Personal IT Security Awareness and Best Practice Guide

 

This white paper is written to bring security awareness and better practices for individual users who transact online from computers, mobile phones, home networks and cloud services, and who need practical guidance for protecting personal data, privacy, accounts and backups.

Introduction and scope

Security awareness for individuals is about making safe decisions repeatedly across everyday technology: home computers, phones, email, social media, banking, shopping, government portals, work-from-home tools and cloud services.

The goal is not to become paranoid or to stop using online services. The goal is to understand where attacks happen, why personal data has value, what controls reduce risk, and how to recover if something goes wrong.

This guide uses the CIA model as a foundation: confidentiality, integrity and availability. It also incorporates practical data protection concepts such as backup strategy, retention, RTO, RPO, snapshots and replication so that personal security includes both prevention and recovery.

A useful training demonstration is a cyberthreat live map, such as the public Kaspersky Cyberthreat Live Map. Treat such maps as awareness tools rather than precise operational intelligence: they make the volume and global nature of attacks visible.

Practical actions

• Treat security as an everyday habit, not a one-time setup task.
• Protect accounts, devices, networks and backups together; weakness in one area can undermine the rest.
• Assume you will eventually face a suspicious email, unsafe link, lost device or failed disk, and prepare accordingly.

 

Online life and personal data as an asset

People transact online for personal, professional and administrative reasons. The same person may use a laptop for work, a phone for banking, a tablet for shopping, a desktop for family photos, and a cloud account to synchronize everything.

Personal data is an asset because it can be used to access money, impersonate you, embarrass you, pressure you, target you or damage your reputation. It includes obvious identifiers such as name, address, phone number, date of birth and passport details, but it also includes device identifiers, browsing history, location history, photographs, family relationships, employment information, medical records, financial records and private messages.

An asset should be protected according to its value and exposure. A casual shopping account matters because it may contain saved payment details and delivery addresses. A social media account matters because it can be used to impersonate you or manipulate your contacts. A cloud photo account matters because it may contain memories that cannot be replaced.

The individual security mindset is therefore asset-based: know what data you have, where it is stored, who can access it, how it moves, and how you would recover it if lost, stolen or encrypted by ransomware.

Personal data type	Why it matters	Example protection
Identity details	Used for impersonation, account recovery and fraud.	Limit sharing; protect documents; use strong account recovery settings.
Financial records	Useful for theft, scams and tax fraud.	Use MFA, secure devices, avoid public Wi-Fi for banking, keep backups.
Medical records	Highly sensitive and difficult to change after disclosure.	Use trusted providers, strong passwords, device encryption and privacy controls.
Photos and family data	Often irreplaceable and useful for social engineering.	Back up offline and offsite; restrict social sharing.
Work or client data	May create legal, contractual or professional obligations.	Separate work and personal use; follow employer policy; encrypt portable devices.

 

Practical actions

• Make an inventory of important accounts, devices and data stores.
• Identify irreplaceable data such as family photos, records and documents.
• Use different security levels for low-risk accounts, critical accounts and irreplaceable data.

 

Security principles and data access

Information security is often summarized by three principles: confidentiality, integrity and availability. Data access is commonly managed through authentication, authorisation and accounting.

Confidentiality means only authorised people should access restricted data. For an individual, this includes passwords, device locks, account permissions, encryption and private sharing settings.

Integrity means data remains accurate, complete and in its intended form. Individuals protect integrity with version history, checksums where appropriate, reliable storage, cautious editing, malware protection and backups.

Availability means data and services are available when needed. Individuals improve availability with redundant copies, cloud and offline backups, spare devices, tested recovery steps and disaster recovery planning.

Authentication answers: who is accessing the data? Authorisation answers: are they permitted to access it? Accounting answers: is access logged or auditable? Even at home, these questions matter for shared computers, family tablets, cloud folders and accounts used by multiple people.

Principle	Individual meaning	Typical controls
Confidentiality	Keep private data away from unauthorised people.	Strong passphrases, MFA, permissions, encryption, screen locks.
Integrity	Keep data correct and unaltered.	Backups, versioning, cautious downloads, malware protection, checksums for critical files.
Availability	Keep data and services usable when needed.	3-2-1 backups, spare recovery options, cloud/offline copies, recovery rehearsals.
Authentication	Prove who is signing in.	Passwords, passkeys, authenticator apps, biometrics, hardware keys.
Authorisation	Limit what each person or app can do.	Least privilege, app permissions, separate accounts.
Accounting	Know what happened.	Login alerts, account activity history, audit logs where available.

 

Practical actions

• Use separate user accounts rather than sharing one administrator account.
• Enable login notifications and review recent activity on critical accounts.
• Keep one recovery path that does not depend on the device you might lose.

 

Privacy and anonymity

Privacy and anonymity are related but different. Privacy means controlling who can see information about you. Anonymity means acting without your real-world identity being known or easily linked to the activity.

Privacy usually applies to legitimate online transactions where the service provider knows who you are but should handle your data responsibly. Examples include banking, government services, healthcare portals, online shopping and work collaboration platforms.

Anonymity may apply when you want to separate an activity from your identity, such as reading sensitive topics, protecting a whistle-blower, publishing under a pseudonym, or communicating in an oppressive environment. Anonymity is difficult because browser fingerprints, payment trails, device identifiers, metadata and behaviour patterns can reveal identity even when a name is not provided.

For most everyday security decisions, the aim is practical privacy: reduce unnecessary disclosure, limit tracking, control sharing, and prevent unauthorised access. Anonymity tools can have legitimate uses, but they also introduce risk and may not protect against mistakes in behaviour.

Privacy and anonymity does not just apply online. Do not forget about the personal data that you may disclose and surrender at the checkout of a physical store. It is now very common for physical stores to ask for your email address or phone number or post code and shoppers happily surrender it. This information then ties a person to a name, contact details, a transaction, a shopping habit, etc. All are very valuable to the merchant.

You need to always ask:

• why do you need this information?
• how do you intend to use this information?
• do you sell my information?
• who has access to this information?
• how securely is this information stored?

If the merchant unlikely answers any of these questions, would you still surrender your personal information?

Concept	Core question	Example where it applies	Main risk
Privacy	Who can see my information?	Banking, medical portal, cloud photo storage, shopping.	Over-sharing, weak provider settings, excessive tracking.
Anonymity	Can this activity be linked to me?	Sensitive research, whistleblowing, journalism, political speech.	Identity leakage through accounts, payments, metadata or behaviour.
Pseudonymity	Can I use a stable identity that is not my real name?	Forums, gaming, creative publishing.	The pseudonym may become linked to your real identity over time.

