Digital Security curriculum

Many attackers are criminals after money, while nation-state actors may also want information or the means to disrupt essential services. An insider, anyone with authorized access, can cause harm on purpose or by accident, so a threat is not only someone outside trying to break in.

Online criminals tend to go after easy targets: people and systems that skip basic precautions. An attack is often not about your account at all but about using your access as a stepping stone to something larger, so assuming nobody would bother with you is not a safe bet.

Your attack surface is the set of points where someone could try to get in, cause an effect, or pull data out. Each account, app or connected device adds a point, so removing ones you no longer use shrinks it, just as hardening the ones you keep does.

Attackers often get in by signing in with a password they phished, took from an old breach, or stole with malware. A correct username and password look like you to the service, which is why a second factor matters so much.

Risk combines how much harm a loss would cause with how likely it is to happen. Your email deserves more protection than a forum login because losing it does more damage: whoever holds it can reset your other accounts, so the same chance of compromise carries more risk.

Defense in depth layers different kinds of protection so an attack one control misses can be caught by another. A firewall may block hostile traffic yet do nothing about malware you run yourself, so it works alongside updates, antivirus and careful habits rather than replacing them.

Length is a primary driver of password strength, while rules demanding a digit and a symbol often produce predictable tweaks like "Password1!". NIST now tells services not to impose composition rules and to check new passwords against lists of common and breached ones instead.

A strong password reused on several sites is only as safe as the weakest site that stores it. When one service is breached, the same password opens every other account that shares it, so strength cannot make up for reuse.

In credential stuffing, attackers take username and password pairs leaked from one site and try them on others. Nothing has to be guessed or cracked, so it works against strong passwords too. Distinct passwords break the chain, and a second factor blocks the login even when a pair matches.

People answer password rules in predictable ways, such as capitalizing the first letter and adding a digit or symbol at the end, and NIST notes that attackers are likely to guess passwords like these that have worked before. Details like a birthday are easy to look up. Random words or a generated password avoid both traps.

People who know they must change a password soon tend to choose a weaker one, then make small edits such as bumping a number. An attacker holding the old password can apply the same edit, so NIST tells services not to require periodic changes, but to force one when there is evidence the password was compromised.

Passwords exposed in past breaches are among the first that attackers try, so one that appears on a breach list is weak however complex it looks. NIST requires services to reject new passwords found on such a blocklist; if yours turns up, replace it everywhere you used it.

When several people use one login, the account cannot tell them apart, so nothing it records shows who did what, and NIST notes that few technical controls can detect a secret its owner hands over. Separate accounts, each with only the access that person needs, keep every action tied to one user.

A password manager generates long random passwords, stores them, and fills them in, so you can use a different one on every site without remembering any. NIST requires services to allow managers and autofill, noting that managers have been shown to make stronger password choices more likely.

With a password manager you remember one password, the one that unlocks all the others, so it has to be long, unique and used nowhere else. A memorable passphrase of several random words fits, and a second factor on the manager adds another layer.

Browsers and devices can save and fill passwords for free, and standalone managers do the same job. Either way the store is only as safe as access to it: depending on settings, anyone using your computer may be able to see browser-saved passwords, so lock the device and protect the vault.

Standards such as FIDO2 and WebAuthn sign you in by proving you hold a private key instead of typing a secret the site checks. The credential is tied to the site's real domain name, so a lookalike site cannot use it. Some versions sync the key through a cloud account, which then needs protecting too.

After a breach or a phish, change the exposed password, then every other account that reused it, and secure your email early because it can reset everything else. Turning on two-factor authentication as you go keeps a copied password from working again.

Factors come in three kinds: something you know, like a password; something you have, like a phone or security key; and something you are, like a fingerprint. When NIST's guidelines pair two single-factor methods, one must be something you have, and a biometric counts only alongside a physical device.

With multi-factor authentication, a stolen password alone no longer opens the account, because the attacker also needs the second factor. That is why attackers turn to tricking you into handing over a code or approving a prompt, and why the strongest methods resist even that.

A texted code can be intercepted, and in a SIM swap a criminal talks a carrier into moving your number to their phone, so the codes go to them. CISA ranks SMS and voice codes as the weakest form of MFA, a last resort that is still better than no second factor at all.

An authenticator app generates a fresh code about every 30 seconds on your phone, so nothing travels by text and a SIM swap does not expose it. It is still not phishing-resistant: type the code into a fake login page and the attacker can relay it while it is still valid.

A security key using FIDO2 or WebAuthn ties each credential to the website's real domain, so a lookalike site gets nothing it can reuse. The protection does not depend on you spotting the fake, which is why CISA calls phishing-resistant MFA the gold standard.

In push bombing, an attacker sends sign-in prompt after prompt, hoping you approve one by accident or just to make them stop. A prompt you did not start means someone is trying to get into your account, so never approve it, and report it. Number matching, which makes you enter a code shown on screen, blunts the trick.

A one-time code is the last step that lets someone finish signing in as you, which is why criminals pose as bank staff or tech support to get you to read it out. Companies generally do not contact you to ask for your password or code, so hang up and call a number you look up yourself.

Recovery codes are one-time codes you save when you set up MFA, for the day your phone or key is lost. They are meant to be kept offline, printed or written down and stored securely, apart from the device they back up, so losing that device does not take them with it.

