Personal Cybersecurity & Identity for Executives

Reading time ~12 minutes · No technical prerequisites · Day 1, Module 1.4

Day 1 has built a case: you are in persistent contact with capable adversaries, you are personally the high-value target, and the leverage is upstream and human. This lesson is the pay-off — the concrete, do-it-this-week rules for hardening your own devices, accounts, and identity, and the single authentication change that defeats the intrusion the programme opened with.

Device security: the non-negotiables

Five device controls are not optional for anyone who holds sensitive information. Encryption must be switched on — full-disk encryption on laptops and the default on modern phones — because it protects nothing if it is not enabled. Updates must be applied promptly, since the overwhelming majority of exploited vulnerabilities already had a fix the victim had not installed. A screen lock with a short timeout is the cheapest defence against the device left unattended on a table or in a hotel room. Personal and corporate separation ensures that one compromise does not automatically become two. And remote wipe turns a lost or stolen device from a crisis into a manageable cost.

Account security and the reset trap

Three account controls matter most. A password manager gives you unique, strong passwords on every service without having to remember them. Multi-factor authentication belongs on every account that offers it, above all on your email, which is the master key to your digital identity. And secure recovery deserves as much attention as your password itself, because an adversary who can reset your password never needs to steal it.

Not all MFA is equal

Recall the intrusion in Lesson 01: the adversary relayed a one-time passcode in real time and logged in as the assistant. That is the crucial, under-appreciated fact about authentication — one-time codes can be phished. A fake login page captures the code you type and forwards it to the real site within seconds, and codes sent by SMS carry the additional risk of SIM-swapping. Authenticator-app codes are better than SMS, but they are still something you type into a page, so they too can be relayed.

Phishing-resistant authentication — hardware security keys and passkeys built on the FIDO2 standard — closes this gap. Your device proves your identity to the genuine site cryptographically, bound to that site's real address. On a fake page there is nothing to type and nothing to relay, so the login simply does not work for the attacker. For executive accounts, adopting phishing-resistant authentication is the single highest-impact security change available, because it defeats the exact credential-access step that most targeted intrusions depend on.

One-time codes can be relayed in real time. A passkey is bound to the real site, so there is nothing for a fake page to steal.

PKI in plain terms

The machinery behind passkeys is public-key infrastructure, and the idea is simpler than the name. You hold a private key that never leaves your device and a public key that anyone may see. You prove who you are by performing a calculation only the private key can perform, without ever transmitting a secret that could be intercepted. "Nothing secret crosses the wire" is precisely why these methods resist phishing — there is no shared code or password for a fake site to capture.

Connectivity risks on the move

Several everyday conveniences are also attack vectors. Treat hotel and public Wi-Fi as hostile and use your own trusted connection for anything sensitive. Avoid public charging points, which can carry data as well as power; carry your own charger and a power-only cable. Treat a QR code as a hidden link — "quishing" hides a malicious destination behind a convenient square — and verify before acting. And keep Bluetooth off when unused while never inserting removable media of unknown origin; a "found" USB drive is a classic delivery method.

Phishing as tradecraft

Phishing aimed at you is not the crude mass mail in your spam folder. It is tailored tradecraft that draws on the very fragments described in Lesson 03: spear-phishing referencing a real event you are attending, a fake invitation that matches your actual calendar, an impersonation of a colleague you genuinely trust. The best lures wrap themselves in real context and then apply urgency, which is engineered specifically to stop you pausing to verify. Recognising that urgency is a weapon — not a reason to hurry — is half the defence.

The golden hour, and the culture you set

If you suspect you have clicked, tapped, or typed something you should not have, the most valuable action is to report it immediately and without embarrassment. Early reporting lets responders contain damage before it spreads; a hidden mistake is the one that becomes a catastrophe. As a leader you control whether reporting feels safe. If your people fear blame, they will conceal incidents, and concealment is the enemy of resilience. Making prompt, blameless reporting the norm is a security control you alone can install.