This guide brings together the protective habits that hold up over time for a private individual, a self-employed worker or a small organization. It assumes no prior knowledge: every technical term is explained where it appears.
A person's security comes down to a small number of habits applied systematically. Along the way, this guide corrects three very widespread pieces of advice, acceptable in the past and misleading today: reading the padlock in the browser, the recipe for the "short but complicated" password, and the fear of charging stations.
The threats that really affect a private individual
Four situations come up constantly in the incidents suffered by an individual.
- Phishing (in French hameçonnage): a message imitates a well-known organization and asks for credentials, a code received by text message or banking details, on a page that looks like the real one.
- The reused password: a site suffers a leak, and the password found there is tried on your other accounts. If it is the same, they all fall at once.
- Ransomware (in French rançongiciel): a program encrypts your files and demands a payment. Against it, preparation counts more than vigilance.
- The hijacked account: someone gets into your mailbox and uses it to reset your other accounts.
These situations target people, not systems. For the complete vocabulary — virus, worm, Trojan horse, spyware — see a few basic notions of computer security; for the distinction between threat, risk and vulnerability, information system security notions.
Recognizing a fraudulent message
A fraudulent message is not recognized by its spelling mistakes: many of them reuse the real letters of the imitated organization, logo included. It is recognized by three things: the address it comes from, what it asks for, and the way it puts on pressure.
Reading a sender's address
An email address is read in two pieces separated by the at sign. On the left, a label chosen freely, which proves nothing. On the right, the domain name, reserved with a registry by its owner: it is the only part that commits anyone.
This domain name is read from right to left. The last piece is the extension (.fr, .com). French public administrations are recognized by the gouv.fr domain, which the French State reserved for itself inside the .fr extension. The domain name is the word immediately preceding that extension. Everything left of it is a subdomain, added freely by the owner of the domain.
Two demonstration examples, with fictitious domains: the .test extension is reserved for this kind of illustration.
Exemple 1
Adresse réelle : contact@mail.verification-espace.test
Extension : .test
Nom de domaine : verification-espace.test
Sous-domaine : mail
Exemple 2
Adresse réelle : securite@organisme-officiel.fr.controle-compte.test
Extension : .test
Nom de domaine : controle-compte.test
Sous-domaine : organisme-officiel.frThe second example is the most common trap: the name of a well-known organization is placed in the subdomain, where the eye stops. Remember the method rather than the examples: start from the extension, go back one word, stop.
Since the name displayed next to the address is free text, make the full address appear. And as a sender can be forged, a correct address is a good sign, not a proof.
The signals that accompany fraud
- Urgency. A short deadline, an announced suspension, a refund that is about to expire: urgency serves to prevent verification. A real organization leaves you the time.
- The request to enter something. Password, card number, code received by text message, identity document. A validation code is never given to anyone, not even to someone presenting themselves as an adviser or a police officer.
- The unusual channel. A service to which you have never given your number writing to you by text message.
- The unexpected attachment. Opening a document that asks you to "enable macros" amounts to running a program supplied by the sender.
The reflex that settles all these cases is simpler than the analysis: do not click on the link in the message. Open the service by the usual path — bookmark, installed application, address typed by hand. A real request appears in your personal account area; a fraudulent request exists only in the message.
After an entry you regret, the French public assistance scheme for victims can be reached at cybermalveillance.gouv.fr; the State's recommendations are published on cyber.gouv.fr.
Browsing: what the padlock says and what it does not say
The symbol displayed to the left of the address — a padlock in most browsers, a settings button in others — indicates that the connection uses HTTPS, the encrypted version of the web protocol: the data exchanged is scrambled during the journey. On a hotel Wi-Fi network, the person sitting next to you cannot read what you send.
The padlock says nothing about the honesty of the site. The certificate that activates it attests that the server does control the requested domain, nothing more; these certificates are issued free of charge and automatically within a few minutes. A phishing site therefore displays a valid padlock.
The padlock guarantees that nobody reads the conversation on the way, not who you are talking to. What indicates who you are talking to is the domain name. Its absence justifies giving up immediately on a page that asks you to enter something; its presence is never an authorization.
Reading the address of a site
In the address bar, ignore the beginning (https://) and look for the first / character that follows: the domain name is what lies just before it, and is read starting from the extension. What comes after is an internal path, chosen freely by the owner of the site.
Three traps come up: a well-known organization placed in the subdomain, an unusual extension, a letter replaced by a neighboring character. The best remedy is habit: bookmark sensitive sites and reach them only that way.
Browser extensions
An extension is a program added to the browser. The most common permission — reading and modifying the data of all the sites visited — gives access to everything displayed on the screen, banking pages included, and an extension can change owner and then update itself on its own. Install few of them, from the official store. Extensions that promise a virtual private network call for the same caution: they see all the traffic of the browser go by. On what such a service really brings, see five things to know about VPNs.
The phone
The phone concentrates messaging, payments and the validation codes of the other accounts. Four points are specific to it.
Where applications come from
Install from the official store of the system, and check the name of the publisher as much as that of the application: imitations reuse the logo and the label, rarely the publisher. A request to install a "security" application passed on by phone is a classic fraud scenario.
Permissions
Two moments count. At launch, when an application asks for the contacts, the microphone or the location: a flashlight does not need the address book. The second is more often neglected: permissions granted in the past remain active. The settings offer a view by permission, which makes it possible to take back the ones that are no longer justified.
