer this. When enabled, you'll get an email or text when someone logs into your account from a new device or location. If it wasn't you, you'll know immediately. You can typically fine this option in security settings. ## 2.1.3 Better Protection - Expand password manager use - Enable Multi-Factor Authentication (MFA) - Use passkeys when available - Understand when is best to use biometrics - Check for compromised accounts regularly ### Expand Password Manager Use Once you have your critical applications vaulted (email, financial, and health-related accounts), you’ll want to go back and begin adding other important sites and applications like cloud storage (Google drive, iGloud, OneDrive, Dropbox), social media, and shopping accounts. Follow the same process to change the password using the password manager’s password generator, forcing logout of active logins, and updating security questions. ### Enable Multi-Factor Authentication (MFA) MFA adds a second step to logging in; usually a code sent to your phone or generated by an authenticator application. If you use MFA, even if someone steals your password, they can't access your account without this second factor. **Common MFA methods (from least to most secure):** - SMS text codes: Simple but vulnerable to SIM-swap attacks - Email codes: Better than nothing but relies on email security - Authenticator apps: Generate time-based codes even without cell service. Examples include Google Authenticator, Microsoft Authenticator, RSA Authenticator - Passkeys: Biometric, cryptographic, or physical devices you plug into your device (covered in Extra Credit) **Where to enable MFA:** - Password manager (highest priority) - Email, financial, and health service accounts - Cloud storage (Google Drive, iCloud, Dropbox, OneDrive) - Social media accounts - Shopping accounts - Any other account with sensitive personal information **Recommended:** Google authenticator is used very broadly, is available in both android and apple app store, and has a cloud backup feature in case your device is lost, stolen, or breaks. The option to enable MFA on a website or application is typically in security options. You will usually be offered a choice of authenticator the site supports. Select the authenticator you have installed on your phone, open that application on your phone, and scan the QR code provided by the website by clicking the `+` icon on the authenticator application. **Important:** When you enable MFA, you'll receive recovery codes (usually 8-10 random codes). Store these safely, like in your password manager, as they're the backup if you lose your authenticator; phones break, can get stolen, or get lost. You can also install the authenticator application on multiple devices, such as a tablet, so if you lose one device you do not lose access. Plus it is easier to restore to a new device that way. ### Use Passkeys When Available Passkeys are a newer, phishing-resistant way to sign in. They use cryptography instead of passwords, and are built into many devices. They're easier to use than passwords and more secure than MFA. Enable them when offered. Major sites like Google, Microsoft, Apple, and others now support passkeys. To start using passkeys, enable them in the website or application, typically in security options. Once enabled, you will be prompted to generate a passkey, typically through fingerprint or facial recognition. Passkeys are device-specific, but can be linked across all your devices. ### Understanding Biometrics Fingerprints, Face ID, and other biometrics are convenient but come with trade-offs: **Pros:** - Can't be forgotten - Quick and convenient - Better than weak passwords **Cons:** - Can't be changed if compromised - Can be forged (though it's difficult and expensive) - Can be compelled by court order (unlike passwords, which are protected speech) - Someone with physical access to you can use your biometrics (passed out at a party, etc.) **Best practice:** Use biometrics as a second factor alongside passwords, not as your only authentication method. For banking apps with very sensitive data, consider using a PIN instead of biometrics for unlocking the app on your phone. **Exception - Passkeys:** Passkeys are different. When you use biometrics to unlock a passkey, the biometric stays on your device and only unlocks a cryptographic key. The website never sees or stores your biometric data. This makes passkeys with biometric unlock more secure than traditional biometric-only authentication, and it's safe to use them as your primary sign-in method. ### Check for Compromised Accounts Visit [https://haveibeenpwned.com](https://haveibeenpwned.com/ "https://haveibeenpwned.com") every few months to see if your email addresses have appeared in recent, known data breaches. If you find your information was compromised: - Change the password for that account immediately - Review recent account activity for unauthorized access - If you reused that password anywhere else, change those too - Enable MFA if you haven't already ## 2.1.4 Extra Credit - Use hardware security keys - Use one-time passwords - Use separate email accounts - Conduct full account audits periodically ### Use Hardware Security Keys Hardware authenticators like YubiKey [https://www.yubico.com](https://www.yubico.com/ "https://www.yubico.com") are physical devices you plug into your computer or tap against your phone. They're the most secure form of MFA because they can't be phished, intercepted, or duplicated. Hardware keys are ideal for: - Password managers - Email accounts - Financial accounts **Tip:** Set up two keys and keep one in a safe place as a backup. That way if you lose your primary key, you'll still have access. ### Use One-Time Passwords for Apps Some services let you create app-specific passwords, or one-time passwords (OTP), instead of using your main password. This is especially useful for email accessed through desktop or mobile applications. The password only works once to connect the first device that uses it. Even if malware captures it, it's useless to an attacker. Set these up for any critical applications that contain sensitive information. It may take a little hunting to find these settings. In Gmail, for example, “App Passwords” are within the 2-step verification settings, beneath the list of second steps. Once you generate the one-time password, log out of that application on your device, then log back in using the one-time password. Repeat this for all devices (phone, tablet, desktop, and laptop applications). ### Review Account Security Regularly At least quarterly, check your important accounts: - Check recent login activity for suspicious locations or times - Review authorized devices and remove any you don't recognize or are no longer using - Verify your recovery information (email addresses, phone numbers) is current - Look for third-party apps with access and revoke any you don't use ### Separate Email for Sensitive Accounts Consider using a separate email account exclusively for your most sensitive sites (financial and health portals) that you never use for anything else (shopping, social media, or regular communication). This makes it much harder for attackers to find or target this email, since it won't be in typical data breach lists. Ideally, you should have a total of 3 or 4 email accounts. One, primary account you use for regular communication, a secondary email for sensitive sites like financial and health portals, and a recovery email address which you use to recover your email accounts if you lose access. A fourth email can be used to split out messages from shopping, social media accounts, and so forth, since those generate the most spam. When providing an email address to a company you can also use [https://10minutemail.com](https://10minutemail.com/ "https://10minutemail.com"). This is a service which offers disposable email accounts; they are only valid for 10 minutes by default, although you can extend 10 minutes at a time. While this account is active you can send and receive email like any other email account. Using this keeps your regular email private if you just want to try out a service but aren’t certain you want to use it long-term. Once you register this email address with any service, if you decide to keep that service, you can always change your email address to one of your others. # 2.2 Scam and Social Engineering Defense *Core Concepts: Protect Yourself, Protect Your Data* Humans are the weakest link in security. Even perfect technical security fails if you're tricked into handing over credentials or sending money. The good news is most scams use the same playbook, so learn to recognize the patterns. ## 2.2.1 Understanding Social Engineering Social engineering is the art of manipulating people into giving up confidential information or taking actions that compromise security. Attackers exploit human psychology, our trust, fear, curiosity, and desire to be helpful, rather than technical vulnerabilities. **Common tactics attackers use:** - Urgency: "Act now or your account will be closed!" - Authority: Impersonating your bank, the IRS, or your boss - Fear: "Your computer is infected!" or "You owe taxes!" - Greed: "You've won a prize!" or "Make money fast!" - Curiosity: "See who viewed your profile" or "This video is about you" - Helpfulness: "Can you do me a quick favor?" **Your defense:** Slow down. Verify. Be skeptical. Trust your gut; if something feels off, it probably is. ## 2.2.2 The Basics - Recognize phishing emails and texts - Check links before clicking - Never open unexpected attachments - Verify unexpected requests through another channel - Watch for caller ID spoofing - Recognize gift card and wire transfer scams - Spotting for tech support scams - Watch for impersonation on social media ### Recognize Phishing Emails and Texts Phishing is a fake message designed to trick you into clicking a link, opening an attachment, or sharing sensitive information. Here's how to spot them: - Generic greetings: "Dear Customer" instead of your name - Urgent language: "Act immediately" or "Within 24 hours"; they want you to act before you have time to think about whether or not it is a scam - Threats: "Your account will be suspended" or "You'll be charged" - Too good to be true: Free money, prizes you didn't enter, inheritance from unknown relatives - Spelling and grammar errors: Professional companies proofread their communications - Mismatched sender addresses: The display name says "PayPal" but the email is from "paypa1-secure@gmail.com" - Suspicious attachments: Especially .exe, .zip, or files you weren't expecting - Requests for personal information: Real companies never ask for passwords, SSN, account numbers, or any other personal information via email - Unexpected delivery notifications “there was a problem with your package” when you didn’t order anything ### Check Links Before Clicking Before clicking any link in an email or text message: **On desktop:** - Hover your mouse over the link (don't click!) and look at the URL that appears - Does it match what you expect? If an email claims to be from Amazon, the link should go to amazon.com, not amaz0n-secure.net - Watch for look-alike domains: paypal.com vs. paypa1.com (that's a number one), or apple.com vs. app1e.com **On mobile:** - Press and hold the link to preview where it goes - When in doubt, don't click - go directly to the company's website through your browser or app instead A quick note about QR codes, since those are really just links. Legitimate examples of these can be found on company advertisements, restaurant menus, business cards, etc. Scammers also sometimes use QR codes to bypass email security filters and trick you into visiting malicious sites. This is called “quishing.” **How it works:** - You receive an email with a QR code claiming to be from your bank, IT department, or a package delivery service - You scan the code with your phone - It takes you to a fake login page that steals your credentials **Protection:** - Be skeptical of unexpected QR codes in emails - Before scanning, ask yourself if you were expecting this - After scanning, check the URL before entering any information - When possible, access services directly rather than through QR codes in emails ### Never Open Unexpected Attachments Attachments are a common way to deliver malware. Follow these rules: - Don't open attachments from unknown senders, period - If you get an unexpected attachment from someone you know, verify with them through a different channel (call them) before opening - Be especially wary of: .exe, .zip, .scr, .com, .bat, .js files - Even seemingly safe files like PDFs and Word documents can contain malware, verify before opening ### Verify Unexpected Requests If you receive an unexpected request whether by email, text, phone, or social media, pause and verify: - Don't use contact information from the suspicious message - Look up the organization's official phone number or website independently - Call or message through a verified channel - Ask: "Did you send me a message about \[topic\]?" *Example:* Your bank sends a text saying your account is locked. Don't click the link in the text. Instead, call the number on the back of your credit or debit card. ### Watch for Caller ID Spoofing Scammers can make their phone number appear as any number they want on your caller ID, including your bank, the IRS, or even your own number. **Protection:** - Don't trust caller ID alone - If someone claims to be from your bank or a government agency, get their name, the agency they claim to represent, and whatever topic identifier they can provide related to why you called, (ticket number, case number, incident number, etc) - Then hang up and call back using an official number (absolutely not one they offer to provide) - Real organizations won't mind you verifying their identity this way - Be extra suspicious of robocalls or calls demanding immediate payment ### Recognize Gift Card and Wire Transfer Scams **No legitimate organization will ever ask you to pay with gift cards or wire transfers.** Gift cards are untraceable, and both gift cards and wire transfers are non-refundable. That's why scammers love them. If someone asks for payment this way, it's a scam, **no exceptions**! ### Spotting Tech Support Scams Tech support scams come in many forms. Pop-up warnings with messages like "Your computer is infected! Call this number immediately!" These are fake. Real security warnings don’t give you a number to call. **Never call this number!** Close the browser tab and don’t go back. If it came from a site you think is legitimate, like your bank, notify them immediately. Cold calls are another type of scam. Someone claiming to be from Microsoft, Apple, your internet provider, or even from the FBI or local police, stating that they have detected a problem with your computer. They usually ask for remote access to “fix” the problem. What they want is access to your computer to install malware, steal files, or extort money for fake "repairs." Never give remote access to unsolicited callers. Real tech companies don't call you unsolicited about computer problems; hang up immediately. Block the number if they keep calling back. ### Watch for Impersonation on Social Media Scammers create fake profiles impersonating: - Your friends and family members - Company customer service accounts - Celebrities or other influencers **Red flags:** - New account or very few posts - Small changes in username (JohnSmith vs John\_Smith or JohnSmith1) - Requests for money or personal information - Messages from "customer service" accounts you didn't contact **Verification:** If a friend messages you with an unusual request, call or text them directly (not through the suspicious message) to verify. # 2.3 Identity and Cloud Account Safety *Core Concept: Protect Yourself, Protect Your Data* Your identity and your cloud accounts are two of your most valuable digital assets. Your identity can be used to open accounts, file fraudulent tax returns, and ruin your credit. Your cloud accounts, Google, Microsoft, Apple, hold years of emails, photos, documents, and are often the gateway to resetting passwords for everything else. A compromised identity or cloud account can create a cascading failure across your entire digital life. This section covers how to protect yourself. ## 2.3.1 Understanding the Risks **What is identity theft?** Identity theft is when someone uses your personal information, social security number, name, date of birth, address, etc, to impersonate you. **Common identity theft scenarios:** - Opening credit cards or loans in your name - Taking over existing accounts - Filing fraudulent tax returns to steal refunds - Creating fake IDs with your information - Using your insurance for medical care **How identity theft happens:** - Phishing emails and scam calls - Data breaches (companies losing your information) - Data brokers selling your information - Public WiFi snooping - Lost or stolen wallet - Mail theft (stealing statements, pre-approved credit offers) ## 2.3.2 The Basics - Guard your personal information - Review third-party app access - Configure account privacy settings - Shred sensitive documents ### Guard Your Personal Information **Do not ever give out any information to someone who calls you!** If you receive a call asking you to confirm your identity by providing personally sensitive information, explain that you do not provide this on a call you did not initiate. - Ask them for their name, who they represent, the purpose of the call, and a reference number so you can call back (do not accept a number they provide as valid) - Look up the number of your bank or other service on their official website or contact card (credit card companies have the fraud reporting numbers on the back) and call that number. - Do not continue to engage with the caller; if it is a legitimate call they will not threaten, coerce, or be upset at you verifying **Before you ever give sensitive, personal information out to anyone, ask these questions:** - "Why do you need this?" - "Is it required by law?" - "Can I use an alternative identifier?" - "How will you protect it?" ### Review Third-Party App Access Apps you've authorized can access your cloud account data. Review and revoke unnecessary access. **How to review:** **Google:** - myaccount.google.com > Security > Third-party apps with account access - Review each app, remove ones you don't use or recognize **Microsoft:** - account.microsoft.com > Privacy > Apps and services - Remove apps you don't use **Apple:** - appleid.apple.com > Sign-In & Security > Apps Using Apple ID - Stop using Apple ID for apps you no longer use Do this quarterly. ### Configure Account Privacy Settings Cloud providers collect extensive data about you. Limit what they collect and share. Do the same for social media accounts, such as facebook, instagram, etc. **Google:** - myaccount.google.com > Data & privacy - Web & App Activity: Consider turning off or auto-delete after 3 months - Location History: Turn off unless actively using - YouTube History: Auto-delete after 3-18 months - Personalized advertising: Turn off **Microsoft:** - account.microsoft.com > Privacy - Manage your activity data > Clear activity - Turn off diagnostic data sharing where possible **Apple:** - Settings > Privacy & Security (on each device) - Review Location Services, limit to "While Using" for most apps - Turn off "Share iPhone Analytics" - Turn off personalized ads ### Shred Sensitive Documents Physical documents can reveal your identity. **Documents to shred:** - Bank statements - Credit card offers - Medical records and EOBs - Tax documents (after 7 years) - Insurance documents - Anything with SSN, account numbers, or personal info **Shredder type:** Use cross-cut or micro-cut shredder, not strip-cut (too easy to reconstruct). ## 2.3.3 Better Protection ### Opt Out of Pre-Approved Credit Offers Pre-approved credit offers in the mail can be stolen and used to open accounts. **How to opt out:** - Call 1-888-5-OPT-OUT (1-888-567-8688) - Or visit optoutprescreen.com - Choose 5-year opt-out or permanent opt-out This reduces mail clutter and risk of identity theft ### Use Privacy Services for Online Signups Avoid giving your real email and phone number to every website. **Email masking:** - Firefox Relay [https://relay.firefox.com/](https://relay.firefox.com/ "https://relay.firefox.com/") - Apple Hide My Email (iCloud+ subscribers) - 10-Minute Mail [https://10minutemail.com/](https://10minutemail.com/ "https://10minutemail.com/") (temporary mailbox) **Phone masking:** - Google Voice for a free, US phone number - Use for non-critical signups, not banking or important accounts so you can refresh it periodically to keep spam calls and texts down ### Review Cloud Storage Sharing Make sure you're not unintentionally sharing files or folders. **How to check:** - Google Drive: drive.google.com > Shared with me / Shared (check both) - OneDrive: onedrive.com > Shared - Dropbox: dropbox.com > Sharing - iCloud Drive: icloud.com > iCloud Drive > Shared folders **What to look for:** - Public links you forgot about - Shares with old colleagues or friends - "Anyone with link" permissions ## 2.3.4 Extra Credit ### Opt Out of Data Brokers Data brokers collect and sell your personal information. You can opt out, but it's tedious. **Major data brokers:** - Spokeo, WhitePages, PeopleFinder, BeenVerified - Each has their own opt-out process - Search your name to see what's listed - Follow opt-out instructions for each site DeleteMe [https://joindeleteme.com](https://joindeleteme.com/ "https://joindeleteme.com") is a paid service that handles opt-outs (~$130/year) # 3. Your Devices # 3.1 Software and App Safety *Core Concepts: Minimize Your Exposure, Protect Your Data* Malware often disguises itself as legitimate software. A free game, a helpful utility, even a security tool can hide viruses, spyware, or ransomware. The software you install is one of the largest parts of your attack surface. Knowing what's safe to install, and what to avoid, is critical. ## 3.1.1 Understanding Software Risks Every piece of software you install increases your attack surface; the number of ways someone could compromise your system. Even legitimate software can have security vulnerabilities that attackers exploit. **Common ways malicious software spreads:** - Fake versions of popular software on download sites - "Free" versions of paid software (pirated/cracked) - Browser extensions that promise useful features - Mobile apps that look legitimate but aren't - Software bundled with other installations - Attachments in phishing emails **Think before you install.