HN Explorer

Ask HN: How to do a Personal Cybersecurity audit

24 points by preciousoo ↗ HN
I am acutely aware that if I were targeted by a non sophisticated actor (like a very motivated hacker, or a phone/laptop thief with programming knowledge), I would be toast if they figured out, e.g my windows password, as that is the key to my Chrome keychain, for e.g, which allows them into a pandora's box of accounts.

Even more likely, if I were to get a laptop stolen while unlocked, they could get access to my primary email(s), which could lead them to getting access to accounts via password reset. There were a lot of similar other failure points I used to keep enumerated mentally, but now there's too many to count. The biggest ones are email access however.

Is there a process or method I can use to enumerate/track and fix those kids of failure points in my personal cybersecurity?

7 comments

[ 2.0 ms ] story [ 25.6 ms ] thread
ifh-hn
Don't use chrome to store your passwords. Use a password manager that's not tied to a cloud company that you can use multifactor Auth with, one of which is off device.

Don't leave yourself signed into your accounts. As soon as you're done sign out.

Keep everything portable and not centralised.

Convenience doesn't make for good cyber security.

You can't protect yourself from everything but you can make it more difficult.

montague27
I would be more careful towards social engineering than some random typical hackers. The former seems more prevalent and successful in my POV.
1970-01-01
Start at the fundamentals, dammit!

Do you have off-site backups of all your critical data on a regular schedule?

Do you have physical 2FA on all your accounts?

Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch?

Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.

rainonmoon
Start with your threat model. Who is the “someone” you’re imagining attacking you? What are the most likely risks to occur? What are the most damaging? Where do those two lists overlap? Prioritise addressing those first. There’s no point worrying about someone stealing your laptop if it rarely leaves the house, but something like not having reliable 2FA on your accounts is probably more likely to get exploited and potentially as damaging. There’s no point worrying about nation state actors exploiting a side-channel to leak data via an LED on your earphones if you’re currently embroiled in a messy divorce.
rankiwiki
A simple starting point for me was checking password reuse and enabling hardware-based 2FA everywhere possible. It’s surprising how much risk disappears just from that.