Turn on MFA everywhere it is offered, but start with email, because whoever controls your inbox can reset most other passwords, then move to financial and social accounts. A strong second factor on email protects every account that sends its reset links there.

Password reset links go to your email, so someone who takes over your inbox can request a reset for your other accounts, read the link, and lock you out. Your email therefore deserves your strongest password and second factor, plus recovery details you control.

Answers like a mother's maiden name, a birthplace or a first car can often be found online, in public records, or guessed from a short list. NIST no longer accepts security questions as an authenticator. Where a site insists, treat each answer like a long random password and use it on that site only.

The backup email and phone number on an account are a way back in, so they need to stay in your hands. Check that every listed address and number is one you entered and can still reach, and update them when you change numbers or close an old inbox.

Takeovers often leave traces before you are locked out: an alert about a password change you did not make, a sign-in from an unfamiliar device or place, friends getting messages you never sent, or an email rule quietly forwarding your mail to someone else.

Before anything else, update your security software, scan the computer, and remove anything suspicious, then follow the provider's official recovery steps. Once back in, change the password, sign out all other devices, turn on two-factor authentication, check recovery details and forwarding rules, and warn your contacts.

A message claiming there is a problem with your account and asking you to confirm personal or financial details is a classic phishing script. Legitimate companies do not email or text a link to update payment details, so reach them through a website or phone number you already know.

Changing the password is not the whole fix. Also use the option to sign out of all devices, which kicks out anyone signed in to your account somewhere else, then check your sent folder and recent posts for messages you did not send.

Phishing tells a story, such as suspicious activity, a billing problem or an invoice you do not recognize, to rush you into clicking a link, opening an attachment or handing over details. The pressure is the tell: a real company will give you time to stop and check another way.

The words of a link can say anything; what matters is the address it actually opens. Hover over a link to see its real destination before clicking, and be wary of shortened links, which hide it. When in doubt, type the site's address yourself instead of clicking.

A fake site can copy a real one's look exactly, so the address is the place to check. Attackers alter or drop a few characters, as in amazan.com, or keep the name and change the ending. The same tricks hide in QR codes and texts, so read every address before you sign in.

The name on an email or caller ID can be set to anything, and a return address can be spoofed or made to resemble a real company's. A message that seems to come from someone you know proves only that someone used that name, so confirm unusual requests with them directly.

An unexpected file is a common way to deliver malware, and even ordinary-looking documents, PDFs or ZIP files can exploit flaws in the program that opens them. A fake invoice or urgent notice is a common excuse, so check with the sender another way before opening it.

Spear phishing is aimed at a specific person or team, using details about them or about current events to make a message feel expected. Because it may contain nothing generic to spot, judge it by what it asks for, such as money, credentials or a file, and confirm through a channel you already trust.

The same scam arrives as a text (smishing) or a phone call (vishing). Caller ID can be spoofed, and a text can carry a link or number that opens a browser or dials with one tap. Legitimate companies will not ask for account details by text, so contact them through a number you know.

A QR code hides its address until you scan it, and scammers have stuck their own codes over real ones on parking meters. A callback lure, such as a fake renewal invoice with a number to dispute the charge, gets you to call the scammer yourself. Check every address, and call only numbers you look up.

If a message might be real, check it through a channel it did not give you: a website you type in, the number on your card or statement, or a separate call or text to the person. Contact details inside the message lead back to whoever sent it.

Reporting helps others, not just you. Forward phishing email to the Anti-Phishing Working Group, forward scam texts to 7726 so your carrier can block similar ones, use the report button in your app, and tell the FTC at ReportFraud.ftc.gov, which uses reports to spot trends and build cases.

A pretext is a believable role and story, such as a new employee, a repair person or a researcher, sometimes backed by credentials, that makes questions seem routine. Each answer can lend credibility to the next approach, so verify the person's identity directly with their organization before sharing.

Scammers claim to be the government, your bank or someone you know and say something bad happens unless you act now: arrest, a lost account, a family emergency. The rush exists to stop you checking, and some tell you not to hang up. Honest organizations give you time to decide.

Tech support scams start with a fake pop-up, call or text warning of a computer problem, then ask for remote access and payment to fix it. Real security warnings never ask you to call a number, and legitimate tech companies do not contact you out of the blue about your computer.

In business email compromise, a criminal uses a hacked or imitated email account so that a request for a payment, or for a change of bank details, seems to come from someone you trust. Verify any change to payment information through a second channel, and if money already went out, contact the bank at once to request a recall.

Some attacks target the people who can reset your accounts instead of you. In a SIM swap, criminals convince a mobile carrier to move your number to their device, capturing every texted code. An authenticator app or security key does not rely on your number, so that attack does not reach it.

An attacker may turn up as a new employee or repair person, even carrying credentials, counting on looking routine to get through a door or into a conversation. Be wary of unsolicited visits asking about staff or internal details, and verify the person's identity with their organization directly.

Social engineering works when checking feels rude. If an unexpected caller claims to be from your bank or a company, offer to call back after looking up the number yourself; an honest caller will give you that time. Making it the normal response, at home or at work, removes the pressure a scammer relies on.

