← Back to Tools
Cybersecurity threats come from many directions: opportunistic criminals running automated attacks, targeted attacks by skilled adversaries, malicious insiders, and nation-state actors. Most people only face the first category — automated opportunistic attacks.
The good news: most cyberattacks are not sophisticated. They exploit the same basic weaknesses: reused passwords, unpatched software, and clicking on malicious links. Fixing these three problems eliminates the vast majority of your risk.
The 80/20 rule of security: 80% of breaches are caused by just a few root causes — weak passwords, phishing, unpatched vulnerabilities, and misconfigured systems. Fixing these is more valuable than exotic defenses.
🎣 Phishing
Tricking you into revealing credentials or installing malware via deceptive emails, SMS, or calls. Over 90% of data breaches start with phishing.
✓ Verify sender addresses • Don't click unexpected links • Use 2FA • Hover over links before clicking
🔐 Credential Stuffing
Attackers take email/password combinations from breached databases and try them on other services. Works because most people reuse passwords.
✓ Unique password for every site • Use a password manager • Enable 2FA • Check haveibeenpwned.com
💰 Ransomware
Malware that encrypts your files and demands payment to decrypt them. Often delivered via phishing or exploit kits. Can spread across networks.
✓ Regular offline backups (3-2-1 rule) • Don't open unexpected attachments • Keep systems patched • Email filtering
🕵️ Social Engineering
Manipulating people into taking actions or revealing information. Exploits trust, urgency, authority, and reciprocity — not technical vulnerabilities.
✓ Verify requests through known channels • Never give credentials to inbound callers • Create a verification code word with family
🔓 Unpatched Vulnerabilities
Attackers exploit known security flaws in software that hasn't been updated. Eternal Blue (used in WannaCry) was patched by Microsoft months before it caused $4B in damage.
✓ Enable automatic updates • Patch within 48 hours of critical releases • Remove unused software
🎯 Least Privilege
Grant users only the minimum access needed. If a process doesn't need admin rights, don't give it admin rights.
🛡️ Defense in Depth
Multiple layers of security. If one layer fails, others still protect. No single control is sufficient.
🔒 Zero Trust
Never trust, always verify. Assume breach. Don't trust network location — verify every access request explicitly.
📐 Attack Surface Reduction
Remove what you don't use. Fewer services, ports, users, and software = fewer ways to attack.
📋 Separation of Duties
No single person should have enough access to commit and conceal fraud. Split critical functions across multiple people.
📊 Audit & Monitor
Log everything. You can't detect what you can't measure. Anomalies in logs often reveal breaches in progress.
Email Red Flags
- 🚩Sender email domain doesn't match the company (paypa1.com, amaz0n-support.net)
- 🚩Generic greeting ("Dear Customer") when the company knows your name
- 🚩Urgent language: "Your account will be suspended in 24 hours"
- 🚩Links that don't match the displayed text (hover before clicking)
- 🚩Unexpected attachments, especially .exe, .zip, .docm, .xlsm
- 🚩Requests for credentials, passwords, or payment info by email
Golden rule: If an email asks you to click a link to log in, don't use the link. Instead, type the website address directly into your browser or use your saved bookmark.
- ✓Never open email attachments from unknown senders — scan with VirusTotal if unsure
- ✓Only download software from official sources and app stores
- ✓On Windows: enable Windows Defender (free, built-in, very effective)
- ✓Disable macros in Office documents from the internet
- ✓Run as a standard user, not as administrator
- ✓Use an ad blocker — malvertising is a common malware delivery vector
- ✓Verify software checksums (SHA-256 hash) when downloading sensitive tools
The majority of successful cyberattacks exploit vulnerabilities that have already been patched. Updates are not optional — they are your most reliable defense against known threats.
- ✓Enable automatic updates for your operating system
- ✓Keep browser and browser extensions updated
- ✓Update apps promptly — especially anything internet-facing
- ✓Replace end-of-life software that no longer receives security patches
- ✓Update router firmware — often forgotten but critical
The WannaCry ransomware (2017) infected 230,000 computers using a vulnerability Microsoft had patched two months earlier. Patching is free. Ransomware recovery is not.
Backups protect against ransomware, hardware failure, accidental deletion, and theft. The 3-2-1 rule is the gold standard:
- 3Keep 3 copies of your data (1 original + 2 backups)
- 2Store on 2 different media types (e.g. internal drive + external drive)
- 1Keep 1 copy offsite (cloud or physically separate location)
Critical: A backup connected to your computer can also be encrypted by ransomware. Keep at least one backup that is offline or air-gapped.
Test your backups periodically by actually restoring a file. A backup you've never tested is not a backup — it's a hope.