Book III · The Shadow System · How To · No. 10
Protect Yourself
For when you already know the threats exist and still don’t know where to start.
Security is not a one-time purchase — it's a daily discipline, and you are the strongest link in your own defence chain.
Sam's bank called on a Tuesday morning: a login attempt from a country Sam had never visited, using a password Sam recognised at once — the one from a fitness app that had been breached two years earlier, back when the email about it went straight to spam. Nothing about that breach had felt urgent at the time. It felt urgent now.
That's the shape most personal breaches actually take. Not a hacker who singled you out, but an old habit catching up with you months or years later — a password reused once too often, a profile left public, a text answered half a second too fast. The shadow economy behind this doesn't need to outsmart anyone. It just needs you to stay predictable a little longer than you should.
The card holds four practice areas, read as one sequence rather than split by audience: locking down the accounts and devices that are the front door to your digital life, recognising the manipulation aimed at your judgement rather than your hardware, curating the footprint that makes you easy to research, and building the habits — backups, statement checks, a rehearsed response — that turn a breach into an inconvenience instead of a catastrophe. Written for anyone with an inbox and an account worth protecting, which is everyone.
It comes from The Shadow System, where the fuller economics and anatomy of these attacks live. The card stands alone — you don't need the book to use it.
Print it, or send it to whoever in your life still uses the same password everywhere.
So here's the honest question: of the four fronts on this card, which one have you been quietly putting off?
Protect Yourself
Your Personal Fortifications
Securing Your Accounts and Devices
- Use a password manager. Stop recycling passwords — a breach on one site can compromise every account that shares it. A password manager generates unique, high-entropy passwords for everything and leaves you only one master password to remember.
- Enable Two-Factor Authentication. A second verification step — ideally a TOTP app like Google or Microsoft Authenticator rather than SMS, which is vulnerable to SIM-swapping — breaks the attack even if your password is stolen. Prioritise it on email, banking, cloud storage and social media.
- Practise digital hygiene. Enable automatic updates on every device — computers, phones, routers, smart home systems. The gap between a patch's release and its installation is the window criminals actively scan for.
Recognising and Avoiding Social Engineering
- Spot the phish. Be sceptical of messages built on urgency or unrealistic reward, verify the sender's actual domain, and navigate to official sites directly rather than clicking embedded links.
- Beware impersonation and pretexting. Criminals posing as banks, IT desks or officials will never legitimately ask for your password or 2FA code by email or text — call back on a company's published number if in doubt.
- Adopt a zero-trust mindset. Treat every unexpected message, attachment or link as unproven until you've verified it yourself, even when the sender looks familiar.
Curating Your Digital Footprint
- Limit what you share. Criminals target the 'Big Three' — your mother's maiden name, first pet, and childhood address — the trivial details behind most security questions.
- Control your privacy settings. Public profiles make an attacker's reconnaissance effortless, mapping your schedule and vacation status for a perfectly timed spear-phishing message.
- Question quizzes and surveys. Playful prompts like 'what's your superhero name?' are often data-harvesting tools built to mimic common security-question formats.
Building Resilient Habits
- Implement the 3-2-1 backup rule. Keep three copies of your data on two different media, with one copy stored offsite — the strongest defence against ransomware.
- Review your statements regularly. Fraud often starts with small test charges of only a few pounds before it escalates — catch them early.
- Act immediately if compromised. Isolate the device from the network, change every password from a clean device, enable 2FA everywhere, and report the incident — time is what matters most.
The future will not be secured by firewalls alone, but by foresight, discipline, and the courage to write a different, resilient story.
From The Shadow System · © Neil Catton · Filed under security and safety
Read it alongside
Also from The Shadow System · No. 17Build Your Digital FortressFor when the passwords are set, the 2FA is on, and the risk hasn’t actually gone away.
Also from The Shadow System · No. 24Secure the Smart HomeFor the moment you realise nobody in the house has thought about the smart speaker's security since the day it went in the box.
Also from The Shadow System · No. 31Fortify the EnterpriseFor when the human element is your strongest layer of defence, not your weakest.