** Every piece of software is a potential security risk. Ask yourself: - Do I really need this? - Is this from a trustworthy source? - Have I checked reviews and permissions? - What's the worst that could happen if this is malicious? When in doubt, don't install it. ## 3.1.2 The Basics - Never use pirated software - Use official app stores - Verify download sources - Watch out for bundles - Understand app permissions ### Never Use Pirated Software **This cannot be emphasized enough: Pirated or "cracked" software is one of the most common ways to get infected with malware.** **Why pirated software is dangerous:** - The crack/keygen itself is often malware - No way to verify what's been modified in the software - Can't receive security updates - Often bundled with adware, spyware, or ransomware - You have no recourse if something goes wrong **Alternatives to piracy:** - Use free, open-source alternatives (LibreOffice instead of Microsoft Office, GIMP instead of Photoshop) - Use free versions or trials to see if you actually need the paid version - Look for student discounts or educational licenses - Use subscription services when available (often cheaper than buying outright) - Wait for sales and discounts ### Use Official App Stores Only App stores vet software before allowing it in their store. While not perfect, this dramatically reduces your risk. **Mobile devices:** - iPhone/iPad: Apple App Store only - Android: Google Play Store (avoid "sideloading" APK files unless you really know what you're doing) **Desktop computers:** - Windows: Microsoft Store or directly from the software maker's website - Mac: Mac App Store or directly from the software maker's website - Linux: Official repositories for your distribution (apt, yum, pacman, etc.) or directly from the software maker’s website **Avoid:** - Download sites like download.com, softonic.com, or similar aggregators - Torrent sites - Warez or "cracked software" sites - Pop-up ads claiming you need to download something - Email attachments claiming to be software updates **Other potentially useful software sites (use these with caution):** - Homebrew: Package manager for Mac and Linux - [https://brew.sh/](https://brew.sh/ "https://brew.sh/") - Open Source Initiative: Non-profit org dedicated to open source collaboration - [https://opensource.org/](https://opensource.org/ "https://opensource.org/") - Github: Open source software repo - [https://github.com](https://github.com/ "https://github.com") ### Verify Download Sources When downloading directly from a website instead of an app store, make sure you’re downloading from the official publisher **Steps to verify:** - Go directly to the software maker's website, don't use download buttons from search results or ads - Check the URL carefully, is it the real company website? - Look for HTTPS (padlock icon) in the address bar - Avoid third-party download mirrors unless they're official (like SourceForge for open source) *Example:* You want VLC media player. Search "VLC official download" and go to videolan.org (the real site), not vlc-player-download.com (fake). ### Watch for Bundled Software Some legitimate software tries to install additional programs during installation, toolbars, antivirus trials, browser plug-ins. **How to avoid unwanted software:** - Always choose "Custom" or "Advanced" installation, never "Express" or "Recommended" - Read every screen during installation - Uncheck boxes for additional software you don't want - Watch for pre-checked boxes that make the default "Install toolbar" or "Change homepage" - When in doubt, decline everything except the main program ### Understand App Permissions Permissions tell you what an app can access on your device. Always check permissions before installing. **Ask yourself: Does this make sense?** - Photo editing app wants camera access? Makes sense. - Flashlight app wants contacts and location? Suspicious. - Weather app wants location? Makes sense. - Calculator app wants microphone access? Suspicious. **Permissions to be extra careful about:** - Contacts - access to everyone in your address book - Location - where you are at all times - Camera/Microphone - can record you without indication - SMS/Phone - can read messages or make calls - Storage - access to all your files - Install other apps - can install malware If permissions don't make sense for what the app does, don't install it. ## 3.1.3 Better Protection - Review app permissions regularly - Uninstall unused applications and software - Keep software updated - Be careful with browser extensions ### Review App Permissions Regularly Apps can request additional permissions after installation. Review these periodically: **On iPhone:** - Settings > Privacy & Security - Check each category (Location, Contacts, Camera, etc.) - Revoke access for apps that don't need it **On Android:** - Settings > Privacy > Permission manager - Review each permission type - Remove permissions from apps that don't need them **On Windows:** - Settings > Privacy & security - Review Camera, Microphone, Location, and other permissions **On Mac:** - System Settings > Privacy & Security - Review each category and remove unnecessary access Do this review quarterly. ### Uninstall Unused Apps and Software Software you don't use is a security risk for no benefit. Every unused app is a potential vulnerability. **Monthly cleanup routine:** - Look through your installed apps - If you haven't used it in 3 months, uninstall it - You can always reinstall later if you need it - Don't keep trial software after the trial expires **How to properly uninstall:** - Windows: Settings > Apps > Installed apps > Select app > Uninstall - Mac: Open Applications folder, drag app to Trash, empty Trash - Mobile: Press and hold app icon, select "Remove" or "Uninstall" **Don't just delete the icon or folder:** Use the proper uninstall process to remove all components. ### Keep Software Updated Software updates fix security vulnerabilities. Delaying updates leaves you exposed to known exploits. **Enable automatic updates for:** - Operating system - Web browsers - Antivirus software - Mobile apps - Any software that handles sensitive data **For software without auto-update:** Check for updates monthly. Most programs have a "Check for updates" option in their menu. ### Be Careful with Browser Extensions Browser extensions have access to everything you do in your browser, every website you visit, everything you type, all your passwords. **Extension safety rules:** - Install from the official browser store only (Chrome Web Store, Firefox Add-ons, etc.) - Check the number of users - thousands or millions is better than dozens - Read reviews, especially recent ones - Only install extensions you truly need - Review installed extensions quarterly and remove ones you don't use - Be suspicious of extensions that were recently sold or changed developers **Red flags for extensions:** - Requests excessive permissions - Very few users or reviews - Recent reviews mention ads or changed behavior - Poor grammar in description ## 3.1.4. Extra Credit - Use a sandbox for unknown software ### Use a Sandbox for Unknown Software A sandbox is an isolated environment where you can run software without it affecting your main system. If the software is malicious, it's contained. **Sandbox options:** - Windows Sandbox (Windows 10/11 Pro): Built-in, creates a temporary isolated environment - Virtual machines (VirtualBox, VMware): Run a complete separate OS - Online sandboxes [https://hybrid-analysis.com](https://hybrid-analysis.com/ "https://hybrid-analysis.com") upload files for automated analysis This is advanced but very effective for testing questionable software safely. # 3.2 Mobile Device Hardening *Core Concepts: Protect Your Data, Minimize Your Exposure* Your phone carries more personal data than your computer ever did, photos, messages, contacts, emails, banking apps, location history, health data, and more. It goes everywhere with you, making it vulnerable to loss, theft, and unauthorized access. It's also constantly connected to the internet, making it a target for remote attacks. Mobile operating systems (iOS and Android) are designed with security in mind and include excellent built-in protections. The challenge is ensuring these features are enabled and properly configured. ## 3.2.1 Understanding Mobile Security Mobile devices face unique security challenges: - **Physical security:** Phones are easily lost or stolen - **Always connected:** Constant internet access means constant exposure - **App permissions:** Apps can access cameras, microphones, location, contacts - **Public networks:** Frequently connect to unsecured WiFi - **Personal data concentration:** Everything in one device This section covers both iPhone (iOS) and Android. Follow the instructions for your device, or both if you use multiple phones or tablets. ### Mobile Security Habits Beyond settings, develop these habits: - **Lock your phone every time you put it down:** Press the power button to lock manually - **Don't leave your phone unattended:** Even for "just a second" - **Be careful what you connect to:** Public charging stations can compromise phones (use your own charger with a power adapter) - **Avoid public WiFi for sensitive activities:** Use cellular data or a VPN for banking, shopping - **Review installed apps monthly:** Uninstall apps you don't use - **Don't jailbreak (iPhone) or root (Android):** This removes built-in security protections Your phone is your most personal computer. It knows where you go, who you talk to, what you buy, what you search for, and holds keys to your digital life. Protecting it isn't paranoia, it's common sense. Mobile platforms are pretty secure by default. You just need to enable the right settings, review permissions regularly, and develop good habits. Start with The Basics, add Better Protection over time, and remember, the most important security feature is the lock screen. Use it every time. ## 3.2.2 The Basics - Set a strong passcode - Enable Find My Device - Enable automatic updates - Review app permissions - Disable lock screen notifications for sensitive apps - Enable automatic backup ### Set a Strong Passcode and Enable Biometrics Your lock screen is your first line of defense. **iPhone:** - Settings > Face ID & Passcode (or Touch ID & Passcode) - Set up Face ID or Touch ID if you haven't already - Tap "Change Passcode" - Tap "Passcode Options" - Choose "Custom Alphanumeric Code" for strongest security - Or at minimum, choose "Custom Numeric Code" with 6+ digits - Avoid simple patterns like 123456 or repeating digits **Android:** - Settings > Security > Screen lock - Choose "Password" or "PIN" (6+ digits) - Avoid "Pattern" as these are easier to observe and guess - Set up fingerprint in Settings > Security > Fingerprint - Or face unlock (varies by device manufacturer) Biometrics are convenient for daily use, but the passcode is more secure against certain attacks (can't be compelled in court, can't be used while you're unconscious). See Understanding Biometrics in the Authentication topic. ### Enable Find My Device If you lose your phone, you need to be able to locate it, lock it remotely, and erase it if necessary. **iPhone (Find My):** - Settings > \[Your Name\] > Find My - Turn on "Find My iPhone" - Turn on "Find My network" (works even when offline) - Turn on "Send Last Location" (sends location before battery dies) - Test it: Open iCloud.com on a computer, sign in, click Find My iPhone **Android (Find My Device):** - Settings > Security > Find My Device - Turn it on - Make sure Location is enabled: Settings > Location > On - Test it: Visit android.com/find on a computer, sign in with your Google account ### Enable Automatic Updates Mobile OS updates fix security vulnerabilities. Enable automatic updates so you're always protected. **iPhone:** - Settings > General > Software Update - Tap "Automatic Updates" - Turn on "Download iOS Updates" - Turn on "Install iOS Updates" - Turn on "Security Responses & System Files" **Android:** - Settings > System > System update (location may vary by manufacturer) - Enable automatic downloads and installation - For Google Play apps: Open Play Store > Profile icon > Settings > Network preferences > Auto-update apps > Over any network ### Review App Permissions Apps request access to your camera, microphone, location, contacts, and more. Review what you've granted and revoke unnecessary permissions. **iPhone:** - Settings > Privacy & Security - Go through each category (Location Services, Camera, Microphone, Contacts, etc.) - Review which apps have access - Remove access from apps that don't need it - For Location: Use "While Using the App" instead of "Always" when possible **Android:** - Settings > Privacy > Permission manager - Review each permission type (Camera, Location, Microphone, etc.) - Tap each to see which apps have access - Change to "Don't allow" or "Ask every time" for apps that don't need constant access Do this review quarterly; apps update and request new permissions over time. ### Disable Lock Screen Notifications for Sensitive Apps Notifications on your lock screen can reveal sensitive information to anyone who glances at your phone. **iPhone:** - Settings > Notifications - Tap each sensitive app (banking, email, messaging, dating apps) - Turn off "Show on Lock Screen" - Or change "Show Previews" to "When Unlocked" **Android:** - Settings > Apps & notifications > Notifications - Tap each sensitive app - Turn off "Show on lock screen" - Or choose "Don't show notification content" ### Enable Automatic Backup If you lose your phone, you need your data backed up. Enable automatic cloud backup. **iPhone (iCloud Backup):** - Settings > \[Your Name\] > iCloud > iCloud Backup - Turn on "iCloud Backup" - Backs up automatically when plugged in, locked, and on WiFi - Free tier: 5GB (may need to purchase more storage for photos) **Android (Google Backup):** - Settings > Google > Backup - Turn on "Back up to Google Drive" - Select what to back up (app data, call history, contacts, etc.) - For photos: Open Google Photos app > Profile > Photos settings > Back up & sync > Turn on ## 3.2.3 Better Protection - Enable remote wipe capability - Use encrypted backups - Disable USB accessories when locked - Use one-time passwords for apps - Review location services settings - Turn off unused wireless features - Review privacy and tracking settings ### Enable Remote Wipe Capability If your phone is stolen and you can't recover it, you should be able to erase all data remotely. **iPhone:** - Already enabled with Find My iPhone (see Basics section) - To erase remotely: iCloud.com > Find My iPhone > Select device > Erase iPhone Note: After erasing, you can't track it anymore **Android:** - Already enabled with Find My Device (see Basics section) - To erase remotely: android.com/find > Select device > Erase device Note: After erasing, you can't track it anymore ### Use Encrypted Backups Cloud backups can be encrypted so even the backup provider can't access your data. **iPhone (Advanced Data Protection):** - Settings > \[Your Name\] > iCloud > Advanced Data Protection - Turn on Advanced Data Protection - This end-to-end encrypts most iCloud data (even Apple can't access it) - Important: Save your recovery key; if you lose it and your devices, your data is unrecoverable **Android:** - Google backups are encrypted in transit and at rest - For additional security, use third-party encrypted backup apps ### Disable USB Accessories When Locked USB accessories can be used to attack locked phones. Disable them when locked. **iPhone:** - Settings > Face ID & Passcode (or Touch ID & Passcode) - Scroll down to "Allow Access When Locked" - Turn off "USB Accessories" (requires unlocking to connect) **Android:** - Some phones have "Block USB connections while locked" under Settings > Security and Privacy > More Security Settings ### Use One-Time Passwords for Apps For email and other accounts accessed through apps, use app passwords instead of your main password. - Gmail, iCloud, and other services offer app-specific passwords - These passwords only work for that specific app - If your phone is compromised, revoke the app password without changing your main password - See the Use One-Time Passwords for Apps in the Authentication topic for more details ### Review Location Services Settings Location tracking is convenient but invasive. Review what's tracking you and when. **iPhone:** - Settings > Privacy & Security > Location Services - Review each app - Change apps to "While Using the App" instead of "Always" where possible - Turn off "Precise Location" for apps that don't need exact coordinates **Android:** - Settings > Location - Tap "App location permissions" - Review each app - Change to "Allow only while using the app" instead of "Allow all the time" ### Turn Off Unused Wireless Features Bluetooth, WiFi, and NFC create additional attack surfaces when not in use. - Turn off Bluetooth when not using wireless headphones or accessories - Turn off WiFi when out and about (prevents auto-connecting to malicious networks) - Turn off NFC (contactless payments) when not actively using it Use Control Center/Quick Settings for easy toggling. ### Review Privacy & Tracking Settings Apps and advertisers track your activity across apps and websites. Limit this tracking. **iPhone:** - Settings > Privacy & Security > Tracking - Turn off "Allow Apps to Request to Track" - Settings > Privacy & Security > Apple Advertising - Turn off "Personalized Ads" **Android:** - Settings > Privacy > Ads - Turn on "Opt out of Ads Personalization" - Settings > Google > Manage your Google Account > Data & privacy - Review "Activity controls" and turn off tracking you don't want ## 3.2.4 Extra Credit - Use separate work and personal profiles - Use secure folder / private space features - Enable advanced privacy features - Set up a SIM PIN - Use lockdown mode (iPhone) for high-risk situations ### Use Separate Work/Personal Profiles (Android) Android allows multiple user profiles or work profiles to keep personal and work data separated. This may already be a requirements and set up automatically depending on where you work and how you access work data on your phone. Contact your local IT center with any questions. - Settings > System > Multiple users - Add a user or work profile - Each profile has separate apps, data, and settings - Useful for: Separating work/personal, creating a "clean" profile for sensitive activities ### Use Secure Folder / Private Space Features Some phones offer encrypted, hidden spaces for sensitive apps and files. **Samsung Secure Folder:** - Settings > Security and privacy > Secure Folder - Encrypted space for apps, photos, files - Separate authentication from main phone **Google Private Space (Android 15+):** - Settings > Security & privacy > Private space - Hidden apps and data with separate authentication **iPhone:** - No built-in secure folder, but you can: - Use the Hidden album for photos (Settings > Photos > scroll down, turn on "Use Face ID" for Hidden album) - Use Notes app with password-protected notes ### Enable Advanced Privacy Features **iPhone (iOS 15+):** - Mail Privacy Protection: Settings > Mail > Privacy Protection (hides IP address and prevents tracking pixels) - Hide My Email: Settings > iCloud > Hide My Email (generate random email addresses for signups) - Private Relay: Settings > iCloud > Private Relay (Safari browsing privacy, requires iCloud+) **Android:** - Privacy Dashboard: Settings > Privacy > Privacy dashboard (see which apps accessed permissions recently) - Microphone/Camera indicators: Green dot appears when apps use camera/mic - Permission auto-reset: Settings > Privacy > Permission manager > (gear icon) > Remove permissions if app unused ### Set Up a SIM PIN A SIM PIN prevents someone from using your SIM card in another phone (protects against SIM-swap attacks). **iPhone:** - Settings > Cellular > SIM PIN - Turn on SIM PIN - Default is often 1234 - change it immediately **Android:** - Settings > Security > SIM card lock - Turn on "Lock SIM card" - Change from default PIN **Warning:** If you enter the wrong SIM PIN 3 times, you'll need a PUK code from your carrier to unlock it. Keep your carrier's customer service number handy. ### Use Lockdown Mode (iPhone) for High-Risk Situations Lockdown Mode is an extreme security mode for people facing serious targeted threats (journalists, activists, executives). - Settings > Privacy & Security > Lockdown Mode - Severely restricts functionality to protect against sophisticated attacks - Most people don't need this, only use if you're at genuine risk of targeted attacks # 3.3 Operating System Hardening *Core Concepts: Minimize Your Exposure, Protect Your Data* Your operating system is the foundation of your computer's security. Everything else, your applications, your files, your passwords, sits on top of it. A properly configured OS blocks most attacks before they can start. A poorly configured one leaves the door wide open. Modern operating systems have excellent security features built in. The challenge is that many of these features aren't enabled by default, or the default settings prioritize convenience over security. This section shows you how to configure your OS for better protection without making it unusable. ## 3.3.1. Understanding OS Security Operating system hardening means configuring your system to be more resistant to attacks. This involves: - Closing unnecessary entry points for attackers - Enabling built-in security features - Reducing what information your computer shares - Making it harder for malware to run or spread - Protecting your data even if your computer is stolen We'll cover Windows, macOS, and Linux. Skip to the section for your operating system, or read them all if you use multiple systems. ### Maintaining Your Hardened System OS hardening isn't a one-time task. Maintain your security: - **Monthly:** Verify updates are installing, review privacy settings, check firewall status - **Quarterly:** Review app permissions, startup programs, installed software - **After major OS updates:** Re-check privacy settings (they sometimes reset) - **When something breaks:** Document what you changed recently so you can undo it **Remember:** Security is about balance. If a setting makes your computer too difficult to use, you'll disable it or work around it, defeating the purpose. Find the right balance between security and usability for your needs. ## 3.3.2. The Basics - Enable automatic updates - Use an antivirus - Enable the built-in firewall - Enable full-disk encryption - Create separate accounts for each person - Lock your screen when not in use - Disable autoplay ### Enable Automatic Updates **This is the single most important thing you can do.** Unpatched vulnerabilities are responsible for roughly half of all data breaches. Software vendors release updates to fix security holes; if you don't install them, you're leaving known vulnerabilities exposed. **Windows:** - Settings > Windows Update > Advanced options - Turn on "Receive updates for other Microsoft products" - Under "Additional options" enable "Get the latest updates as soon as they're available" - Let Windows restart when needed - yes, it's annoying, but necessary **Mac:** - System Settings > General > Software Update - Click the info button (i) next to "Automatic updates" - Enable all update options: Check for updates, Download new updates, Install macOS updates, Install app updates, Install security responses **Linux:** - Ubuntu: Software & Updates > Updates tab > Check for updates: Daily - Enable "Install security updates automatically" - Other distributions: Configure your package manager for automatic security updates ### Use an Antivirus Modern operating systems come with built-in antivirus that's quite good. Make sure it's enabled and updating. Part of a defense in depth strategy. **Windows Defender:** - Settings > Privacy & security > Windows Security > Virus & threat protection - Verify "Real-time protection" is On - Verify "Cloud-delivered protection" is On - Verify "Automatic sample submission" is On - Run a quick scan occasionally There is some debate as to whether these are necessary for Mac and Linux. While Unix-based and Linux operating systems are generally more secure (Mac is Unix-based), they are not immune to viruses. There is also a rise in development of malware for Linux-based operating systems as their use becomes more common. Also, there is more to malware than just viruses, and most modern antivirus solutions are able to detect and block access to websites known to be infected, monitor system processes for evidence of ransomware, and detect malicious web traffic. Make a risk-based decision for yourself: Is the risk of dealing with leaked personal information and ransomware worth the tiny amount of system resources protection requires? Personally, I recommend Sophos as part of a defense-in-depth strategy. **Mac XProtect:** - Built-in and automatic, no configuration needed - Updates automatically with system updates **Linux:** - Linux malware is rare but not nonexistent - ClamAV is the most popular open-source antivirus for Linux - Install: sudo apt install clamav - Update: sudo freshclam ### Enable Built-In Firewall A firewall blocks unauthorized network connections to and from your computer. Every modern OS has one built in, make sure it's on. **Windows:** - Settings > Privacy & security > Windows Security > Firewall & network protection - Verify the firewall is "On" for all three network types: Domain, Private, and Public - If any show "Off," click them and turn the firewall on **Mac:** - System Settings > Network > Firewall - Turn on the firewall - Click "Options" and enable "Block all incoming connections" for maximum protection (note: this may interfere with file sharing and screen sharing, but you can add exceptions as needed **Linux:** - Ubuntu: Use UFW (Uncomplicated Firewall) - Open Terminal and type: sudo ufw enable - Check status with: sudo ufw status ### Enable Full-Disk Encryption Encryption scrambles your entire drive so no one can access your files without your password. If your laptop is stolen, your data is protected. This is especially important for laptops and any computer with sensitive information. **Important:** Back up your data before enabling encryption. While rare, problems during encryption can result in data loss. **Windows (BitLocker - Windows Pro or higher):** - Type "BitLocker" in the search bar - Click "Manage BitLocker" - Click "Turn on BitLocker" for your system drive (usually C:) - Choose how to unlock: password or USB key (password is more convenient) - Save your recovery key in a safe place (password manager, printed and stored in a safe) - Let the encryption process complete (can take hours, but you can use your computer) Note: Windows Home edition doesn't include BitLocker. Consider upgrading to Pro or using VeraCrypt (free, open-source alternative). **Mac (FileVault):** - System Settings > Privacy & Security > FileVault - Click "Turn On FileVault" - Choose whether to allow iCloud account to unlock the disk (convenient) or create a recovery key (more secure) - Save the recovery key if you create one (a password manager is a good place) - Restart when prompted **Linux (LUKS):** - Easiest to enable during installation - Most distributions offer "Encrypt this installation" option during setup - If already installed, encrypting requires backing up, reformatting, and restoring ### Create Separate Accounts for Each Person **Never share user accounts.** Each person should have their own account to provide security and privacy for everyone. **On computers:** - Create standard (non-administrator) accounts for children - Give each child their own username and password - Keep at least one admin account for parents only - Children will need parent approval to install software **Windows:** - Settings > Accounts > Other users > Add a user - If they are not going to sign into their Microsoft account (for OneDrive and O365 access) select “I don’t know this person’s sign-in information” - Then “add a user without a Microsoft account” - This creates a standard account, to provide admin rights select “change account type” once the account has been fully created - To add a child, Settings > Accounts > Family - Follow instructions to add a child to your Microsoft account - This automatically creates a standard account with parental controls **Mac:** - System Settings > Users & Groups > Add Account - Select "Standard" account type - For children, enable "Parental Controls" after creating the account ### Lock Your Screen When Not In Use Your screen should lock when you step away. This prevents someone from accessing your computer if you forget to lock it manually. On Windows use windows key + L; on Mac use command + control + Q; on Linux, use windows key + L (dependent on keyboard). You should also set your screen to automatically lock in case you step away and forget. **Windows:** - Settings > Personalization > Lock screen > Screen timeout settings - Set "On battery power, turn off after" and "When plugged in, turn off after" to 15 minutes or less - Settings > Accounts > Sign-in options > Require sign-in: Select "When PC wakes up from sleep" **Mac:** - System Settings > Lock Screen - Set "Start Screen Saver when inactive" to 15 minutes or less - Enable "Require password after screen saver begins or display is turned off": Immediately **Linux (Ubuntu):** - Settings > Privacy > Screen Lock - Enable "Automatic Screen Lock" - Set delay to 15 minutes or less ### Disable AutoPlay/AutoRun When you connect a USB drive or CD, your computer can automatically run files. This is dangerous as malware often spreads via USB drives. Turn off AutoPlay. **Windows:** - Settings > Bluetooth & devices > AutoPlay - Turn off "Use AutoPlay for all media and devices" - Or set all device types to "Take no action" **Mac:** - Finder > Settings > General - Uncheck boxes for external disks, CDs, DVDs showing on desktop or opening automatically **Linux:** - Ubuntu: Settings > Removable Media - Set all media types to "Ask what to do" or "Do nothing" ## 3.3.3. Better Protection - Review and minimize privacy settings - Configure user account control (Windows) - Enable antivirus and keep it updated - Disable unnecessary services (Windows) - Disable legacy network protocols (Windows) - Review startup programs ### Review and Minimize Privacy Settings Modern operating systems collect data about how you use your computer. Some of this is for diagnostics, some for targeted advertising. Review these settings and turn off what you don't need. **Windows:** - Settings > Privacy & security - Go through each category on the left and turn off what you don't need: - General: Turn off advertising ID, website language access, Start menu suggestions - Diagnostics & feedback: Choose "Required diagnostic data" (minimum) - Activity history: Turn off "Store my activity history" - Location: Turn off unless needed - Camera/Microphone: Review which apps have access, remove unnecessary ones - Review these periodically as Windows updates sometimes reset them or add more **Mac:** - System Settings > Privacy & Security - Review each category (Location Services, Analytics, etc.) - Turn off what you don't need - Review app permissions for Camera, Microphone, Contacts, etc. **Linux:** - Privacy concerns are generally less with Linux as most distributions don’t collect telemetry data by default - Ubuntu: Settings > Privacy ### Configure User Account Control (Windows) User Account Control (UAC) prompts you when programs try to make system changes. Make sure it is configured it to always notify you. - Type "UAC" in the search bar - Click "Change User Account Control settings" - Move the slider to the top: "Always notify" - Yes, this is slightly annoying, but it's also what stops malware from making unauthorized changes. ### Disable Unnecessary Services (Windows) Windows runs many background services. Some are necessary, others aren't. Disabling unused services reduces attack surface. **Safe services to disable for most users:** - Remote Registry - unless you manage computers remotely - Remote Desktop Services - unless you use Remote Desktop **How to disable:** - Type "services" in search bar - Find the service, right-click, select Properties - Change Startup type to "Disabled" - Click "Stop" to stop it now, then Apply/OK **Warning:** Only disable services you understand. When in doubt, leave it alone. ### Disable Legacy Network Protocols (Windows) Windows keeps old networking features for compatibility. You probably don't need them, and they're security risks. - Settings > Network & Internet > Advanced network settings > More network adapter options - Right-click your network adapter, choose Properties - Uncheck these if present: - Client for Microsoft Networks (unless on corporate network) - File and Printer Sharing (unless you share files on your network) - QoS Packet Scheduler - Link-Layer Topology Discovery items - Click OK - Repeat for each network adapter (WiFi and Ethernet) ### Review Startup Programs Programs that start automatically when you boot slow down your computer and can be security risks. Review and disable unnecessary startup items. **Windows:** - Press Ctrl+Shift+Esc to open Task Manager - Click "Startup" tab - Review the list - disable items you don't need running at startup - Keep: Antivirus, system utilities you use daily - Disable: Programs you rarely use, updaters, helper applications **Mac:** - System Settings > General > Login Items - Review the list and remove items you don't want to start **Linux:** - Varies by distribution and desktop environment - Ubuntu: Search for "Startup Applications" ## 3.3.4 Extra Credit - Create a guest account - Enable secure boot (Windows) - Encrypt external drives - Disabled SMB1 protocol (Windows) ### Create a Guest Account If friends or family need to use your computer, create a guest account with limited access. This protects your files and prevents accidental system changes. **Windows:** - Settings > Accounts > Family & other users > Add account - Choose "I don't have this person's sign-in information" - Choose "Add a user without a Microsoft account" - Create a "Guest" account as Standard User **Mac:** - System Settings > Users & Groups - Click + to add user - Select "Standard" account type - Name it "Guest" with no password (or simple password) ### Enable Secure Boot (Windows/Linux) Secure Boot prevents unauthorized operating systems and bootloaders from starting. It protects against bootkits and rootkits that load before Windows. - This is configured in your computer's UEFI/BIOS settings - Restart your computer and press F2, F10, Delete, or Esc during boot (varies by manufacturer) - Look for "Secure Boot" option in Security or Boot menu - Enable it - Save and exit Note: Some Linux distributions and dual-boot setups may have compatibility issues with Secure Boot. Verify that your distribution and hardware are compatible with secure boot before enabling. ### Encrypt External Drives If you store sensitive data on external drives or USB sticks, encrypt them too. **Windows (BitLocker To Go):** - Connect the external drive - Right-click the drive in File Explorer - Select "Turn on BitLocker" - Follow the wizard, save recovery key (and save in your password manager) **Mac:** - Connect the external drive - Right-click in Finder, select "Encrypt \[drive name\]" - Set a password **Linux:** - Use LUKS with cryptsetup - Or use VeraCrypt for cross-platform encrypted drives ### Disable SMBv1 Protocol (Windows) SMBv1 is an old file sharing protocol with known security vulnerabilities (like WannaCry ransomware). Disable it unless you need to connect to very old network devices. - Search for "PowerShell" - Right-click, select "Run as Administrator" - Type: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol - Press Enter - Restart when prompted # 3.4 Physical Security *Core Concepts: Minimize Your Exposure, Protect Your Data* All the passwords, encryption, and firewalls in the world won't help if someone can simply walk away with your laptop or peek over your shoulder to see your password. Physical security is often overlooked because we focus on digital threats, but physical access defeats almost all security measures. If someone steals your laptop, they have unlimited time to try to break your encryption or find vulnerabilities. If they watch you type your password once, they don't need to hack anything. Physical security is where digital security starts. ## 3.4.1. Understanding Physical Security Physical security covers protecting your devices and data from: - **Theft:** Devices stolen for resale or data access - **Loss:** Leaving devices behind or losing them - **Observation:** Shoulder surfing, hidden cameras - **Unauthorized access:** Someone using your unlocked device - **Physical tampering:** Hardware keyloggers, evil maid attacks - **Physical damage:** Accidents, water damage - **Improper disposal:** Data recovered from discarded devices The good news is most physical security measures are simple, inexpensive, and about habits more than technology. You don't need expensive equipment, you need to lock your screen every time, keep devices with you, and stay aware of your surroundings. ## 3.4.2. The Basics - Lock your screen every time - Be aware of your surroundings - Use device tracking features - Be cautions with public charging - Mark your devices ### Lock Your Screen Every Time **This is the single most important physical security habit.