 

Practical actions

• Use privacy settings on devices, browsers and apps deliberately; do not accept defaults blindly.
• Disable targeted advertising, unnecessary diagnostics, user-experience telemetry and tracking where you do not need them.
• Separate roles where useful: personal browsing, banking, work and high-risk research should not all share the same browser profile and extensions.

 

Threats, vulnerabilities and risk

A threat is a potential harmful event. A vulnerability is a weakness that can be exploited. Risk is the likelihood and impact of a threat exploiting a vulnerability.

For individuals, threats include ransomware, account takeover, phishing, identity theft, malicious apps, insider misuse of privileged data, physical device theft, drive failure, accidental deletion and service outages. Vulnerabilities include software bugs, weak passwords, default passwords, excessive permissions, unpatched systems, exposed remote services, poor backups and bad habits.

Risk changes when context changes. A weak password on an unused forum is a risk, but the same password reused on email is far more dangerous because email often controls password resets for other accounts. A lost laptop without disk encryption may expose all local files. A lost laptop with full disk encryption and a strong password is less likely to leak data, though the data may still be unavailable until restored.

Security effort should be proportional. The highest priority should be email, financial accounts, cloud storage, phone, password manager, backup destinations, identity documents and any account that can reset other accounts.

Term	Plain-language meaning	Individual example
Threat	Something bad that could happen.	A phishing email tries to steal banking credentials.
Vulnerability	A weakness that makes harm easier.	The same password is reused on email and banking.
Risk	The chance and impact of harm.	If the reused password is leaked, both accounts may be taken over.
Control	A safeguard that reduces risk.	Unique passphrases, MFA and login alerts.

 

Practical actions

• Rank your most critical accounts and strengthen those first.
• Change default passwords on routers, modems, cameras, NAS devices and smart home equipment.
• Remove software, accounts and devices you no longer use.

 

Ransomware, malware and malicious disruption

Ransomware encrypts or steals data and demands payment for that data to be returned. It matters to individuals because it can destroy family photos, financial records, creative work and business files just as effectively as it can disrupt a company.

Ransomware commonly arrives through phishing links, malicious attachments, fake updates, pirated software, compromised websites, remote-access weaknesses and infected removable media. Modern ransomware may also steal data before encryption and threaten to publish it.

Backups are the main practical defence against permanent ransomware damage. However, backups only help if they are not encrypted by the same attack. An external USB drive that remains plugged in all the time can be encrypted together with the computer. Cloud sync can also replicate encrypted or corrupted files unless version history is available and retained long enough.

Malware is broader than ransomware. It includes keyloggers, credential stealers, remote access tools, banking trojans, adware and spyware. Anti-virus helps, but it is only one layer. Safer behaviour, least privilege, updates, application control and backups are all needed.

Ransomware rule: A backup that is continuously writable by your computer may be vulnerable to the same ransomware event. Offline, immutable or snapshot-protected copies are safer.

Practical actions

• Keep at least one backup offline or otherwise protected from automatic encryption.
• Do not open unexpected attachments, even if they appear to come from a known sender.
• Avoid pirated software, unofficial cracks and fake download sites; these are common malware delivery paths.
• Know how to disconnect a device from the network quickly if ransomware is suspected.

 

Social engineering and phishing

Social engineering attacks people rather than systems. Phishing can be in the form of an email, phone call, direct message from a social or professional platform, etc. The aim is to make you reveal information, open a file, click a link, approve an MFA prompt or send money.

Attackers adapt to personality, skills, role and public information. Social media posts can reveal family names, birthdays, pets, school history, travel plans and employment details. Those details can be used to guess secret questions, tailor scams or impersonate friends.

A social engineer may pretend to be a friend, bank, delivery company, government agency, employer, helpdesk, charity, software vendor or job recruiter. Job recruiter scams are especially effective because they create a reason to send attachments and request personal details. A formal company domain is more trustworthy than a generic webmail address, but domains can still be spoofed or look similar to real ones.

Some attacks can be quite elaborate and impersonate someone you may need to trust such as a bank employee, the government, etc. They always present to some matter of urgency that requires your attention. A very recent style of attack is the attacker impersonating a recruiter. They prepare by collecting our professional information shared via various online platforms and reach out to your offering job opportunities. Who wouldn’t like a pay rise? They will sound professional, conduct interviews and then send you a fake job description or letter of offer, which you open or link that you click.

Social engineering succeeds when pressure defeats verification. Urgency, fear, greed, curiosity, authority and helpfulness are all used to move a person from suspicion to action.

Signal	What to look for	Safer response
Urgency	Act now, account will close, payment overdue.	Pause; use a known-good channel to verify.
Authority	CEO, bank, government, IT support, police.	Do not rely on display names; verify identity independently.
Unexpected attachment	Invoice, resume, shared document, voicemail.	Confirm with sender before opening; scan file.
Link mismatch	Text says one domain, hover shows another.	Do not click; type or use a bookmark for known services.
Too much information	A stranger knows details from social media.	Do not treat personal detail as proof of legitimacy.

 

Practical actions

• Reduce public social media information that can be used against you.
• Verify unusual requests through a channel you choose, not a channel supplied in the message.
• Treat MFA prompts you did not initiate as evidence that someone may know your password.

 

The dark web: what individuals should understand

The dark web is a collection of sites and services intentionally hidden from ordinary browsers and search engines. Accessing the dark (or deep) web typically requires specialised tools such as Tor (onion routing network), non-obvious links and directories.

The dark web is associated with illicit marketplaces for stolen data, drugs, weapons, malware, fraud services and counterfeit documents. It is also dual purpose: anonymity networks can support journalists, activists, whistleblowers and people in oppressive states who need privacy and safety.

Anonymity is enabled through layered encryption and routing that masks the user and service location. This does not make activity risk-free. Dark web sites can host scams, malware, illegal content, malicious downloads and law-enforcement operations. A person can also reveal identity through reused usernames, payments, documents, browser settings or behaviour.

For most individuals, the practical lesson is not to explore high-risk environments casually. Instead, understand that stolen personal data may be traded there and that good account hygiene, breach monitoring, MFA and rapid password changes reduce downstream harm.

Practical actions

• Do not visit unknown dark web links out of curiosity.
• Assume compromised personal data may circulate beyond ordinary search engines.
• Use unique passwords so a breach on one site does not unlock others.

 

Means used in cyberattacks

Attackers use multiple delivery paths. A strong personal security plan considers email, removable media, websites, internal or private websites, mobile apps, physical access and people.

Email remains one of the most common attack paths because it can carry links, attachments, invoices, resumes, shared documents and urgent requests. Removable media can carry malware or malicious scripts, and unknown USB devices should be treated as unsafe. Web browsing can lead to deceptive downloads, drive-by downloads, fake support pages and malicious advertising.

