Cyber Hygiene Field NotesNew and updated notes https://us.rmrf.name/2026-11-11T09:00:00Z garik How to read a suspicious messagehttps://us.rmrf.name/articles/suspicious-message/2026-11-11T09:00:00ZThree things to check before you click, and what to do when a message fails the check. A QR code is a link you cannot readhttps://us.rmrf.name/articles/qr-codes/2026-11-11T09:00:00ZWhy a square of dots deserves the same caution as an unknown link, and how to check one. When an email asks you to change payment detailshttps://us.rmrf.name/articles/payment-requests/2026-11-11T09:00:00ZBusiness email compromise uses no malware and no links. It needs one person to skip one phone call. One long password per account, kept in a managerhttps://us.rmrf.name/articles/passwords/2026-11-11T09:00:00ZReused passwords are how one leaked website turns into five lost accounts. A password manager removes the reason to reuse. Turn on a second step for sign-inhttps://us.rmrf.name/articles/second-step/2026-11-11T09:00:00ZWith multifactor authentication, a stolen password is not enough. Some second steps resist phishing better than others. Updates close doors that are already knownhttps://us.rmrf.name/articles/updates/2026-11-11T09:00:00ZMost attacks on devices use flaws that were fixed months earlier. Automatic updates remove the gap. Back up what you cannot afford to losehttps://us.rmrf.name/articles/backups/2026-11-11T09:00:00ZA backup turns ransomware, theft or a dead laptop from a disaster into a bad afternoon, provided it is separate and tested. The first hour after a mistakehttps://us.rmrf.name/articles/first-hour/2026-11-11T09:00:00ZYou clicked, typed a password or sent a payment. What you do in the next hour decides how much it costs. The caller who needs you to act right nowhttps://us.rmrf.name/articles/phone-calls/2026-11-11T09:00:00ZPhone scammers borrow the voice of a bank, a courier, a government office or a relative. The script changes; the pressure does not. The warning that fills your screen is not from your computerhttps://us.rmrf.name/articles/fake-warnings/2026-11-11T09:00:00ZA page that shouts about a virus and shows a phone number is an advertisement for a scam. Real security warnings never ask you to call. Passkeys: sign in without a passwordhttps://us.rmrf.name/articles/passkeys/2026-11-11T09:00:00ZA passkey replaces the password with a key stored on your device. There is nothing to type, so there is nothing to phish. Your phone holds the keys to everything elsehttps://us.rmrf.name/articles/phone/2026-11-11T09:00:00ZEmail, banking and sign-in codes all live on your phone. A few settings decide what a thief or a bad app can reach. The box in the hallway: securing your home routerhttps://us.rmrf.name/articles/home-router/2026-11-11T09:00:00ZEvery device in your home reaches the internet through one small box. Twenty minutes in its settings is enough. Ransomware in plain wordshttps://us.rmrf.name/articles/ransomware/2026-11-11T09:00:00ZA program locks your files and its authors sell you the key. What decides the outcome is what you set up before it happens. Lock the screen every time you stand uphttps://us.rmrf.name/articles/screen-lock/2026-11-11T09:00:00ZAn unlocked computer gives a passer-by everything you are signed in to. Locking takes one second. The stranger who walks in behind youhttps://us.rmrf.name/articles/visitors/2026-11-11T09:00:00ZMost people who get into an office without permission are simply let in. Here is how to be polite and still keep the door closed. A found flash drive is not a gifthttps://us.rmrf.name/articles/found-usb/2026-11-11T09:00:00ZPlugging in an unknown drive lets its owner run code on your computer. The same goes for free cables and public charging ports. Devices on the roadhttps://us.rmrf.name/articles/travel/2026-11-11T09:00:00ZA laptop is most often lost in a taxi, a café or a hotel room. Prepare before the trip so that a lost device is only a lost device. Before you sell, give away or bin a devicehttps://us.rmrf.name/articles/disposal/2026-11-11T09:00:00ZDeleting files does not remove them. A few steps make sure the next owner gets an empty device. What the current NIST guidance says about passwordshttps://us.rmrf.name/articles/password-rules/2026-11-11T09:00:00ZThe 2025 edition of the NIST digital identity guidelines drops several habits that made passwords worse. A short reading for anyone who sets the rules. Public Wi-Fi without the dramahttps://us.rmrf.name/articles/public-wifi/2026-11-11T09:00:00ZOpen networks in cafés, hotels and airports are usable if you know which one you joined and what you do on it. Cameras, speakers and other small computershttps://us.rmrf.name/articles/smart-devices/2026-11-11T09:00:00ZA smart device is a computer that rarely gets updates and often keeps its factory password. Four settings fix most of it. Six questions for a small teamhttps://us.rmrf.name/articles/small-team/2026-11-11T09:00:00ZThe NIST Cybersecurity Framework 2.0 groups all security work into six functions. For a team of five or fifty they turn into six plain questions.