Cyber-risk map

Know the risks, keep the habits.

Open a category to see the technologies in it, the risks they carry and what protects you.

Home NetworkRouters, gateways, mesh Wi-Fi, NAS, firewalls, segmentation tools

Routing & Gateways

Wi-Fi RouterHigh risk

Weak points

Default credentials never changed
Outdated firmware with unpatched CVEs
WPS enabled and brute-forceable
Weak WEP/WPA encryption
Remote management exposed to internet
DNS hijacking via compromised admin panel

How attacks happen

Attacker logs in with default admin/admin — redirects DNS to malicious servers
Evil twin SSID mimics home network, intercepts all traffic
Router enlisted into Mirai botnet for DDoS attacks
MITM intercepts unencrypted HTTP sessions

What protects you

Change default admin credentials immediately
Enable WPA3 or WPA2-AES; disable WEP/WPA
Disable WPS, UPnP, and remote management
Update firmware monthly or enable auto-update
Create separate guest network for IoT devices

Good habits

Use reputable brands with active security lifecycle
Consider pfSense for advanced home firewall
Review connected devices list monthly
Enable DNS-over-HTTPS on router

ISP Modem / GatewayMedium risk

Weak points

ISP retains backdoor admin access
Default Wi-Fi password on device label
Slow ISP-controlled firmware patching
Shared infrastructure across subscribers

How attacks happen

Physical attacker reads Wi-Fi credentials from label
DNS hijacking via modem admin panel compromise
ISP-level supply chain compromise of firmware

What protects you

Place personal router behind ISP modem
Change default Wi-Fi password on gateway
Enable modem's built-in firewall
Request ISP disable remote management

Good habits

Buy your own modem to reduce ISP control
Review ISP data retention policy annually
Use VPN at router level for all traffic

Mesh Wi-Fi System (Eero / Google Nest / Orbi)Medium risk

Weak points

Cloud-dependent management creates extra attack surface
Mobile app API vulnerabilities
Vendor stores network topology data
Inter-node traffic potentially unencrypted

How attacks happen

Vendor cloud account compromise gives full network access
Malicious OTA firmware via vendor infrastructure
Companion app API vulnerability exposes controls

What protects you

Strong password + MFA on vendor cloud account
Review vendor privacy and data policy
Keep firmware updated via app
Disable unused port forwards

Good habits

Choose vendors with bug bounty programs
Segment IoT to separate VLAN
Audit connected device lists regularly

pfSense / OPNsense FirewallMedium risk

Weak points

Misconfigured firewall rules expose LAN
Outdated packages with known CVEs
Weak admin credentials on web UI
Exposed management interface on WAN

How attacks happen

Attacker exploits unpatched HAProxy package for RCE
Brute-force on web UI grants full network control
Misconfigured NAT exposes internal services

What protects you

Restrict web UI to LAN only
Use strong passwords + 2FA via plugin
Update OS and packages monthly
Enable logging and review weekly

Good habits

Deploy IDS/IPS (Suricata, Snort)
Use VLANs for segmentation
Maintain configuration backups offline

Storage & Backup

Network-Attached Storage (NAS)High risk

Weak points

Default admin credentials
Services exposed directly to internet (port 5000/443)
Ransomware targeting NAS via network shares
Unpatched NAS OS (Synology/QNAP CVEs routinely exploited)

How attacks happen

QNAP/Synology ransomware: DeadBolt encrypted thousands of NAS devices
Exposed NAS admin portal brute-forced from internet
NAS used as staging point for lateral movement on network

What protects you

Never expose NAS directly to internet; use VPN for remote access
Change default credentials; disable admin account
Enable auto-updates; apply security advisories promptly
Enable 2FA on NAS admin interface

Good habits

Enable immutable snapshots for ransomware recovery
Review which services are publicly accessible
Enable IP block-listing after failed login attempts

Cloud Backup Service (Backblaze / iDrive)Medium risk

Weak points

Account credentials reusable from breaches
No client-side encryption by default
Vendor breach exposes years of data
Restore process slow during incidents

How attacks happen

Credential stuffing accesses backup archive
Ransomware encrypts files which then sync to backup, replacing clean copies
Vendor data breach exposes file metadata

What protects you

Enable client-side encryption with private key
Use unique strong password + MFA
Choose vendor with versioning / point-in-time restore
Periodically test restore procedure

