| name | cybersecurity-personal |
| description | Comprehensive guide to personal digital security covering password management strategies, two-factor authentication setup, VPN selection and usage, phishing recognition techniques, social engineering awareness, device security hardening, privacy settings for social media and browsers, data breach response procedures, and secure communication tools.
Use when the user asks about cybersecurity personal, related techniques, best practices, or needs guidance in this domain.
Do NOT use when the request is outside the scope of cybersecurity personal or requires a different specialized skill.
|
| license | Apache-2.0 |
| metadata | {"author":"foundry-skills","version":"1.0.0","tags":"health-wellness checklist guide cloud testing automation research networking","category":"health-wellness","subcategory":"preventive-health","depends":"","disclaimer":"not-medical-advice","difficulty":"intermediate"} |
Personal Cybersecurity Guide
Disclaimer: This skill provides general wellness and health information for educational purposes only. It does NOT constitute medical advice, diagnosis, or treatment recommendations. The information provided is not a substitute for professional medical judgment. Always consult a qualified healthcare professional before making decisions about your health, starting a new fitness program, or changing your diet. If you are experiencing a medical emergency, contact emergency services immediately.
When to Use
Use this skill when:
- User asks about cybersecurity personal techniques or best practices
- User needs guidance on cybersecurity personal concepts
- User wants to implement or improve their approach to cybersecurity personal
Do NOT use when:
- The request falls outside the scope of cybersecurity personal
- User needs a different specialized skill for their specific situation
- The topic requires professional consultation beyond general guidance
Questions to Ask First
- How many online accounts do you estimate you have (email, banking, social media, shopping)?
- Do you currently use a password manager?
- Do you have two-factor authentication enabled on your most important accounts?
- Have you ever been a victim of a hack, phishing attack, or data breach?
- What devices do you use daily (phone, laptop, tablet, smart home devices)?
- Do you use public Wi-Fi frequently (coffee shops, airports, hotels)?
- What is your comfort level with technology?
- Do you handle sensitive information for work from personal devices?
- How many people have access to your devices or accounts?
- What is your biggest cybersecurity concern (identity theft, privacy, financial fraud)?
Phase 1: Password Management
Why Passwords Matter
Over 80% of data breaches involve compromised passwords. Reusing passwords across sites means one breach can compromise all your accounts.
Password Best Practices
Strong password characteristics:
- Minimum 16 characters (longer is better)
- Mix of uppercase, lowercase, numbers, and special characters
- NOT based on personal information (birthdate, pet name, address)
- NOT a common word or phrase
- Unique for every account (no reuse)
Passphrase method (recommended):
Create a memorable phrase with random words:
Example: "correct-horse-battery-staple" (but use your own random words)
Add complexity: "Correct-Horse-Battery-Staple-42!"
Password Managers
Why use a password manager:
- Generates strong, unique passwords for every account
- Remembers them all so you do not have to
- Auto-fills login forms securely
- Alerts you to compromised passwords
- Works across all your devices
Recommended Password Managers:
| Manager | Cost | Platforms | Key Features |
|---|
| Bitwarden | Free / $10/year premium | All platforms | Open source, excellent free tier |
| 1Password | $36/year | All platforms | Travel mode, family sharing |
| Dashlane | $60/year | All platforms | VPN included, dark web monitoring |
| KeePassXC | Free | Desktop (cross-platform) | Offline, open source, full control |
Setting up a password manager:
- Choose a manager and create your account
- Create a STRONG master password (this is the one password you must remember)
- Write your master password on paper and store it in a secure physical location
- Install the browser extension and mobile app
- Start saving passwords as you log into sites
- Gradually update weak or reused passwords with generated ones
- Enable two-factor authentication on the password manager itself
Passwords to Change First (Priority Order)
- Email accounts (email is the key to all other account recovery)
- Financial accounts (banking, investment, payment apps)
- Password manager master password
- Social media accounts
- Cloud storage (Google Drive, iCloud, Dropbox)
- Shopping accounts with saved payment information
- Work accounts
- All remaining accounts
Phase 2: Two-Factor Authentication (2FA)
What is 2FA?
Two-factor authentication requires two different types of verification to access an account: something you know (password) plus something you have (phone, security key) or something you are (biometrics).
Types of 2FA (Ranked by Security)
| Method | Security Level | Convenience | Notes |
|---|
| Hardware security key (YubiKey, Titan) | Highest | Medium | Physical device, phishing-resistant |
| Authenticator app (TOTP) | High | High | Time-based codes on your phone |
| Push notification | High | Very High | Approve/deny on phone app |
| SMS text message | Medium | Very High | Better than nothing, but vulnerable to SIM swap |
| Email code | Low-Medium | High | If email is compromised, 2FA is bypassed |
Setting Up 2FA
Priority accounts for 2FA:
- Email (Gmail, Outlook, etc.)