** Lock your screen whenever you step away from your device, even for a moment. Also, never leave devices unattended in public. It only takes a second for someone to pick it up. **Quick lock shortcuts:** - Windows: Windows key + L - Mac: Control + Command + Q (or close the lid) - Linux: Usually Ctrl + Alt + L (varies by desktop environment) - Phone: Press the power button ### Be Aware of Your Surroundings Shoulder surfing is when someone watches your screen or keyboard to see what you're typing. They could observe passwords, PINs, sensitive emails, etc. They do not have to be directly over your shoulder either, across the room with a cellphone camera is enough. To that point, even security cameras could inadvertently capture sensitive information. **How to protect yourself:** - Position your screen away from foot traffic - Sit with your back to a wall when possible - Be aware of people standing too close or paying too much attention - Shield your keyboard or phone when entering passwords or PINs - Reduce screen brightness in public - Don't do sensitive work (banking, confidential documents) on planes or in crowded spaces ### Use Device Tracking Features Enable Find My Device features on all your devices (covered in Mobile Device Hardening and OS Hardening sections). **What this enables:** - Locate lost devices - Lock devices remotely - Display a message on the lock screen with contact info - Wipe devices remotely if stolen **Test it now:** Make sure you can actually locate your devices before you need to. ### Be Cautious with Public Charging Stations Public USB charging stations (airports, hotels, conference centers) can be compromised with "juice jacking" attacks that install malware or steal data. **How to protect yourself:** - Use AC power outlets with your own charger (safest) - Carry a portable battery pack - Use a "USB condom," a device that blocks data transfer, only allows charging (~$10) - Use charge-only USB cables (no data wires) - If you must use public USB, turn off your device while charging ### Mark Your Devices Visibly marking your devices makes them less attractive to thieves (harder to resell) and easier to identify if recovered. Just don’t use anything which could make it a bigger taget, such as your name or a company logo. **Marking options:** - Engraving (most permanent) - Distinctive stickers or decals - UV marker with your contact info (invisible unless checked with UV light) - Asset tags (if company-issued, check with local IT for rules about additional marking) **What to mark:** - Bottom of laptop - Inside battery compartment (if removable) - Phone case - External hard drives **Document:** Keep a record of serial numbers and device identifiers. Take photos. Store this in your password manager or secure cloud storage. ## 3.4.3. Better Protection - Secure webcam and microphone - Use a cable lock for laptops - Use privacy screens ### Secure Webcam and Microphone Your webcam and microphone can be accessed by malware or accidentally left on during video calls. **Simple protection:** - Use a webcam cover (sliding covers cost a few dollars) - Or use a small piece of opaque tape - For microphones, consider a hardware mute button or unplug external microphones when not in use - Position your webcam to not show sensitive information in the background - Use a background filter for calls ### Use a Cable Lock for Laptops Cable locks (Kensington locks) physically secure your laptop to a desk or other fixed object. **When to use:** - In offices with foot traffic - Hotel rooms (lock to furniture or plumbing) - Dorm rooms - Anywhere you can't take the laptop with you **What to buy:** - Kensington lock cable (~$20-50) - Check that your laptop has a lock slot (most do) - Combination locks are more convenient than key locks (no key to lose) Note: Cable locks are deterrents, not absolute security. Determined thieves can cut cables or remove the lock slot, but they do reduce opportunistic theft. ### Use Privacy Screens Privacy screens are physical filters that narrow the usable field of view of your monitor. Some laptops have this feature integrated. HP has a featured called the Sure View integrated privacy screen which can be turned on and off using a keyboard shortcut. If your laptop does not have a built-in privacy screen, consider purchasing one if you frequently access sensitive data in public. **When to use:** - On planes or trains - In coffee shops - In open offices - Anywhere you work with sensitive information in public **What to buy:** - Laptop privacy screens: ~$30-60, measured to your screen size - Removable vs. permanent adhesive: removable is more flexible - Phone privacy screen protectors: ~$10-20 **Tradeoff:** Privacy screens reduce screen brightness and can make it harder to see in certain lighting. Worth it for sensitive work. # 3.5 Data Lifecycle and Disposal *Core Concept: Protect Your Data* Data doesn't just disappear when you delete it. When you click "delete" or throw a device in the trash, your personal information often remains completely recoverable. This section covers how to properly manage data throughout its entire lifecycle, from creation to destruction. Whether you're selling an old phone, donating a computer, recycling a hard drive, or just trying to clean up years of accumulated digital clutter, you need to know how to truly delete data so it can't come back to haunt you. ## 3.5.1 Understanding Data Lifecycle and Deletion Delete doesn’t mean “gone.” When you delete a file, your computer doesn't actually erase it, it just marks that space as "available for reuse." The data sits there, completely intact, until something else overwrites it. This might take days, months, or never happen at all. **Where your data lives:** - **Active files:** Documents, photos, videos you're currently using - **Trash/Recycle Bin:** Deleted files waiting to be permanently removed - **Free space:** Deleted files not yet overwritten, recoverable with tools - **Backups:** Local and cloud backups (Time Machine, iCloud, Google Drive) - **Cloud services:** Email, cloud storage, social media - **Device caches:** Temporary files, thumbnails, previews - **Other devices:** Printers, copiers, phones, tablets **Real-world consequences of improper disposal:** - Identity theft from recovered tax returns and financial documents - Private photos recovered from donated computers - Medical records from hospital equipment - Passwords and login credentials from old phones ## 3.5.2. The Basics - Factory reset devices before selling or donating - Delete old online accounts - Delete cloud data you don’t need ### Factory Reset Before Selling or Donating Devices Never sell, donate, or recycle a device without factory resetting it. **Before factory reset:** - Back up any data you want to keep (see Backups section) - Sign out of all accounts (iCloud, Google Drive, Microsoft OneDrive, etc.) - Right click icon on system tray (the icons around your clock) - Go to settings, or open and from the main window look for a way to log out (exit only closes the program on your computer, it does not sign you out) - Deauthorize device from all services (iTunes, Adobe, etc.) - Log into account through their website and view authorized devices; remove the device from the list - Remove active logins from all accounts (social media, email, etc) - Log into each service and view active devices; remove the device from the list - Remove device from Find My Device (see Mobile Device Hardening topic) - Remove SIM card and memory cards **How to factory reset:** **iPhone/iPad:** - Settings > General > Transfer or Reset iPhone > Erase All Content and Settings - Enter passcode and Apple ID password - Confirm erasure **Android:** - Settings > System > Reset > Factory data reset - Confirm and enter PIN/password **Windows:** - Settings > System > Recovery > Reset this PC - Choose "Remove everything" - Choose "Local reinstall" or "Cloud download" - Additional settings > "Clean data" (more secure but slower) **Mac:** - Sign out of iCloud: System Settings > Apple ID > Sign Out - Restart and hold Command+R to enter Recovery Mode - Disk Utility > Erase main drive (choose APFS or Mac OS Extended) - Reinstall macOS ### Delete Old Online Accounts Old accounts you no longer use still contain your personal data. Some accounts to review include: - Old social media profiles - Shopping sites you no longer use - Gaming services - Forums and community sites - Old email accounts **Before deleting account:** - Download any data you want to keep - Cancel any subscriptions or payment methods If you’re not sure how to delete an account (service provider instructions are not always clear) you can look up the site here: [https://justdeleteme.xyz/](https://justdeleteme.xyz/ "https://justdeleteme.xyz/") ### Delete Cloud Data You Don't Need Data in the cloud doesn't necessarily automatically delete when you delete it locally. Review your cloud data storage occasionally and remove any sensitive information to limit its exposure. Don’t forget to empty the trash, as cloud services often retain deleted items for 30+ days. ## 3.5.3. Better Protection - Use secure deletion tools - Check printers and copiers ### Use Secure Deletion Tools When disposing of a computer, if you have used it to store sensitive files, normal deletion isn't enough. Secure deletion tools overwrite the data multiple times. **Recommended tools:** - **DBAN:** [https://dban.org/](https://dban.org/ "https://dban.org/") - Free, boots from USB, wipes entire drive (DBAN only works with traditional hard drives (HDDs), not SSDs) - **Parted Magic:** [https://partedmagic.com/](https://partedmagic.com/ "https://partedmagic.com/") - Paid, includes secure erase for SSDs - **Manufacturer tools:** Many SSD makers provide secure erase tools **DoD 5220.22-M standard:** Overwrites data 7 times (for HDDs). Once considered necessary, now overkill; 1-3 passes is sufficient for HDDs. For SSDs, multiple overwrites are ineffective due to wear-leveling; use manufacturer's Secure Erase utility or ensure the drive was encrypted from the beginning. ### Check Printers and Copiers Many printers and copiers have internal storage that keeps copies of things you printed or scanned. **Before disposing:** - Check manual for how to clear memory/storage - Many have "Clear All Settings" or "Factory Reset" option - For office copiers with hard drives, remove and destroy the drive ## 3.5.4. Extra Credit ### Plan for Digital Legacy What happens to your data when you die? Plan for it. **Digital legacy planning:** - List all important accounts and where passwords are stored - Designate trusted person to handle digital affairs - Use your password manager's emergency access feature - Set up legacy contacts on Google, Apple accounts - Include digital assets in will **Services:** - Google Inactive Account Manager - Auto-delete or share after inactivity - Apple Legacy Contact - Designate someone to access your Apple account - Facebook Legacy Contact - Memorialize or delete account # 4. Network and Browsing # 4.1 Browser Hygiene *Core Concepts: Protect Yourself, Minimize Your Exposure* Your web browser and email are your primary gateways to the internet, and the primary ways attackers try to reach you. Most cyber attacks start with either a malicious website or a phishing email. Good browser and email hygiene can stop the vast majority of these attacks before they start. You don't need to be a technical expert. Most protection comes from recognizing common patterns, adjusting a few settings, and building good habits about what you click. ## 4.1.1. Understanding Browser Threats **Common browser threats:** - Malicious websites that install malware - Fake websites that steal passwords (phishing) - Malicious browser extensions - Tracking cookies and fingerprinting - Drive-by downloads (downloads that start without your permission) - Man-in-the-middle attacks on unsecured connections ## 4.1.2. The Basics - Use a modern browser - Look for HTTPS and the padlock icon - Check URLs carefully - Minimize browser extensions ### Use a Modern, Updated Browser Modern browsers have built-in security features that older browsers lack. Keep your browser updated to get the latest protections. **Recommended browsers:** - Google Chrome - Most popular, excellent security, but heavy on tracking - Mozilla Firefox - Good balance of security and privacy - Microsoft Edge - Good security, integrates with Windows - Safari - Best for Mac/iPhone users, good privacy - Brave - Privacy-focused, blocks ads and trackers by default **Enable automatic updates:** - Chrome/Edge: Updates automatically, restart when prompted - Firefox: Settings > General > Firefox Updates > Automatically install updates - Safari: Updates with macOS system updates ### Look for HTTPS and the Padlock Icon HTTPS encrypts the connection between your browser and the website. Always check for it, especially on sites where you enter passwords or payment information. **What to look for:** - Padlock icon in the address bar - "https://" at the start of the URL (not just "http://") - Modern browsers show "Not Secure" warning for HTTP sites **Warning signs:** - No padlock icon - "Not Secure" warning - Certificate error warnings - don't ignore these! **NEVER enter passwords or payment info on HTTP sites.** Close the site and find a secure alternative. ### Check URLs Carefully Before Clicking Attackers create fake websites with URLs that look almost right. Always verify URLs before clicking or entering information. **How to check URLs:** - Hover over links to see the actual URL (bottom left of browser) - Look for misspellings: "amaz0n.com" instead of "amazon.com" - Watch for extra words: "amazon-login.suspicious-site.com" - Check the domain name “https://amazon-login.suspicious-site.com/login” - Be suspicious of shortened URLs (bit.ly, tinyurl) from unknown sources **Common tricks:** - Character substitution: "paypa1.com" (number 1 instead of letter l) - Adding words: "secure-bankofamerica-login.com" **When in doubt, type the URL manually** rather than clicking links. ### Use Minimal Browser Extensions Browser extensions have access to everything you do in your browser. Only install extensions you truly need from trusted developers. **Extension safety rules:** - Install only from official browser stores - Check number of users (millions is better than dozens) - Read recent reviews - Review permissions ;if they seem excessive, don't install - Uninstall extensions you don't actively use **Recommended extensions:** - Password manager extension (all, good password managers have them, install from their site) - Privacy badger [https://www.eff.org/pages/privacy-badger](https://www.eff.org/pages/privacy-badger "https://www.eff.org/pages/privacy-badger") See the Software and App Safety section for additional extension guidance. ## 4.1.3. Better Protection - Configure browser for privacy - Use a privacy-focused search engine - Install a reputable add blocker ### Configure Browser for Privacy Browsers collect data about your browsing. Review and restrict this. **Chrome:** - Settings > Privacy and security - Turn on "Send a 'Do Not Track' request" - Cookies: Choose "Block third-party cookies" - Safe Browsing: Use "Enhanced protection" or "Standard protection" **Firefox:** - Settings > Privacy & Security - Enhanced Tracking Protection: Choose "Strict" - Enable "Tell websites not to sell or share my data" - HTTPS-Only Mode: Turn on for all windows **Safari:** - Settings > Privacy - Enable "Prevent cross-site tracking" - Enable "Hide IP address from trackers" ### Use a Privacy-Focused Search Engine Search engines track your searches and build profiles. Consider alternatives that don't track. **Privacy-focused options:** - DuckDuckGo: [https://duckduckgo.com/](https://duckduckgo.com/ "https://duckduckgo.com/") - Startpage: [https://www.startpage.com/](https://www.startpage.com/ "https://www.startpage.com/") - Brave Search: Privacy-focused, integrated with Brave browser **How to change default search:** - Chrome: Settings > Search engine > Manage search engines - Firefox: Settings > Search > Default Search Engine - Safari: Settings > Search > Search engine ### Install a Reputable Ad Blocker Ad blockers prevent malicious ads and reduce tracking. Choose carefully - some ad blockers themselves track you. **Recommended ad blockers:** - Privacy Badger - Made by EFF, learns to block trackers - uBlock Origin - Free, open-source, highly effective, no tracking **Avoid:** AdBlock, AdBlock Plus (these allow "acceptable ads," ads that pay them) ## 4.1.4. Extra Credit - Use a hardened browser - Use browser profiles or containers ### Use Hardened Browser For maximum privacy and security, use browsers with hardened default configurations. **Privacy-focused browsers:** - Brave - Chromium-based, blocks ads/trackers by default - LibreWolf - Firefox-based, pre-configured for privacy - Tor Browser - Maximum anonymity (but slow) **Advanced Firefox hardening:** - Use arkenfox user.js template - Disables telemetry, fingerprinting, and tracking - Warning: Can break some websites - not for beginners ### Use Browser Profiles or Containers Separate your browsing into different profiles or containers to isolate activities. **Browser profiles (Chrome/Edge/Brave):** - Create separate profiles for work, personal, shopping - Each has its own bookmarks, history, passwords, extensions - Prevents cross-contamination of tracking cookies **Firefox containers:** - Install "Firefox Multi-Account Containers" extension - Isolate sites into containers (Facebook, Banking, Shopping, Work) - Sites in one container can't see cookies from other containers # 4.2 Home Wifi Security *Core Concepts: Protect Your Data, Minimize Your Exposure* Your home WiFi network is the gateway to everything in your digital life, your computers, phones, tablets, smart home devices, security cameras, and more. A compromised network means all your devices are at risk. Worse, your neighbors or someone parked outside could be using your internet for illegal activities, and it would trace back to you. Securing your home WiFi doesn't require deep technical expertise. Most protection comes from changing a few default settings that take 15-30 minutes to configure. ## 4.2.1. Understanding WiFi Security Risks **Common WiFi threats:** - **Unauthorized access:** Neighbors or attackers using your WiFi without permission - **Traffic interception:** Attackers reading data sent over unsecured WiFi - **Man-in-the-middle attacks:** Attackers positioning themselves between you and the internet - **Router vulnerabilities:** Unpatched routers with known security holes - **Compromised IoT devices:** Smart devices used to attack other devices on your network - **Evil twin networks:** Fake networks that impersonate your WiFi ## 4.2.2. The Basics - Change your router’s default admin password - Use WPA3 or WPA2/WPA3 mixed mode - Create a strong WiFi password - Keep router firmware updated - Use a custom network name (SSID) ### Change Your Router's Default Admin Password **This is the single most important thing you can do.** Routers typically come with default passwords like "admin/admin" or "admin/password" that are publicly known. Anyone on your network can access your router's settings with these defaults. Some more modern routers like what you would get from your Internet Service Provider (ISP) may come with a unique password on a sticker on the back of the device. It is still a good idea to change this password. **How to access your router:** - Open a web browser - Type your router's IP address in the address bar - Usually 192.168.1.1 or 192.168.0.1 - Check the sticker on your router - Look it up online ([https://router-network.com/default-ip-addresses](https://router-network.com/default-ip-addresses "https://router-network.com/default-ip-addresses")) - Log in with the default credentials (check router manual, sticker, or [https://routerpasswords.com](https://routerpasswords.com/ "https://routerpasswords.com")) **Change the admin password:** - Look for "Administration," "Management," or "System" settings - Find "Change Password" or "Admin Password" - Create a strong, unique password (16+ characters) - Store it in your password manager - Save/Apply changes ### Use WPA3 or WPA2 Encryption WiFi encryption protects your wireless traffic from being read. WPA3 is the newest and most secure, but not all devices support WPA3 yet. WPA2/WPA3 (mixed mode) is fine if you have devices on your home network that don’t support WPA3. **How to enable:** - In router settings, look for "Wireless Security" or "WiFi Security" - Set Security Mode to: - WPA3-Personal (best, if available) - WPA2/WPA3 Mixed Mode (good compatibility) - Save changes **NEVER use:** - WEP - Completely broken, can be cracked in minutes - WPA1 (original) - Outdated and insecure - Open/None - Anyone can connect without a password ### Create a Strong WiFi Password Your WiFi password (also called the network key or passphrase) protects who can connect to your network. **Password requirements:** - Mix of letters, numbers, and symbols OR simple but long - Not your address, phone number, or birthdate **How to change:** - In router settings, find "Wireless Security" or "WiFi Password" - Enter your new strong password - Save/Apply - You'll need to reconnect all your devices with the new password **Tip:** Consider creating a passphrase from 4-5 random words: "Correct-Horse-Battery-Staple-47!" is both strong and easier to type on phones than random characters. ### Keep Router Firmware Updated Router firmware is like the operating system for your router. Manufacturers release updates to fix security vulnerabilities. **How to update:** - In router settings, look for "Firmware Update," "Router Update," or "Administration" - Check for updates - If available, click Update/Upgrade - Wait for update to complete (don't unplug router during update!) - Router will restart automatically **Enable automatic updates if available:** - Many modern routers can auto-update - Look for "Automatic Firmware Updates" setting - Enable it (likely already enabled by default) **If no auto-update:** Check manually every 3 months. ### Use a Custom Network Name (SSID) Your network name (SSID) shouldn't reveal your router model or personal information. **Why change it:** - Default names like "NETGEAR-5G" or "Linksys" tell attackers what router you have - Attackers can look up known vulnerabilities for that specific model - Makes your network easier to identify among neighbors **What NOT to use:** - Your name or address: "Smith Family WiFi" or "123 Main St" - Anything personally identifiable - Provocative or offensive names (neighbors can see it) **Good options:** - Random words: "BlueElephant" or "QuietMountain" - Numbers/letters: "Network7845" - Anything generic and non-identifying **How to change:** - Router settings > Wireless Settings > SSID or Network Name - Enter new name - Save/Apply - Reconnect devices to the new network name ## 4.2.3. Better Protection - Disable WPS (WiFi protected setup) - Set up a guest network - Disable remote management - Disable Universal Plug and Play (UPnP) - Review connected devices regularly ### Disable WPS (WiFi Protected Setup) WPS was designed to make connecting devices easier, but it has a critical security flaw that makes it easy to crack your WiFi password. **Why disable it:** - WPS PIN can be brute-forced in hours - Once cracked, attacker has your WiFi password - No legitimate reason to keep it enabled **How to disable:** - Router settings > Wireless or WPS settings - Find "WPS" or "WiFi Protected Setup" - Disable it (turn off) - Save/Apply ### Set Up a Guest Network A guest network gives visitors internet access without exposing your main network and devices. **Benefits:** - Guests can't see your computers, phones, or shared files - Infected guest devices can't spread malware to your devices - You can give out the guest password without compromising your main network - Can disable guest network when not needed **How to set up:** - Router settings > Wireless Settings > Guest Network - Enable Guest Network - Set a different SSID (network name): "Guest" or "Visitors" - Set WPA2/WPA3 encryption - Create a separate guest password (simpler than main network is OK) - Enable "Client Isolation" or "AP Isolation" if available (prevents guest devices from seeing each other) - Save/Apply **What to put on guest network:** - Visitor devices - Smart home devices (doorbell, thermostat, smart lights) ### Disable Remote Management Remote management allows you to access router settings from outside your home network. Unless you specifically need this, disable it. **Why disable:** - Opens your router to the entire internet - Attackers can try to access your router from anywhere - Most people never need this feature **How to disable:** - Router settings > Administration or Advanced Settings - Find "Remote Management" or "Remote Administration" - Disable it - Save/Apply ### Disable Universal Plug and Play (UPnP) UPnP allows devices to automatically open ports in your router. This is convenient but can be exploited by malware. **Why disable:** - Malware can use UPnP to open ports and bypass your firewall - Creates security holes without your knowledge - Most services work fine without it **How to disable:** - Router settings > Advanced Settings or WAN settings - Find "UPnP" or "Universal Plug and Play" - Disable it - Save/Apply Note: Some gaming consoles and P2P applications prefer UPnP. If you have issues, you can manually configure port forwarding instead, or enable UPnP again. ### Review Connected Devices Regularly Check what's connected to your network to spot unauthorized devices. **How to check:** - Router settings > Connected Devices, Attached Devices, or Device List - Review the list of connected devices - Look for: - Unknown device names - More devices than you expect **If you find an unknown device:** - Disconnect it from the router interface - Change your WiFi password immediately **Do this monthly:** Set a calendar reminder to review connected devices. ## 4.2.4. Extra Credit - Use VLANs to segment your network - Install a custom router ### Use VLANs to Segment Your Network VLANs (Virtual LANs) separate devices into isolated network segments. This is advanced but powerful. **Example segmentation:** - VLAN 1: Trusted devices (computers, phones) - VLAN 2: Smart home/IoT devices (can't access VLAN 1) - VLAN 3: Guest network **Benefits:** - Compromised IoT device can't access your computers - Better control over device communication - Improved network performance **Requirements:** - VLAN-capable router (not all consumer routers support this) - Managed network switch (if hardwired devices) - Technical knowledge to configure properly Note: This is advanced. Most people should use guest networks instead, which provide similar isolation with much easier setup. You will need to search online to contact an IT support person for specific instructions for your equipment. ### Install a Custom Router You can turn any PC into a custom router by installing open source router software, such as OPNSense. This is relatively advanced, so not for the faint of heart, but worth the effort if you are willing to learn a bit about networking and OK with spending a few hundred dollars for a truly secure, custom solution. You can view my guide on TheDen Home Network Runbook if you are curious about what is involved. # 4.3 Smart Home and IoT Devices *Core Concepts: Minimize Your Exposure, Protect Your Data* Smart home and other Internet of Things (IoT) devices make life convenient; smart speakers, security cameras, thermostats, door locks, light bulbs, refrigerators, and more. But these devices are often the weakest link in your home network. Many ship with poor default security, rarely get updated, and connect to the internet 24/7. A compromised smart device can become a gateway for attackers to access your entire network, spy on you through cameras and microphones, or recruit your devices into a botnet (an army of hacked devices used for cyberattacks). With some basic precautions, you can enjoy the convenience of smart devices without compromising your security. ## 4.3.1. Understanding IoT Security Risks **What are IoT devices?** Any device that connects to the internet but isn't a traditional computer or phone: - Smart home: Speakers (Alexa, Google Home), thermostats, light bulbs, plugs - Security: Cameras, video doorbells, smart locks, alarm systems - Entertainment: Smart TVs, streaming devices, game consoles - Appliances: Refrigerators, ovens, washing machines, robot vacuums - Wearables: Fitness trackers, smartwatches - Health: Baby monitors, medical devices **Common IoT security problems:** - **Weak default passwords:** Often "admin" or "12345" - **No security updates:** Many manufacturers abandon support after a couple years - **Always listening:** Smart speakers and cameras can be compromised for spying - **Excessive data collection:** Many devices send usage data to manufacturers - **No encryption:** Some send data unencrypted over your network - **Unnecessary features:** Open ports, remote access enabled by default **Real-world consequences:** - Hackers streaming from home security cameras - Smart speakers recording conversations and sending them to strangers - Compromised devices used in massive DDoS attacks (e.g., Mirai botnet) - Smart locks unlocked remotely by attackers - Baby monitors accessed by strangers You don't need to avoid IoT devices, they're useful and can make life easier. But treat them with appropriate caution. An IoT device is basically a tiny computer, running software, connected to the internet 24/7. Would you leave a computer with default password "admin" connected to the internet? No? Then don't do it with your TV either. ## 4.3.2. The Basics - Change all default passwords - Keep firmware updated - Disable unnecessary features - Review device permissions and privacy settings - Use strong authentication for device apps ### Change All Default Passwords Default passwords are publicly available and attackers scan for devices using them. **For each IoT device:** - Check if it has a default password (look in manual or on device label) - Log into the device's app or web interface - Find password/security settings - Change to a strong, unique password - Store password in your password manager ### Keep Firmware Updated IoT devices need security updates just like computers. Enable automatic updates where possible. **How to update:** - Open the device's mobile app - Look for Settings > About > Firmware or Software Update - Enable automatic updates if available - If not available, check for updates manually **For devices without apps:** - Check manufacturer's website for updates - May need to download and install manually **Create a quarterly reminder** to check for updates for your IoT devices that don't auto-update. ### Disable Unnecessary Features IoT devices often have features enabled by default that you don't need. Turn them off. **Common features to disable:** - **Remote access:** Unless you need to control devices away from home - **Cloud recording:** For cameras, use local storage if you can - **Voice purchasing:** On smart speakers (someone could order without your permission) - **Always-on microphones:** If you don't use voice commands - **Usage analytics:** Data sharing with manufacturer **How to find these:** - Device app > Settings > Privacy or Security - Look through all settings - Default to "off" or "disabled" for things you don't actively use ### Review Device Permissions and Privacy Settings IoT device apps request permissions on your phone. Review and restrict them. **Check app permissions:** - Phone Settings > Apps > \[IoT Device App\] > Permissions - Ask yourself: "Does my smart bulb app really need my location?" - Deny unnecessary permissions **Common unnecessary permissions:** - Smart bulb app requesting location (unless for automation) - Thermostat app wanting microphone access - Any device requesting contacts ### Use Strong Authentication for Device Apps The apps that control your IoT devices should have strong passwords and MFA. **For each device manufacturer account:** - Create unique, strong password (use password manager) - Enable two-factor authentication if available - Use different email for IoT accounts vs banking/primary email See the Authentication section for detailed password and MFA guidance. ## 4.3.3. Better Protection - Research before you buy - Put IoT devices on guest network - Use physical controls for cameras and microphones - Review smart speaker voice history ### Research Security Before Purchasing Not all IoT devices are created equal. Buy from manufacturers with good security track records. **Before buying, check:** - Does it receive regular firmware updates? - How long does manufacturer support it? - Does it require account creation or work locally? - Does it support WPA3 WiFi encryption? - Are there known security issues? (search "\[device name\] security vulnerability") - What data does it collect and where does it go? **Good signs:** - Manufacturer offers multi-year support commitment - Automatic firmware updates - Local control option (doesn't require internet) - End-to-end encryption for data - Two-factor authentication support **Red flags:** - Unknown or generic Chinese manufacturer - No firmware updates in 6+ months - Must have cloud account to function - Vague privacy policy - Price seems too good to be true ### Put IoT Devices on Your Guest Network IoT devices shouldn't have access to your computers and phones. Use your guest network to isolate them. **Why this matters:** - Compromised smart bulb can't access your laptop - Hacked security camera can't see your file shares - Infected smart TV stays contained **What to do:** - Set up guest network on your router (see Home WiFi section) - Connect IoT devices to guest network instead of main network - Keep computers, phones, tablets on main network **Exception:** Devices that need to communicate with your phone/computer (like Chromecast, AirPlay, or printer) may need to be on the main network. This is a tradeoff where you weigh convenience against security for each device. ### Use Physical Controls for Cameras and Microphones Cameras and microphones in IoT devices can be compromised. Use physical controls. **For cameras:** - Focus on entry points (doors, windows) not living spaces - For smart displays, use the physical camera cover if available - Tell guests if cameras are present - Use motion-activated recording instead of continuous - Store locally instead of cloud when possible - Set auto-delete for old footage (30 days is reasonable) - Enable encryption if available **For microphones:** - Many smart speakers have physical mute buttons; use them when you want privacy - Consider where you place always-listening devices ### Review Smart Speaker Voice History Smart speakers record your voice commands. Review and delete this history regularly. **Amazon Alexa:** - Alexa app > More > Settings > Alexa Privacy - Review Voice History > Filter by date - Delete recordings or enable auto-delete **Google Home:** - Google Home app > Settings > Google Assistant > Your data - Review and delete activity - Enable auto-delete for activity older than 3-18 months **Apple HomePod:** - Apple doesn't store Siri recordings by default - Check opt-in settings: Settings > Siri & Search > Siri & Dictation History ## 4.3.4. Extra Credit - Use local control instead of cloud - Use VLAN for advanced network segmentation ### Use Local Control Instead of Cloud Devices that work locally don't require internet and can't be compromised through manufacturer's cloud. **Local control options:** - Home Assistant - Open-source home automation platform - Hubitat - Local smart home hub - Devices with Zigbee or Z-Wave (don't require manufacturer cloud) **Benefits:** - Works even if internet is down - No dependency on manufacturer's servers - Devices still work if company goes out of business - More privacy, data stays in your home **Tradeoff:** More complex to set up and requires ongoing maintenance. Only recommended for technically comfortable users. ### Use VLANs for Advanced Network Segmentation VLANs provide the strongest isolation between IoT devices and your trusted devices. **VLAN segmentation example:** - VLAN 10: Trusted devices (computers, phones) - VLAN 20: IoT devices (smart bulbs, thermostats) - VLAN 30: Security cameras (complete isolation) - VLAN 40: Guest network **Firewall rules:** - IoT devices can access internet but not trusted devices - Trusted devices can initiate connections to IoT (for control) - Security cameras can't initiate any connections **Requirements:** - Managed router/firewall (OPNSense, UniFi, etc.) - Managed network switch (if using wired devices) - Technical knowledge to configure VLANs and firewall rules See the Home WiFi section for more on VLANs, of TheDen Home Network Guide. # 4.4 Virtual Private Networks (VPNs) *Core Concepts: Protect Yourself, Protect Your Data* VPNs are one of the most misunderstood security tools. They're marketed as making you "invisible online" which isn't true, but they do have legitimate, specific uses that can protect your privacy and security. This section cuts through the marketing hype to explain what VPNs actually do, when you need one, when you don't, and how to choose and use one effectively. ## 4.4.1. Understanding VPNs **What is a VPN?** A Virtual Private Network creates an encrypted tunnel between your device and a VPN server. All your internet traffic goes through this tunnel before reaching its destination. A VPN protects your network traffic from local snooping on public WiFi, but it does not make you anonymous or protect you from phishing or malware. Think of regular internet traffic like sending a postcard. Anyone handling it can read the message and see where it’s going. A VPN puts your postcards in sealed envelopes and sends them to a trusted friend (the VPN server) who opens them and sends them to their final destination. The recipient sees the message as coming from your friend, not you. **What VPNs DO:** - **Encrypts your traffic:** Prevents people between you and the VPN server from seeing what you're doing - **Hides your IP address:** Websites see the VPN server's IP, not yours - **Hides activity from your ISP:** Your internet provider sees you're using a VPN but not what you're doing - **Bypasses geographic restrictions:** Access content blocked in your location - **Protection on public WiFi:** Secure your connection on untrusted networks **What VPNs DON'T DO:** - **Make you anonymous:** Websites can still identify you through logins, cookies, and device fingerprinting - **Protect against malware:** You can still download viruses or visit phishing sites - **Prevent tracking:** Facebook, Google, etc. still track you when you're logged in **The trade-off:** VPNs add an extra step to your internet connection, which usually means slower speeds. You're trading some speed for privacy and security in specific situations. ### When You Should Use a VPN #### On Public or Untrusted WiFi This is the real reason for using a VPN. Use a VPN when connected to any open (unencrypted) WiFi network. An open WiFi network is any network you do not have to enter a network key to connect to. Note that captive portal sign-in is not the same thing. If you have ever connected to a network, then had to open a browser and sign in to get internet access, you were probably on an open network with a captive portal. A captive portal is a web page that appears when you connect to some WiFi networks (like at hotels or airports) requiring you to agree to terms or enter a password before accessing the internet. These do not offer any protection! When you connect to an open WiFi network, all other people on the network can potentially see what you are doing. This means a malicious person could also tamper with the data coming from or going to your device. A VPN encrypts all your traffic so they cannot. #### For Privacy from Your ISP Your internet service provider can see all the websites you visit. A VPN hides this. **Why you might want this:** - ISPs can sell your browsing history to advertisers (legal in the US) - ISPs may throttle certain types of traffic (streaming, gaming) - You don't trust your ISP with your browsing data **Keep in mind:** You're shifting trust from your ISP to your VPN provider. Choose your VPN provider carefully. ### When You DON'T Need a VPN #### To "Stay Anonymous Online" VPNs don't make you anonymous, this is marketing hype. You are still tracked based on the accounts you log into, browser and device fingerprinting, tracking cookies, and payment information. If you want more anonymity (for journalism, activism, etc.), you need specialized tools like Tor, not just a VPN. ## 4.4.2. The Basics ### Choose a Reputable VPN Provider **This is the most important decision.