Good habits

Follow 3-2-1 rule (3 copies, 2 media, 1 offsite)
Air-gap a periodic full backup
Audit account access logs quarterly

External / Portable USB DriveLow risk

Weak points

No encryption — physical theft = full data exposure
Lost or misplaced easily
USB malware (BadUSB)
No tamper indication

How attacks happen

Lost drive at airport reveals years of personal data
BadUSB-style firmware attack pivots into host
Office cleaner copies drive contents

What protects you

Use VeraCrypt or BitLocker To Go for full-disk encryption
Pair with strong passphrase, not just PIN
Disable USB autorun on hosts
Label and inventory drives

Good habits

Prefer hardware-encrypted drives (Apricorn, iStorage)
Wipe drives securely before disposal
Avoid plugging unknown drives

Network Segmentation

Smart Ethernet Switch / PoEMedium risk

Weak points

Default credentials on managed switches
Unencrypted management via Telnet
VLAN misconfiguration allows lateral movement
Firmware rarely updated

How attacks happen

Attacker accesses management interface via default login
VLAN hopping exposes corporate traffic on home network
Compromised PoE switch powers malicious devices

What protects you

Change default credentials; disable Telnet — use SSH only
Segment networks via properly configured VLANs
Update switch firmware; disable unused ports

Good habits

Disable management access from untrusted ports
Use 802.1X authentication for port access control
Log all admin access to switch

Guest / IoT VLANLow risk

Weak points

Misconfigured inter-VLAN routing leaks traffic
mDNS/Bonjour leaks across VLANs by default
Improper firewall rules between segments

How attacks happen

Compromised IoT device pivots to main LAN due to permissive firewall rule
Guest discovers production printer via mDNS leak

What protects you

Default-deny inter-VLAN traffic; allow specific flows only
Use mDNS reflector with strict per-interface rules
Audit firewall rules quarterly

Good habits

Place all IoT, smart TVs, cameras on isolated VLAN
Treat guest VLAN as untrusted internet
Document VLAN purpose and rules

Network Security Tools

Pi-hole / AdGuard Home (DNS sinkhole)Low risk

Weak points

Single point of DNS failure
Web admin UI exposed if not firewalled
Outdated blocklists may miss new threats
Update mechanism could be hijacked

How attacks happen

Attacker compromises Pi-hole UI, redirects DNS to malicious resolver
Malware bypasses sinkhole using DoH directly to attacker server

What protects you

Restrict admin UI to LAN only; use strong password
Enable DNS-over-HTTPS upstream (Cloudflare, Quad9)
Auto-update blocklists weekly
Block outbound DoH/DoT from clients (force them through Pi-hole)

Good habits

Run on dedicated Pi or container
Maintain a secondary resolver for HA
Review blocked-domain reports weekly

Home IDS/IPS (Suricata, Zeek, Wazuh)Low risk

Weak points

False positives cause alert fatigue
Sensor placement misses encrypted traffic
Resource-intensive on small hardware
Outdated signature feeds

How attacks happen

Critical alerts ignored due to noise
Encrypted exfiltration goes undetected
Attacker disables agent on compromised host

What protects you

Tune rules to your environment
Update Emerging Threats / Talos rulesets weekly
Forward logs to a separate, hardened collector
Monitor agent health

Good habits

Start with detect-only mode (IDS) before IPS
Use Wazuh for correlated host + network telemetry
Document and review high-severity alerts

Personal ComputeLaptops, PCs, tablets, smartphones, e-readers, AI assistants

Mobile Devices

SmartphoneCritical risk

Weak points

OS not updated — known zero-days exposed
Malicious sideloaded apps
Excessive app permissions (mic, camera, location)
Weak 4-digit lock screen PIN
Juice jacking via public USB chargers
Bluetooth always-on broadcasts device

How attacks happen

Spyware via malicious app reads messages, contacts, location
SIM swap at carrier intercepts SMS 2FA codes
Juice jacking via compromised public charger
Stalkerware installed via brief physical access

What protects you

Full disk encryption (default iOS; verify Android)
Biometric + 6-digit PIN
Official app stores only; revoke unused permissions
USB data blocker for public charging
Enable remote wipe / Find My

Good habits

Authenticator app (not SMS) for 2FA
Auto-update OS and apps
Mobile security app (Lookout, Bitdefender)
SIM PIN via carrier to prevent SIM swap