Internal websites and local devices can also be risky if they are poorly secured. Home router pages, NAS dashboards, camera interfaces and printer portals often retain default passwords or outdated firmware. Mobile apps collect personal information and may request access to camera, microphone, location, contacts, files and photos.

Physical access matters. An attacker, visitor or thief who can touch an unlocked device may be able to copy files, install malware, reset settings, read messages or approve account changes. People remain the final control: if a person is tricked into approving the attack, technical controls may be bypassed.

Attack path	Typical risk	Personal control
Email	Phishing links, attachments, impersonation.	Verify sender, links and attachments; use MFA.
Removable media	Malware, malicious shortcuts, unknown content.	Avoid unknown devices; scan trusted drives; disable autorun.
Browsing	Fake sites, malicious downloads, scripts.	Use bookmarks, HTTPS, updates and cautious extensions.
Mobile apps	Excessive permissions, data harvesting, malicious apps.	Install from known providers; review permissions after updates.
Physical access	Theft, tampering, unlocked sessions.	Screen lock, disk encryption, secure storage.
People	Social engineering and coercion.	Pause, verify, and escalate uncertainty.

 

Practical actions

• Map common attack paths to a habit you can perform every time.
• Use a standard verification routine for suspicious messages.
• Control physical access to devices, especially when travelling or in shared spaces.

 

Passwords, passphrases and hashing

Passwords protect the first gate to many accounts. Better password practice is built on length, uniqueness and unpredictability.

When a service stores a password properly, it should store a salted cryptographic hash rather than the password itself. A hash is a one-way representation: the service can check whether the submitted password matches without needing to store the original. If a password database is stolen, attackers try to crack hashes by guessing passwords at high speed.

Brute force is the process of trying many possible passwords. The exact time required varies greatly by hardware, hash type and password complexity. As a simple awareness point, short passwords can fall quickly while longer passphrases become dramatically harder to guess. The difference between six characters and twelve or more characters can be enormous.

Default passwords are dangerous because they are widely known. Modems, routers, cameras, smart devices, Bluetooth devices, network storage and printers should have default administrator passwords changed immediately. A long passphrase can be easier to remember and stronger than a short complex password. Examples include three or more unrelated words, or a sentence transformed into memorable initials with added length and randomness.

Practice	Why it helps	Caution
Use long passphrases	Length makes brute-force attacks harder.	Avoid famous quotes, song lyrics or predictable phrases.
Use unique passwords	A breach of one site does not unlock others.	Do not make minor variations of the same password.
Add randomness	Unpredictability resists guessing.	Personal facts are not random.
Change defaults	Removes known vendor credentials.	Also change Wi-Fi and device admin passwords.
Review periodically	Keeps critical accounts current.	Prioritise changes after breaches, reuse or suspicion.

 

Practical actions

• Use a unique, long passphrase for email, banking, cloud, password manager and device accounts.
• Change any default password on network and smart devices.
• Do not reuse passwords between personal, work and low-trust sites.

 

Password managers, secret questions and multi-factor authentication

A password manager reduces the burden of remembering many unique passwords. Multi-factor authentication adds protection when a password is stolen or guessed.

Password managers can be browser-based, cloud-based, offline or hybrid. Browser managers are convenient but tied closely to the browser account and device security. Online managers synchronize across devices but require trust in the provider and strong MFA on the manager account. Offline managers such as KeePass give more local control but require disciplined backup and synchronization practices.

A password manager should generate unique passwords and store them securely. It means the user has one primary password to remember, so that password must be strong, memorable and protected. Recovery codes for the manager and other critical accounts should be stored securely offline.

Secret questions are often weak because answers such as maiden names, pets, first car, school or birthplace can be found through Google searches, public records or social media. Consider using random responses saved in the password manager rather than truthful answers.

MFA can be based on something you know, something you have or something you are. SMS is better than no MFA but can be intercepted through provider compromise, SIM swap or phone cloning. Authenticator apps generate one-time passwords and are usually stronger than SMS, but they may not transfer automatically to a new phone. Biometrics are convenient but raise privacy and legal concerns for some users. Hardware security keys provide strong protection for critical accounts.

Factor	Example	Strengths	Weaknesses
Something you know	Password or passphrase.	Portable and familiar.	Can be phished, guessed or reused.
Something you have	Authenticator app, hardware key, SMS.	Adds a second barrier.	Phones can be lost; SMS is weaker; backup codes needed.
Something you are	Fingerprint or face unlock.	Convenient for device unlocking.	Biometric data is sensitive and cannot be changed like a password.

 

Practical actions

• Use a reputable password manager or a well-managed offline vault.
• Avoid storing password in browsers.
• Enable MFA on email, banking, cloud storage, social media, password manager and phone accounts.
• Store recovery codes securely and make sure you can recover accounts after a lost phone.
• Use random answers for security questions and save them in the password manager.

Email Accounts

Email accounts are now a core part of personal identity, not just a communication tool. They are used for banking, government services, health records, shopping, password resets, account recovery, subscriptions, rewards programs and day-to-day correspondence.

Because an email address is so widely used, it should be treated as sensitive personal information. Many organisations request an email address for convenience, marketing, tracking, profiling or loyalty programs, and that address may later be spammed, shared, sold, exposed in a data breach or used to target the individual with phishing attacks.

A practical best practice is to separate email accounts based on privacy and usage.

• Use one highly protected account for important services such as banking, government, health, business and account recovery
• Use another for bills, subscriptions and routine online services
• Use a separate low-trust or ‘play’ account for social media, shopping rewards, newsletters, competitions and casual sign-ups.
• For one-off or low-value registrations, disposable receive-only email services such as Temp-Mail, Guerrilla Mail or TempMail, that can help protect personal email accounts from spam and unnecessary exposure. However, disposable email addresses should not be used for important accounts, password resets, financial services, identity services or anything requiring long-term access, because they may expire, be reused, be visible to others or provide no reliable recovery path.

This approach supports the broader security principle of protecting personal data as an asset and reducing exposure through better account separation.

 

Email safety

Email safety is built on verifying the sender, the destination and the requested action. The display name is not enough.

Check the full email address, including the fully qualified domain name. A message from support@example.com is different from support@example-security.com or support.example@gmail.com. Attackers rely on people reading quickly and trusting logos, display names or copied signatures.

Hover over links on a computer, or press and inspect carefully on mobile where safe to do so, to see the actual destination. Be cautious with shortened links, tracking links and domains that look almost correct. For banks, government portals and high-value services, avoid clicking email links at all: use a saved bookmark or type the known URL yourself.

Attachments should be expected, verified and scanned. A file can be malicious even when it appears to be a PDF, spreadsheet or document. If an attachment requests macros, elevated permissions or installation of a viewer, treat it as suspicious.