** A bad VPN provider is worse than no VPN as they can see and log everything you do. Avoid free tiers, as they make money by selling ads to you or your data to someone else. In fact, avoid any VPN that offers a free tier. **What to look for:** - **No-logs policy:** Provider doesn't keep records of your activity - **Independent audit:** Third-party verification of no-logs claims - **Strong encryption:** AES-256 or equivalent - **Kill switch:** Blocks internet if VPN disconnects so you don’t accidently disclose unencrypted internet traffic - **Based in privacy-friendly jurisdiction:** Not subject to invasive data retention laws - **Good reputation:** Positive reviews from independent tech sites My recommendation is Mullvad [https://mullvad.net/en](https://mullvad.net/en "https://mullvad.net/en"). ## 4.4.3. Better Protection ### Install On Your Phone Too (Tested with Mullvad, should be a similar process for others) **Android Setup:** - Install & Log In - Download from the Play Store - Log in or activate using your subscription code - Enable Always-on VPN + Kill Switch - Go to: Settings > Network & internet > VPN > \[Your VPN\] > Gear Icon - Toggle: Always-on VPN - Block connections without VPN (kill switch) - This ensures traffic only flows through the VPN when it’s meant to. - Configure Auto-Connect - In your VPN app: Settings > Auto-connect > On WiFi - Choose “Untrusted networks only”. - Add your home/work SSIDs to the Trusted Network List. - Use WireGuard - If offered, select WireGuard protocol for faster performance and quicker reconnections on unstable public WiFi. **iOS Setup:** - Install & Log In - Download from the App Store - Sign in or activate your account - Enable Kill Switch - In the VPN app, toggle “Kill switch” or “Permanent VPN” (name varies) - This is critical on iOS because background app behavior can otherwise leak traffic - Set Auto-Connect for Untrusted Networks - In the VPN app: Settings → Auto-connect → On WiFi - Choose “When joining unsecured networks” or “Untrusted networks only” - Add your safe networks (home/work) to the Trusted list - Allow VPN Configurations - First time you enable Auto-connect, iOS will prompt to install a VPN profile; approve it ## 4.4.4. Extra Credit ### Run Your Own VPN Server Advanced users can set up their own VPN server. **Options:** - Cloud VPS (DigitalOcean, Linode, Vultr) - ~$5/month - Home server (Raspberry Pi, old computer) - Use WireGuard or OpenVPN software **Benefits:** - Complete control; you're the VPN provider - No third party to trust - Access your home network from anywhere (if you host on your network) **Drawbacks:** - Doesn't hide activity from ISP (traffic still goes through your connection) - Single server location (wherever you host it) - Requires technical knowledge - You're responsible for security and maintenance Best for encrypting your traffic on a public WiFi or accessing your home network remotely, not for privacy from ISP or geographical restrictions. # 4.5 Travel Guide *Core Concepts: All Four* Travel introduces unique risks. Prepare before you go and stay vigilant while away. ## 4.5.1. Before You Leave - **Back Up Everything:** Full backup, test restore (see Backups topic) - **Enable and Test Find My Device:** Verify location tracking works (see Mobile Device Hardening and OS Hardening topics) - **Update All Devices:** OS, apps, firmware (see OS Hardening and Mobile Device Hardening topics) - **Know How to Remotely Wipe:** Review the process (see Mobile Device Hardening topic) - **Install and Test VPN:** Essential for public WiFi (see VPN topic) - **Enable Strong Lock Screens:** Not just biometrics (see Authentication and Mobile Device Hardening topics) - **Pack Cable Locks:** Physical security essentials (see Physical Security topic) - **Use RFID Blocking Sleeves:** for credit cards and passport - **Create Emergency Contacts List:** Nearest embassy if international, bank fraud numbers; print and store in luggage ## 4.5.2. During Travel - **Use VPN on All Public WiFi:** Hotels, airports, cafes (see VPN topic) - **Don’t Use Public USB Charging:** Use AC outlets with your charger (see Physical Security topic) - **Keep Devices With You:** Never in checked luggage (see Physical Security topic) - **Lock Screen Every Time:** Even for a moment (see Physical Security topic) - **Disable Auto-Connect WiFi and Bluetooth:** Prevent automatic connections to malicious networks (see Mobile Device Hardening topic) - **Be Aware of Shoulder Surfers:** Shield screen and keyboard (see Physical Security topic) - **Don't Use Hotel Business Center Computers For Sensitive Tasks** ## 4.5.3. At Border Crossings - **Power Off Devices Before Crossing:** Cold boot required to access encrypted storage (see OS Hardening topic) - **Consider Disabling Biometrics Temporarily:** Can be compelled to use (see Authentication topic) - **Know Your Rights:** Varies by country, research in advance ### Plan for Border Crossings International border agents can legally search devices in many countries. **Standard precautions:** - Turn off devices before border crossing (cold boot required to access encrypted drives) - Log out of all services and set back up after crossing - Uninstall social media apps, delete potentially sensitive text messages - Clear your browser’s cache - Consider changing important passwords after crossing if device was searched - Don't volunteer passwords or unlock devices unless legally required **High-security approach:** - Travel with a "clean" device containing minimal data - Access sensitive data through cloud services after crossing the border - Use a burner phone for international travel - Wipe device before travel, restore from backup after arrival # 5. Backups and Recovery # 5.1 Backups *Core Concepts: Protect Your Data, Have a Recovery Plan* You need backups BEFORE disaster strikes. Ransomware, hardware failure, theft, accidental deletion, fire, flood, or simple human error, any of these can wipe out years of photos, documents, and memories in seconds. The question isn't IF you'll need a backup, but when. ## 5.1.1. Understanding Backups A backup is simply a copy of your files stored somewhere other than your main device. If something happens to your computer or phone, you can restore your files from the backup. The key principles: - Automatic is better than manual - Multiple backups are better than one - Different locations are better than same location - Tested backups are better than untested ### The 3-2-1 Rule This is the gold standard for backups: - **3** copies of your data (the original plus two backups) - **2** different types of storage (e.g., removable drive, and cloud) - **1** copy offsite (cloud storage or at a different physical location) Don't let perfect be the enemy of good, even one automatic backup is better than none. ### Common Backup Mistakes to Avoid - **"I'll do it manually":** You won't. Automate it. - **"I'll do it later":** Do it now. Disasters don't wait. - **"My only backup is on the same desk as my computer":** Fire, flood, or theft takes both. - **"I've never tested my backup":** Hope is not a backup strategy. - **"I sync to the cloud, that's my backup":** Sync is not backup; if you delete something, it deletes from the cloud too. Use actual backup services. - **"I backup my whole computer including programs":** This is overkill and wastes space, just back up your data files. - **"I haven't checked my backup in months":** Backups fail silently. Check monthly. ### Quick Start Backup Plan If you do nothing else, do this today: - Buy an external hard drive (at least 2TB, costs ~$50-80) - Enable Time Machine (Mac) or File History (Windows) to back up to that drive - Enable iCloud Backup (iPhone) or Google Backup (Android) - Test restore one file - Set a calendar reminder to check backups monthly This gives you basic protection in 30 minutes. You can add cloud backup and other layers later. **Remember:** The best backup is the one that exists. A simple automatic backup you've tested beats a perfect backup plan you never implement. Start simple, then improve over time. ## 5.1.2. The Basics - Enable built-in backup tools - Know what you’re backing up - Back up your phone - Test your backups ### Enable Built-In Backup Tools Every modern operating system has a built-in backup feature. Turn it on right now: **Windows (Windows Backup):** - Open Settings > System > Storage > Advanced storage settings > Backup options - Connect an external hard drive (USB) - Turn on "Back up using File History" or "Back up my files" - Select what to back up (Documents, Pictures, Desktop, etc.) - Set frequency (daily is most likely the right balance) **Mac (Time Machine):** - Connect an external hard drive (USB or Thunderbolt) - Open System Settings > General > Time Machine - Click the + button and select your external drive - Turn on "Back Up Automatically" - Time Machine backs up hourly, keeps daily backups for a month, and weekly backups until the drive is full **Linux (varies by distribution):** - Ubuntu: Settings > System > Backups (uses Déjà Dup) - Connect external drive and select it as backup location - Enable automatic backups ### Know What You're Backing Up Make sure your backup includes: - Documents folder - Pictures/Photos folder - Desktop files - Downloads folder (if you keep important files there) - Any other folders where you store personal files You don't need to back up: - The operating system (you can reinstall it) - Applications (you can reinstall them) - Temporary files ### Back Up Your Phone Your phone probably contains more important data than your computer; photos, contacts, messages, and app data. **iPhone (iCloud Backup):** - Settings > \[Your Name\] > iCloud > iCloud Backup - Turn on iCloud Backup - It backs up automatically when connected to WiFi, plugged in, and locked - Free tier gives 5GB - you may need to buy more storage for photos **Android (Google Backup):** - Settings > Google > Backup - Turn on "Back up to Google Drive" - Enable "Photos & videos" backup in Google Photos app - Backs up over WiFi automatically - Free tier gives 15GB shared across Gmail, Drive, and Photos ### Test Your Backups **This is critical and almost everyone skips it.** A backup you haven't tested is just hope, not a backup. **How to test:** - Pick a file and rename it - Use your backup system to restore it - View the restored file and make sure it works - Did it work? Great! If not, troubleshoot now before you actually need it Test your backups at least twice a year. Set a calendar reminder. ## 5.1.3. Better Protection - Use encryption - Add cloud backup - Maintain external drive backups - Set a backup schedule - Backup before major changes - Monitor your backup storage ### Use Encryption If your backups contain sensitive information, encrypt them. **Why encrypt?** - If someone steals your external drive, they can't access your files - Cloud providers can't view your files (zero-knowledge encryption) - Protects financial records, medical information, and personal documents **How to encrypt:** - Mac Time Machine: Enable encryption when setting up the backup drive - Windows: Use BitLocker to encrypt the external drive (see OS Hardening section) - Cloud services: Look for "zero-knowledge encryption" or "client-side encryption" - Dedicated tools: Duplicati [https://duplicati.com/](https://duplicati.com/ "https://duplicati.com/") or Restic [https://restic.net/](https://restic.net/ "https://restic.net/") for encrypted backups **Critical:** Store your encryption password somewhere safe (password manager). If you lose it, your backup is useless. ### Add Cloud Backup If you back up to a removable drive, consider adding backups to a cloud service provider. Cloud backup stores your files on servers maintained by a company, accessible from anywhere with internet. This gives you the "offsite" component of the 3-2-1 rule. **Good cloud backup options:** *General purpose cloud storage:* - Google Drive: 15GB free, integrates with Android - iCloud: 5GB free, seamless with Apple devices - OneDrive: 5GB free, integrates with Windows - Dropbox: 2GB free, works on all platforms *Dedicated backup services (recommended):* - Backblaze: Unlimited backup for one computer, ~$9/month - Carbonite: Similar to Backblaze, ~$6-24/month depending on plan - IDrive: 5GB free, affordable paid tiers **Why dedicated backup services are better:** - They back up everything automatically, not just selected folders - They keep versions of files (so you can restore an older version) - They're designed for recovery, not just storage - They run continuously in the background ### Maintain Your External Drive Backup If you're using an external hard drive for backups: - Keep it plugged in so backups run automatically (but see ransomware note below) - Check monthly that backups are actually running; look at the backup software to see the last backup date - Replace the drive every 3-5 years, hard drives don't last forever **Ransomware consideration:** Some ransomware can encrypt external drives that are connected. To protect against this: - Have at least one backup that's disconnected or in the cloud - Or rotate two external drives, use one for a month, then swap it out and store it somewhere safe such as a fireproof safe ### Set a Backup Schedule Different types of data need different backup frequencies: - **Critical work documents:** Back up hourly or immediately (real-time cloud sync) - **Photos and personal files:** Back up daily - **Phone:** Back up daily (automatic when charging overnight) - **System settings:** Back up weekly or after major changes Most backup software handles this automatically once you set it up. ### Back Up Before Major Changes Always create a backup before: - Installing a major OS update - Upgrading to a new computer or phone - Installing new hardware (especially hard drives) - Major software installations that might affect system files - Disk repairs or reformatting ### Monitor Your Backup Storage Check regularly that you have enough space: - External drives: Should be at least 2x the size of what you're backing up - Cloud storage: Watch for "storage almost full" warnings - If you run out of space, backups may stop silently; check occasionally that new files are being backed up ## 5.1.4. Extra Credit - Own your cloud data - Implement true offsite backup - Create a disaster recovery plan ### Own Your Cloud Data When you use cloud services like Google Drive, iCloud, or Dropbox, your data lives on someone else’s computer. For most situations this is fine, it's convenient and reliable, but you give up some control. The company can change terms, raise prices, close accounts, or potentially access your files. If you want more control over your cloud storage, you can create your own personal cloud. **What "owning your cloud" means:** - Your files live on hardware or at least infrastructure you control - You can access them from anywhere, just like commercial cloud services - No storage limits except the size of your drives - Complete privacy, no company can access your files - Local cloud options have no monthly fee after additional purchase price **Basic options for personal cloud storage:** Network Attached Storage (NAS) - A NAS is essentially a specialized computer with hard drives that sits on your home network and provides storage to all your devices. **Beginner-friendly NAS options:** - Synology DiskStation (DS220+, DS224+): Easy to set up, excellent software, great for beginners. ~$200-300 plus drives. - QNAP: Similar to Synology, good interface. ~$150-400 plus drives. - Western Digital My Cloud: Simplest option, plug-and-play. ~$150-300 with drives included. **What you can do with a NAS:** - Automatic backup from all your computers and phones - Access files from anywhere via mobile apps or web browser - Stream photos, videos, and music to your devices - Share files with family members - Create your own personal Dropbox/Google Drive replacement **How difficult is it?** - Setup: 1-2 hours following the manufacturer's setup wizard - Ongoing maintenance: Minimal, mostly software updates - Technical skill needed: If you can set up a WiFi router, you can set up a NAS **Considerations:** - Initial cost: $300-600 depending on capacity - Your internet upload speed matters: If your home internet has slow upload speeds, accessing files remotely will be slow - You're responsible for drive failures: Buy drives rated for NAS use (WD Red, Seagate IronWolf) and set up RAID for redundancy - Power outages: Your NAS is at home, so if your power goes out, you can't access it remotely - Still need offsite backup: A NAS at home doesn't protect against fire, flood, or theft - you still need an offsite backup (cloud service or physical offsite drive) This gives you speed, control, and protection. **Bottom line:** Owning your cloud data isn't for everyone, but if you: - Have lots of data and don't want ongoing monthly fees - Want complete control over your files - Are comfortable with basic tech setup - Have good home internet then a personal NAS can be a great long-term investment. Otherwise, commercial cloud services are perfectly fine and often more reliable for non-technical users. ### Implement True Offsite Backup For maximum protection, keep a backup in a completely different physical location: **Options:** - Cloud backup (already covered in Better Protection) - External drive stored in a fire-proof safe, a bank safe deposit box, or at a friend or family member's house (swap drives monthly) Offsite backups protect against fire, flood, theft, and natural disasters that could destroy both your computer and local backups. ### Create a Disaster Recovery Plan Document your backup system so you (or someone helping you) can recover: **What to document:** - What backup services you use - Where external drives are stored - Login credentials for cloud services (stored in password manager) - Encryption passwords (stored in password manager) - Step-by-step instructions for restoring from each backup type - Who to call for help (tech-savvy friend or family member) Keep this documentation in your password manager and print a copy for your emergency kit. # 6. Incident Playbooks # 6.1 How to Use These Playbooks When you discover a security incident: 1. **Don't panic** - Take a breath; most incidents are recoverable if you act systematically 2. **Find the right playbook** - Match your situation to one of the scenarios below 3. **Follow the steps in order** - Steps are prioritized by urgency and importance 4. **Document everything** - Keep notes on what happened, when, what you did, who you spoke to 5. **Ask for help** - If you're overwhelmed, ask a tech-savvy friend or professional # 6.1 Account Compromise ### Compromised Email Account **Signs your email might be compromised:** - Can't log in / password doesn't work - Emails you didn't send in your sent folder - New forwarding rules or filters you didn't create - Password reset emails you didn't request - Even assuming the reset email is not a phishing attempt, this is not necessarily a major warning sign, but if you recieved a password reset email for a website or service and then lose access to that service it is possible someone used that email to reset your password - Contacts reporting spam from you **Step 1: Regain Control if Locked Out (IMMEDIATELY)** - Go to the email provider's recovery page - Use your recovery email or phone number to reset your password - If recovery fails, contact provider support immediately - Gmail: https://support.google.com/mail/answer/8253 - Yahoo/AOL: https://vzmmemberservices.secure.force.com/?fc=aolhelpus - Outlook/Hotmail: [https://account.live.com/password/reset](https://account.live.com/password/reset "https://account.live.com/password/reset") - Change password to a strong, unique password (20+ characters) - Store new password in your password manager - Remove ALL authorized devices from account settings - Re-add only your trusted devices **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number are correct - Update security questions (if applicable) with new answers - Enable MFA if not already enabled - If MFA is already enabled, remove all MFA devices and re-add only yours - Save new recovery codes in password manager **Step 3: Damage control (Within Hours)** - Check for and remove any email forwarding rules you didn’t create - Review sent folder for emails you didn’t send - Review recently deleted emails - Check for auto-replies or vacation responders you didn’t set - Alert contacts immediately if spam / phishing was sent from your account - Review inbox filters and labels for suspicious rules - Check for password reset emails from other services - If found, secure those accounts immediately (see relevant sections below) **Step 4: Additional Actions** - Monitor account daily for 1 week for suspicous activity - If sensitive information was accessed, consider notifying affected parties (contacts and calendar invites often contain sensitive information) ### Compromised Password Manager ***This is the worst-case scenario. Act fast!