The "how not to get hacked" rules you can apply to your own devices and accounts this week — and the one authentication change that defeats the intrusion from Lesson 01.
Day 1Do-it-nowPersonal
Notes: This is the practical pay-off of Day 1. Keep it concrete and actionable; every rule should be something a participant can do without IT's help today.
Lesson 04 · Slide 2
Device security: the non-negotiables
Encryption on — full-disk on laptops, default on modern phones; useless if not enabled
Updates promptly — most exploited flaws already had a fix you didn't install
Screen lock + short timeout — the cheapest control against the "left it on the table" risk
Personal / corporate separation — don't let one compromise become both
Remote wipe enabled — so a lost device is a cost, not a crisis
Notes: Reveal one at a time. Ask for a show of hands on each — the gaps in the room are the lesson.
Lesson 04 · Slide 3
Account security: the non-negotiables
A password manager — unique, strong passwords everywhere, remembered for you
MFA on every account that offers it — especially email, the master key
Secure recovery — your reset path is as attackable as your password; harden it
The reset trap
An adversary who can reset your password never needs to steal it. Recovery email and phone are part of your attack surface.
Notes: Recovery is the most overlooked weakness. Reused recovery email + SMS reset is a common path in.
Lesson 04 · Slide 4
Not all MFA is equal
Recall Lesson 01: the adversary relayed a one-time code in real time and walked straight in. Press → to compare the two paths.
One-time-code MFA
You type a 6-digit code into a page
A fake page captures and relays it instantly
Adversary is logged in. Defeated.
Phishing-resistant (FIDO2 / passkey)
Your device proves identity to the real site cryptographically
On a fake site, there is nothing to type and nothing to relay
The login simply does not work for the attacker. Held.
Notes: Reveal the two columns in step. The core point: phishing-resistant auth is bound to the real origin, so a relayed credential is worthless. This is the single highest-impact change for executive accounts. The demo link opens a sanitised, local-only comparison page.
Lesson 04 · Slide 5
Which of these is phishing-resistant?
C. A and B can be phished or relayed in real time (and SMS can also be SIM-swapped). D is not a second factor at all. Only C cryptographically binds the login to the genuine site, so there is nothing for a fake page to steal.
Notes: Many will pick A, believing authenticator apps are immune. They are better than SMS but still phishable by relay. Only origin-bound factors are phishing-resistant.
Lesson 04 · Slide 6
PKI in plain terms
Public-key infrastructure sounds technical; the idea is simple. You hold a private key that never leaves your device and a public key anyone can see. You prove who you are by doing maths only the private key can do — without ever sending a secret that could be intercepted.
Why you care
This is the machinery behind passkeys and hardware keys. "Nothing secret crosses the wire" is why they resist phishing.
Notes: Keep it conceptual. Leaders need the intuition (no shared secret to steal), not the cryptography.
Lesson 04 · Slide 7
Connectivity risks on the move
Hotel / public Wi-Fi — assume it is hostile; use your own connection where it matters
Public charging / "juice jacking" — carry your own charger and a power-only cable
QR codes ("quishing") — a QR is just a hidden link; verify before you act
Bluetooth & removable media — off when unused; never plug in found drives
Notes: These are travel-relevant; Day 2 (Lesson 07) goes deeper. Here, the habits.
Lesson 04 · Slide 8
Phishing as tradecraft
Phishing against you is not spray-and-pray. It is tailored: spear-phishing using the fragments from Lesson 03, fake event invitations, and impersonation of people you trust.
The best lures use real context — a real event, a real colleague, a real deadline
Urgency is a weapon — it is engineered to stop you verifying
Notes: Urgency + authority + plausibility is the formula. Naming it helps the room resist it. Verification rules come in Lesson 09.
Lesson 04 · Slide 9
The golden hour
If you think you clicked, tapped, or typed something you shouldn't have, the most valuable thing you can do is report it immediately — without embarrassment. Speed beats damage.
Leadership move
Make prompt reporting safe. If your people fear blame, they hide incidents, and hidden incidents are the ones that become catastrophes.
Notes: The cultural point is a leadership lever: you set whether reporting is safe. Connect to Day 3 crisis leadership.
Lesson 04 · Slide 10
Two-minute drill: harden your phone now
Right now, on your own phone: confirm encryption/lock is on, set the screen timeout shorter, and check that "find my device / remote wipe" is enabled. Go.
Notes: Start the timer. Walk the room. This converts the lesson from knowledge to a completed action before they leave the chair.
Lesson 04 · Slide 11
Day 1 — where we have arrived
The adversary is persistent; you are the target; the leverage is upstream
You can deny fragments, harden your chain, and verify before you act
One change — phishing-resistant authentication — defeats the intrusion we opened with
Tomorrow
Day 2 — OPSEC and counter-collection, devices, mobility, travel, and secure communications.
Notes: Close Day 1 by tying the bow back to Lesson 01's kill-chain: the credential-access stage is exactly what phishing-resistant auth defeats.