3 rules of personal cybersecurity: Advice for our clients (summary)

Personal cybersecurity has become more important than ever. Yet, for many ordinary people, the concept of cybersecurity can be overwhelming. To make this crucial topic more approachable, I often recommend three essential rules for personal cybersecurity. They are simple, understandable, and most importantly, a great start in offering a level of protection against most untargeted cyberattacks.

The Power of Simplicity

The beauty of these three rules lies in their simplicity. If your parent or your grandparent asks about these rules, you can explain them very quickly, and they understand. This is crucial because cybersecurity, when presented as a complex topic, overwhelms most people. They hear an array of confusing and contradictory advice, which is often well-meaning but ill-founded. Its better to have a few cyber security rules well applied than all of them ignored.

The Three Rules explained

Rule 1: Protect your most important accounts

The first rule is to safeguard your most important accounts. This includes your email account (which could reset all of your other accounts), banking or financial accounts, online storage accounts, and password safe accounts. Protecting these accounts involves using complex passwords, and enabling two-factor authentication (preferably something that includes a biometric like Face ID or a fingerprint). By securing these accounts, you significantly reduce your chances of falling victim to a cyberattack.

On the other side, also think about how your loved ones could access these accounts (if they needed to) if something happened to you.

Example: On a case we examined, a personal account was breached. It did not have two-factor authentication. Many personal documents were stolen by criminals. The criminals learned that the person was undergoing a divorce, and that the parties had agreed on an amount to settle the relationship. They then used that information to trick the victim into transferring over $70K to criminal elements.

The lesson: Protect your email account because people can impersonate you, reset passwords, or see a lot of sensitive activities.

Rule 2: Use only trusted devices

The second rule is to use only trusted devices. A trusted device is one you know the history of, and has only software you trust running on it. Be selective about the software you install, particularly browser extensions or software of dubious origin, can go a long way to protecting you from malware. That means also keeping software up to date, and recycling devices for devices that no longer receive security updates.

Now, sometimes, we want to relax the rules about the trust of a device a bit. For example, if there are budding tech enthusiasts in your household who wish to experiment, it’s advisable to separate the machines used for this purpose from those used for sensitive tasks (like email, banking, and your password safe). Not everyone is fortunate enough to have spare machines for this, so you could also research virtualisation as a way to allow safe experimentation.

Special Note: In my experience, virus scanners are helpful, but they don’t detect everything. Much easier and safer to stop bad software getting onto your device.

Example: A CEO had a personal machine which was not managed by the company’s IT security policy. He purchased a Mac because he heard they didn’t get viruses. He was wrong. He had installed untrusted extensions into his web browser which stole his credentials to his (two-factor protected) work email account. Criminals used this information for corporate espionage purposes which was ultimately very damaging.

The lesson: Use only a trusted machine for your work, because criminals can monetise your business’s information.

Rule 3: Maintain the trustworthiness of your devices

The final rule is to do everything possible to maintain the trustworthiness of your devices. This means being vigilant about what you install and visit online. It also involves regularly checking your device settings to review what permissions have been granted to different apps.

For example, when I run a class for cyber security professionals, many of them find it eye-opening to see which apps have been allowed access to your camera or location on their phones. As an exercise, I often ask my workshop participants to check their phone’s settings to see what apps have what permissions. Why not try it yourself now? Here is a link for Apple’s procedure. For Android devices, Google does not maintain a standard procedure as of June 2023, so you may need to play around with your device to find the settings for location, microphone and contacts sharing (among others).

Setting a baseline for personal cybersecurity

The above-mentioned three rules may not provide a foolproof safeguard against every conceivable cyberthreat. However, they lay the groundwork for personal cybersecurity, catering especially to individuals who aren’t under direct or specific threat. These rules establish a minimum cybersecurity standard that, regrettably, many still fail to meet.

It’s worth noting that these rules aren’t derived from scientific studies. Rather, they are the product of our observational insights and practical experience, gathered from our work in cyber breach investigations. They represent the principles that seem to get the most ‘bang for buck’.

Note for special risk people

These guidelines serve as a starting point for individuals with regular risk profiles. However, if you’re a business owner, executive leader, high-profile public sector individual, certain types of journalists, activists, or fall within other specialised risk categories, your cybersecurity needs may be more nuanced and require a tailored plan. In these instances, it’s crucial to seek out expert advice tailored to your unique situation.

Does your business need cyber defence? You need more than these three rules

These rules, though, are primarily intended for individual users who don’t have ‘special risks’. For businesses and corporations, a more tailored approach to cybersecurity is needed. At Notion, we specialise in assisting companies to define and implement a cyber defence strategy that is appropriately scaled to their specific needs. If you wish to benefit from Notion’s extensive experience in investigating cyber breaches, feel free to get in touch with us.