Scammers insist on gift cards, wire transfers, payment apps or cryptocurrency because, once sent, the money is hard to trace or get back, much like cash. Being told you can pay only one of these ways is itself a warning sign, and no real business or government agency will tell you to pay with a gift card.

Impostors pose as a government agency, a bank or utility, a delivery company, or a relative in trouble, and may spoof caller ID or even clone a loved one's voice. The story changes, but the moves repeat: a problem or a prize, pressure to act now, and a specific way to pay.

Romance scammers strike up a relationship to win your trust, often moving you off the dating platform and explaining why they can never meet. The money request comes once they have that trust, for travel, a medical bill or a crypto investment. Never send money or gifts to someone you have not met in person.

Fake investment sites look real, but when you try to withdraw from your account you cannot, or only after paying high fees. Only scammers guarantee profits, and someone you met on a dating site or app who wants to show you how to invest in crypto is running a scam. Crypto payments are usually irreversible once sent.

A buyer who sends a check for more than the price and asks for the difference back is running a fake check scam: the funds may appear, but the check can bounce weeks later and you owe the bank. Fake delivery texts lead to spoofed sites. Paying by credit card keeps your right to dispute a charge.

Fake jobs ask you to pay for training or starter kits, to deposit a check and send part of it on, or to reship packages bought with stolen cards. Reshipping is never a real job; it makes you part of the scam, and the payroll details you handed over can lead to identity theft.

A fake renewal notice says you were charged hundreds of dollars and gives a number to dispute it. Call, and the scammer asks for remote access, then claims to have refunded too much and demands the difference back. Check your real account for the charge and reach the company through a number you know.

Speed matters: contact the bank, card issuer, payment app, gift card company or crypto exchange that moved the money right away and ask for a reversal. Cards carry legal protections that crypto lacks. Keep receipts and the gift card itself, then report the scam at ReportFraud.ftc.gov.

Thieves gather personal details from data breaches, phishing messages and calls, malware, and paper sources such as mail and discarded documents, then combine them. That is why shredding papers, collecting mail promptly and questioning requests for your Social Security number all matter.

Warning signs include a bill that stops arriving, which can mean your address was changed, charges or withdrawals you did not make, new bills you did not expect, and accounts on your credit report you do not recognize. Reviewing statements and free credit reports is how you catch them.

A credit freeze stops anyone, including you, from opening new credit in your name until you lift it. It is free to place and lift, does not affect your credit score, and must be set at each of the three bureaus. You can lift it temporarily when you apply for a loan, a job or an apartment.

A fraud alert tells lenders to check with you before opening new credit, but unlike a freeze it does not block access to your report. An initial alert is free, lasts one year, and needs a request to only one bureau, which tells the others; an extended alert for identity theft victims lasts seven years.

First call the fraud departments of companies where fraud occurred, then place a fraud alert and get your credit reports, then report to the FTC at IdentityTheft.gov, which builds a recovery plan and prefilled letters. After that, close fraudulent accounts, remove bogus charges and correct your reports.

Tax identity theft often surfaces when the IRS rejects your return because someone already filed with your Social Security number, or writes about income you never earned. Monitoring services usually miss it, and benefit claims too. A report at IdentityTheft.gov can produce the IRS identity theft affidavit.

A child usually has no credit report, so fraud in their name can go unseen until a student loan is denied years later. You can ask each bureau for a manual search for a report and freeze credit for a child under 16. Fraud aimed at people 60 and older has its own FBI category, elder fraud, and a hotline helps with filing at IC3.

Write down who you contacted and when, keep copies of every letter you send, and ask for written confirmation when a company agrees you are not responsible for an account. With your FTC report, those records let you show what was agreed when you follow up or dispute a debt.

Malware names describe behavior. A virus copies itself to infect computers, a worm spreads from computer to computer on its own, a trojan hides inside software that seems legitimate, spyware secretly gathers information, adware pushes unwanted ads, and ransomware locks your data until a ransom is paid.

Malware usually needs a way in: an email attachment or link, free downloads from unfamiliar sites or file-sharing networks, a malicious ad, an infected USB drive, or a booby-trapped website. Most of these routes depend on you opening, clicking or plugging in something.

Some malware exists to steal what you have saved, such as usernames, passwords and account numbers. NIST also warns that malware can steal session secrets like browser cookies, which keep you signed in, so a thief may not need your password at all. After an infection, change your passwords and sign out of all devices.

No one symptom proves an infection. A device that slows, freezes or crashes, a homepage or toolbar you did not set, redirects, disabled tools like Task Manager, or messages you never sent could each be a sign. Security software can miss malware for a while, so a clean scan is not proof either.

Antivirus matches files against signatures of known malware, so it catches much of what is already known but can miss something new until vendors add it. Keep it updated and scanning automatically, and keep your other habits too; it is one layer, not a guarantee.

Scareware fakes a security warning, often a pop-up saying your computer is infected, to make you call a number, grant remote access and pay to fix a problem that does not exist. Real security warnings never ask you to call. Never use a number shown in a pop-up; update your own security software and run a scan instead.

Disconnect from the internet, update your security software and run a full scan, then change your passwords. If the scan cannot remove the infection, reinstalling the operating system is the fallback, and it usually erases your files, so your backups decide how painful that is.