*** **Signs your password manager is compromised:** - Can't log in with your master password - Unauthorized devices in account settings - Notifications of success password changes you didn't initiate - Unfamiliar new entries or missing entries in your vault **Step 1: Regain Control (IMMEDIATELY)** - If you can still log in - Change master password - Remove ALL authorized devices - Re-add only your trusted devices - If locked out and recovery is available - Use your password manager’s account recovery process - Follow provider’s emergency access procedures - Once recovered, change master password - If locked out with no recovery - Create new password manager account **Step 2: Reset All Passwords In Your Vault (IMMEDIATELY – this takes time)** Assume every account in your vault is compromised. Work through tiers in order. For EACH account changed: 1. Change password to new unique password 2. Remove all authorized devices 3. Enable or verify MFA 4. Check recent activity 5. Verify security questions and recovery settings 6. Check for account-specific issues (email forwarding, rofile changes, etc) **Tier 1 – Immediately** - Password manager account itself (if recovered) - Recovery email addresses - All other email accounts **Tier 2 – Within 1 Hour** - Banks and credit unions - Investment accounts - PayPal, Venmo, payment processors - Credit card accounts **Tier 3 – Within 4 Hours** - Cloud storage (Google Drive, iCloud, OneDrive, Dropbox, etc) - Medical portals - Social media accounts (Facebook, Twitter, LinkedIn, etc) **Tier 4 – Within 12 Hours** - Shopping sites (Amazon, eBay, etc) - Gaming accounts (Steam, Xbox, Discord) - Streaming services (Netflix, Hulu, AppleTV, etc) **Tier 5 – Within 24 Hours** - Everything else **Step 3: Additional Actions** - Monitor all financial accounts daily for 1 week - Review credit reports for unauthorized activity - Consider placing fraud alert on credit reports - Document which accounts were in vault when compromised - File police report if identity theft of financial fraud occurred ### Compromised Financial Account (Bank, credit union, credit card, investment account, etc) **Signs of compromise:** - Unauthorized transactions - Can't log in / password doesn't work - Alerts about new devices or locations - New accounts or cards you didn't open - Unexpected credit inquiries **Step 1: Regain Control (IMMEDIATELY)** - Call the fraud number on the back of your card - Ask them to: - Freeze the account - Document the compromise - Issue new cards - Enable enhanced monitoring - Report known unauthorized transactions and explain you will call back after a full review - If you cannot log in, reset the password using recovery options - Once logged in, change the password to a strong, unique password - Store new password in your password manager - Remove ALL authorized devices from account settings - Re-add only your trusted devices **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number are correct - Update security questions (if applicable) with new answers - Enable MFA if not already enabled - If MFA is already enabled, remove all MFA devices and re-add only yours - Save new recovery codes in password manager - Verify linked external accounts - Review authorized card users **Step 3: Damage Control (Within Hours)** - Review all recent transactions (go back 90 days) - Document every transaction you didn’t make - Check for, document, and correct where possible: - New accounts opened in your name - Credit applications you didn’t submit - Chagned account settings (address, email, phone) - New beneficiaries or authorized users - For payment apps (Venmo, Paypal, etc) review sent messages for phishing attempts - Call the fraud line back and report all unauthorized activity **Additional steps**: - File a police report (required for most fraud disputes) - Place fraud alert on credit reports with all three bureaus: - Equifax: 888-766-0008 - Experian: 888-397-3742 - TransUnion: 800-680-7289 - Monitor credit reports monthly for 6 months - Consider credit freeze if multiple accounts were affected - Monitor affected financial accounts daily for 2 weeks ### Compromised Social Media Account (Facebook, Twitter/X, Instagram, LinkedIn, forums, etc) **Signs of compromise:** - Can't log in / password doesn't work - Posts you didn't make - Messages sent from your account - New friends or followers you didn’t send - Profile information changed - Friends reporting spam from you **Step 1: Regain Control (IMMEDIATELY)** - Use platform-specific recovery: - Facebook: facebook.com/hacked - Instagram: help.instagram.com - Twitter/X: help.twitter.com - LinkedIn: linkedin.com/help - Reset password using recovery email or phone - Once logged in, change the password to a strong, unique password - Store new password in your password manager - Remove ALL authorized devices from account settings - Re-add only your trusted devices - If you cannot recover your account: - Create new account and notify contacts - Ask friends to unfriend/unfollow compromised account **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number are correct - Update security questions (if applicable) with new answers - Enable MFA if not already enabled - If MFA is already enabled, remove all MFA devices and re-add only yours - Save new recovery codes in password manager - Check for connected accounts (e.g., "Sign in with Facebook" to other services) - Revoke access to third-party apps you don’t use **Step 3: Damage Control (Within Hours)** - Alert friends/contacts if spam was posted or sent - Post a public message explaining the compromise - Message close contacts directly - Review and delete posts you didn't make - Review and delete messages sent from your account - Check friend/follower lists for accounts you didn't add - Remove suspicious connections - Review profile information and undo any changes - Check privacy settings - Review tagged photos and posts **Step 4: Additional Actions** - Monitor account daily for 1 week for new suspicious activity - Report the compromise to the platform - If personal information was exposed, consider notifying affected individuals ### Compromised Cloud Storage Account (Google Drive, OneDrive, iCloud, Dropbox, etc) **Signs of compromise:** - Can't log in / password doesn't work - Files you didn't upload or share - Sharing notifications you didn't create - New devices accessing your files - Unusual storage usage **Step 1: Regain Control (IMMEDIATELY)** - Reset password using recovery email or phone - Change password to strong, unique password - Store new password in password manager - Remove ALL authorized devices and active sessions - Re-add only your trusted devices **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number - Update security questions if available - Enable or verify MFA - Save recovery codes in password manager - Revoke access to ALL third-party apps - Re-authorize only apps you actively use **Step 3: Damage Control (Within Hours)** - Review all shared files and folders and remove unauthorized users - Remove public sharing links you didn't create - Review recently accessed files for sensitive data exposure - Check for files you didn't upload and delete them - If you must open them to verify, download and perform a virus scan first! - Review deleted files folder for files you didn't delete - Check activity log for unauthorized downloads - If sensitive files were accessed: - Note which files (financial docs, passwords, personal info) - Determine what actions to take based on exposure (change passwords, notify affected parties) **Step 4: Additional Actions** - Download audit log if available (Google and Microsoft offer this, but availability varies by account type and region) - Monitor account daily for 1 week - If sensitive data was exposed, take appropriate action: - Financial documents - monitor accounts, consider credit freeze - Passwords - change affected passwords - Personal identification - consider identity theft protection - Review all devices with cloud app installed ### Compromised Shopping Account (Amazon, eBay, Etsy, etc) **Signs of compromise:** - Unauthorized orders - Can't log in / password doesn't work - New payment methods you didn't add - Changed shipping address - Gift cards purchased without your knowledge **Step 1: Regain Control (IMMEDIATELY)** - Reset password using recovery email or phone - Change password to strong, unique password - Store new password in password manager - Remove ALL authorized devices - Re-add only your trusted devices **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number - Update security questions if available - Enable or verify two-step verification - Save recovery codes in password manager **Step 3: Damage Control (Within Hours)** - Review ALL orders (including cancelled orders) - Cancel any unauthorized pending orders - Contact seller to cancel shipped unauthorized orders - Report unauthorized orders to platform - Review and remove unauthorized payment methods - Check for unauthorized gift card purchases or balances - Verify shipping addresses and remove unauthorized addresses - Review account balance or store credit for unauthorized changes - Check wish lists and shopping lists for changes - Review seller account for unauthorized listings (if you have one) **Step 4: Additional Actions** - Dispute unauthorized charges with credit card company - Monitor payment methods for unauthorized charges - File police report if fraud amount is significant - Contact platform customer service to document compromise ### If Any Other Account is Compromised **Signs of compromise:** - Unauthorized transactions - Can't log in / password doesn't work - Alerts about new devices or locations - Alerts about personal information updates - Account information changes you didn’t make - Notifications about password changes you didn’t initiate **Step 1: Regain Control (IMMEDIATELY)** - Use the site's password recovery to reset password - Change password to strong, unique password - Store new password in password manager - Remove ALL authorized devices and active sessions - Re-add only your trusted devices **Step 2: Update Security Settings (Within Minutes)** - Verify recovery email and phone number - Update security questions if available - Enable or verify two-step verification - Save recovery codes in password manager - Revoke access to all third-party apps (if applicable) - Re-authorize only apps you actively use (if applicable) **Step 3: Damage Control (Within Hours)** - Review recent account activity for unauthorized actions: - Purchases or transactions - Posts, messages, or comments - Profile or account information changes - Privacy setting changes - Friend/connection requests sent - Undo unauthorized changes - Delete unauthorized content - Alert contacts if spam/phishing was sent from your account - Review any sensitive data that may have been accessed - Check for linked accounts ("Sign in with..." connections) **Step 4: Additional Actions** - Report the compromise to the service provider - Monitor account daily for 1 week for suspicious activity - Review connected services, secure any that use this account for login - If financial loss occurred, file police report (also review Compromised Financial Account playbook) - Document the incident for your records - Consider whether any legal/regulatory notifications are required # 6.3 Personal Data Incidents ### Identity Theft **Signs of identity theft:** - Accounts or loans you didn't open appearing on credit report - Calls or mail from debt collectors about debts you don't owe - IRS notification of multiple tax returns filed in your name - Medical bills for services you didn't receive - Mail or email about accounts you didn't create - Missing mail or bills - Denied credit unexpectedly - Unauthorized withdrawals from bank accounts **Step 1: Contain the Damage (IMMEDIATELY)** - Place fraud alert on credit reports (call ONE bureau, they notify the others) - Equifax: 1-888-766-0008 - Experian: 1-888-397-3742 - TransUnion: 1-800-680-7289 - Fraud alert lasts 1 year, requires creditors to verify your identity - File FTC Identity Theft Affidavit - Go to [https://www.identitytheft.gov](https://www.identitytheft.gov/ "https://www.identitytheft.gov") - Click “get started” – you’ll be guided through a series of questions, have ready: - Personal information (name, address, SSN, DOB) - Details about the identity theft (what happened, when discovered) - Information about fraudulent accounts (account numbers, companies, amounts) - Any evidence you have (emails, bills, credit reports) - Review and submit - Download and print multiple copies (keep one safe as a backup) - This will be used for police reports and to legally contest any action taken against you on account of the identity theft - Get your credit reports - Request from all three bureaus immediately - Go to annualcreditreport.com (or one of your financial accounts) - Or request from the bureau you called for fraud alert - Review for accounts and inquiries you don't recognize - File police report - Contact local police department - Bring FTC Identity Theft Report - Request a copy of the police report - You'll need this for disputing fraudulent accounts **Step 2: Close Fraudulent Accounts (Within 24-48 Hours)** - For each fraudulent account found - Contact the fraud department of the company - Explain you're an identity theft victim - Provide your Identity Theft Report - Request the account be closed - Request fraudulent charges be removed - Ask for written confirmation - For fraudulent credit cards or loans - Request investigation - Provide police report and FTC Identity Theft Report - Follow company's fraud dispute process **Step 3: Secure Your Legitimate Accounts (Within 48 Hours)** - Change passwords on all financial accounts - Enable MFA on all accounts - Review recent activity on all accounts - Close accounts that were compromised **Step 4: Additional Actions** - Consider a credit freeze - More protective than fraud alert - Blocks new accounts from being opened - Free at all three bureaus - You can temporarily lift when applying for credit - Ongoing monitoring (6-12 months) - Review credit reports every 3 months - Monitor bank and credit card statements weekly - Watch for new collection calls or letters - Keep detailed records of all actions taken - Follow up on dispute resolutions - If tax fraud occurred - Contact IRS Identity Protection Specialized Unit: 1-800-908-4490 - File Form 14039 (Identity Theft Affidavit) - If medical identity theft - Contact your health insurance company - Request copies of medical records to review - Dispute incorrect information with providers ### Lost or Stolen Wallet or Purse **What's at risk:** - Credit/debit cards - Driver's license or ID - Social Security card (if you carry it - you shouldn't) - Insurance cards - Other identification documents **Step 1: Immediate Containment (IMMEDIATELY)** - Cancel all cards: - Call fraud departments for all credit and debit cards in wallet - Request new cards with new numbers - Note the date/time you report each card - Place fraud alert on credit reports (if ID was in wallet): - Call one credit bureau (see Identity Theft section above) - Check accounts for unauthorized charges - Review all recent transactions - Report unauthorized charges immediately **Step 2: Replace Documents (Within 24-48 Hours)** - Driver's license/ID: Contact your state DMV to report and replace - Social Security card: Contact SSA (don't carry SSN card in future) - Insurance cards: Contact providers for replacements - Other cards: Library, gym, membership cards - contact to cancel/replace **Step 3: Monitoring** - Monitor all financial accounts daily for 2 weeks - Review credit reports monthly for 3 months - Watch for fraudulent account openings - Save all documentation of reported theft ### Sent Money to a Scammer **Common scenarios:** - Wire transfer to scammer - Gift cards purchased and codes given - Cryptocurrency sent - Payment app (Venmo, PayPal, Zelle) transfer - Credit card payment to fake website **Step 1: Try to Stop the Payment (IMMEDIATELY)** Document everything: - How scammer contacted you - What they claimed - Timeline of events - Amount lost - All communications For wire transfers: - Contact your bank (fraud department) - Request wire transfer recall - Most effective within 24 hours - Provide details: amount, date, receiving bank For credit/debit card charges: - Contact card issuer fraud department - Request transaction be blocked or reversed - File dispute/chargeback - Request new card number For payment apps (Venmo, PayPal, Zelle): - Contact app support - Report unauthorized transaction - Request cancellation/reversal - Note: Zelle transfers are usually instant and irreversible For gift cards: - Contact gift card company (number on card) - Provide card numbers and receipt - Request freeze/cancellation - Success rate is low but worth trying immediately For cryptocurrency: - Generally irreversible - Report to exchange if applicable - Document transaction details **Step 2: Report the Fraud (Within 24 Hours)** - File FTC report [https://reportfraud.ftc.gov](https://reportfraud.ftc.gov/ "https://reportfraud.ftc.gov") - Creates official record - Helps track scam patterns - File police report: - Needed for most theft claims - Helps with bank/credit card disputes - Bring all documentation **Step 3: Protect Against Further Loss (Within 24 Hours)** - Place fraud alert on credit reports if you gave personal information - Monitor accounts daily for additional unauthorized charges ### Gave Out Personal Information Follow this playbook if you gave out high risk, personal information via email or to a caller in a conversation you did not initiate. **High Risk Personal Information:** - Passwords or PINs - Bank account numbers including any credit card data (number, CVV) - Social Security number or date of birth - Any answer you use in a security question **Step 1: Immediate Actions (Based on What You Shared)** - Passwords or PINs: Follow the appropriate account compromise playbook above - Bank account numbers or any credit card data: Contact fraud department on back of card, or call banking institution to stop any unauthorized pending transactions and have new card or account issued - Social security number or date of birth: Monitor credit report for any queries or new accounts and follow the Identity Theft playbook if anything shows up; consider a credit freeze regardless by calling one of the three credit bureaus (see Identity Theft playbook) - Any answer you use in a security question: Change the security question in all sites where it was used **Step 2: Monitor accounts daily for 2 weeks** If you see anything unusual, follow the appropriate playbook ### Clicked a Phishing Link or Opened Suspicious Attachment Your next steps are based on what you did, based on risk. **Low Risk** - If you ONLY clicked the link and did not enter any information or download any files, close the browser and clear your browser cache. - If you downloaded any files, and especially if you opened the file, delete the files and run a full virus scan (see Malware or Virus infection playbook below). **High Risk** - If you entered a password, follow the playbook for the appropriate type of compromised account above - If you entered any other personal information, follow the playbook for Gave out Personal Information based on the type of data you entered ### Received Notice of Data Breach This is when a company notifies you your data was exposed. **Common notification sources:** - Email from company - Letter in mail - News article about breach - Notification from HaveIBeenPwned.com **Step 1: Verify Notification is Legitimate (IMMEDIATELY)** Beware of phishing! Don't click links in breach notification emails, instead, verify using one of the following: - Go directly to company's website (type URL yourself) - Look for official breach notification page - Verify through news sources - Call company using official phone number **Step 2: Understand What Was Exposed (Within 24 Hours)** Read the notification carefully: - What specific data was compromised? - When did the breach occur? - What is the company doing? - What services are they offering (credit monitoring, etc.)