Email verification routine: Ask: Was I expecting this? Is the sender domain correct? Does the link go where it claims? Is the attachment necessary? Can I verify through another channel?

Practical actions

• Verify sender, link and attachment before acting.
• Use a known-good channel to confirm unusual requests for money, credentials or documents.
• Do not approve MFA prompts triggered by an email link unless you initiated the login independently.
• Report phishing to your email provider or organisation where appropriate.

 

Public Wi-Fi, hotspots and VPNs

Public Wi-Fi should be treated as an untrusted network. Other users, compromised access points or fake hotspots may monitor, block, redirect or manipulate traffic.

Modern HTTPS protects much web traffic, but public networks can still expose metadata, device names, DNS queries, captive portal manipulation, insecure apps, downgrade attempts and local sharing services. On any public or shared network, personal firewalls should be enabled and file sharing should be off unless explicitly needed.

A VPN can protect traffic between your device and a trusted VPN server, which is useful on hostile networks. However, a VPN shifts trust to the VPN provider and does not protect you from phishing, malware, unsafe websites or compromised accounts. Free VPNs can have privacy and reliability risks.

Using your phone as a Wi-Fi hotspot can be safer than unknown public Wi-Fi, assuming the mobile account and phone are secure. The safest approach is to limit sensitive activity on public networks and use cellular or a trusted hotspot for banking, administration and work.

Practical actions

• Prefer your own mobile hotspot or cellular data for sensitive transactions.
• If using public Wi-Fi, ensure HTTPS is present and do not ignore certificate warnings.
• Disable file sharing and network discovery on public networks.
• Use a reputable VPN where appropriate, but do not treat it as a complete security solution.

 

Personal computers

A personal computer should have a secure baseline: account separation, lock screen, updates, firewall, malware protection, app permissions, disk encryption and privacy settings.

Configure a lock screen that requires a password, passphrase or secure unlock method. Do not leave devices unlocked in shared spaces. Avoid daily use from an administrator account where possible; use standard accounts for everyday work and elevate only when needed. On Windows, User Account Control helps prevent silent elevation. On macOS, require administrator approval for sensitive changes and review login items and profiles.

Privacy settings matter. Disable convenience features, diagnostics, feedback, targeted advertising and optional experience-improvement telemetry that you do not need. Review AI assistants, voice assistants and content-analysis features that may process files, prompts, audio, screenshots or browsing context. Disable those features unless you understand the data handling and accept the trade-off.

Firewalls should remain on. App permissions should be reviewed for access to camera, microphone, files, photos, contacts, location and local network. Disk encryption protects data if a computer is stolen and the drive is removed or mounted elsewhere; it does not protect against ransomware when the system is unlocked. Recovery keys are critical: if you forget the password or lose the key, you may lose access permanently.

Turn off services you are not using, such as Wi-Fi, Bluetooth, remote desktop, file sharing or network discovery. This reduces the exposed attack surface.

Practical actions

• Enable lock screen and full-disk encryption, then store recovery keys safely.
• Keep the firewall enabled on all network types.
• Review privacy and app permissions after major operating-system updates.
• Review privacy and permissions of your AI or assistant.
• Use standard user accounts for daily work and administrator access only when necessary.
• Disable unused wireless, sharing and remote-access services.

 

Removable media

USB drives, USB sticks, SD cards and other removable media create high risk because they can carry malware, hidden files, malicious shortcuts or tampered firmware.

Do not use devices from unknown sources. A free USB stick, a found drive, borrowed SD card or conference giveaway can contain malicious content. Some attacks can emulate keyboards or network adapters, meaning the device does not behave like ordinary storage.

Even trusted removable media should be handled carefully. Scan the device, avoid autorun behaviour, and do not open unexpected files. If using external USB drives for backups, disconnect them after the backup completes so they are not continuously writable by ransomware.

Removable media should not be the only copy of important data. USB drives fail, are easy to lose and are often not encrypted. If a drive contains personal or work-sensitive data, use encryption and label it without revealing sensitive contents.

Practical actions

• Never plug in unknown USB devices or SD cards.
• Use encrypted removable storage for sensitive data.
• Disconnect backup drives after the backup has completed.
• Keep removable media physically secure and replace aging drives proactively.

 

Browsers and search engines

Browsers are the main interface to online life, so browser hygiene is central to personal security.

Understand the basic URL layout. The protocol appears before the domain, such as https://. The domain is the main site identity, and attackers often use lookalike domains or misleading subdomains. For example, bank.example.com is a subdomain of example.com, while example.com.fakebank.invalid belongs to fakebank.invalid. HTTPS is important because it encrypts traffic and validates the server certificate, but HTTPS alone does not mean a site is legitimate.

Bookmark commonly used URLs for banking, email, cloud services and government portals. Do not search for your bank name and click the first result; sponsored results and lookalike pages can be abused. Use real URLs or known bookmarks for sensitive services.

Avoid saving passwords directly in a browser when a dedicated password manager is available and appropriate. Browser profiles can help separate roles: one profile for banking with minimal extensions, one for general browsing, and one for testing or less-trusted sites. Profiles also help manage different security and privacy settings.

Extensions and plugins can read or change web pages, capture video, download files or inject scripts. Install only extensions from known providers, remove those you no longer need, and use script blockers carefully: exceptions should be limited to trusted sites you actually need.

URL habit: Read domains from right to left: the registrable domain near the end is what matters most. A familiar word on the left side may only be a subdomain controlled by someone else.

Practical actions

• Use bookmarks rather than search results for critical services.
• Check protocols and domains before entering credentials.
• Keep browsers updated and remove unnecessary extensions.
• Use separate browser profiles for banking, work, general browsing and high-risk research where useful.

 

Mobile phones and mobile apps

Mobile phone applications have become deeply embedded in both personal and professional life. They allow people to communicate instantly, manage finances, navigate unfamiliar places, shop, study, work remotely, access entertainment and organise everyday activities from almost anywhere. Their appeal comes largely from mobility and portability: a smartphone is usually within reach, and an app can provide a specialised service without requiring the user to visit a physical location or sit at a computer. Features such as saved preferences, biometric sign-in, notifications, digital wallets and location-based services can make routine tasks faster and more convenient. Professionally, apps support email, collaboration, document sharing, video meetings, scheduling and access to business systems, enabling people to remain productive while travelling or working away from the office.

However, this convenience has a less visible side. Many apps collect information about the people who use them, including account details, device identifiers, browsing or purchasing behaviour, contacts, photographs, location history and patterns of use. Depending on the permissions granted and the design of the app, it may also request access to the camera, microphone, call information, stored files, calendar or other components of the phone. Some of this access may be necessary—for example, a navigation app needs location data, while a video-calling app requires the camera and microphone—but excessive or poorly explained permissions can create privacy and security risks. Information may be retained for long periods, combined with data from other sources, shared with business partners or exposed through a data breach. Even when individual pieces of data appear harmless, together they can reveal a detailed picture of a person’s routines, interests, relationships, workplace and movements.