Ransomware is often the last step. Attackers get in through a phishing email or a vulnerable system, may sit unnoticed while they spread and steal data, then encrypt files and demand payment. Some also hunt down and delete backups first, to make recovery harder.

Attackers often steal data before encrypting it and threaten to sell or leak it if you refuse to pay. Restoring from backups solves the lockout but not the leak, so protecting sensitive data and knowing what was taken matter as much as having copies.

Backups let you restore instead of paying, but only if ransomware cannot reach them. Keep a copy offline, on a device not connected to the computers it backs up, and check that backups actually complete, because attackers look for backups to delete.

At the first sign of ransomware or other malware, disconnect the affected computer from the internet and your network, so the attacker can no longer reach it and the infection is less likely to spread. Ransomware can encrypt files on attached drives and networked computers, not just the one in front of you.

Paying does not guarantee you get your data back, and it rewards the attackers and encourages more attacks, which is why the FBI does not support it. Whatever you decide, report the attack to IC3 with the details of the demand.

Ransomware arrives much like other malware: a phishing attachment or link, a malicious ad or website, or a weakness in outdated software. Keeping systems updated, using MFA and treating unexpected attachments with caution close the most common doors.

Recovery runs in order. First remove the infection, by scanning or, if that fails, reinstalling the operating system; then install the patches that close the weakness and change your passwords. Only then restore your files, from backups kept apart so the ransomware could not reach them.

Decide before an attack who does what, which processes and systems matter most, and whom to call, with an up-to-date contact list that includes law enforcement. NIST advises a response and recovery plan with defined roles, tested so each person knows their part, and IC3 advises a continuity plan.

Many updates fix security flaws, and attackers may keep targeting a flaw for months or even years after the fix is available. Choosing “Remind me later” leaves a known weakness open; CISA calls keeping software up to date the best defense against attacks on flaws that already have a fix.

Automatic updates install fixes as soon as they are released, without waiting for you to remember. Turn the setting on for your operating system, browser, apps and security software, and get updates only from the maker's site or built-in app store.

Your router, smart TV, cameras and voice assistant all run software that can have flaws, and so do browsers, apps and security tools. Install every update, not only the operating system's, and remember that some devices must be updated by hand.

When a vendor stops supporting a product, it stops issuing fixes, so every flaw found afterward stays open. Unsupported software also brings compatibility and performance problems, which is why CISA recommends retiring end-of-life products rather than living with them.

Attackers disguise malware as updates, through email links, ads or attachments claiming to be a patch. Real updates come through your device's settings, built-in app stores or the vendor's own site, so ignore update offers that arrive by email or ad and update from settings instead.

Devices like routers run their own built-in software, and many do not update themselves. Check the maker's website for newer versions, register the device so you hear about updates, and if your internet provider supplied it, ask whether they update it automatically.

Not every flaw is equally urgent. CISA's Known Exploited Vulnerabilities catalog lists flaws attackers are already using, and organizations are told to use it as an input when deciding what to patch first. At home, the practical version is to install updates promptly, especially those marked critical.

A phone in the wrong hands can expose your accounts, your money and even your identity. Set it to lock automatically when you are not using it, use at least a six-digit passcode, and add fingerprint or face unlock if it is available.

Full-disk encryption makes a lost or stolen laptop's storage unreadable: the computer asks you to authenticate before it will decrypt and start the operating system. The catch is the key. If it is lost or damaged, the data may be unrecoverable, so keep any recovery key somewhere safe.

Phones include a feature that can locate a lost device, lock it, or erase it if it was stolen, but only if you turned it on beforehand. Enable it in settings now, and keep regular backups so erasing a stolen device does not cost you your data.

Least privilege means giving each user only the access their tasks need. Doing daily work in a standard account limits what malware you run by mistake can do and keeps it from reaching administrator rights; grant admin rights only temporarily, when a task needs them.

A firewall restricts outside access by blocking unwanted network traffic, and most operating systems include one you should turn on even behind a router. It does not stop malware you install or run yourself, and default settings can be loose, so it is one layer, not the whole defense.

An unknown USB drive can carry malware that infects the computer it is plugged into, and some devices have been infected during manufacturing. Never plug in a drive you find; hand it to security or IT. Turn off autorun, scan outside media before use, and encrypt your own drives.

Deleting files or emptying the trash leaves the data recoverable. Before a device leaves your hands, back up what you need, then use a proper wipe or a factory reset and remove memory and SIM cards. Physical destruction is the final option for storage you cannot wipe.

Treat a library, hotel or other shared computer as untrusted: depending on its browser settings, it may keep passwords and sessions for the next user. Avoid signing in to banking or email on one, and if you must sign in, always log out before you leave.

The FBI notes that official app stores scan for malicious content, while apps from unfamiliar websites or third-party stores carry a higher malware risk. The screening is not perfect: CISA notes malicious apps have slipped past even reputable stores, which is why you still research the developer and read reviews.

A permission request should fit the app's job: a ride-share app needs your location to pick you up, a flashlight has no use for your contacts. Once allowed, an app can keep collecting even when you are not using it, and developers may share data with advertisers, so deny what is unneeded and limit location to while-in-use.

