// CHAPTER 03 · PROTECT YOURSELF //

SECURITY AWARENESS // YOU ARE THE LAST LINE OF DEFENSE //

95% of breaches are caused by human error. This page gives you the knowledge to be the defender — not the vulnerability. No theory. Just real tactics.

95%
BREACHES FROM HUMAN ERROR
60%
SMBs CLOSE AFTER ATTACK
11s
BETWEEN RANSOMWARE ATTACKS
YOU
ARE THE CRITICAL LAYER
PHISHING · RANSOMWARE · ZERO TRUST · MFA · SOCIAL ENGINEERING · PASSWORD HYGIENE · DEVICE HARDENING · FULL DISK ENCRYPTION · EVIL TWIN · ROOTKIT · USB ATTACKS · VPN · PHISHING · RANSOMWARE · ZERO TRUST · MFA · SOCIAL ENGINEERING · PASSWORD HYGIENE · DEVICE HARDENING · FULL DISK ENCRYPTION · EVIL TWIN · ROOTKIT · USB ATTACKS · VPN ·

KNOW YOUR ENEMY

TYPES OF
THREATS YOU FACE

Before you can defend yourself, you need to understand what's coming at you.

VIRUSES & WORMS
Self-replicating code that damages files and spreads across systems automatically — often without any user interaction required.
PHISHING & SOCIAL ENG.
Fake emails, calls, and messages designed to trick you into giving credentials or clicking malicious links. The #1 attack vector.
RANSOMWARE
Encrypts ALL your files and demands payment. Often unrecoverable without backups. A new attack launches every 11 seconds globally.
SPYWARE & KEYLOGGERS
Silently records everything you type — passwords, credit cards, private messages — and sends it to the attacker invisibly.
ACCOUNT TAKEOVER
Attacker gains full access to your accounts — email, cloud, banking. One compromised password can cascade across all services.
EVIL TWIN ATTACK
Fake Wi-Fi hotspot with the exact same name as a trusted network. Your device auto-connects and ALL traffic is intercepted in real time.

EARLY WARNING SYSTEM

ARE YOU
ALREADY COMPROMISED?

These are the red flags. If you spot any of them — stop, disconnect, and contact your security team immediately.

LAPTOP RED FLAGS
⚠Sudden extreme slowness or freezing with no apparent reason
⚠Pop-ups, new toolbars or browser extensions you didn't install
⚠Antivirus or firewall turned OFF by itself — major red flag
⚠Strange outgoing network activity in Task Manager
⚠Unknown processes consuming CPU or RAM unexpectedly
⚠Files renamed with weird extensions (e.g. .locked, .encrypted)
MOBILE RED FLAGS
⚠Battery drains much faster than usual with no change in habits
⚠Unexplained mobile data usage spike — check data stats
⚠New apps you don't remember installing appear on your phone
⚠Ads appearing OUTSIDE of apps (overlay ads on home screen)
⚠Phone gets hot even when idle and no apps are running
⚠SMS or calls sent from your number without your knowledge

THE SECURITY MINDSET

PREVENTION →
DETECTION → RESPONSE

PHASE 01
PREVENTION
BEFORE INFECTION
  • Strong passwords + MFA on everything
  • Keep all software updated always
  • Never click suspicious links or attachments
  • Verify every attachment before opening
  • Use a VPN on public networks
PHASE 02
DETECTION
KNOW YOU'RE HACKED
  • Monitor device behavior daily
  • Check running processes regularly
  • Review permission logs monthly
  • Watch for anomalies in network traffic
  • Use threat detection tools proactively
PHASE 03
RESPONSE
REACT CORRECTLY
  • Disconnect from network immediately
  • Contact security team — don't act alone
  • Do NOT reboot normally — preserve evidence
  • Screenshot everything you see first
  • Only force shutdown if instructed by team
NEVER TRUST.
ALWAYS VERIFY.
// Verify every email link — even from colleagues
// Assume every device could be compromised
// Never use personal USB on work machines
// You are a target — act accordingly, always

YOUR DEFENSIVE TOOLKIT

ESSENTIAL
SECURITY TOOLS

All free or built-in. No excuses. These are the minimum tools every device must have.

BUILT-IN
Windows Defender
Built-in AV — always keep enabled. First line of defense on every Windows machine.
FREE
Malwarebytes
Secondary scanner for deep scans. Enable rootkit scanning. Always run after Defender.
FREE
Bitwarden / 1Password
Password manager — generate and store unique passwords. Never reuse a single password.
FREE
Google Authenticator
MFA app — protect every critical account. Do NOT use SMS-based MFA — vulnerable to SIM swap.
ONLINE
VirusTotal.com
Upload suspicious files and get results from 70+ AV engines. Scan before you open anything.
FREE
uBlock Origin
Browser extension that blocks malicious ads and trackers. Install on every browser.
FREE
Autoruns (Sysinternals)
See everything that auto-starts on your machine. The ultimate persistence checker for Windows.
FREE
KnockKnock (Mac)
Shows everything auto-starting on macOS. Detects unsigned or unknown persistence items.

REAL-WORLD TRAINING

ATTACK
SCENARIOS

These actually happen. Know the attack. Know the correct response. Click to expand each scenario.

01
SUSPICIOUS HR EMAIL
// PHISHING SIMULATION — CLICK TO EXPAND
›
🚩 Urgency + deadline = pressure tactic — a classic manipulation technique
🚩 External domain (company-hr-bonus.net) — NOT the actual company domain
🚩 Hover over the link first — check the real URL in your status bar
🚩 HR sends bonuses through official internal systems — NEVER via email links
✓ CORRECT ACTION: Do NOT click → Report to security team → Delete the email immediately
02
USB FOUND IN PARKING LOT
// PHYSICAL ATTACK VECTOR — CLICK TO EXPAND
›

You find a USB drive in the car park. It's labeled "CONFIDENTIAL - Salary List Q4". You're curious.