Companies, corporations and merchants encourage customers to install their apps because apps can make doing business easier for both parties. Customers may receive faster ordering, convenient payments, personalised recommendations, delivery tracking, electronic receipts, loyalty rewards and direct access to customer service. For the business, however, the app is also a powerful commercial channel. It creates a permanent presence on the customer’s phone, allows the company to send notifications and promotions, reduces reliance on physical stores or third-party websites, and can lower transaction and support costs. It may also help the company collect valuable information about customer behaviour, such as what people view, what they buy, how often they return, where they are located and which offers influence their decisions.

This explains why vendors often reserve larger discounts, loyalty points, special offers or additional conveniences for app users. The apparent generosity is usually part of a broader commercial exchange. A discount may encourage the customer to create an account, provide personal details, enable notifications, save payment information or use the service more frequently. Once the app becomes part of the customer’s routine, changing to a competitor may feel less convenient. The merchant benefits from increased sales, repeat business, stronger customer loyalty, more opportunities for targeted advertising and a richer source of data for analysing and predicting customer behaviour. In some cases, the value of this ongoing relationship may be considerably greater than the cost of the discount originally offered.

The same trade-off applies to games, social platforms and other “fun” or free apps. Although no purchase price may be charged, the app still needs to generate income or provide some other benefit to its developer. Revenue may come from advertising, in-app purchases, subscriptions, sponsorships or the collection and commercial use of behavioural data. The personal cost to the user may therefore be attention, exposure to advertising, reduced privacy, battery and data usage, or pressure to make repeated purchases. Poorly designed or malicious apps can introduce additional risks, including insecure storage of personal information, unwanted tracking, fraudulent charges, account theft or access to information that is unrelated to the app’s stated purpose. “Free” should therefore not automatically be understood as meaning that the user gives up nothing in return.

Mobile apps are not inherently harmful, and many provide genuine value, enjoyment and efficiency. The important issue is whether the benefits are proportionate to the information and access being requested. Users should consider who developed the app, why it needs particular permissions, how its privacy settings are configured and whether the same service could be used with less access to personal data. Ultimately, every app represents an exchange: the user receives convenience, entertainment or financial benefits, while the provider may gain revenue, attention, loyalty and information. Understanding that exchange allows people to enjoy the advantages of mobile technology without overlooking its potential personal, professional and security costs.

Protecting and regularly backing up a mobile phone is important because the device often contains far more than telephone numbers and photographs. It may provide access to email, banking, payment cards, workplace systems, social media, health information, personal documents and authentication codes used to sign in to other services. Strong screen locks, biometric security, current software updates, carefully controlled app permissions and reliable cloud or computer backups can reduce the risk of permanent data loss and unauthorised access. Features that allow the phone to be located, locked or erased remotely should also be enabled before the device is lost or stolen. A backup ensures that contacts, messages, photographs, settings and other important information can be restored to a replacement device rather than being lost permanently.

Being without a phone can cause significant personal and professional disruption, particularly when it is used for communication, navigation, payments, work access and identity verification. The consequences can be more serious if the phone is stolen, cloned or otherwise compromised. A criminal may be able to impersonate the owner, intercept messages and verification codes, access accounts, make fraudulent purchases, contact friends or colleagues, or obtain sensitive personal and business information. A compromised device can also expose saved passwords, location history, private photographs and confidential workplace data. For this reason, a missing or suspiciously behaving phone should be treated as a potential security incident: the mobile provider, employer and relevant financial institutions should be notified promptly, important passwords should be changed, and the device should be remotely locked or erased where possible.

Configure a strong device PIN or passcode for the phone, not only the SIM card. The SIM PIN protects use of the SIM in some cases, but the phone lock protects access to the device and data. Lock screens should require authentication quickly and should hide sensitive notification content where appropriate.

Biometric unlock is convenient, but some users choose not to use biometrics for privacy, legal or personal reasons. A strong passcode is still essential because biometrics generally unlock a device; they do not replace the need for a strong fallback secret.

Review all privacy and security settings for the operating system and every app. Disable diagnostics, feedback, user-experience data sharing and targeted advertising where not needed. Turn off Wi-Fi, Bluetooth, hotspot, NFC and location services when not in use, especially in sensitive environments. Phones can be cloned or accounts hijacked, although it is not always easy; strong account recovery settings and carrier protections help.

Install apps only from known providers and official app stores where possible. After every major app or OS update, check permissions again because defaults, features and data handling can change.

Consider the consequences of installing a “fun”  App and coexisting with your other very critical Apps such as email and social media accounts, banking, stock/crypto accounts, your MFA, etc. Do you know what that “fun” App does in the background?

Like it or not but mobile smart devices are becoming core to everything that we do. Therefore, they must be protected with the utmost diligence.

Mobile control	What to check	Why it matters
Device lock	PIN/passcode strength, timeout, notification privacy.	Prevents immediate access after loss or theft.
App permissions	Camera, microphone, photos, files, contacts, location.	Limits unnecessary data collection and abuse.
Network services	Wi-Fi, Bluetooth, hotspot, NFC, location.	Reduces tracking and local attack surface.
Account recovery	MFA, backup codes, trusted numbers, carrier PIN.	Helps recover after a lost phone or SIM attack.

 

Practical actions

• Use a strong phone passcode and fast lock timeout.
• Review app permissions after every update or when an app adds new features.
• Install only apps you need and remove unused apps.
• Prepare for lost-phone recovery before the phone is lost.

 

Anti-virus and endpoint protection

Anti-virus scans files, programs and behaviour against known signatures, heuristics and reputation databases. It offers some protection, but it is not a guarantee.

Signature-based detection is effective against known malware but weaker against new, targeted or modified malware. Behavioural detection can help, but it may also miss attacks or produce false positives. Anti-virus should be viewed as one layer in a larger system of safe behaviour, updates, least privilege, backups and account protection.

Having a Mac does not make a user immune. Windows is often targeted more because it is common in business environments, but macOS, Linux, iOS and Android all have malware and abuse paths. Browser extensions, malicious documents, phishing and credential theft are platform-independent.

Endpoint protection should be active, updated and not ignored. Alerts should be read carefully, and repeated detections should trigger investigation rather than simply clicking allow.

Practical actions

• Keep built-in or reputable anti-virus protection enabled and updated.
• Do not disable protection just to run a download, crack, macro or unknown tool.
• Treat detections as a signal to investigate source, account exposure and backup integrity.