In a SIM swap, a criminal tricks a carrier, or bribes one of its employees, into moving your number to their SIM, then receives the texted codes that reset your accounts. A carrier PIN required before porting the number adds a check, and moving accounts to an authenticator app or security key helps only once SMS is switched off too, since enrolling does not remove it.

A phone's port carries data as well as power, and NIST's mobile guidance lists plugging into an untrusted charging station among the ways data can end up somewhere you do not control and malware can pass between devices. The concern is the unknown device at the other end of the cable, not the electricity itself.

The first hour goes better when the setup is done beforehand: a passcode, the built-in find-my-phone feature switched on, and a recent backup. Then you can locate, lock or erase the phone remotely, contact your carrier at once, and restore your data to a replacement instead of losing it.

Before installing, look into who built the app, read its reviews, and compare the permissions it asks for with what it claims to do. A privacy policy that is vague about who receives your data, or a permission list wider than the app's purpose, is reason to skip it; delete apps you stop using so they stop collecting.

The padlock and https mean the connection is encrypted, so others on the network cannot read what you send. They say nothing about who runs the site: scammers set up encrypted fake sites too, and your data then travels safely to the scammer. Check the address itself, not just the lock.

A browser warning means the site's certificate failed a check: the name on it does not match the site, it has expired, or its issuer is not one the browser trusts. Sometimes the cause is harmless, but clicking through means accepting a site you cannot verify, so do not enter personal information there.

Lookalike addresses alter or drop a character, or swap the ending, such as .com for .net, and the copied page can look identical to the real one. Hover over a link to see where it truly goes, and reach important sites by typing the address you know rather than following a link.

Criminals buy search ads on lookalike domains, and the ads sit above the real results with little to tell them apart. The landing page copies the real site to collect logins, or offers malware named after the program you wanted. Typing the known address, or scrolling past results marked Ad or Sponsored, avoids the trap.

An extension can be granted wide access inside your browser: CISA notes that ad-blocking extensions run with high privilege and see all traffic between your computer and the network, so a bad one can collect data or act maliciously, and some take payment to let certain ads through. Add one only if you need it, after reading reviews from reputable sources.

Get software by typing the maker's address yourself, not through an ad, a pop-up or a free-download site. Criminals run software ads that lead to cloned sites, or plant malware in a real installer through a hidden backdoor, which makes the infection hard to notice. Skip peer-to-peer downloads as well.

Malvertising slips malicious ads into legitimate ad networks, and it can compromise a system without a click. Pop-ups claiming your computer is infected and urging you to call support are a classic scam. An updated browser and an ad blocker cut exposure, though an ad blocker does not detect malware the way security software does.

Many accounts send their password reset links to your email, so whoever controls your inbox can request resets for your other accounts, change those passwords and lock you out. That is why the FTC calls protecting your email account critical, with a strong password and two-factor authentication.

SPF, DKIM and DMARC let a receiving server check that mail claiming a domain came from servers that domain allows, and was not altered in transit. They vouch for the domain, not the message: they cannot stop mail sent from a hijacked real account, and an address one letter off is simply a different domain.

After taking over a mailbox, an attacker can add a rule that silently forwards your incoming mail to an outside address. Because the rule is a setting rather than a login, recovery includes its own step: check the mail settings for forwarding rules you did not create and delete them.

A familiar sender name is not proof: malware can spoof a return address or mail itself from a friend's infected account. Check unexpected attachments with the sender through another channel, turn off automatic downloading of attachments, and remember a clean antivirus result does not rule out a brand-new threat.

Any company that gets your address may store, share or sell it, and addresses posted publicly can be harvested. A secondary address for shopping, sign-ups and public forums keeps that traffic out of the inbox you use for banking and recovery, and can be abandoned if it fills with spam.

Ordinary SMS texts are not encrypted, while end-to-end encrypted messaging apps keep message content readable only by the people in the conversation. The service can still collect and store metadata about your messaging, which is why CISA suggests checking how much an app keeps when choosing one.

Clicking a link or an unsubscribe button inside spam can confirm that your address is live, which invites more mail. The FTC points instead to your email provider's own unsubscribe features, and marking messages as spam or junk helps train the filter.

Default router logins can be found online or are printed on the device, so change the admin password as well as the Wi-Fi password. Turn off remote management, which exposes the settings page to the internet, and WPS, whose PIN design lets attackers guess it quickly; then keep the firmware updated.

Choose WPA3 Personal if your router offers it, otherwise WPA2 Personal; WEP and the original WPA are outdated, and a router offering nothing newer may need a software update or replacing. Encryption scrambles traffic between your devices and the router, while the network password is what keeps strangers off, so make it long, unique and free of your name, address or router brand.

A guest network gives visitors internet access under a separate name and password, so fewer people hold your main password, and if a guest's phone carries malware it stays off the network your own devices use. The FTC suggests the same split for cameras, so that someone who gets onto your main network does not also reach them.

Most websites and apps now encrypt traffic, so a public hotspot usually cannot read your logins the way it once could. What remains is a fake hotspot imitating the real one, the occasional unencrypted site, and file sharing left switched on, so confirm the network name and turn sharing off.

A personal VPN routes your traffic through the VPN company, so what your internet provider could have seen becomes visible to that company instead. CISA warns many free and paid VPN providers have questionable privacy and security policies. A work VPN required to reach company systems is a different use.

