Don't open, click or run suspicious files, links, and programs. Rule of thumb: if you are not expecting it, it is suspicious.

Don't open suspicious files, email attachments, or archived documents, if you do not completely trust the source they are originating from. Send unwanted emails to spam folder before reading – files or links from people you don't know should be treated as malicious by default. Verify file origin by the means other than media used to receive it. For example, if you have received a Word document via email, contact the sender by an Instant Messenger or by phone and verify the reason for sending it. The most risky file types are: Any executable files: exe, com, bat, ps1, swf, jar etc. MS Office documents, especially with macros: doc/docx/docm, xls/xslx/xslm etc. PDF documents: pdf. Vector graphics with embedded code: svg. Archives of these files, especially password-protected.

Sometimes it's hard to tell malicious files from legitimate ones under time pressure. Use Virustotal to verify any file by scanning it by more than 50 antiviruses at the same time. While it is much more efficient than scanning files offline, consider the fact that you need to disclose the file to a third party. https://virustotal.com

Don't open suspicious URL links, especially those pointing to web-sites you don't normally visit. Always check web-site domain names before clicking the links: attackers could mangle the domain name for it to look familiar: facelook.com, gooogle.com etc. Use HTTPS and verify SSL certificate of the web-site to ensure it is not cloned or spoofed.

Malicious URLs can 'masked' by arbitrary text in HTML files, documents and emails. In web-browsers and email programs hover the mouse cursor over the link (don't click) and wait for a while before the real URL pops up. Or right-click on the link and copy it to the text editor to see its actual address. Use Virustotal to scan suspicious links the same way you scan files. https://virustotal.com

Malicious URLs can be encoded as QR codes or printed out, including in a form of 'shortened' URLs generated by services such as tinyurl.com, bit.ly, ow.ly etc. Don't enter those links into your browser or scan QR codes by your smartphone unless you know exactly what you are doing. You can 'resolve' shortened URLs before opening them using these services: http://checkshorturl.com/ http://www.expandurl.net/

Be careful with pop-ups in your browser, applications and operating system. Always read pop-up messages and don't 'accept' anything in a hurry. Pop-ups can be dangerous in many ways: some result in installing malicious SSL certificates that allow attackers to sniff your network traffic; some could install malicious software on your computer or redirect your browser to malicious web-sites that infect your computer with malware.

Do not insert flash drives, CD/DVD, external HDDs etc. into your computer unless you explicitly trust their origin. There are techniques of hacking into your computer before you open files on a flash drive and way before your antivirus scans them. If you found it outside or inside the office, if you received it by mail or delivery, if a stranger gives it to you asking to print out a document or just open attach it to a PC – it is likely to be malicious. Only trust your own devices and proceed with caution when dealing with devices received from people you work with or otherwise collaborate.

Use passphrases instead of passwords to eliminate problems related to passwords' length and use of dictionary words. To create a passphrase, choose a phrase you won't forget easily: a line from a poem or a song lyrics, a proverb, a slogan etc. Then transform it to a single string by removing spaces and replacing letters to similar digits. Adding special characters and capitalizing random words in the phrase also makes it stronger.

Use passphrase recipes to create strong unique passphrases. Recipe is an algorithm used to create different passphrases for different systems using a common basis. For example:1. Choose a strong basis, say, the passphrase w3llD0nem8'.2. Think about a way of linking the passphrase to the system. Simply adding server name in the end is easy: w3llD0nem8'googleSplitting the name in halves and adding in the beginning and end of the phrase is even cooler: goow3llD0nem8'gle glew3llD0nem8'goo3. Don't forget to apply a mangling rule too, say, change the last letter of the server name to a digit if applicable, and always add an exclamation mark or another special character. goow3llD0nem8'gl3!

No one should know your passphrase except you. Don't tell it to anyone including your boss, your sysadmin or helpdesk, your wife, your parents, your kids etc. There is no legitimate reason for anyone to ask for your passphrase. Technically, even the system that you are using it for does not have your passphrase in its original form – instead it 'hashes' it and stores its cryptographically protected copy. Never write down your passphrases on paper or in a clear text (unencrypted) file. Password-protected Excel is not encrypted. Password-protected archive is not properly encrypted. Only use trustworthy password managers if needed.

Change passphrases regularly and at least once a year. Your corporate passphrases or the passphrases you use more often (e.g. multiple times a day) have to be changed at least once a moth or two. The rule of thumb is: the more frequently you use it, the more frequently it has to be changed.

Use a password manager software and follow these rules:0. Generate strong random passwords of configurable length and complexity.1. Make sure your master password is strong.2. Use a password manager that encrypts password database before storing it in the cloud or synchronizing it between your devices via the network.3. Backup your password database often.Examples of good password managers are: 1Pasword https://1password.com KeePass http://keepass.info Password Safe https://pwsafe.org

Strong passwords are long, complex, and unique. This means they should be longer than 10 characters, contain different types of characters (letters, digits, special chars), and be different for every service, web-site or system you use. Passwords should not be based on simple words that could be found in dictionaries. Passwords shall not be cognitive, that means they have to be based on something else than data about the user or the system. Otherwise, information related to the user or the system could and will help an attacker guess the password.

Most respected online services allow multi-factor authentication. Enable it using a built-in software token (available on Facebook, Twitter, Google etc.) or an SMS one-time verification code.URLs to multi-factor authentication settings of popular web-sites: Apple 2-factor authentication https://support.apple.com/en-us/HT204915 Google 2-step verification https://myaccount.google.com/security/signinoptions/two-step-verification Facebook Login Approvals https://www.facebook.com/settings?tab=security&section=approvals Twitter Login verification https://twitter.com/settings/security Dropbox Two-step verification https://www.dropbox.com/account/#security

Prefer using Google Authenticator, physical token, or mobile app verification techniques. Avoid SMS one-time passwords wherever possible.

Linux

Linux, macOS

macOS

Linux

Always make sure that the web-site you are passing your sensitive data is protected by HTTPS. That means it has https:// before it in the address bar and its certificate is validated by your browser, so it does not generate security warnings. Note that presence of HTTPS by itself should not increase your trust in the web-site: anyone can generate a valid certificate for his/her web-site. The web-site domain name should be verified because it can be easily spoofed and web-site cloned if you don't pay attention. And do not accept untrusted certificates neither temporarily, nor permanently.

You can use Full Disk Encryption feature of your OS to protect the data at your laptop or PC from theft or loss. FDE is a free feature on Linux, macOS, and Windows Pro.

You can encrypt external drives or individual files too.

Use trusted end-to-end encrypted communications for private/confidential data. End-to-end encryption ensures that no one other than you and your recipient can access the conversation. The means of encrypting email end-to-end are PGP or GPG, or S/MIME. End-to-end encrypted Instant Messengers are Signal, WhatsApp, iMessage, Viber, Threema. Facebook Messenger, Google Allo, and Telegram have 'secret chats' that may be seen as more secure than default mode.

Encrypt your sensitive data before uploading it to the cloud. Remember: there is no 'cloud', it's just someone else's computer.Boxcryptor is a tool that allows you to encrypt data offline before putting it to your cloud drive. Use for one cloud drive is free of charge. Boxcryptor https://www.boxcryptor.com

To protect your traffic data and metadata from network sniffing, use VPN. You can choose from many VPN services providers, such as proXPN or OpenVPN AS. You can install and maintain your own VPN server as well. Always use corporate VPN when working with business data remotely. proXPN https://secure.proxpn.com OpenVPN https://openvpn.netHow to setup your own VPN server: https://www.digitalocean.com/community/tutorials/openvpn-access-server-centos