 

Updates and configuration drift

Updates apply to computers, phones, apps, browsers, TVs, routers, NAS devices, smart home equipment and cloud software. They are necessary, but they can also change behaviour and settings.

Updates fix security vulnerabilities, improve reliability and add support. Delaying security updates indefinitely leaves known weaknesses open. However, updates can break features, install optional applications, add new cloud or AI functions, change privacy settings, enable diagnostics or alter defaults. This creates configuration drift: the device slowly moves away from the secure state you intended.

A practical approach is to keep security updates current while remaining cautious about optional features and major upgrades. Where possible, review release notes, ensure backups exist before major updates, and schedule changes when you have time to fix problems. On personal devices that force updates, make a habit of checking privacy, permissions and default apps after updates complete.

Routers, NAS devices, smart cameras and other home infrastructure are often forgotten. These devices may expose admin interfaces, remote access and cloud features. They should receive firmware updates from trusted vendor sources and should not retain default credentials.

Practical actions

• Install security updates promptly, especially for browsers, operating systems and routers.
• Avoid unnecessary optional features, bundled products and trial software.
• Check privacy, app permissions and default settings after major updates.
• Back up important data before major operating-system or device upgrades.

 

The real cost of data loss

Data loss has practical, emotional, financial and legal costs. It is not only an IT problem.

When data or services are offline or unavailable, normal activity stops. A small business may be unable to take orders or send invoices. A household may be unable to access documents needed for travel, tax, health or school. A professional may lose work in progress.

Some data is lost forever if there is no recoverable copy. Wedding photos, baby photos, creative projects, financial records, scanned identity documents and medical records can be irreplaceable. Other data may be stolen or compromised, leading to identity theft, fraud, blackmail or reputational harm.

Individuals may also hold other people’s data: family records, client information, committee documents, club member lists, financial information or medical details. Protecting that data is a responsibility, not only a personal preference.

Cost category	Examples	Security implication
Offline / unavailable	Cannot work, transact, send invoices, access records.	Availability and recovery time matter.
Lost forever	Photos, documents, medical or financial history.	Backups must be tested and retained.
Stolen / compromised	Identity, fraud, personal records.	Confidentiality, encryption and access control matter.
Responsibilities	Other people’s data, work data, family records.	Legal, ethical and professional duties may apply.

 

Practical actions

• Identify data you cannot replace and protect it first.
• Separate recovery planning for availability from privacy planning for confidentiality.
• Consider who else could be harmed if data you hold is lost or exposed.

 

Disruption to data services

Data services can be disrupted by environmental events, administrative mistakes, system failures and malicious activity.

Environmental events include power loss, fire, flood, earthquake, storm, heat and theft. Administrative causes include accidental deletion, poor naming, bad practices, no backups, no recovery plan and misconfigured sharing. System causes include failed hardware, poor design, lack of redundancy, full disks, expired subscriptions and corrupted storage. Malicious causes include viruses, malware, denial of service, ransomware, account takeover and deliberate deletion.

The source of disruption affects recovery. A failed laptop may be solved by restoring to another device. A cloud account takeover may require account recovery, password resets and audit of sharing permissions. A house fire requires offsite copies. Ransomware requires clean backups and confidence that restored systems are not reinfected.

Individuals should build resilience around likely disruptions rather than only dramatic disasters. The most common incidents are often accidental deletion, failed drives, lost phones, phishing and forgotten passwords.

Disruption type	Example	Resilience measure
Environment	Power loss, fire, flood, earthquake, theft.	Offsite backups, surge protection, cloud copy, recovery documents.
Administrative	Mistakes, bad practices, no backups, no plans.	Clear folder structure, versioning, documented backup schedule.
Systems	Failed disk, no redundancy, corrupted device.	Reliable hardware, SMART monitoring, NAS/cloud, replacement plan.
Malicious	Viruses, malware, denial of service, ransomware.	MFA, updates, anti-virus, offline backups, incident plan.

 

Practical actions

• Plan for the most likely failures, not only worst-case disasters.
• Keep recovery information accessible without depending on the failed system.
• Test recovery after changing backup tools, cloud providers or device structure.

 

Data in transit, data at rest, virus checking and encryption

Data in transit is moving across a network. Data at rest is stored on a device, drive, backup, cloud service or server. Both states need protection.

Encryption in transit protects data while it moves between your device and a service. HTTPS, secure mail protocols and VPN tunnels are examples. Encryption at rest protects stored data, such as a full-disk encrypted laptop, encrypted phone, encrypted USB drive or encrypted cloud backup.

Virus checking can inspect files before, during or after transfer, but it is not a substitute for encryption or backups. A file can be private but malicious, or clean but exposed. Security controls solve different problems: encryption protects confidentiality, anti-virus helps detect malicious content, backups protect availability and integrity, and access controls restrict who can reach the data.

Individuals should know where encryption is active and where it is not. A cloud provider may encrypt storage on its systems, but account compromise can still expose files. A password-protected document may not be strongly encrypted depending on the format. An encrypted disk protects against theft only while locked; when the user is signed in, malware running as that user may access files.

Data state	Example	Primary concern	Control
In transit	Logging into banking over Wi-Fi.	Interception or manipulation.	HTTPS, certificate warnings, VPN when appropriate.
At rest	Files stored on laptop or USB drive.	Theft or unauthorised access.	Full-disk encryption, file encryption, strong device lock.
In backup	Cloud, NAS, USB, external disk.	Loss, ransomware, unauthorised access.	3-2-1 design, encryption, offline/offsite copies, retention.
Being opened	Attachment or download.	Malware execution.	Virus checking, sandboxing, cautious opening.

 

Practical actions

• Use encrypted connections and never ignore certificate warnings for sensitive activity.
• Enable full-disk encryption on laptops and phones, and encrypt sensitive removable media.
• Do not confuse encryption with backup; both are needed.

 

Backups and recovery strategy

Backups are the only practical protection against permanent data loss from ransomware, hardware failure, accidental deletion or disaster, if they are done properly and tested.

Backup all critical devices and not just a computer ie:

• files and data
• computers
• mobile phones
• network devices: routers, firewalls, NAS appliances

A backup strategy should define what is backed up, how often, where backups are stored, how long they are retained, who can access them, how they are protected, and how recovery is tested. A policy states the intended rules; a plan describes the practical steps; a test proves the plan works.

Full backups copy everything in scope. Incremental backups copy changes since the last backup. Some tools back up entire systems, some copy disk blocks, and others protect specific folders. Real-time syncing is useful for convenience but is not the same as backup unless versioning and retention protect against deletion, corruption and ransomware.

Backups can target external USB, another computer, a NAS with snapshots, cloud storage, or specialised backup services. Each has trade-offs. Local backups restore quickly but can be destroyed by theft, fire or ransomware. Cloud backups are offsite but depend on accounts, subscriptions, bandwidth and provider retention. NAS systems can provide snapshots and local speed but must be secured and backed up offsite.