Protective DNS checks the domain names your devices look up against threat intelligence feeds and blocks access to ones tied to phishing, malware, botnets and ransomware. CISA cites studies that most malware relies on DNS, which makes lookups a useful place to block. Encrypted DNS solves a different problem: it stops others reading or altering your lookups.

Attackers scan the internet for connected devices that are poorly protected, so a service left reachable from outside is likely to be noticed. Router remote management, UPnP, which malware can use to slip past the router's firewall, and remote desktop tools can all serve as entry points; turn them off unless you need them.

Default passwords offer little protection, because they are published and easy to find. Attackers work at scale, infecting large numbers of devices at once and using them in botnets to attack other machines, so change the default login at setup and never reuse a password from another account.

A connected device stays protected only while its maker keeps fixing it, and NIST's consumer IoT baseline expects makers to tell customers about changes to support terms and when support or functionality ends. That date is worth knowing before you buy, and an old device you no longer use belongs off the network, since its out-of-date security becomes a weak point.

Putting cameras on a separate network from your computer and printer means someone who gets onto your main network does not also have easy access to the cameras. The split matters because malware that lands on one device can spread to others on the same network; your router maker's instructions explain how to set one up.

Voice assistants usually send recordings to the maker's servers, and many cameras store video in the cloud, so exposure depends on who can reach the feed and how long recordings are kept. Choose cameras that encrypt, protect the cloud account with two-factor login, check access logs for unfamiliar addresses, and set recordings to auto-delete where offered.

Many smart devices need the maker's cloud service and app to work, and that backend may store and process the data the device collects. NIST's consumer IoT baseline expects makers to tell customers when support or functionality ends, so features can stop with the service while your data sits with the maker; read the support terms and privacy policy before buying.

Before selling, trading in or recycling a device, back up what you want, take out any SIM or memory card, and use the built-in reset to restore factory settings, since simply deleting files does not fully erase them. If your number changes, update the accounts that use it to identify you, and reactivate any authenticator app.

Data that was never handed over cannot be stolen in someone else's breach. The FTC tells businesses that data they have no real need for should not be collected or kept; for you, the same logic means sharing your birth date, Social Security number or main email address only where it is truly required.

Sign-up forms can come with boxes already ticked that add you to mailing lists or share your details with partner companies. Fill in only what the service genuinely needs, untick pre-selected options, and read the privacy policy to see where your information will go before you submit.

People search sites, one kind of data broker, build reports from public records, public social media and data bought from other brokers, then sell them to anyone who pays. Most let you opt out, but it is site by site, it does not remove public records, and your details can reappear, so recheck periodically.

Location shared with apps, plus an advertising identifier that lets companies follow your activity across apps, can add up to a record of where you go and when. NIST notes that a device sharing its location makes it easier to link where you are with who you meet and what you do, so give location only to apps that need it, only while in use, and reset tracking identifiers.

Many image, video, audio and document formats store metadata inside the file, such as where it came from and when it was made. Encrypting a file protects its content, yet CISA notes the author and creation date stay visible, and although platforms often strip metadata when files are shared, it is not removed every time.

If a breach exposed a password, change it there and on every account that reused it. If your Social Security number was exposed, a free fraud alert asks creditors to contact you before opening accounts, while a credit freeze blocks most access to your credit report; IdentityTheft.gov builds a recovery plan.

Settings you chose can quietly change: sites revise their privacy options and policies over time, and defaults tend to favor convenience. CISA advises reviewing privacy and security settings regularly, and re-checking device settings whenever you install a patch or a new software version.

Treat anything you post as public and permanent: privacy settings can fail, and even a deleted post may live on in saved or cached copies on other people's machines. On some sites the default lets anyone see your profile until you restrict it, so check the settings rather than assume.

Security questions about your birthplace, zip code or mother's maiden name have answers anyone can look up online or in public records, and one with few possible answers, like your first car's color, can simply be guessed. Where a site insists on these questions, treat the answers like passwords: random, long and different for each site.

Posts that reveal your schedule or routine, such as being away right now, show strangers when you are not home. CISA lists schedule and routine among the details not to post, and notes that what friends post about you adds to the same picture, so the combined information should be no more than you would want strangers to know.

Scammers create fake profiles, now often with AI-generated photos, or pose as someone you know, then message contacts asking for money or clicks. Before acting, confirm the account really belongs to that person through a channel you already trust, and warn your contacts if your own account is hacked.

Third-party apps connected to a social account may be granted access to your personal information, and some are malicious apps made to look innocent. Enable only apps you trust, limit what each can reach in your settings, and review those settings regularly, since sites change their options over time.

What you post about a child is hard to take back, since saved or cached copies can outlive deletion. CISA asks people to be considerate when posting about others, and to talk with children about the risks of sharing details themselves, such as being home alone.

The 3-2-1 rule means three copies of important files, on two different kinds of storage such as an external drive and the cloud, with one copy kept off-site. Mixing on-site and remote copies covers hardware failure, physical damage and cyberattacks, so no single event is meant to take out every copy.

Malware that gets onto one device can spread to others on the same network, so a backup kept permanently connected sits within its reach. The FTC advises keeping backups on a drive or server not connected to your network, so data can be restored if attackers get in, and CISA lists offline copies among the protections a backup needs.

