Security guidance library
Practical security guidance across five operating areas, rated by difficulty and impact so teams can prioritise the highest-value improvements first.
Password & Authentication
Use a password manager
high impactUse a reputable password manager (Bitwarden, 1Password, Dashlane) to generate and store unique 20+ character passwords for every account. Never reuse passwords across accounts — a breach at one service immediately exposes all accounts that share the same password.
Easy
Enable MFA on every account
high impactEnable multi-factor authentication wherever it is offered. Prioritise: email accounts, banking and financial services, cloud storage, social media, and your password manager. Prefer authenticator apps (Microsoft Authenticator, Google Authenticator) over SMS-based codes, which are vulnerable to SIM swap attacks.
Easy
Use passkeys where available
high impactPasskeys are phishing-resistant authentication using your device's biometric or PIN, replacing traditional passwords entirely. Google, Apple, Microsoft, and many major services now support passkeys. Adopt them wherever available — they are significantly more secure than passwords and MFA combined.
Easy
Create a strong master password
high impactYour password manager master password is the key to everything. Use a memorable passphrase of 4+ random words (e.g. 'purple-clock-garden-storm') rather than complex short passwords. Long passphrases are harder to crack and easier to remember. Write it down and store it securely offline.
Easy
Check HaveIBeenPwned regularly
medium impactVisit haveibeenpwned.com and enter your email addresses to check if they have appeared in known data breaches. Enable notifications to receive alerts for future breaches. Change passwords for any breached services immediately — prioritising those where you have not yet enabled MFA.
Easy
Email & Phishing
Verify senders before clicking links
high impactCheck the sender's actual email address (not just the display name) before acting on any email. Attackers commonly use domains like 'microsoft-security.com' or 'paypa1.com' that appear legitimate at a glance. Hover over links before clicking to preview the destination URL. When in doubt, navigate directly to the site rather than following a link.
Easy
Be suspicious of urgency
high impactPhishing emails typically create artificial urgency ('Your account will be suspended in 24 hours', 'Immediate action required'). This pressure is designed to override your critical thinking. Legitimate organisations give you time to verify. If an email creates strong urgency around a financial or security action, treat it as suspicious and verify independently.
Easy
Use email aliases for sign-ups
medium impactServices like SimpleLogin, AnonAddy, or Apple's Hide My Email generate unique email aliases for every service. When an alias starts receiving spam, you know that specific service was compromised or sold your data. Disable the alias without affecting your primary inbox.
Medium
Enable DMARC for your domain
high impactIf you own a business domain, implement DMARC, SPF, and DKIM records. DMARC tells receiving mail servers how to handle emails that fail authentication checks — preventing attackers from sending emails that appear to come from your domain. Start with p=none (monitoring), then move to p=quarantine, then p=reject.
Hard
Never open unexpected attachments
high impactMalware is most commonly delivered via email attachments — PDFs, Word documents, and ZIP files containing malicious macros or executables. If you receive an unexpected attachment (even from a known contact whose account may be compromised), verify with the sender via a separate channel before opening.
Easy
Network Security
Avoid public Wi-Fi for sensitive tasks
high impactPublic Wi-Fi networks (hotels, cafés, airports) are untrusted. Avoid accessing banking, email, or work systems on public networks. If you must, use a trusted VPN that encrypts your traffic. Be particularly wary of networks with generic names — attackers create fake 'Free Airport WiFi' hotspots to intercept traffic.
Easy
Use a DNS security filter at home
high impactConfigure your home router to use a DNS security service (Cloudflare 1.1.1.2, Quad9, or NextDNS) that blocks known malicious domains before your device connects to them. This provides protection for all devices on your network without installing anything on individual devices.
Medium
Segment your home network
medium impactCreate a separate network (guest SSID) for IoT devices (smart TVs, cameras, smart speakers). These devices often have poor security and receive infrequent updates. Keeping them on a separate network prevents a compromised smart device from accessing your computers and files.