Backup truth: A backup has value only when it can be restored. A backup that has never been tested is an assumption.

Practical actions

• Write down what is included in backup scope: entire device, specific folders, photos, documents, password vault, phone data and cloud data.
• Include recovery steps, not just backup steps.
• Test restoring files regularly and after changing backup software or devices.
• Protect backup accounts with unique passwords and MFA.

 

Backup media, retention, syncing and versioning

Backup design depends on media, retention, versioning and whether data is copied or synchronized.

Disk-to-disk backup is common for individuals because external drives and NAS devices are affordable and quick. Disk-to-cloud backup provides offsite protection and geographic separation. Disk-to-tape is less common at home but remains relevant in some organisations because tape can be offline and cost-effective for long retention.

Retention defines how long backups and versions are kept. Without retention, a backup may only preserve the latest bad state. Versioning allows recovery of earlier versions after corruption, accidental edits or ransomware. A point-in-time copy is useful only if it predates the incident and is still retained.

Real-time syncing keeps files available on multiple devices but can replicate mistakes immediately. If a synced folder is encrypted by ransomware, the encrypted files may sync to the cloud. Version history may allow recovery, but only within the provider’s retention window. Important data needs backup, not only synchronization.

Method	Strength	Weakness	Best use
External USB disk	Fast, inexpensive, under your control.	Can be lost, stolen or encrypted if left connected.	Local copy disconnected after backup.
Cloud backup	Offsite and resilient to local disaster.	Depends on account security, bandwidth and subscription.	Offsite copy for important folders or full systems.
NAS	Central storage, snapshots and local speed.	Needs security, updates and offsite protection.	Home file share and snapshot target.
Sync service	Convenient access across devices.	Replicates mistakes unless versioning exists.	Convenience plus version history, not sole backup.
Tape or offline media	Strong isolation and long retention.	Less convenient and uncommon at home.	Archive and high-assurance retention.

 

Practical actions

• Know your retention period and version history window.
• Use versioning for folders that are edited often.
• Disconnect or isolate at least one backup copy after completion.
• Do not rely on sync as your only backup.

 

Backup best practice: 3-2-1

The 3-2-1 rule is a simple backup design: keep three copies of data, on two different media types, with one copy offsite.

Your backup strategy should create three copies of your data.

The first copy can be your locally attached USB drive. Your second copy can be to a NAS (network-attached storage) or virtual tape library (VTL). Your third copy can be to a Cloud service, remote NAS or VTL or even a USB drive that is cycled and taken to a safe geographic location.

Two media types reduces the chance that one failure mode destroys all copies. One offsite copy protects against theft, fire, flood or local disaster.

For ransomware, add an isolation principle: at least one copy should not be continuously writable by the computer. That may mean unplugging a USB drive after backup, using NAS snapshots with restricted access, using immutable cloud backup or rotating offline drives.

The exact implementation can be simple. A family photo library could exist on a laptop, a NAS or external drive, and a cloud backup. Financial and identity documents could exist on a computer, encrypted external drive and encrypted cloud vault. The key is to know which copy is primary, which is backup, and how each is protected.

3-2-1 element	Meaning	Individual example
3 copies	Primary plus two backups.	Laptop + USB backup + cloud backup.
2 media types	Avoid one technology failure mode.	Internal SSD + external disk + cloud object storage.
1 offsite	Protect against local disaster.	Cloud backup or drive stored at another trusted location.
Isolation	Protect from ransomware.	Unplugged drive, immutable backup or NAS snapshots.

 

Practical actions

• Implement 3-2-1 for irreplaceable data first.
• Unplug USB backup drives after backup jobs complete.
• Store at least one copy away from the home or office.
• Test restoring from each type of backup.

 

Data availability, RTO, RPO and disaster recovery

Availability planning asks how quickly data must be restored and how much data can be lost. The two key terms are RTO and RPO.

Recovery Time Objective (RTO) is how fast you need data or a service back online. A family photo archive may tolerate days. A work computer needed for tomorrow’s deadline may require hours. A small business order system may need minutes or less.

Recovery Point Objective (RPO) is how much data you are prepared to lose, measured as time. If backups run nightly, the RPO may be up to one day of changes. If snapshots run every fifteen minutes, the RPO may be fifteen minutes. Lower RTO and RPO usually cost more in money, complexity and administration.

Disaster recovery is more than backups. It includes plans, rehearsals, credentials, replacement devices, software installers, license keys, network configuration, recovery contacts and decisions about what to restore first. Costs matter: the most resilient solution is not always justified for every dataset.

Term	Question answered	Example individual decision
RTO	How long can I be without it?	I need tax records within one day; photos can wait a week.
RPO	How much recent work can I lose?	A daily backup means I may lose today’s edits.
DR plan	What steps get me operating again?	Buy replacement laptop, restore cloud backup, sign in with recovery codes.
Rehearsal	Do the steps work?	Restore a sample folder to a spare location every quarter.

 

Practical actions

• Set different RTO and RPO targets for critical, important and archival data.
• Document recovery steps, credentials and where recovery keys are stored.
• Rehearse recovery before a crisis.

 

Availability technologies: RAID, snapshots and replication

The only method of improving availability is to identify and remove SPOFs (single points of failure) by building in redundancy.

RAID, snapshots and replication improve availability and recovery options, but they do not replace backups.

RAID combines multiple disks to provide varying levels of performance and protection against disk failure. RAID 1 mirrors data, RAID 5 and RAID 6 use parity, and RAID 10 combines mirroring and striping. RAID can keep a system running after a disk failure, but it does not protect against deletion, corruption, ransomware, theft, fire or account compromise.

Snapshots are point-in-time copies. On a NAS or file system, snapshots can allow rapid recovery to an earlier state. The recovery point can be very low, such as minutes, and recovery time can be short if the storage remains healthy. However, snapshots stored on the same system can be lost if that system is destroyed or compromised.

Replication is remote copy. It sends data from a production system to another system, such as an offsite server or cloud. Replication can support disaster recovery, but it may replicate errors, deletions or ransomware unless versioning, delay, snapshots or immutability are included.

Storage arrays, local file shares and cloud storage can be a starting point for high availability and disaster recovery because they may include hardware redundancy, dual power supplies, dual network paths, RAIDed disks, snapshots and replication. Individuals and small offices should balance these capabilities against cost, complexity and security maintenance.

Technology	What it helps with	What it does not solve
RAID	Disk failure and local availability.	Accidental deletion, ransomware, theft, fire, account compromise.
Snapshots	Fast point-in-time rollback.	Loss of the storage system unless replicated or backed up.
Replication	Remote copy and disaster recovery.	Bad data can replicate without versioning or delay.
Backups	Recoverable independent copies.	May not provide instant availability unless designed for low RTO.