Scheduled recovery tests show whether backup copies are intact and whether your team actually knows the restore steps. Practice restoring both whole systems and single files, and after an attack check that a backup is clean before you restore from it.

CISA's backup guidance asks that you be able to roll data back at least seven days, which works only if your backups keep earlier versions instead of overwriting them with the newest copy. Choose a backup that runs automatically and regularly, and test the rollback rather than assume it.

A backup holds the same sensitive data as the original, so CISA says to encrypt backups, whether they go to an external drive or a cloud service. Encryption locks the copy with a key or passphrase, which means forgetting or losing it can lock you out too, so protect that secret as carefully as the data.

Encryption in transit protects data while it moves between your device and a service; encryption at rest protects it where it is stored. They are separate controls, and one does not cover the other: data encrypted on the way to a company but stored unprotected is exposed if attackers break into that company's systems.

Symmetric encryption uses one secret key both to lock and unlock data, so everyone who holds it must keep it secret. Asymmetric encryption uses a key pair: the public key can be shared freely while the private key stays secret. It is much slower, so systems often combine the two, using asymmetric methods to set up symmetric keys.

End-to-end protection keeps a message encrypted from the sender's mailbox to the recipient's, so the services in between carry it without being able to read it. Encryption between mail servers is different: it protects mail as it hops between relays, guarding against eavesdroppers on the path rather than sealing the message itself.

Encryption is reversible: whoever has the right key can turn ciphertext back into the original. A cryptographic hash is a fixed-length, one-way fingerprint that cannot practically be reversed, so it is used to check whether data has changed, not to protect data you will need to read again.

A digital signature is created with the sender's private key over a hash of the message, and anyone can check it with the matching public key. If the message changes, the check fails, so a signature proves integrity and origin without hiding the content, and it is only as trustworthy as the protection of the private key.

A site's certificate carries its public key and is signed by a certificate authority that checked the address belongs to that organization. Your browser accepts it when the address matches, the date is valid and the issuer is on its built-in trusted list, so you are really trusting those authorities to have verified the owner.

Encryption moves the secret from the data to the key: whoever holds the key can read the data, and if a key needed to recover stored data is lost, NIST notes the data is lost unless the key can be recovered. A lost signing key is different, since you can create a new key pair, so recovery planning matters most for keys that lock data.

An algorithm's strength is the work needed to break it, and retirement can follow a published break or simply faster computers that make key searches feasible. NIST moves algorithms and key lengths from acceptable to deprecated, legacy-only or disallowed; 80-bit strength, for example, is no longer approved for protecting new data.

CISA's guidance for cloud business apps splits the job: the provider secures the underlying platform, and the customer is responsible for configuring the account and its settings securely. The service model sets how much of the environment you control, so strong sign-in and careful sharing settings stay your job however good the provider is.

Every account that can open a shared drive is another way in, since a stolen login reaches everything that account can see. NIST's framework expects access permissions to be reviewed and kept to least privilege, and the FTC tells businesses to check who currently has access and whether they still need it, then remove what is not.

When you sign in to an app with an existing account or connect it to one, the app can collect information from that account and sometimes send information back the other way. Check what it asks to see before approving, use a separate login with its own password when unsure, and limit or remove connections you no longer use.

If one cloud account holds the only copy of important files, an attacker who takes it over can lock you out of all of them. Make sure the recovery email addresses and phone numbers are ones you entered and can reach, turn on two-factor login, and keep your own backup, such as on an external drive.

Phishing is often used to steal credentials and get into accounts, and CISA warns it can arrive from known contacts whose accounts were compromised, so a familiar sender proves little. Instead of signing in through a link in the message, go to the service yourself, and confirm unexpected requests with the sender through a contact method you already have.

Protection starts with knowing what you have. Keep an inventory of hardware, software, services and data, including phones, cloud services and any employee home computers that hold company information, and rank each item by how critical it is to the business.

New staff should get only the access their role needs and agree to the security rules from day one. The exit step matters as much: when someone leaves or changes roles, end their passwords and access promptly and collect keys and badges, and give vendors access only for as long as the job lasts.

Least privilege means each person can reach only the resources their job requires, whatever their rank. It caps how much one stolen account or one mistake can expose, and the NIST framework pairs it with separation of duties so that no single role holds every key.

Business email imposters set up an address that looks like it comes from your company and use it to get logins, bank account numbers or payments. A standing rule that staff call to confirm emailed wire transfer requests, using a number they already know rather than one in the message, works even when the email looks genuine.

A personal laptop or phone used for work sits outside the organization's control, so agreements to keep it secure generally cannot be enforced automatically and an infected device may still connect. NIST describes tiered access as one option, giving personal devices fewer resources than company-managed ones, and keeping sensitive data off them as another.

Vendors who can reach your data or network can expose it, so their weaknesses become yours. Write security requirements into contracts, check that vendors follow them rather than taking their word, limit their access to what they need and for how long, and plan what you will do if a vendor is breached.

CISA says once-a-year training is not enough, because phishing tactics keep changing and messages now carry personal details that make them look real. Keep staff current on red flags, teach them to verify requests through a known contact, and make sure everyone knows exactly whom to tell and how.

