## Instructions - Passwords: unique per site, manager-generated (memory is not a password strategy). Passkeys where offered — phishing-proof by design. - 2FA everywhere that matters (email first — it resets everything else): authenticator app or hardware key, never SMS unless it's the only option. Store recovery codes OFFLINE (paper in a drawer). - Backups 3-2-1: three copies, two media, one offsite/offline. Ransomware only works on people with one copy. Test restores — untested backups are wishes. - Scams: assume every unexpected message asking for action/money/info is hostile until proven otherwise — verify through a SEPARATE known-good channel (call the number on the card, not the one in the text). Urgency + secrecy = the two tells. - Updates: enable automatic OS/browser updates; most compromises ride known patched bugs, not zero-days. - WiFi/network: WPA3 or strong WPA2 passphrase, guest network for IoT junk, router firmware updated, remote admin off. - Separate concerns: one email for accounts/recovery, another for newsletters/shopping. Breach exposure mapping via haveibeenpwned alerts. - Devices: disk encryption ON (BitLocker/FileVault/LUKS — verify, don't assume), screen lock ≤5min, Find-My enabled, remote wipe tested on paper before theft day. - Backups against ransomware: one offline/offsite copy (USB rotated monthly, or immutable cloud versions) — synced cloud drives (Dropbox/Drive) mirror ransomware too unless versioned; test a file restore yearly. - Public WiFi: VPN or phone hotspot for anything authenticated; forget the network after (auto-rejoin invites evil twins); verify captive portals show HTTPS before entering credentials. - Smart-home/IoT: guest VLAN for cameras/plugs/TVs, default passwords changed day one, UPnP off on the router, firmware auto-update where offered. - Kids/family: passkey-first on new accounts, apprentice admin (separate kid account, no admin rights), photo/location sharing rules written down once. ## Examples - "Bank" text with a link: don't tap — open the bank app manually or call the number on your card. - Laptop stolen: disk encryption (on by default these days — verify it) + remote wipe + sessions revoked from another device. - "Support" caller asking for remote access: hang up — real support never cold-calls; call back on the published number. ## Workflows 1. Harden in order: email 2FA → password manager migration → backups → network → recovery codes drawer. 2. Yearly: review active sessions, old accounts (delete), backup restore test. 3. New device: encryption → OS updates → manager + 2FA → backup → Find-My → old device wiped (factory reset + remove from accounts). 4. After a breach notice: change that password + everywhere reused → revoke sessions → check haveibeenpwned → enable 2FA where missing. ## Templates - New-device checklist: encryption on, 2FA on email first, manager installed, backup configured, find-my enabled. - Password-manager migration: import browser CSV → dedupe → rotate top-10 critical (email, bank, cloud, socials) → enable 2FA per site → delete browser-saved passwords → emergency-kit printout in the drawer. - Travel mode: device updated + backed up, sensitive docs off-device (cloud vault), screen-lock 1min, VPN installed, hotel-safe PIN changed. ```text # Yearly security review (30 min, calendar it) # [ ] Email 2FA still on + recovery codes findable # [ ] haveibeenpwned alerts clear (rotate anything flagged) # [ ] Active sessions pruned (Google/Apple/bank device lists) # [ ] Backup restore test: recover ONE file from each copy # [ ] Dead accounts deleted (old forums, trials, ex-employer SSO) # [ ] Router firmware current, guest net still isolated # [ ] Password manager emergency kit prints + drawer copy fresh ``` ```bash # breach-response order (do not skip steps) # 1. Rotate the EMAIL account first (it resets everything else) # 2. Banks + payment apps second, revoke all sessions # 3. Socials/cloud third, check forwarding rules attackers add # 4. haveibeenpwned.com — see what else leaked with it ``` ## Tools - SARAH passwords plugin for generation; file tools for inventory notes. - haveibeenpwned alerts (per-email breach pings), Google/Apple security checkups quarterly. ## Advanced - Phishing anatomy: sender mismatch (display name vs address), urgency + secrecy pressure, link text vs href (hover/long-press reveals), attachment double-extensions (`invoice.pdf.exe`), QR-code phishing (quishing) — verify via a separate known-good channel, every time. - 2FA ladder: hardware key (FIDO2/passkey) > authenticator app (Aegis/2FAS, encrypted backup) > email codes > SMS last resort (SIM-swap risk); store recovery codes on paper, split locations for critical accounts. - Account inventory: yearly `accounts.md` (service / email used / 2FA state / recovery codes location); delete zombie accounts (old forums, trials) — each is breach surface. - Home network: router admin password changed, WPA3 (or WPA2-AES 20+ char passphrase), guest net for IoT/visitors, remote admin OFF, firmware auto-update; Pi-hole for malicious-domain blocking. - Small-project hygiene: secrets in env (never git), Dependabot/Renovate on, 2FA on the org, backup the repo + DB separately from the host, incident contact written down. - Troubleshooting: locked out with 2FA → recovery codes drawer first, then provider account-recovery (takes days — start early); suspected malware → disconnect, backup docs-only (no executables), clean reinstall from known-good media, rotate passwords from a clean device; identity-theft signs (unknown 2FA prompts, reset emails) → assume breach: rotate email first, then banks, then everything. - Scam scripts to rehearse: "bank fraud call" (hang up, call the card number), "tech support refund" (never install remote tools for a caller), "parcel redelivery fee" (track via the retailer app, not the SMS link), "CEO gift cards" (verify in person or known channel), romance-investment ("pig butchering" — any stranger pitching crypto = scam). - Kids' accounts: family-sharing child IDs (no ad profiling), YouTube supervised mode, game-chat limited to friends, photo rule (no school uniform/location cues), one trusted adult for "is this message weird?" checks. - Router 10-minute lockdown: change admin password → WPA3 passphrase 20+ chars → guest network on (IoT + visitors) → remote admin off → auto-update firmware on → UPnP off → reboot and reconnect everything once. - Document theft response: credit freeze (all three bureaus, free, liftable) + fraud alert + police report number + replacement order (passport/license/bank) tracked in one note. ## Templates ```text # Account inventory row (yearly review, one line per service) # Service | login email | 2FA (key/app/SMS/none) | recovery codes where | last rotated # Example: bank | me@recovery-mail.com | hardware key | paper drawer A | 2026-09 ``` ## Documentation - haveibeenpwned.com, EFF Surveillance Self-Defense guides. - EFF SSD: https://ssd.eff.org - CISA family safety: https://www.cisa.gov/secure-our-world