1.2 Core Concepts

Everything in this guide flows from these four concepts. Keep them in mind and most day‑to‑day decisions get simpler.

Protect Yourself

• Be a skeptic. Treat unexpected links, attachments, and “urgent” requests as suspicious; verify using a separate channel you trust.

• Use strong, unique passwords for each site and application.

• Use a password manager with a long master passphrase, and use it to generate unique passwords everywhere.

• Turn on security alerts for new logins and password changes.

• Turn on multi‑factor authentication (MFA) wherever possible and store recovery codes safely.

• Prefer passkeys where offered (a phishing‑resistant sign‑in method).

• Use a virtual private network (VPN) on public or untrusted WiFi networks.

Protect Your Data

• Keep everything updated; your operating system (OS), software, and mobile applications.
• Only install software from trusted sources such as official app stores and directly from software vendor websites.
• Lock your screen when you step away.
• Use encryption. Every modern, major OS has this built-in. Include external drives if they hold sensitive files.
• Configure data backups automatically and test restores so you know recovery works.
• Secure your home Wi‑Fi with WPA2/WPA3 protocols, using a strong admin password, and segregate less trustworthy devices.

Minimize Your Exposure

• Install less software and keep your browser lean with only a few, trusted extensions. Uninstall unused apps and remove extensions you don’t recognize. Fewer apps = fewer problems.

• Don’t overshare. Review application and website permissions, turn off ad and diagnostic sharing you don’t need.

• Use standard (non‑administrator) accounts for daily use; approve admin prompts intentionally when making system changes.

Have a Recovery Plan

• Find, lock, and wipe; know how to locate and remotely erase your laptops and mobile devices. Test “Find My Device” features.

• Keep an emergency kit with backup codes, recovery emails and phone numbers, know where backups live, and who to call if you need help such as bank fraud reporting numbers.

• This runbook provides some printable guides on how to respond and recover from some common incidents in the Incident Playbooks section. Feel free to print them out and keep them in your kit.