Tablet (iPad / Android tablet)Medium risk

Weak points

Shared family device without account separation
Child app installs without oversight
End-of-life devices with no security updates
Public Wi-Fi without VPN

How attacks happen

Child downloads malware-laden app
Visitor accesses saved credentials on shared tablet
Phishing via unsafe browser session

What protects you

Child profiles with parental controls
Restrict app installs to trusted accounts
Replace EOL devices
VPN on public networks

Good habits

Monthly app permission review
Screen time and content limits for children
No sensitive financial data on shared tablets

eSIM / Dual-SIM PhoneMedium risk

Weak points

eSIM provisioning hijack via QR code phishing
Carrier-side eSIM swap easier than physical SIM swap
Multiple numbers complicate compromise detection

How attacks happen

Attacker social-engineers carrier to provision eSIM on attacker device
QR phishing tricks user into provisioning attacker eSIM
Work line and personal line both compromised in one swap

What protects you

Set carrier port-out PIN/passphrase
Use authenticator apps over SMS 2FA
Monitor carrier account for new eSIM activations
Enable carrier identity verification (e.g., Number Lock at Bell/Rogers)

Good habits

Treat phone number as compromised — minimize SMS-based auth
Subscribe to carrier fraud alerts
Document recovery procedure if SIM is hijacked

Desktop & Laptop

Laptop / DesktopHigh risk

Weak points

Unpatched OS and third-party software
No full-disk encryption
No antivirus or outdated definitions
USB auto-run enabled
Shared admin accounts across family

How attacks happen

Drive-by malware from compromised website
USB drop attack installs RAT
Keylogger delivered via phishing attachment
Ransomware encrypts all files
Physical theft of unencrypted device

What protects you

BitLocker (Windows) or FileVault (macOS)
Keep OS and all software updated
Reputable AV/EDR solution
Disable USB auto-run
Separate user accounts per person

Good habits

3-2-1 backup rule (3 copies, 2 media, 1 offsite)
Password manager; don't save in browser
Enable Secure Boot in BIOS
Use standard account daily; admin only when needed

Linux WorkstationMedium risk

Weak points

False sense of immunity to malware
Sudo misconfiguration grants full root
Outdated repositories miss security patches
Personal scripts running with elevated privileges

How attacks happen

Cross-platform supply-chain attack via npm/pypi packages
Misconfigured SSH server brute-forced
Browser zero-day exploited identically to Windows

What protects you

Enable unattended-upgrades / dnf-automatic
Use SELinux or AppArmor
Disable SSH password auth; key-based + fail2ban
Use a non-root user daily

Good habits

Run a minimal, supported distro (Ubuntu LTS, Fedora)
Verify package signatures
Use Flatpak/Snap sandboxing where possible

Homelab Server / ProxmoxMedium risk

Weak points

Web UI exposed to internet
Default credentials on hypervisor
VM escape vulnerabilities
No network segmentation between guests

How attacks happen

Attacker accesses Proxmox UI on port 8006, deploys cryptominer
VM escape from compromised guest
Lateral movement across all VMs on flat network

What protects you

Restrict UI to VPN only
Strong passwords + 2FA on hypervisor
Apply patches monthly
Use VLANs and firewall between VMs

Good habits

Snapshot before changes
Isolate management network
Monitor with Wazuh / Prometheus

Wearables & Companion Devices

Smartwatch / Fitness TrackerMedium risk

Weak points

Sensitive health data in vendor cloud (heart rate, sleep, location, fertility)
Vendor acquisition changes privacy terms
BLE proximity tracking
Health data accessible to insurers if sold

How attacks happen

Vendor sells health data to insurers or advertisers
Compromised account reveals location patterns
Bluetooth sniffing enables physical tracking in public

What protects you

Restrict all data sharing in companion app
MFA on platform account
Disable BLE when not syncing
Read privacy policy before purchase

Good habits

Choose privacy-committed vendors
Export and delete data when leaving platform
Opt out of research/analytics programs immediately

Smart Ring (Oura / Galaxy Ring)Medium risk

Weak points

Continuous biometric collection (HRV, temperature, sleep stages)
Subscription model creates lock-in
Cloud-only access to your own data
Vendor breach exposes health profile

How attacks happen

Insurance discrimination based on leaked sleep / stress data
Stalker uses cloud account to monitor location and routine
Re-identification from "anonymous" health datasets