? **Step 3: Take Action Based on Data Exposed (Within 48 Hours)** If passwords were exposed: Follow the playbook for the type of compromised account above If email address only: Not much you can do here, just understand you will likely start receiving a lot of spam and potentially phishing attempts, so be extra vigilant in the coming weeks and months. If Social Security number or financial data: - Place fraud alert on credit reports (see Identity Theft section) - Consider a credit freeze - Monitor credit reports monthly for 12 months - Enroll in credit monitoring if offered (only California requires this be offered at the time of this writing, but many companies will offer anyway in a show of goodwill) - Review financial statements going back to the date of the breach (US law requires you are notified, but the timeline for notification is somewhat of a gray area) If medical information: - Watch for fraudulent medical bills - Contact health insurance if fraudulent claims appear - Monitor credit reports monthly for 12 months **Step 4: Accept Company's Offer (If Valuable)** Many companies offer: - Free credit monitoring (usually 1-2 years) - Identity theft protection - Credit freeze assistance **Evaluate the offer:** - Is credit monitoring included? (worth it) - How long is coverage? (longer is better) - Do you have to pay anything? (should be free) - Read terms carefully before accepting **Step 5: Additional Actions** Document the breach: - Save notification letter/email - Screenshot relevant information - Note what data was exposed Monitor relevant accounts based on exposure and consider legal action if negligence was involved. Ongoing monitoring: - Check credit reports every 3 months for 1 year - Monitor financial accounts for suspicious activity - Watch for targeted phishing using your data - Stay alert for identity theft signs ### SIM Swap Attack **Signs of SIM swap:** - Phone suddenly has no service/signal - Can't make calls or send texts (even after reboot) - Notifications of password resets you didn't request - Unusual account activity alerts stop arriving - Carrier confirms your number was ported to new SIM **Step 1: Regain Control of Phone Number (IMMEDIATELY)** **Contact your mobile carrier:** - Call from a different phone or use online chat - Verify account activity and report unauthorized SIM swap if the agent determined your SIM card was ported - Verify your identity (have account PIN ready) - Request your number be restored to your SIM - Ask them to lock your account with additional verification **Step 2: Secure Accounts That Use Phone for 2FA (Within 1 Hour)** Attackers may have targeted accounts using SMS for two-factor authentication. Verify recent logins to new devices in the following priority: - Email accounts (especially recovery emails) - Financial accounts (banks, investment, PayPal) - Cryptocurrency exchanges - Social media accounts - Any other account using SMS for authentication If there was an unauthorized login, for each account: - Remove any new authorized devices that aren’t yours - Change password (from trusted device) - Remove SMS as 2FA if possible and replace with authenticator app or hardware key - Check recent activity for and perform damage control (see relevant playbook in Account Compromise above) - Enable login alerts if not already enabled # 6.4 Device Incidents ### Ransomware Infection **Signs of ransomware** - Files suddenly encrypted with unfamiliar extensions (.locked, .cerber, etc.) - Ransom note demanding payment for decryption - Desktop wallpaper changed to ransom message - Unable to open files (photos, documents, etc.) - Pop-up demanding Bitcoin payment **Step 1: Isolate the Infection (IMMEDIATELY)** - Disconnect from network - Do NOT shut down the computer (some ransomware encrypts more on reboot) - Unplug ethernet cable - Turn off WiFi - Disconnect external and network drives - Unplug any external hard drives, thumb drives, etc - Log out of any cloud accounts you have connected on your computer - Identify the ransomware variant - Take a photo of ransom note with phone - Note the file extensions (.locky, .cerber, etc.) - Visit ID Ransomware [https://id-ransomware.malwarehunterteam.com](https://id-ransomware.malwarehunterteam.com/ "https://id-ransomware.malwarehunterteam.com") to identify variant **Step 2: Assess and Report (Within 1 Hour)** Do NOT pay the ransom, there is no guarantee of file recovery and this funds criminal activity - Report to law enforcement (FBI) [https://ic3.gov](https://ic3.gov/ "https://ic3.gov") - Check if free decryption is available from ID Ransomware - Check what protections and warranties your antivirus solution offers - Additional potentially free options: - [https://nomoreransom.org](https://nomoreransom.org/ "https://nomoreransom.org") - [https://kaspersky.com](https://kaspersky.com/ "https://kaspersky.com") **Step 3: Recovery Options** If decryption is available from your assessment, follow the instructions. This differs by type of ransomware and who is providing instruction, so I cannot be more specific than that. If no decryption is available AND you have backups then performing a clean reinstall of your operating system is the way to go. Again, I cannot be more specific as there are too many variables. If you aren’t sure how to do this, ask a technical friend or visit somewhere that services computers (Microcenter, Best Buy, Apple Store, etc). If no decryption is available and you DON’T have backups, I’m sorry, you’re pretty screwed. From a clean computer, go through all your accounts and remove that computer as an authorized device. Under no circumstances should you boot this computer and connect to anything until it is clean. Keep an eye on the decryption assistance sites above, there may be something in the future that can help, or seek assistance from a professional service. ### Malware or Virus Infection (Not Ransomware) **Signs of malware infection:** - Computer running extremely slowly - Unexpected pop-ups or ads - Browser homepage changed without permission - Programs opening automatically - Antivirus disabled or won't update - Strange network activity - New toolbars in browser - Files disappearing or appearing - Excessive hard drive activity when idle **Step 1: Isolate The Infection (IMMEDIATELY)** - Disconnect from internet (unplug ethernet, disable WiFi), and log out of cloud accounts **Step 2: Scan and Remove (Within 1 Hour)** - Run a full scan using your installed antivirus software - If this fixes the issue, reconnect to the internet and continue to step 3 - Note that removing the virus will not restore settings which the virus changed, so you may need to follow steps 1 through 3 multiple times until the malware is removed and settings “stick” - If this does not fix the issue, boot the computer into safe mode - For Windows: Restart, hold Shift, select Troubleshoot > Advanced > Startup Settings > Safe Mode - For Mac: Restart, hold Shift key - Run full antivirus scan with your installed antivirus - If you do not have an antivirus and are running Windows, use Windows Defender Offline Scan - Settings > search for “virus and threat protection” > click “scan options” > choose “Microsoft Defender Anti-Virus (offline scan)” > click “Scan now” - If you do not have an antivirus and are using a Mac, you can look for a free scanner from Sophos, Kaspersky, Malwarebytes, or BitDefender - The options to run these vary, so follow the instructions - If this fixes the issue, reconnect your cloud accounts and continue to step 3 - If this does not fix the issue it is probably time to seek help from a technical friend or professional services **Step 3: Check for Damage (Within 24 Hours)** - Review your installed software and remove anything you didn’t install (Windows will show you the date installed so you can use that as a guide for when the malware behavior started) - Start > add or remove programs - Review browser extensions and remove anything suspicious - Browser settings > Extensions (varies by browser) - Check browser homepage and search engine settings, restore as needed - Browser settings > Homepage (varies by browser) - Browser settings > Search engine (varies by browser) - Check startup programs for unfamiliar entries - Windows: Settings > Apps > Startup - Mac: System settings > General > Login Items & Extensions **Step 4: Additional Actions** - Update operating system and all software - Determine how infection occurred: - Downloaded software from untrusted source? - Opened email attachment? - Clicked suspicious link? - Monitor accounts for any suspicious activity for a couple weeks If infection cannot be cleaned, contact your antivirus provider. Even if you don’t pay for the service they may still offer help. The worst-case scenario, make sure your backups are working and perform a clean reinstall of your operating system. If unsure how to do this, talk to a technical friend or seek professional services. ### Gave Remote Access to Your Computer **Common scenarios:** - Tech support scammer asked you to install remote access software - Downloaded and ran software that gave attacker control - Allowed access via TeamViewer, AnyDesk, LogMeIn, etc. **Step 1: Cut Off Access (IMMEDIATELY)** - Disconnect from internet (unplug ethernet cable or turn off WiFi) to stop access - Close remote access software, force close if necessary - Windows: Ctrl+Alt+Delete > Task Manager > End suspicious processes - Mac: Command+Option+Esc > Force Quit suspicious apps - Close any software they installed or opened - Uninstall any software they installed, booting into safe mode if necessary (safe mode prevents most malware from running) - For Windows: Restart, hold Shift, select Troubleshoot > Advanced > Startup Settings > Safe Mode - For Mac: Restart, hold Shift key - Uninstall remote access software: - Windows: Settings > Apps > Find TeamViewer/AnyDesk/etc. > Uninstall - Mac: Drag application to Trash, empty Trash **Step 2: Scan for Malware (Within 30 minutes)** - See Malware or Virus Infection playbook above - If you see anything that looks like it may be encrypting your files refer to Ransomware Infection playbook **Step 3: Additional Actions** - Consider what the attacker accessed - Follow the appropriate playbook if any sensitive information was accessed - Monitor accounts daily for a week ### What To Do If Your Phone or Computer Is Lost or Stolen Act quickly, the sooner you respond, the better your chances of recovery or protecting your data. **Step 1: Protect Your Data (IMMEDIATELY)** Use Find My Device (see Mobile Device Hardening or Physical Security section) to: - Locate your device - Play a sound (if nearby) - Lock it remotely with a message to call you at another number Suspend services and force logouts: If you had an authenticator app on your phone, you may lose MFA access, so you may need to use another device where the authenticator app is install or the recovery codes form your password manager. - Call your carrier (for phones) to suspend service (prevents calls and data charges) - Disable payment methods on device - Apple Pay: iCloud > Devices > remove the lost device from the list - Google Pay: pay.google.com - Samsung Pay: [https://v3.account.samsung.com/dashboard/](https://v3.account.samsung.com/dashboard/ "https://v3.account.samsung.com/dashboard/") > Devices - Force active device logout for all accounts (prevents someone who gains access from accessing any of your data) **Step 2: Erase and File Reports (Within 12 Hours)** If stolen or otherwise not recoverable: - Erase it remotely (see Mobile Device Hardening or Physical Security section) - File a police report (needed for insurance claims) - File insurance claim (if insured against theft) with the insurer (your mobile carrier, Apple, etc) **Step 3: Recovery** If device is recovered, before using: - Inspect for physical tampering (opened, different SIM) - Check for new apps you didn't install - Review recently accessed files and folders - Check settings for changes: - New accounts logged in - Developer options enabled (Android) - Unknown device profiles (iPhone) - New email forwarding rules - VPN or proxy configurations - Accessibility permissions changes If suspicious changes found, factory reset the device and proceed as if setting up a new device. # 7. Reference # 7.1 Maintenance Checklists ### Monthly Checklist Time Required: ~30 minutes **Backups** - Verify your computer backup completed successfully (check last backup date) - Verify your phone backup completed successfully - Check backup drive has sufficient free space - For cloud backups, verify storage isn't full - Check password manager is syncing properly across devices **Network Security** - Review devices connected to your home WiFi - Remove any unknown or unauthorized devices - Disconnect them and reset your WiFi password - Do this at a time when convenient to reconnect all other devices on your network - Check router firmware is up to date **Software & Updates** - Verify automatic updates are still enabled on all devices - Check for pending updates and install if needed ### Quarterly Checklist Time Required: ~1-2 hours **Account Security Review** - Review authorized devices on critical accounts (email, banking, cloud storage) - Remove old/unrecognized devices from authorized lists - Check recent login activity on important accounts - Verify recovery email addresses and phone numbers are current - Check [https://haveibeenpwned.com](https://haveibeenpwned.com/ "https://haveibeenpwned.com") to see if any of your accounts have been compromised **Device Maintenance** - Review installed applications on computers and mobile devices - Remove apps you no longer use or recognize - Review app permissions on computers and mobile devices - - Revoke permissions from apps that don't need them - Check privacy settings haven't been reset by updates (Windows, Mac, phone) - Run full antivirus scan on computers - Review third-party app access to Google/Microsoft/Apple accounts - Review browser extensions and remove unused ones - Review startup programs on computers, disable unnecessary ones - Check for firmware updates on smart home devices ### Annual Checklist Time Required: ~2-3 hours (can be spread across multiple sessions) **Comprehensive Account Audit** - Delete online accounts you no longer use (through their website before you delete the password from your password manager) - Use the password manager’s tools to check for reused passwords and update them - Review recovery options and updated as needed **Backup & Recovery Testing** - Perform a test restore of at least one important file from backup - Test "Find My Device" on all phones and laptops - Review and update your emergency contact list - Update digital legacy planning (who gets access if something happens to you) - Review external backup drives, consider replacing if 3-5+ years old **Privacy Review** - Review and adjust privacy settings across all cloud platform accounts - Review smart device voice history and delete (Alexa, Google Home) - Opt out of data broker sites (or renew opt-outs) # 7.2 Glossery
**Term** **Definition**
**3-2-1 Rule** A backup strategy: keep 3 copies of your data, on 2 different types of storage, with 1 copy stored offsite (like in the cloud).
**Account recovery** The backup ways to prove an account is yours (like a recovery email, phone number, or recovery codes) if you forget your password or lose your phone.
**Admin account** A computer account that can install software and change system settings. Use it rarely.
**Adware** Unwanted software that shows ads or tracks you for ads.
**Antivirus** Software that looks for and blocks malicious software (malware). Built‑in options are usually enough when combined with updates.
**Attack Surface** The sum of the attack vectors where an attacker can attempt an attack.
**Authenticator app** An app that generates time‑based codes for multi‑factor authentication (MFA). Works even without cell service.
**Backup** A second copy of your files you can restore if your device is lost, stolen, damaged, or encrypted by ransomware.
**Biometric** Using your body (fingerprint, face) to unlock a device or app.
**BitLocker / FileVault / LUKS** Full-disk encryption tools built into operating systems. BitLocker (Windows), FileVault (macOS), and LUKS (Linux) scramble your entire hard drive so data can't be accessed without your password.
**Botnet** A network of infected devices controlled by attackers to launch coordinated cyberattacks, send spam, or mine cryptocurrency without the owners' knowledge.
**Browser extension** A small add‑on to your web browser. Only install ones you truly need and trust.
**Caller ID spoofing** When scammers fake the phone number that appears on your caller ID to make it look like a call is from your bank, the IRS, or another trusted source.
**Captive portal** The web page that appears when you connect to some WiFi networks (like at hotels or airports) requiring you to agree to terms or enter a password before accessing the internet.
**Cloud** Someone else's computers you access over the internet (like iCloud, Google Drive, OneDrive).
**Data breach** When sensitive information is stolen from a company or organization's systems, often exposing passwords, emails, credit card numbers, or personal data of users.
**DDoS attack** Distributed Denial of Service attack. When many compromised devices flood a website or service with traffic to overwhelm it and make it unavailable.
**Default gateway** The IP address of your router. Your computer uses this to access the internet and other networks.
**Encryption** A way to scramble data so only someone with the right key can read it. Examples: FileVault (macOS), BitLocker (Windows), built‑in encryption on iPhone and Android.
**End‑to‑end encryption (E2EE)** Only the sender and receiver can read messages; even the service provider cannot.
**Firewall** A security feature that controls which network traffic is allowed. Your router and computer have one built in.
**Firmware** The permanent software programmed into a hardware device (like a router or smart device) that controls how it operates. Like an operating system, but specifically for that device.
**Guest network** A separate wireless network for visitors and untrusted devices that keeps them isolated from your main network, computers, and files.
**IoT (Internet of Things)** Any device that connects to the internet but isn't a traditional computer or phone, like smart speakers, thermostats, security cameras, or smart light bulbs.
**IP address** Internet Protocol address. A unique number assigned to each device on a network that identifies it, like a street address for your computer or phone.
**ISP** Internet Service Provider. The company that provides your internet connection (like Comcast, AT&T, Verizon).
**Keylogger** Malicious software that records everything you type on your keyboard to steal passwords and sensitive information.
**Kill switch (VPN)** A VPN feature that automatically blocks all internet traffic if the VPN connection drops, preventing your data from being exposed.
**Malware** Malicious software designed to harm, spy, or steal (viruses, ransomware, spyware, trojans).
**Multi‑factor authentication (MFA)** Adding a second step to log in (like a code or prompt) so a stolen password alone is not enough.
**Operating system (OS)** The main software that runs your device (Windows, macOS, Linux, iOS for iPhone, Android).
**Passkey** A newer, phishing-resistant sign-in method that uses cryptography instead of passwords. Passkeys are stored on your device and use biometrics or a PIN to unlock, but the biometric data never leaves your device.
**Passphrase** A longer, easy‑to‑remember password made of several words.
**Password manager** A secure app that creates and stores unique passwords for every account.
**Phishing** A fake message (email/text/DM) that tries to trick you into clicking a link, opening an attachment, or sharing a code or password.
**PIN** Personal Identification Number. A numeric password, typically 4-6 digits, used to unlock devices or authenticate transactions.
**Quishing** QR code phishing. A scam using QR codes in emails or texts to trick you into visiting fake websites that steal your information.
**Ransomware** Malware that locks your files and demands payment to unlock them.
**Recovery codes** Backup codes provided when you enable multi-factor authentication that let you access your account if you lose your phone or authenticator app.
**Remote wipe** Erasing a lost or stolen device over the internet.
**SIM‑swap** A criminal moves your phone number to their SIM card to receive your text messages and calls.
**Social engineering** The art of manipulating people into giving up confidential information or taking actions that compromise security. Attackers exploit human psychology (trust, fear, urgency) rather than technical vulnerabilities.
**Software update** A fix or improvement for your device or app. Turning on automatic updates closes security holes.
**SSID** Service Set Identifier. The name of your wireless network that appears when you search for available WiFi networks.
**UPnP** Universal Plug and Play. A feature that lets devices automatically open ports in your router. Convenient but can be exploited by malware to bypass your firewall.
**URL** Uniform Resource Locator. The web address you type into your browser (like [https://www.example.com](https://www.example.com/ "https://www.example.com/")).
**USB** Universal Serial Bus. The common rectangular port and cable used to connect devices like keyboards, mice, external drives, and phones to your computer.
**Virtual private network (VPN)** A service that encrypts your internet traffic and routes it through the VPN provider. Useful on public Wi‑Fi; not a magic invisibility cloak.
**VLAN** Virtual Local Area Network. A way to separate devices on a network into isolated groups so they can't communicate with each other, improving security and organization.
**WEP / WPA / WPA2 / WPA3** WiFi security protocols. WPA3 is the newest and most secure, WPA2 is older but still secure, WPA (original) is outdated, and WEP is completely broken and should never be used.
**WPS** WiFi Protected Setup. A feature designed to make connecting devices easier using a PIN, but it has security flaws that make it easy for attackers to crack your WiFi password.
**Zero-knowledge encryption** Encryption where even the service provider cannot access your data because they never have your encryption keys. Only you can decrypt your files.