NIST tells organizations to assume that networks and places outside the office hold hostile threats. At home that means a router using WPA2 or WPA3 with its default password changed and devices with full-disk encryption; in public it means watching for shoulder surfers and never leaving devices unattended.

Logs record sign-ins, access and changes, and after an incident they are often what identifies which computers were compromised and who had access to the data. Keep central security logs, and watch them for warning signs such as repeated failed logins from unknown users or unusual traffic at odd hours.

CSF 2.0 groups security outcomes under six functions, with Govern at the center shaping the other five. NIST stresses they are not a checklist or a sequence: Govern, Identify, Protect and Detect run continuously, while Respond and Recover stay ready for when an incident occurs.

Identify means understanding your assets, suppliers and the risks to them, which lets you prioritize effort in line with your strategy. The CSF's functions run together rather than in a fixed order, yet Protect builds on Identify, because safeguards are chosen once assets and risks are known and ranked.

Protect covers everyday safeguards: identity management, authentication and access control, awareness and training, data security, platform security for hardware and software, and resilient technology. The aim is to lower both the likelihood and the impact of incidents once your assets and risks are known.

Detect is about finding and analyzing possible attacks and compromises in time to act, and it supports successful response and recovery. For a small organization that means watching devices and software for unauthorized access, investigating unusual activity, and checking the network for unknown users or connections.

Respond covers containing an incident, analyzing it, and reporting and communicating about it; Recover covers restoring affected systems and operations. Writing and testing incident response, disaster recovery and business continuity plans beforehand turns both into steps you follow instead of improvising.

A Current Profile records which security outcomes you achieve now, and a Target Profile the ones you have chosen to reach. Comparing the two gives a gap analysis, which becomes a prioritized action plan that you carry out and repeat as threats and needs change.

Risk weighs how likely a threat is to exploit a weakness against the impact if it does. The CSF asks you to rank assets by criticality and impact on your mission and to choose risk responses accordingly, so limited time and money go first where a loss would hurt most.

Contain first: disconnect an infected device from the network but leave it powered on, because shutting down can erase information investigators need. Stop entering passwords on that device, since malware is often after them, then change your passwords and turn on two-factor authentication in case an attacker already has access.

Wiping or rebuilding a compromised system right away can destroy what shows how the attacker got in and what they took. Even when no prosecution is likely, collected incident data counts as evidence, so record what you find and do, and let investigators capture images of affected systems before they are reset.

Before calling an incident contained, establish its scope: how the attacker got in, which systems, accounts and data were reached, how many people are affected, and whether there are signs of persistence elsewhere. NIST notes that judging an incident's magnitude is often one of the hardest parts of response.

If financial accounts may be affected, contact your bank or card issuer immediately. Then tell the people who need to act: your organization's IT or security contacts if work information was involved, your own contacts so they ignore messages sent in your name, and the platform through its account recovery process.

In the US, the FBI's IC3 is the central intake for cyber-enabled crime and fraud, the FTC takes fraud reports at ReportFraud.ftc.gov, and IdentityTheft.gov returns a personal recovery plan. IC3 cannot answer every report, but reports help track trends and, in some cases, freeze stolen funds.

Removing the attacker's tools is not the end: until the stolen credentials are changed and the weakness they used is fixed, the same attack can work again. A root-cause analysis and a lessons-learned review turn the incident into specific changes to controls and plans.

Walking through a scenario together shows whether everyone understands their role before a real incident tests it. NIST lists tabletop discussions and other exercises as ways to prepare staff and key suppliers and to find improvements, and CISA offers no-cost tabletop exercises that small organizations can adapt.

A scammer needs only a short clip of someone's voice, often taken from posts online, to clone it and call a relative claiming an emergency. Do not trust the voice: hang up and call the person on a number you know, and agree on a family code word that a stranger would not know.

Criminals now generate video for live calls posing as executives, officials and other authority figures, and the FBI says AI content is often hard to identify. Lag and lip movement out of sync with the audio can be clues, but verification is the defense: confirm through a contact method you already trust.

Misspellings and clumsy grammar were long taught as phishing tells, but criminals now use generative AI to write and translate fluent messages that remove those errors. Judge a message by what it asks for, such as urgency, a sign-in link, a payment or a code, and verify through a channel you choose.

What you type into an AI tool may be stored on the company's servers; the FBI notes some apps keep collected data, prompts included, for as long as the developers deem necessary. The FTC warns these companies have a continuing appetite for data to build models, and NIST notes models can leak sensitive information, so keep passwords and confidential details out of prompts.

An AI assistant that reads web pages, email or documents mixes that content with its instructions, so a third party can plant text that steers it to leak data or take actions you never asked for. NIST says current defenses do not give full protection, so designers may build such systems assuming injection is possible.

Interest in AI makes it good bait: criminals run ads for AI tools that lead to cloned download sites, or slip malware into real software through a hidden backdoor. Get AI apps from official app stores or by typing the maker's address yourself, never through an ad or an unfamiliar site.

Provenance metadata, such as signed content credentials, records where a file came from and how it changed, which can support trust but does not guarantee it. Metadata is often stripped when files are shared and a signature shows only what the signer claims, so a missing credential proves little today; NIST notes that could change if provenance becomes widespread.