Notes on everyday security for people at work
Most attacks start with an ordinary message.
These notes explain how to read a suspicious message, protect your accounts, and what to do in the first hour after a mistake. Every note is short and based on public guidance from national security agencies.
- From
- IT Service Desk <helpdesk@company-portal-login.example1>
- To
- you@company.example
- Subject
- Your password expires in 2 hours2
Hello,
Our records show that your mailbox password expires today. To keep access to your email, confirm your current password before 18:00.
3
If you do not confirm, your account will be suspended.4
IT Service Desk
- The domain is not your company’s. Anyone can type a display name; read what follows the @.
- A deadline of two hours is there to stop you from thinking. Real IT teams do not work this way.
- The button opens a copy of your sign-in page. Open the real one yourself instead.
- A threat of losing access is pressure, not procedure.
A typical phishing email, with the four details that give it away.
What to do with a message like this: do not click, report it to your IT team, then delete it.
Read
Short notes, grouped by the moment you need them.
Messages you receive
How to read a suspicious message
Three things to check before you click, and what to do when a message fails the check.
A QR code is a link you cannot read
Why a square of dots deserves the same caution as an unknown link, and how to check one.
When an email asks you to change payment details
Business email compromise uses no malware and no links. It needs one person to skip one phone call.
The caller who needs you to act right now
Phone scammers borrow the voice of a bank, a courier, a government office or a relative. The script changes; the pressure does not.
The warning that fills your screen is not from your computer
A page that shouts about a virus and shows a phone number is an advertisement for a scam. Real security warnings never ask you to call.
Your accounts
One long password per account, kept in a manager
Reused passwords are how one leaked website turns into five lost accounts. A password manager removes the reason to reuse.
Turn on a second step for sign-in
With multifactor authentication, a stolen password is not enough. Some second steps resist phishing better than others.
Passkeys: sign in without a password
A passkey replaces the password with a key stored on your device. There is nothing to type, so there is nothing to phish.
What the current NIST guidance says about passwords
The 2025 edition of the NIST digital identity guidelines drops several habits that made passwords worse. A short reading for anyone who sets the rules.
Devices and data
Updates close doors that are already known
Most attacks on devices use flaws that were fixed months earlier. Automatic updates remove the gap.
Back up what you cannot afford to lose
A backup turns ransomware, theft or a dead laptop from a disaster into a bad afternoon, provided it is separate and tested.
Your phone holds the keys to everything else
Email, banking and sign-in codes all live on your phone. A few settings decide what a thief or a bad app can reach.
The box in the hallway: securing your home router
Every device in your home reaches the internet through one small box. Twenty minutes in its settings is enough.
Public Wi-Fi without the drama
Open networks in cafés, hotels and airports are usable if you know which one you joined and what you do on it.
Cameras, speakers and other small computers
A smart device is a computer that rarely gets updates and often keeps its factory password. Four settings fix most of it.
When something goes wrong
The first hour after a mistake
You clicked, typed a password or sent a payment. What you do in the next hour decides how much it costs.
Ransomware in plain words
A program locks your files and its authors sell you the key. What decides the outcome is what you set up before it happens.
Six questions for a small team
The NIST Cybersecurity Framework 2.0 groups all security work into six functions. For a team of five or fifty they turn into six plain questions.
Physical security
Lock the screen every time you stand up
An unlocked computer gives a passer-by everything you are signed in to. Locking takes one second.
The stranger who walks in behind you
Most people who get into an office without permission are simply let in. Here is how to be polite and still keep the door closed.
A found flash drive is not a gift
Plugging in an unknown drive lets its owner run code on your computer. The same goes for free cables and public charging ports.
Devices on the road
A laptop is most often lost in a taxi, a café or a hotel room. Prepare before the trip so that a lost device is only a lost device.
Before you sell, give away or bin a device
Deleting files does not remove them. A few steps make sure the next owner gets an empty device.
Ten minutes of setup
Eight small changes that stop most everyday attacks. Tick them off as you go; the list is saved in this browser only.
Tools
Estimate a password, see what a website learns about your connection, print a poster.
Open the tools