Updates and locking
A device that no longer receives patches becomes vulnerable to published attacks; the support period announced by the manufacturer is therefore a purchasing criterion. As for locking: a six-digit code at minimum, and storage encryption enabled. On a computer, the equivalent procedure under Windows is described in how to encrypt a disk with BitLocker.
Charging while traveling
A public USB socket carries power and data on the same connector. The hijacking of a charging station is possible in principle and has been the subject of official warnings; the documented cases remain rare, and mobile systems ask for a confirmation before any data exchange. There is therefore no reason to give it up, and the countermeasure is simple: an external battery, or a cable that carries only power.
Passwords
The instruction taught for a long time — ten characters with a capital letter, a digit and a special character — was aimed at the automated attempts of another era. It produces passwords that are hard to remember and easy to break, since attack tools know the usual substitutions. Two criteria have replaced it.
Length first
Each character added multiplies the number of combinations to be tried: length is the only parameter that progresses faster than computing power, and a short password remains weak whatever characters are mixed into it. Aim for fifteen to twenty characters. The way a service transforms a password before storing it is described in an introduction to hashing.
Uniqueness next
A unique password for each account turns a leak at one retailer into an incident limited to that retailer. Without this rule, the same leak opens the mailbox — and the mailbox opens the rest, since it is through it that resets go. To be dealt with first: the mailbox, the bank, the administrative accounts. See also how to check whether I have already been hacked.
The passphrase
A passphrase is a sequence of several words with no logical relation between them, assembled into a single string. It effortlessly reaches a length that a classic password never reaches, and it is remembered because it forms an image. The method: five to seven common, independent words, with no quotation and no element of your personal life. No example is given here, since a published example stops being usable.
The password manager
The passphrase solves the memorization of one secret, not that of a hundred accounts. That is the purpose of the manager: an encrypted vault that generates a long and different password for each site, remembers it and fills it in for you. You then only memorize the secret that opens the vault — the one the passphrase is meant for.
Automatic filling brings along a protection against phishing that human vigilance does not match: the manager associates each credential with a precise domain and offers nothing on a page whose address does not match. Awoui provides a password vault; the installation of a self-hosted manager is the subject of a secure deployment guide.
Two-factor authentication
Two-factor authentication adds a second proof to the password: a code received by text message, a code displayed by a dedicated application, or a physical key plugged into USB. A stolen password is then no longer enough to get in. Enable it at least on the mailbox and on financial accounts, and keep the backup codes somewhere other than in the phone.
The three forms are not equivalent. The code sent by text message can be diverted by the fraudulent transfer of a phone line; it is nonetheless better than nothing. The application that generates a code every thirty seconds does not depend on the carrier. The physical key offers the best guarantee: it checks the domain name itself and refuses to answer an imitated site.
What is no longer done
- Changing your password every three months for no reason. Periodic rotation pushes people toward mechanical variations around the same word. You change when there is a reason: a leak, a doubt, a lost device.
- Requiring three types of characters on a short password. The constraint is paid for in memorization without bringing the resistance that length gives.
- Choosing a security question whose answer is public. City of birth, name of a pet: these answers can be found. Nothing obliges you to answer truthfully.
What saves you when the rest has failed
Patches
A security update fixes a flaw that is already known, often already exploited. The delay between the publication of a patch and its installation is the window during which the device can be attacked with ready-made tools. So enable automatic updates. On a server, see recommended security measures to protect your servers.
Backup
Backup is the only answer to ransomware that does not depend on the attacker. The usual rule is remembered in three figures: three copies, two different media, one off site; against ransomware, that third copy must in addition remain unplugged.
- Three copies: the original data and two backups. A single backup that fails silently leaves nothing.
- Two different media: an external drive and a remote space, for example. The same medium suffers the same failures.
- One off site: a copy kept somewhere other than at home, and unplugged between two backups. Ransomware encrypts everything that is reachable from the machine, including permanently connected drives and synchronized folders; a fire or a theft carries away everything located in the same place.
A backup only exists if it has been restored at least once. Recover a random file from time to time: it is the only check that counts.
The first hour after an incident
- Isolate the device from the network: turn off the Wi-Fi, unplug the cable. This limits the spread toward shared drives.
- From another, healthy device, change the password of the exposed account, starting with the mailbox.
- Check what an intruder changes first: automatic forwarding of messages, backup address, associated number, open sessions.
- If banking details have been given out, block the card without waiting for a debit.
- Keep the traces: the message, the address of the site, the screenshots, the time.
- Report the incident to the French public scheme cybermalveillance.gouv.fr, then file a complaint.
- In the case of ransomware, do not pay, and restore from the offline backup after reinstallation.
What comes next
To put these habits into practice, the Cybersecurity awareness course goes over these subjects with exercises, and the Passeport numérique is aimed at complete beginners; the course catalog presents the other courses. The hands-on labs make it possible to handle these notions on real machines.
As for reading, the security section brings together the technical guides, and the introduction to computer security places these incidents back in their context, legal framework included.
What can be done as early as tomorrow morning
- Enable two-factor authentication on the mailbox, and set the backup codes aside.
- Install a password manager protected by a passphrase, and move the sensitive accounts into it first.
- Plug in an external drive, run a first full backup, then unplug it.
- Open the list of the phone's permissions and remove the ones that are no longer justified.
The rest settles in by habit: starting from the extension to read a domain, opening services through your bookmarks rather than through the links you receive, and treating any urgency as a reason to check rather than to act.
This article was published in March 2023 as a summary of a third-party video, whose name it carried. It was entirely rewritten on September 9, 2026: the outline, the text and the examples are Awoui's own and owe nothing more to that work, which is therefore no longer credited.