Lock It Like You Live There

You lock your front door when you leave. You probably don't think about it, it's muscle memory, built over years, and it works whether or not you're thinking about burglars that day. You also don't expect the lock to make you invincible. It's one habit in a system of habits: the deadbolt, the porch light, the neighbor who grabs your mail.

Digital safety works exactly the same way. October is Cybersecurity Awareness Month, which mostly means a lot of organizations post a lot of reminders you'll scroll past. This is my version of the reminder, and I'm going to do it differently: no fear, no hype, no listicle of thirty things. Just the small set of habits that security professionals, myself included, actually live by, because they're the ones that survive contact with a busy Tuesday.

Why now? Because October has been loud. This month brought news that records on about 7 million California students were stolen from a state testing vendor's systems; and that attackers abused a compromised backup-service credential to make 173 unauthorized sign-ins to Microsoft 365 environments, the email and file systems businesses run on. Those sign-ins don't necessarily mean data was stolen from all 173. That's the distinction that matters this month: the locks and the lockpicks are sometimes the same company. You can't personally prevent every vendor breach. But you can build habits that make many attacks harder, limit the damage when something goes wrong, and give yourself a better chance of recovering.

Stop choosing passwords. Get a password manager, any reputable one, and let it generate a unique, random password for every account. That sentence is the single highest-leverage security advice that exists, and it's been true for a decade.

Here's why: breaches are going to keep happening, and one of the most common things attackers walk away with is login credentials. If your password is unique to each site, a stolen password from one breach can't simply be reused to unlock your other accounts. If you reuse the same password across email, banking, and everything else, one breach can put all those accounts at risk. Read that again.

And notice how California's breach actually started: not with some clever exploit, but with one stolen login to the vendor's file-transfer server. Credentials are the front door, for big organizations and for you.

For students of mine reading this: I don't expect you to memorize 60 passwords. I expect you to have a manager. That's not cutting corners, that's the professional standard.

Multi-factor authentication, the code on your phone, the prompt on your watch, is the deadbolt on top of the doorknob. Even if someone steals your password, MFA puts another substantial obstacle in their way. It isn't foolproof: attackers can trick people into approving prompts or steal active sessions. Wherever a site offers MFA, turn it on. Prioritize email first, your email is the skeleton key to so many "forgot password" resets in your life, then banking, then everything else. An authenticator app is generally better than a texted code. If a site offers passkeys - cryptographic sign-ins often unlocked by your fingerprint, face, or device PIN - prefer those. They're designed to resist the credential-phishing attacks that defeat ordinary passwords and codes.

Patches are the repairman fixing a broken lock you didn't know about. When your phone or laptop says "update available," don't put it off. Some flaws are exploited before fixes even exist, and a published patch can give attackers clues about what to target. Set updates to automatic. Then do the one thing nobody does: restart when it asks. The update that downloads and never installs is a repairman who showed up and stood on the porch.

Photos, documents, the folder with the kids' school projects. Use an automatic backup, cloud is fine, but remember October's irony: even a backup provider's access credentials can be compromised. That doesn't mean the stored backups in this month's incident were stolen. For the files that matter most, aim for three copies: the original, an automatic backup, and another copy in a different place. Keep at least one backup offline, like an external drive in a drawer that you connect only to update. And every so often, try restoring a file. A backup you can't restore is just a comforting story.

This is the one that matters most, and it's free. The Central Ohio Primary Care breach disclosed this month, affecting about 1.4 million patients and employees, started with a voice-phishing call: someone picked up the phone and talked their way into access. No fancy malware. Just a confident voice and a convincing story.

Every real scam I've ever seen runs on the same fuel: hurry. "Your account will be closed." "Your package is stuck." "Your boss needs gift cards." That pressure to act in minutes is a warning sign, even when the caller claims to represent a legitimate organization. When you feel that spike of urgency, hang up and go to the source yourself; type the website address, call the number on your card, look up the official account. The extra ninety seconds breaks the spell.

Here's the part that's new, and it's the reason this month's edition exists. The old advice "look for bad spelling, check for weird formatting" isn't enough anymore. AI can produce polished, convincing messages in many languages. It can tailor a phishing email to your job, imitate your boss's writing style, and draw on information about your recent purchases. Bad spelling is still a warning sign. Good spelling is no longer evidence that a message is safe.

So here's the new rule: stop trusting the message and start verifying independently.

The distinction that matters: it's not the message that confirms anything. It's you reaching out independently, using contact information you already trust. That's the whole game now.

This one I'm putting in its own section because it matters that much. Voice cloning is cheap now, a few seconds of audio from a social media post or a voicemail is enough to build a convincing copy of your child's voice, your parent's voice, your voice. The "grandparent scam" that used to require a decent actor now requires an app. And it's not hypothetical anymore: law enforcement has been warning about exactly this for over a year, and the technology has only gotten better.

So do this, this week, at the dinner table: pick a family safe word. Something silly, something memorable, the sillier the better, because it needs to survive a panicked 11 PM phone call. Write it down somewhere physical. Then make the family rule:

One more thing: don't verify by replying to the suspicious message or calling a number the caller provides. If the "emergency" arrives by text, call a number you already have. If it arrives by voice, hang up and dial the known number yourself. The point isn't that a different channel is magically safe; it's that you initiate the contact independently.

For my students: tell your parents about this. Seriously. They're the targets, and you're the tech person in the family. This is the one conversation that could genuinely save them thousands of dollars.

Every form that asks for your birthday, your mother's maiden name, your "security question" answers is asking you to hand out pieces of a key. Answer fewer questions. If a field isn't required, leave it blank. If a site asks for your full birthdate and only needs to know you're over 18, that's their problem, not yours; leave it blank and see what happens. (Usually, nothing.)

And freeze your credit. It's free at all three bureaus - Equifax, Experian, and TransUnion - and it makes it much harder for someone to open new credit accounts in your name, even if they have your Social Security number. A freeze doesn't stop every kind of identity theft, but it's a strong layer of protection. Temporarily lift it when you actually need to apply for credit, then let the freeze resume. In a year when an attacker spent four months quietly copying records on millions of California students, disability statuses included, this is basic hygiene, not paranoia.

Here's what October taught us, if we were paying attention: the California students didn't do anything wrong. The organizations behind those 173 Microsoft 365 sign-ins didn't necessarily make a mistake of their own. Attackers exploited access entrusted to a vendor, a supply-chain risk that personal password habits alone can't prevent. You cannot personally defend against all of that, and nobody should tell you that you can.

But look at the list above. Notice what none of it requires: no money (mostly), no technical skill, no vigilance 24 hours a day. It requires habits. The lock on your front door doesn't make you a security expert. It makes you a person who locks up. Do the same online, and you've handled the things that matter.

October ends Saturday. Your habits don't have to.

Sources: reporting from Cybernews on the California ETS student-data breach; The Hacker News on the ConnectWise Cloud Backup supply-chain attack against 173 Microsoft 365 tenants; NY Post on the California student-data breach; Cybersecurity News on the ConnectWise compromise; Spectrum News on the Central Ohio Primary Care Physicians breach