Security Training
Passwords & Staying Secure
Most break-ins don't involve fancy hacking — they involve a reused password or a convincing fake message. Get these basics right and you shut the door on the vast majority of it. Tap any rule for the full how-to.
Use a long passphrase, not a short password.
Why: Length beats complexity. A short password full of symbols can be cracked faster than a long, easy-to-remember phrase. Aim for at least 14 characters.
The easiest strong password: 3–4 random words
String together words that don't normally go together, add a number or symbol, and you've got something long, memorable, and hard to guess.
P@ss1! ← short, looks clever, actually weak
- Don't use anything about you that's easy to find: your name, pet, kids, birthday, address, or favorite team.
- Avoid common patterns like Password1, Summer2025, or keyboard runs like qwerty.
Use a different password for every account — and let a password manager remember them.
Why: When one website gets breached, criminals take that email + password and try it on your email, bank, and work logins. If you reused it, they're all open. Unique passwords stop one leak from becoming many.
- Use a password manager to create and store a different strong password for every account — you only need to remember one master passphrase.
- Let it fill passwords in for you. Bonus: it won't auto-fill on a fake look-alike website, which quietly protects you from phishing.
- Not sure which password manager to use? Ask us — we set these up for clients.
Turn on multi-factor authentication (MFA) everywhere it's offered.
Why: MFA means a second step after your password — usually a code or a tap on your phone. Even if someone steals your password, they can't get in without that second factor. It's the single biggest thing you can do to protect an account.
Turn it on for the important stuff first
- Email (this is the master key — it can reset everything else)
- Banking and payroll
- Your work / Microsoft 365 / Google account
Best to worst second factors
- An authenticator app (Microsoft Authenticator, Google Authenticator) or a tap-to-approve prompt — strong and easy.
- Text-message codes — better than nothing, but can be intercepted. Use app-based where you can.
Lock your screen whenever you step away.
Why: An unlocked, logged-in computer is wide open to anyone who walks by — a visitor, a cleaner, a disgruntled coworker. Locking takes one second and undoes all of that.
- On Windows, press Windows + L to lock instantly. Make it a habit every time you get up.
- On a Mac, press Control + Command + Q.
- Set your screen to lock automatically after a few idle minutes as a backstop.
Slow down and check before you click a link or open an attachment.
Why: Phishing works by rushing you. One careful look at who sent it and where a link really goes stops most attacks cold.
Quick gut-check on any message
- Were you expecting it? An unexpected invoice, delivery notice, or “your account is locked” message deserves suspicion.
- Who really sent it? Hover over (or long-press) the sender name to see the actual email address. “Microsoft” from a random Gmail is a fake.
- Where does the link really go? Hover over a link (don't click) to see the true address at the bottom of the screen. If it doesn't match the company, don't click.
- Is it pushing urgency or fear? “Act now or your account closes” is a classic pressure tactic.
Verify any money or password request through a second channel.
Why: A favorite scam is an email that looks like it's from the boss or a vendor: “Change our bank account” or “Buy gift cards and send the codes.” Confirming a different way catches the fake before the money's gone.
- Got a request to send money, change banking details, or share a password/login? Stop.
- Confirm with the person a different way than the message came in — call them on a number you already have, or ask in person. Don't just reply or use a number from the suspicious message.
- Be extra careful when the message adds urgency or secrecy (“don't tell anyone,” “needs to happen today”).
Keep your devices updated, and report anything that feels off.
Why: Most updates quietly fix security holes that attackers are actively using. An out-of-date computer is an unlocked window. And a quick heads-up about something strange lets us catch a problem early, before it spreads.
- Let Windows, your phone, and your browser install updates — don't keep clicking “remind me later” for weeks. (Save your work and restart when asked.)
- If your computer suddenly feels slow, shows pop-ups, or acts strange, report it rather than hoping it goes away.
Don't reuse the same password across different accounts.
Why: One reused password is a master key. When any one of those sites is breached — and breaches happen constantly — everything sharing that password is exposed at once.
- Especially never reuse your email password anywhere else. Email can reset most of your other accounts.
- “Password1” and “Password2” count as reuse — make them genuinely different (a password manager does this for you).
Don't share your password or MFA codes with anyone — ever.
Why: A code texted or shown to you is the one thing standing between an attacker and your account. Scammers call pretending to be IT or your bank specifically to talk you out of that code.
- No legitimate company, bank, or help desk will ever ask you to read back an MFA code. If someone does, it's a scam — hang up.
- Don't share your password with coworkers — ask for your own login instead.
Don't click links or open attachments you weren't expecting.
Why: A single click on a malicious link or attachment can hand over your password or plant ransomware. Unexpected files (invoices, “voicemails,” shipping labels) are a top way attacks get in.
- If you didn't ask for it and weren't expecting it, treat it as suspicious — even if it looks like it's from someone you know (their account may be hacked).
- Not sure? Don't click. Confirm with the sender a trusted way, or send it to us to check.
Don't trust caller ID, sender names, or urgency at face value.
Why: Caller ID and email “From” names are trivially faked. A call showing your bank's name, or an email signed by your boss, can be a complete fake. Urgency is the con artist's favorite tool — it stops you thinking.
- Judge a message by what it's asking you to do, not by the name attached to it.
- Pressure to act right now, pay immediately, or keep it secret is a red flag — slow down and verify.
Don't enter your password on a page you reached from an email or text link.
Why: The most common phishing trick is a login page that looks exactly like the real one, reached through a link in a message. You type your password, and it goes straight to the attacker.
- Instead of clicking a login link in a message, open a new tab and type the website address yourself, or use your saved bookmark.
- If your password manager doesn't offer to fill in your login, that's a warning sign the site may be fake.
Don't save passwords on shared computers or leave them on sticky notes.
Why: A password saved in the browser on a shared or public PC is available to the next person who sits down. A sticky note on the monitor is readable by anyone who walks past — including visitors and photos.
- On a shared or public computer, don't let the browser save your password, and sign out fully when you're done.
- Keep passwords in a password manager, not on paper, in a notes file, or in a spreadsheet.
Don't plug in unknown USB drives or install software you weren't asked to.
Why: A “found” USB stick can infect your computer the moment it's plugged in — that's a real attack, not just a movie plot. And software from a pop-up or random download often carries malware bundled inside.
- Never plug in a USB drive you found or were handed by a stranger.
- Only install software you actually need from the official source. If a pop-up says you need to install or update something, don't — close it and ask us.
Think you clicked something or got caught out?
It happens to careful people too. The worst thing you can do is stay quiet — fast action usually means no harm done. No one will be in trouble for reporting it.
- Don't try to fix or hide it. Tell us right away — open a ticket or call Computer Heaven.
- If you entered a password, change it — from a different device you trust — and change it anywhere you reused it.
- If it involves money or banking, also notify your supervisor and the bank immediately.