- Financial accounts (banks, investment platforms)
- Password manager
- Social media
- Cloud storage
- Work accounts
- Shopping accounts with stored payment info
Recommended authenticator apps:
- Authy (cloud backup, multi-device sync)
- Google Authenticator
- Microsoft Authenticator
- 1Password (built into the password manager)
Setup process (typical):
- Go to account security settings
- Find "Two-Factor Authentication" or "Two-Step Verification"
- Choose your 2FA method
- Follow the setup wizard (usually scan a QR code with your authenticator app)
- Save backup codes in your password manager or a secure location
- Test the setup by logging out and back in
Backup Codes
When you enable 2FA, most services provide backup codes. These are one-time-use codes for when you cannot access your 2FA device. Store these securely in your password manager and/or a physical secure location. Without them, you may lose access to your account if your phone is lost or broken.
Phase 3: VPN Selection and Usage
What a VPN Does (and Does Not Do)
A VPN does:
- Encrypt your internet traffic between your device and the VPN server
- Hide your IP address from websites you visit
- Protect data on public Wi-Fi from local eavesdropping
- Allow access to geo-restricted content
- Prevent your ISP from seeing which specific sites you visit
A VPN does NOT:
- Make you anonymous (the VPN provider can see your traffic)
- Protect against malware or phishing
- Protect accounts with weak passwords
- Make you invisible to law enforcement (with proper legal process)
- Protect data after it leaves the VPN server
Choosing a VPN Provider
Look for:
- No-logs policy (independently audited)
- Strong encryption (WireGuard or OpenVPN protocols)
- Kill switch feature (blocks internet if VPN disconnects)
- Jurisdiction outside surveillance alliances (preferably)
- Transparent ownership and business model
- Regular independent security audits
Recommended VPN providers:
| VPN | Cost | Key Features | Audit Status |
|---|
| Mullvad | $5.50/month | No email needed, anonymous payment | Audited |
| ProtonVPN | Free tier / $5-10/month | Swiss jurisdiction, open source | Audited |
| IVPN | $6-10/month | No email needed, transparent | Audited |
| Surfshark | $2-4/month | Unlimited devices, good value | Audited |
| NordVPN | $3-5/month | Large server network | Audited |
Avoid: Free VPNs from unknown providers (your data is often the product).
When to Use a VPN
- Always on public Wi-Fi (coffee shops, airports, hotels)
- When accessing sensitive accounts on unfamiliar networks
- When you want to prevent ISP tracking
- When traveling internationally (access home services)
Phase 4: Phishing Recognition
What is Phishing?
Phishing is an attempt to trick you into revealing sensitive information (passwords, credit card numbers, personal data) by impersonating a legitimate entity through email, text, phone, or websites.
Common Phishing Indicators
Email phishing red flags:
Text/SMS phishing (smishing):
- Unexpected texts from unknown numbers
- Links to shortened URLs
- Urgent requests to verify accounts
- "You've won" messages
- Package delivery notifications you were not expecting
Phone phishing (vishing):
- Callers claiming to be from the IRS, Social Security, or police
- Threats of arrest or legal action
- Requests for payment via gift cards or wire transfer
- Caller ID spoofing (shows a legitimate number but is not)
- Pressure to act immediately without time to verify
What to Do If You Suspect Phishing
- Do NOT click links or open attachments
- Do NOT reply to the message
- Verify independently (call the organization using a number from their official website, not the one in the message)
- Report phishing emails (forward to the organization and to reportphishing@apwg.org)
- Delete the message
- If you already clicked or entered information, change passwords immediately and enable 2FA
Phase 5: Social Engineering Awareness
Common Social Engineering Tactics
| Tactic | Method | Example |
|---|
| Pretexting | Creating a false scenario | "I'm from IT, I need your password to fix an issue" |
| Baiting | Offering something enticing | USB drive left in a parking lot with malware |
| Tailgating | Following someone into a secure area | Walking into a building behind an employee |
| Quid pro quo | Offering a service for information | "Free tech support" that installs malware |
| Authority | Impersonating someone in power | "The CEO needs this wire transfer done immediately" |
| Scarcity/Urgency | Creating time pressure | "Only 2 left!" or "Act now or lose access" |
Defense Against Social Engineering
- Verify identity independently before sharing any information
- Be suspicious of unsolicited contacts (even if they know some personal information about you -- this is often available publicly)
- Slow down and think before acting on urgent requests
- Never share passwords, even with "IT support"
- Question unusual requests, even from seemingly legitimate sources
- Establish verification procedures for sensitive requests (callback numbers, code words)
Phase 6: Device Security
Smartphone Security
Computer Security
Smart Home Device Security
- Change default passwords on all IoT devices (cameras, speakers, routers)
- Keep firmware updated
- Use a separate Wi-Fi network for IoT devices (if your router supports it)