 

Practical actions

• Identify SPOFs.
• Build redundancy
• Use RAID for availability, not as a substitute for backup.
• Enable NAS snapshots where available and protect snapshot administration.
• Combine replication with retention or snapshots so mistakes are not instantly permanent.

 

Infrastructure overview for home or small office users

A secure home or small-office environment connects laptops, phones, tablets, printers, cameras, smart devices, network equipment, storage and cloud services. Security depends on how these pieces are connected and managed.

Start with the router and Wi-Fi network. Change default administrator credentials, use strong Wi-Fi encryption, keep firmware updated, disable unnecessary remote administration, ensure the firewall is enabled, and consider a guest network for visitors and smart devices. Network segmentation reduces the risk that a compromised camera or guest device can reach personal computers or storage.

Central storage such as a NAS can provide shared folders, local backups, snapshots and media storage. It should have strong passwords, MFA where available, limited accounts, limit account privileges, updates, firewall rules and offsite backup. A NAS is valuable but should not become a single point of failure.

Cloud services add offsite availability and collaboration. Protect cloud accounts with strong unique passwords, MFA, recovery codes, sharing reviews and awareness of sync behaviour. Printers, cameras, TVs and smart devices are computers too: update them, remove unused cloud features and isolate them where practical.

A simple infrastructure map or diagram helps: list devices, where data lives, how it is backed up, and which accounts control access. This map becomes essential during an incident or when replacing equipment.

Practical actions

• Change router, modem, NAS and smart-device default passwords.
• Use separate Wi-Fi networks or VLANs for guests and smart devices where practical.
• Document the network, backup targets and critical account recovery paths.
• Do not expose NAS or camera interfaces to the internet unless necessary and secured.

 

Incident response and recovery

A personal incident response plan helps you act quickly without making the situation worse.

The first action is containment. Do NOT use a device that is suspected of been compromised – use backup/safe/clean/alternate device. If malware or ransomware is suspected, disconnect the device from the network but avoid deleting evidence or randomly running clean-up tools before you understand the scope. If an account is compromised, change the password from a clean device, revoke sessions, review recovery details, enable MFA and check forwarding or sharing rules.

Preserve information: screenshots, suspicious emails, URLs, sender addresses, transaction IDs, detection alerts, timeline and affected accounts. This information helps banks, providers, employers, law enforcement or support teams. For work-related data, follow organisational reporting requirements immediately.

Recovery should use clean backups onto new and safe devices and using trusted installers. Do not restore malware. After recovery, improve controls: patch the root cause, rotate exposed passwords, review MFA, check permissions, update backups and document lessons learned.

Step	Purpose	Examples
Contain	Stop further damage.	Disconnect network; revoke sessions; freeze cards if needed.
Assess	Understand scope.	Which devices, accounts, data and backups are affected?
Preserve	Keep useful evidence.	Emails, screenshots, logs, alerts, transaction records.
Recover	Return safely to operation.	Restore clean backup; reinstall; reset credentials.
Improve	Prevent repeat.	Patch, enable MFA, change habits, adjust backups.

 

Practical actions

• Write down emergency contacts for banks, mobile carrier, email provider and workplace support.
• Keep recovery codes and backup keys accessible without relying on the compromised device.
• After any incident, change related passwords and review account activity.

 

Personal security action checklist

The checklist below turns the white paper into an actionable personal security program. Start with critical accounts and irreplaceable data, then expand to devices, networks and backups.

Do not try to fix everything in one sitting. A useful approach is to complete the quick wins first, schedule the deeper tasks, and then review the checklist monthly or after major changes such as a new phone, router, computer, job or cloud provider.

By breaking down the actions and understanding the steps, you can repeat them and develop good habits as your baseline.

Area	Target state	Done / date
Critical accounts	Unique passphrases, MFA, recovery codes stored safely, recent activity reviewed.
Email account	Strongest protection because email resets other accounts; check forwarding rules and recovery details.
Password manager	Chosen, secured with strong passphrase and MFA; emergency recovery considered.
Secret questions	Random answers stored securely; public personal facts avoided.
Computers	Lock screen, firewall, updates, privacy settings, standard user account, disk encryption.
Phones	Strong passcode, app permissions reviewed, backup/recovery prepared, unused services disabled.
Browsers	Bookmarks for critical sites, minimal extensions, separate profiles where useful.
Email habits	Sender, links and attachments verified; suspicious requests checked through known-good channels.
Public networks	Hotspot or VPN used where appropriate; file sharing disabled; sensitive actions limited.
Removable media	Unknown USB devices avoided; backup drives disconnected after use.
Backups	3-2-1 implemented for irreplaceable data; restore tested; retention known.
Ransomware readiness	Offline or isolated backup exists; response steps known.
Router/NAS/smart devices	Default passwords changed, firmware updated, remote access restricted.
Incident plan	Emergency contacts, account recovery steps, and backup keys documented.

 

First 60 minutes: Strengthen email, banking, cloud storage and password manager accounts first. These accounts are the control points for recovery, identity and money.

Glossary

Term	Meaning
AAA	Authentication, authorisation and accounting: who is accessing data, whether they are allowed, and whether access is recorded.
Backdoor	A hidden or unintended way to bypass normal access controls.
Backup	A recoverable copy of data stored separately from the primary copy.
Brute force	Trying many possible passwords or keys until one works.
CIA	Confidentiality, integrity and availability: the three core information security principles.
Encryption	Transforming data so it cannot be read without the correct key.
Hashing	A one-way mathematical representation used to verify data or passwords without storing the original.
MFA	Multi-factor authentication: requiring more than one type of proof during sign-in.
NAS	Network attached storage: a storage device available over a local network.
Phishing	A social engineering attack that tricks people into revealing information or taking unsafe actions.
RAID	A storage technique using multiple disks for performance and/or resilience against disk failure.
Replication	Copying data to another system, often remotely, to support availability or disaster recovery.
RPO	Recovery Point Objective: how much data loss, measured in time, is acceptable.
RTO	Recovery Time Objective: how quickly a service or data must be restored.
Snapshot	A point-in-time copy used to recover a previous state quickly.
VPN	Virtual Private Network: an encrypted tunnel from a device to a VPN server.

 

Closing note

Security for individuals is a set of habits supported by technology. The strongest personal security posture combines cautious behaviour, strong authentication, privacy-aware settings, updated devices, limited permissions, resilient backups and rehearsed recovery.

Check out our other Cheat Sheets and Blogs and if you would like us to write a cheat sheet for you, for FREE, (and we find it suitable) Contact Us.