Rubber Ducky — looks like USB, acts as a keyboard — injects keystrokes in seconds
USB Killer — sends a power surge that physically destroys your laptop motherboard
Ransomware Dropper — auto-runs malware the moment you plug it in
✓ CORRECT ACTION: NEVER plug it in. Seal it in a bag → hand directly to IT/Security team only
03
DEVICE ACTING STRANGELY
// ACTIVE COMPROMISE — RESPONSE PROTOCOL — CLICK TO EXPAND
›

Mouse moves by itself. Files open and close. Device is very slow. Webcam light blinks unexpectedly. You are being watched.

1 DISCONNECT FROM NETWORK — turn off Wi-Fi + unplug ethernet cable NOW
2 Do NOT shut down normally — you may destroy critical forensic evidence
3 Take a photo/screenshot of the screen with your phone — document everything
4 Call the Security team emergency number IMMEDIATELY — do not delay
5 ONLY force-shutdown (hold power 10 sec) if explicitly instructed by security
✓ CORRECT ACTION: Disconnect → Document → Call security → Wait for instructions. Do NOT act alone.

THE HUMAN EXPLOIT

SOCIAL ENGINEERING
TACTICS

Humans are easier to hack than systems. These are the five most common manipulation techniques used against you.

URGENCY & FEAR
"Act NOW or your account gets deleted in 24 hours"
→ Real companies don't threaten you like this. Urgency = pressure tactic. Slow down and verify.
AUTHORITY IMPERSONATION
"This is Microsoft support. We detected a virus on your PC."
→ Microsoft never calls you unsolicited. Hang up. Call back on the official number yourself.
CURIOSITY BAITING
"You were caught on camera. Click here to see the video."
→ Emotional bait exploits curiosity. If it provokes a strong feeling — be suspicious. Stop. Verify.
RECIPROCITY
"We gave you a free gift. Just confirm your account details."
→ Nothing is free online. Especially if someone initiated the "gift" — it's bait.
FAMILIAR SENDER
Email appears to come from a colleague or trusted friend.
→ Verify by calling them directly. Never reply to the suspicious email itself. Call. Confirm.
SCARCITY
"Only 2 spots left. Claim your account upgrade now."
→ Artificial scarcity creates panic. Legitimate offers don't require instant irreversible decisions.

YOUR KEY TO EVERYTHING

PASSWORD
SECURITY

✗ WEAK PASSWORDS — NEVER USE
password123
Company2024!
yourname@123
Welcome1
✓ STRONG PASSWORDS — USE THESE
kT#9mP!vBq@2Xw
correct-horse-battery-staple-7!
Xm$8kL@nP#2qR!w
4wQ!mB#9rT@kL$2
12+ characters minimum — 16+ strongly preferred for critical accounts
Use a passphrase: 4 random words + numbers + symbols — easy to remember, hard to crack
NEVER reuse passwords — use a password manager like Bitwarden (free)
Enable MFA using an authenticator app — NOT SMS (SIM-swap bypass)
Change passwords immediately after any suspected breach or phishing click

DANGEROUS FILE EXTENSIONS — NEVER OPEN

.exe.msi.bat .cmd.vbs.ps1 .hta.jar.docm .xlsm.scr.pif

If received by email — upload to virustotal.com before opening. When in doubt → DELETE.

SCHEDULE THIS MONTHLY

SECURITY
CHECKLIST

Run this every first Monday of the month. Click boxes to track your progress.

UPDATE OS & ALL APPS
Windows Update · Mac updates · App Store · Browser
RUN FULL SCAN
Defender + Malwarebytes · Both tools back to back
CHANGE SENSITIVE PASSWORDS
Email · Cloud storage · Work systems
REVIEW MOBILE PERMISSIONS
Microphone · Camera · Location for all apps
CHECK LOGGED-IN DEVICES
Google · Apple · Microsoft · Remove unknown devices
DELETE UNUSED APPS
Every unused app is an unnecessary attack surface
VERIFY BACKUP RAN
Check last backup date · Restore test quarterly
REVIEW SAVED WI-FI
Delete any network you no longer actively use
VERIFY MFA ON ALL ACCOUNTS
Authenticator app · Not SMS · Every critical account
CHECK DISK ENCRYPTION
BitLocker (Windows) · FileVault (macOS) · Must be ON
REVIEW BROWSER EXTENSIONS
Remove any extension you don't recognize or need
CLOSE UNUSED PORTS
RDP (3389) · SMB (445) · Telnet (23) · FTP (21)

WHEN THINGS GO WRONG

IMMEDIATE
RESPONSE PROTOCOL

If you suspect you've been breached — follow this exact sequence. Order matters.

01
CHANGE DEVICE & EMAIL PASSWORDS
Laptop login, phone PIN, work email — use 12+ character mix of letters/numbers/symbols immediately
02
CHANGE CLOUD SERVICE PASSWORDS
iCloud, OneDrive, Google Drive — all linked accounts must be treated as compromised until proven otherwise
03
CHECK ACTIVE SESSIONS — SIGN OUT ALL
Google: myaccount.google.com → Security → Manage devices. Remove every unrecognized session.
04
CONTACT SECURITY TEAM IMMEDIATELY
Report what you did or clicked — do this BEFORE cleaning. They need forensic evidence. Do not act alone.
// CRITICAL RULE — MEMORIZE THIS //
WHEN IN DOUBT
STOP · REPORT · DO NOT CLICK
SECURITY HOTLINE
[Insert 24/7 number]
SECURITY EMAIL
security@yourcompany.com
Your device can expose client data. Security is everyone's full-time job. Not a checkbox.