- Disable features you do not use (remote access, voice purchasing)
- Research device privacy policies before purchasing
Router Security
- Change default admin password
- Use WPA3 encryption (or WPA2 minimum)
- Change default network name (SSID) -- do not include personal information
- Enable automatic firmware updates
- Disable WPS (Wi-Fi Protected Setup)
- Consider a guest network for visitors
Phase 7: Privacy Settings
Social Media Privacy
Facebook:
- Set profile to "Friends Only" (not Public)
- Review who can see past posts (Limit Past Posts feature)
- Disable face recognition
- Review apps and websites connected to your account
- Disable location history
- Review tagged photos before they appear on your profile
Instagram:
- Set account to Private (if not a public figure or business)
- Disable activity status
- Review tagged photos before they appear
- Restrict who can message you
General Social Media:
- Do not share your full birthdate, address, or phone number
- Be cautious about check-ins and real-time location sharing
- Do not post vacation photos until after returning home
- Review friend/follower lists periodically
- Be cautious about quizzes and personality tests (data harvesting)
Browser Privacy
- Use a privacy-focused browser (Firefox, Brave) or harden your current browser
- Install uBlock Origin (ad and tracker blocker)
- Enable Do Not Track (limited effectiveness but worth enabling)
- Clear cookies regularly or use containers (Firefox Multi-Account Containers)
- Use private/incognito mode for sensitive searches
- Consider a privacy-focused search engine (DuckDuckGo, Startpage)
- Disable third-party cookies
- Review and limit browser extensions (each extension can see your browsing)
Phase 8: Data Breach Response
If Your Data Has Been Breached
Immediate actions (first 24 hours):
- Change passwords for the breached account immediately
- If the password was reused anywhere, change those passwords too
- Enable 2FA on the breached account (if not already active)
- Check for unauthorized transactions on financial accounts
- Monitor email for password reset requests you did not initiate
Within the first week:
- Place a fraud alert with one of the three credit bureaus (Equifax, Experian, TransUnion -- they are required to notify the other two)
- Review credit reports at AnnualCreditReport.com
- Consider a credit freeze (prevents new accounts being opened in your name)
- Check HaveIBeenPwned.com for other breaches involving your email
- Update security questions (if the breach included personal information)
- Monitor accounts closely for 6-12 months
Credit Freeze vs. Fraud Alert:
| Feature | Credit Freeze | Fraud Alert |
|---|
| Duration | Until you lift it | 1 year (initial) or 7 years (extended) |
| Effect | Blocks all new credit inquiries | Requires additional verification |
| Cost | Free | Free |
| Effort to set up | Must contact each bureau separately | Contact one bureau, others are notified |
| To lift | PIN or password required at each bureau | Expires automatically |
Secure Communication Tools
| Tool | Type | Key Feature |
|---|
| Signal | Messaging | End-to-end encrypted, open source, minimal metadata |
| ProtonMail | Email | End-to-end encrypted, Swiss jurisdiction |
| Tuta (formerly Tutanota) | Email | End-to-end encrypted, German jurisdiction |
| Wire | Messaging | End-to-end encrypted, business and personal |
| iMessage | Messaging | End-to-end encrypted (Apple to Apple only) |
Personal Cybersecurity Checklist
Do This Today
Do This Week
Do This Month
Cybersecurity is not about being perfectly secure -- that is impossible. It is about making yourself a harder target than the next person. Implement these measures in order of priority, and each step significantly reduces your risk.
Process
- Gather information. Ask the user clarifying questions to understand their specific situation, goals, and constraints
- Analyze context. Review the information provided and identify key factors relevant to cybersecurity personal
- Develop recommendations. Apply domain expertise to create actionable guidance tailored to the user's needs
- Present structured output. Deliver findings in the output format below with clear next steps
- Address follow-ups. Answer additional questions and refine recommendations based on feedback
Output Format
## Cybersecurity Personal Analysis
### Assessment
[Key findings and observations]
### Recommendations
1. [Primary recommendation]
2. [Secondary recommendation]
3. [Additional suggestions]
### Action Items
- [ ] [First action step]
- [ ] [Second action step]
- [ ] [Follow-up task]
Edge Cases
- Incomplete information: Ask clarifying questions before proceeding with recommendations
- Conflicting requirements: Prioritize the most critical constraint and note trade-offs
- Out of scope requests: Redirect to appropriate specialized skill or professional resource
- Beginner vs advanced: Adjust depth and terminology based on user's experience level
Example
Input: "Help me with cybersecurity personal for my current situation"
Output:
Based on your situation, here is a structured approach to cybersecurity personal:
- Assessment: Evaluate your current state and identify key areas for improvement
- Strategy: Develop a targeted plan based on best practices
- Implementation: Execute the plan with specific, measurable steps
- Review: Monitor progress and adjust as needed
