Cybersecurity

1. Passwords, MFA & Account Safety

Most account break-ins don't involve clever hacking — they happen because a password was weak, reused, or guessed. Getting the basics right stops the majority of real-world attacks before they start.

• Strong passwords: Use a long passphrase (e.g. "PurpleGoat$Runs42Fast") rather than a short complex one — length matters more than symbols.
• Never reuse passwords: If one site is breached, reused passwords let attackers into every other account you used it on.
• Multi-Factor Authentication (MFA): Adds a second step (a code sent to your phone, or an authenticator app) so a stolen password alone isn't enough to break in. Enable it on email, banking, and social media first.
• Password managers: Tools that generate and remember strong unique passwords for every account, so you only need to remember one master password.

Practical Skill: Audit your own accounts: identify any reused passwords, change them to unique passphrases, and enable MFA on your email account today — it's usually the account that can reset everything else.

=== PERSONAL ACCOUNT SECURITY AUDIT ===

[ ] Email account has a unique password (not reused anywhere)
[ ] Email account has MFA/2-step verification enabled
[ ] WhatsApp has two-step verification enabled
      (Settings -> Account -> Two-step verification)
[ ] Banking/mobile money app has a unique PIN, never shared
[ ] Social media accounts have MFA enabled where available
[ ] No passwords are written in an unlocked phone Notes app
[ ] A password manager (or a written list kept physically safe)
    is used instead of memorizing weak, reused passwords

=== PASSPHRASE VS PASSWORD ===
  Weak:    P@ss1
  Better:  Purple-Goat-Runs-42
  Why:     Longer phrases are far harder to crack, even without
           complex symbols, and easier for you to remember.

2. Phishing & Social Engineering Awareness

Attackers often don't break into systems — they trick people into handing over access. Phishing and social engineering exploit trust, urgency, and fear rather than technical weaknesses.

• Phishing messages impersonate a trusted sender (a bank, WhatsApp, an employer) asking you to click a link, "verify" details, or send money urgently.
• Red flags: Urgent language ("act now or your account is closed"), requests for passwords/PINs, links that don't match the real organization's domain, and unexpected attachments.
• Social engineering can also happen by phone or in person — someone posing as IT support asking for your password, or a "colleague" asking for an urgent money transfer.
• The golden rule: legitimate organizations never ask for your password. When in doubt, contact the organization directly through a number/website you already trust — not one from the suspicious message.

Practical Skill: Review 3 recent messages (SMS, WhatsApp, or email) you received and evaluate each against the red-flag checklist below, deciding whether you would click, ignore, or verify independently.

=== IS THIS MESSAGE A PHISHING ATTEMPT? ===

[ ] Does it create urgency or fear ("act now", "account suspended")?
[ ] Does it ask you to click a link and "log in" or "verify"?
[ ] Does it ask for a password, PIN, or OTP code directly?
[ ] Does the sender's number/email look slightly wrong or unfamiliar?
[ ] Does it offer something too good to be true (a prize, free money)?
[ ] Is it asking you to send money urgently on someone's behalf?

If you checked ANY of these -> do not click, do not reply.
Verify independently using a phone number or website you
already know is real — never one provided in the message itself.

3. Device Security: Updates, Antivirus & Backups

A secure device is one that's kept up to date, protected against malicious software, and backed up so a loss doesn't mean losing everything.

• Updates: Operating system and app updates often patch security holes attackers actively exploit — delaying updates leaves known doors open.
• Antivirus/anti-malware: Reputable free antivirus software catches many common threats. Avoid downloading "cracked" software, which frequently hides malware.
• App permissions: Review what phone apps can access (camera, contacts, location) and remove permissions or apps that don't need them.
• Backups: Keep important files backed up (cloud or external drive) so ransomware, theft, or hardware failure doesn't mean total data loss.

Practical Skill: Check for and install pending updates on a real device, review its installed apps' permissions, and confirm important files have a backup copy somewhere else.

=== DEVICE SECURITY CHECKLIST ===

[ ] Operating system is fully updated
[ ] Reputable antivirus/anti-malware software is installed and active
[ ] Apps are only downloaded from official app stores
[ ] Phone app permissions reviewed — unused permissions revoked
[ ] Screen lock (PIN/fingerprint) is enabled on phone and laptop
[ ] Important files exist in at least 2 places
      (e.g. device + cloud, or device + USB drive)
[ ] Old/unused accounts and apps are removed, not left dormant

4. Safe Browsing & Data Privacy Basics

How and where you browse affects how exposed your data is — public Wi-Fi, oversharing on social media, and unclear privacy settings are common everyday risks.

• HTTPS: Look for the padlock icon and "https://" before entering any sensitive information on a website — it means the connection is encrypted.
• Public Wi-Fi: Avoid logging into banking or sensitive accounts on public/shared Wi-Fi where possible; it's easier for others on the same network to intercept traffic.
• Social media privacy: Review who can see your posts, location tags, and personal details — oversharing (travel plans, daily routines) can create real-world safety risks.
• Data minimization: Only share the personal information a service genuinely needs — question requests for excessive detail.

Practical Skill: Review your main social media account's privacy settings and adjust who can see your posts, contact details, and location information.

=== SOCIAL MEDIA PRIVACY REVIEW ===

[ ] Who can see your posts? (Public / Friends / Custom)
[ ] Is your phone number visible to the public?
[ ] Is location tagging on for your posts? Turn it off unless needed.
[ ] Do old posts reveal your daily routine or travel plans?
[ ] Is your profile photo/bio revealing more than necessary?

=== BEFORE ENTERING SENSITIVE INFO ONLINE ===
[ ] Does the address bar show "https://" and a padlock icon?
[ ] Are you on a trusted network (not open public Wi-Fi)?
[ ] Does the website's name match exactly what you expected
    (watch for lookalike spellings)?

5. Intro to Incident Response: What to Do When Hacked

Even careful people get compromised sometimes. Knowing the right immediate steps limits the damage and helps recover access quickly.

• Act fast: Change the compromised account's password immediately from a different, trusted device if possible.
• Check for unfamiliar activity: Review recent logins, sent messages, or transactions for anything you didn't do.
• Revoke access: Log out of all sessions/devices in account security settings, and remove any unfamiliar connected apps.
• Report and warn: Report compromised financial accounts to your bank/mobile money provider immediately, and warn contacts if a hacked account may have messaged them.

Practical Skill: Write a simple personal "if I get hacked" action plan listing exactly which accounts to check first and who to contact for each (bank, email provider, family).

=== "I THINK I'VE BEEN HACKED" — IMMEDIATE STEPS ===

1. From a DIFFERENT trusted device, change the password of
   the affected account immediately.
2. Check "recent activity" or "login history" in account
   settings for unfamiliar locations or devices.
3. Log out of all other sessions/devices from account settings.
4. Enable MFA on the account now if it wasn't already on.
5. If it's a financial account: contact your bank/mobile money
   provider immediately to freeze/monitor the account.
6. If the account may have messaged your contacts: send a
   quick warning that the account was compromised.
7. Write down what happened while it's fresh — this helps
   you recognize the same attack pattern next time.

Quick Quiz — Cybersecurity Basics