The Essential Guide to Cybersecurity

Key takeaways

• Every security decision protects one of three things: keeping information private, keeping it accurate, and keeping it available when you need it.
• Rank your risks by how likely they are and how much damage they would do, then fix the likely, damaging ones before anything exotic.
• Your email account is the master key to most others, so give it a unique long password and a second factor before anything else.
• Most attacks trick a person before they touch a machine, so pausing and confirming through a second, known channel beats any gadget you can buy.
• Assume any single defence will fail and keep several layers, including a backup you have actually restored, so one mistake never becomes a disaster.

Inside this bit

1. Three things worth protecting

   Cybersecurity sounds like a world of hackers and code, but the whole map rests on one simple idea. Every piece of information you care about needs three kinds of protection.

2. Thinking in risk, not fear

   The second idea on the map is risk, and it needs three words. A threat is anything that could cause harm: a scammer, a flood, a careless colleague.

3. Identity is the front door

   Most modern attacks do not smash through technology; they simply log in. That makes identity, proving who you are, the most important door on the map.

4. The human layer attackers aim for

   Machines are hard to fool; people are easier. Social engineering is the craft of persuading someone to open the door from the inside.

5. Layers, backups and the bad day

   No single defence is perfect, so the field relies on defence in depth: several independent layers, each catching what the one before it missed. At home and in small offices the layers are familiar.

6. What to prioritise and what to ignore

   With the map complete, the trade-offs come into view. Security always costs something: time, money or convenience.