Medium
Keep your router firmware updated
high impactRouter vulnerabilities are frequently exploited to intercept or redirect traffic. Enable automatic firmware updates in your router's settings, or check for updates quarterly. Change the default admin password immediately on any new router — default credentials are widely published and actively exploited.
Easy
Disable unnecessary router services
medium impactDisable features you do not use: UPnP (Universal Plug and Play — frequently exploited), WPS (Wi-Fi Protected Setup — has known vulnerabilities), remote management access (unless you specifically need it). Use WPA3 encryption if your devices support it, or WPA2-AES as a minimum.
Medium
Device Security
Enable full-disk encryption
high impactEnable BitLocker (Windows), FileVault (Mac), or dm-crypt (Linux) on all devices. Full-disk encryption ensures that if your laptop is stolen, the data is inaccessible without your credentials. For mobile devices, enable the device encryption setting — modern iOS and Android devices encrypt by default when a PIN is set.
Easy
Apply updates promptly
high impactThe majority of successful attacks exploit known vulnerabilities for which patches are already available. Enable automatic updates for your operating system, applications, and browser. Treat security updates as critical — apply them within 24–48 hours of release. For Windows, ensure Defender is enabled and up to date with the latest signatures.
Easy
Use screen locks with short timeouts
medium impactConfigure your devices to lock after 2–5 minutes of inactivity. Use strong authentication to unlock: biometric (fingerprint, face recognition) or a PIN of 8+ digits. Disable notification previews on the lock screen to prevent sensitive data being visible without unlocking the device.
Easy
Review app permissions regularly
medium impactAudit which applications have access to your camera, microphone, location, and contacts. Revoke permissions that are not essential for the app's core function. On iOS: Settings > Privacy & Security. On Android: Settings > Privacy > Permission Manager. Remove apps you no longer use — they represent unnecessary attack surface.
Easy
Use a separate browser for sensitive activity
medium impactConsider using Firefox with uBlock Origin and Privacy Badger for day-to-day browsing, and a clean browser profile (Chrome Incognito or Firefox Private Window) for banking and high-value transactions. Browser extensions from third parties can read your web traffic — audit and minimise your extensions.
Medium
Data Protection
Follow the 3-2-1 backup rule
high impactMaintain 3 copies of important data, on 2 different media types, with 1 offsite or cloud backup. For individuals: keep files on your computer (copy 1), an external drive (copy 2, different medium), and a cloud service like OneDrive or iCloud (copy 3, offsite). Test that you can restore from backups at least annually.
Medium
Classify your sensitive data
medium impactKnow where your sensitive data lives. Identify personal data (passport scans, tax documents, financial records), business-sensitive information (contracts, pricing, client data), and credentials (passwords, API keys). Apply stronger protection controls to sensitive data — encryption, restricted sharing, and limited retention.
Medium
Use end-to-end encrypted messaging
high impactFor sensitive personal communications, use Signal (the gold standard — open source, end-to-end encrypted, zero metadata). For business communications, ensure your platform provides end-to-end encryption. Standard SMS and many messaging apps are not encrypted in transit and can be intercepted.
Easy
Shred physical documents
medium impactPhysical documents containing personal information (bank statements, medical records, utility bills) are a significant identity theft vector. Cross-cut shred (not strip-cut) any document containing your name, address, account numbers, or national insurance number before disposal. Use a personal cross-cut shredder rather than communal office shredders.
Easy
Minimise data shared with apps and services
medium impactEvery app and service you provide data to is a potential breach point. Apply data minimisation: only provide information genuinely required for the service, use temporary email aliases for sign-ups, opt out of marketing uses of your data, and regularly review and exercise your rights under UK GDPR to access or delete data held by organisations.
Easy
Need a more tailored view of your exposure?
Use the CyberZonic security assessment to identify likely gaps and receive a more structured recommendation set.
Take the Assessment