Lab Guide — Device & Account Hardening Baseline
Hands-on checklist · 40 minutes · Use your own primary device
What this lab is
A guided, do-it-now hardening pass on your own primary phone and laptop, producing a completed baseline you keep as a participant takeaway. There is nothing to attack and nothing to install beyond settings you already own. Where a setting needs your IT team, note it and move on — the point is to know your own posture.
Part A — Phone (15 min)
Work through and tick each
- Encryption / secure lock enabled (PIN, not a swipe pattern)
- Screen timeout set to the shortest you can tolerate
- Automatic OS updates on
- "Find my device" / remote wipe enabled and tested-locatable
- Biometric unlock on, with a strong fallback passcode
- Bluetooth and Wi-Fi auto-join reviewed; forget unknown networks
Part B — Accounts (15 min)
Work through and tick each
- Password manager in use for your top 10 accounts
- MFA enabled on email first, then everything that offers it
- At least one account moved to a passkey / hardware key (try email)
- Recovery email and phone reviewed; remove anything stale or shared
- SMS removed as a second factor where a stronger option exists
Part C — Connectivity habits (10 min)
Commit to three habits
Write down three connectivity habits you will adopt from: power-only cable for public charging; own connection instead of hotel Wi-Fi for sensitive work; verify-before-scanning QR codes; Bluetooth off when unused; never insert found media.
Your baseline
Keep your ticked checklist. It is your personal hardening baseline and the reference you will re-attest against in the homework and after any travel (Lesson 07).
✓ Self-check: encryption, lock, updates, and remote wipe are confirmed on your phone; MFA is on your email; and at least one account now uses a phishing-resistant factor.