Cybersecurity Cheatsheet

Updated September 2026 · Quick reference

View saved

This sheet is for recognition, prevention, and recovery—not for attacking systems.

Use skills only on accounts and devices you own or are explicitly authorized to protect.

Pair entries with the Cybersecurity Tutorials for fuller context and checklists.

Full lessons: Cybersecurity Tutorials

Foundations

Cybersecurity

Protecting people, devices, accounts, networks, and data from unauthorized access, misuse, disruption, and loss.

# Goals in practice
# Keep accounts private
# Keep files trustworthy
# Keep systems usable when needed

CIA triad

Confidentiality, integrity, and availability—classic goals for judging controls and habits.

Confidentiality  — only authorized access
Integrity       — data stays accurate
Availability    — systems work when needed

Threat

Anything that can cause harm—people, malware, accidents, or natural events that target assets you care about.

# Examples (recognize, don't imitate)
# Stolen credentials
# Ransomware encrypting files
# Lost laptop with unencrypted disk

Vulnerability

A weakness in software, configuration, or process that a threat might exploit.

# Common weakness themes
# Unpatched software
# Reused passwords
# Over-broad sharing permissions

Risk

The combination of how likely something bad is and how bad the impact would be. Prioritize high-impact, realistic risks first.

# Quick risk sketch
Asset: family photos
Threat: device loss / ransomware
Control: offline + cloud backups

Defense in depth

Layered controls so one failure does not equal total compromise—passwords, MFA, updates, backups, and least privilege together.

# Layer example for email
Strong unique password
+ MFA
+ Caution on links
+ Separate recovery codes stored safely

Accounts & authentication

Strong password / passphrase

A long, unique secret that is hard to guess. Prefer a password manager over reuse across sites.

# Passphrase style (illustrative)
correct-horse-battery-staple-style phrases
# Better: generate unique secrets in a manager

Password manager

Stores unique credentials in an encrypted vault so you only memorize one strong master password (plus MFA).

# Everyday flow
1) Open vault
2) Autofill unique site password
3) Enable MFA on the vault account

Multi-factor authentication (MFA)

A second proof of identity (app code, hardware key, or push) so a stolen password alone is not enough.

# Prefer
Authenticator app or security key
# Avoid relying only on SMS when better options exist

Recovery codes

One-time backup codes for MFA. Store them offline; treat them like passwords.

# Safe storage ideas
Printed sheet in a secure place
Encrypted offline note
# Not: public cloud doc titled "codes"

Least privilege

Grant only the access needed for the task. Avoid daily use of admin accounts for browsing and email.

# Habit
Normal user for daily work
Elevate only when installing software

Session hygiene

Sign out of shared computers, review active sessions, and revoke access you no longer need.

# Periodic review
Account → Security → Devices / sessions
Sign out unknown devices

Everyday threats

Phishing

Deceptive messages that push you to click, open files, or hand over credentials or money under false pretenses.

# Pause checklist
Unexpected urgency?
Odd sender domain?
Asks for password / codes?
Verify via a known-good channel

Social engineering

Manipulating people—not just software—using trust, fear, or authority to bypass technical controls.

# Red flags
"Don't tell anyone"
"Wire money now"
"IT needs your password"
# Real IT rarely asks for your password

Malware (overview)

Unwanted software that steals data, spies, encrypts files, or misuses your device. Prevention beats cleanup.

# Safer habits
Install from trusted sources
Keep OS/apps updated
Don't open unexpected attachments

Ransomware mindset

Attackers encrypt or lock data and demand payment. Reliable backups and offline copies reduce the harm.

# Resilience, not payment advice
3-2-1 style backups
Test a restore occasionally
Disconnect and get help if infected

Suspicious links & downloads

Hover or long-press to inspect destinations; prefer typing known URLs or using bookmarks for important sites.

# Safer open
Bookmark bank / email login
Type the address yourself
# Skip surprise "invoice.zip" files

Scareware / fake support

Pop-ups or calls claiming your PC is infected and demanding remote access or payment. Hang up; use known support channels.

# If pressured
Close the browser / power off if needed
Contact the vendor via official site
Never give remote control to cold callers

Device & network hygiene

Software updates

Patches close known weaknesses in operating systems, browsers, and apps. Enable automatic updates when practical.

# Check regularly
OS update settings
Browser updates
Phone app store updates

HTTPS browsing

Prefer encrypted HTTPS connections. Treat certificate warnings seriously—do not click through on sensitive sites.

https://example.com
# Look for HTTPS on logins and payments
# Stop on browser warning pages

Home Wi-Fi basics

Use a strong router admin password, modern Wi-Fi encryption (WPA2/WPA3), and a separate guest network when available.

# Router checklist
Change default admin password
WPA2 or WPA3
Guest Wi-Fi for visitors
Firmware updates on

Public Wi-Fi habits

Assume café and airport networks are shared. Prefer sensitive tasks on cellular data or a trusted personal hotspot.

# On public Wi-Fi
Avoid banking if possible
Use HTTPS sites
Turn off auto-join for open networks

Device lock & encryption

Use a screen lock and full-disk encryption (usually on by default on modern phones and many laptops) so lost devices stay harder to abuse.

# Enable
Screen lock / biometrics
Find My / device tracking
Disk encryption (BitLocker, FileVault, etc.)

Privacy permissions

Review app and site permissions for camera, mic, location, and contacts. Remove access you do not need.

# Periodic cleanup
Phone: Settings → Privacy
Browser: Site settings → Permissions
Revoke unused access

Backups

Keep recoverable copies of important data on a separate device or trusted cloud, and verify restores.

# Simple plan
Photos + documents → cloud sync
+ occasional offline copy
Test opening a restore once

Response habits

Stay calm, contain first

If something looks wrong, pause. Disconnect the device from networks if malware is suspected; stop clicking further links.

# First minutes
Don't pay / don't argue with scammers
Unplug Wi-Fi / Ethernet if needed
Use a different clean device to reset accounts

Account takeover steps

From a trusted device: change the password, review MFA and recovery options, sign out other sessions, and check forwarding rules.

# Email / cloud account
1) Change password
2) Confirm MFA methods
3) Sign out all sessions
4) Check filters / forwarding

Preserve evidence lightly

Screenshot phishing messages, note times, and keep emails; useful for reporting and password resets.

# Record
Sender address
URL (don't visit again)
Time and what you clicked
Screenshot if safe

Report & get help

Use official bank/vendor channels, workplace IT, or platform abuse forms. Friends and family may need a walkthrough, not blame.

# Where to go
In-app "report phishing"
Bank's published fraud number
Employer IT / security team

Aftercare

Watch statements, rotate reused passwords elsewhere, and write down what you will do differently next time.

# Follow-up
Monitor banking / email alerts
Update reused passwords
Confirm backups still work

Comments

One comment per signed-in account. Comments are saved with this page’s URL.