What protects you

MFA on vendor account
Review and minimize data sharing
Export data periodically; delete on cloud
Use unique email for the account

Good habits

Prefer vendors offering local-only mode
Read GDPR/PIPEDA disclosures
Cancel and wipe data when discontinuing

E-Reader (Kindle / Kobo)Low risk

Weak points

Linked store account stores payment info
E-books may contain malicious PDFs
Sync exposes reading habits to vendor
Old firmware rarely updated

How attacks happen

Compromised account enables unauthorized purchases
Malicious e-book exploits PDF parser vulnerability

What protects you

MFA on e-reader store account
Keep firmware updated
Review linked payment methods

Good habits

Use gift cards instead of saved payment methods
Disable Wi-Fi when not in use

AI Assistants & LLM Tools

ChatGPT / Claude / Gemini Desktop AppMedium risk

Weak points

Conversation history may be used for training
Prompt injection via shared documents
Plugins/connectors with broad scopes
Sensitive data pasted into prompts

How attacks happen

Employee pastes customer data into prompt — vendor retains it
Malicious shared document hijacks agent to exfiltrate files
Compromised account exposes years of conversation history

What protects you

Disable training-on-data setting
Use enterprise/team plans with no-train guarantee
Audit installed connectors and revoke unused
Never paste secrets, PII, or regulated data

Good habits

Local LLM (Ollama, LM Studio) for sensitive workloads
MFA on AI account
Document acceptable-use policy at home/work

GitHub Copilot / AI Coding AssistantMedium risk

Weak points

Suggests insecure code patterns
Leaks proprietary code into telemetry
Suggests memorized secrets from training data
Supply-chain risk via suggested packages

How attacks happen

Hardcoded credentials suggested and committed
Vulnerable dependency installed based on suggestion
Reverse-engineered training data leaks confidential snippets

What protects you

Enable enterprise / business plan with code-not-used-for-training
Use SAST + secret-scanning on AI-generated code
Review every suggestion before accepting

Good habits

Pair AI suggestions with code review
Disable telemetry where possible
Train developers on common AI failure modes

Smart Home Hub & AssistantsVoice assistants, smart displays, hubs, Matter/Thread devices, automation platforms

Voice Assistants

Smart Speaker (Alexa / Google Home)Medium risk

Weak points

Always-on microphone — passive surveillance
Anyone physically present can issue commands
Linked account is high-value target
Third-party skills may be malicious

How attacks happen

Ultrasonic "dolphin attack" issues inaudible commands
Compromised Amazon account enables unauthorized purchases
Malicious Alexa skill phishes credentials

What protects you

Physical mute button when not in use
Require voice PIN for purchases
Remove unused third-party skills
MFA on linked Amazon/Google account

Good habits

Place away from windows (ultrasonic mitigation)
Regularly delete voice history in app
All smart home devices on separate IoT network

Smart Display (Echo Show / Nest Hub)Medium risk

Weak points

Camera and microphone always on
Displays personal calendar, messages, photos
Linked account high-value
Children may access adult services

How attacks happen

Physical attacker views private calendar or photos on display
Visual eavesdropping of displayed messages
Compromised display used to monitor home occupancy

What protects you

Disable camera/mic when not needed
Place away from sensitive areas
Use guest/restricted profiles for children
MFA on linked account

Good habits

Cover camera physically when not in use
Review daily-summary content shown publicly
Audit linked services and apps

Apple HomePod / Siri DevicesLow risk

Weak points

iCloud account compromise affects HomeKit
Voice recognition can be fooled
Limited automation cross-ecosystem

How attacks happen

Compromised iCloud account unlocks HomeKit-controlled doors
Replay attack with recorded voice unlocks personal data

What protects you

Strong Apple ID password + MFA
Enable "Recognize Voice" only for trusted users
Review HomeKit shared users quarterly

Good habits

Use Advanced Data Protection on iCloud
Limit HomeKit to truly trusted family
Disable Siri on lock screen for sensitive commands

Hubs & Automation Platforms

SmartThings / Hubitat HubMedium risk

Weak points

Cloud dependency — local control depends on hub model
Custom code from community apps unvetted
Z-Wave/Zigbee pairing mode physical exploit window
Account compromise = full home control

How attacks happen

Malicious community app exfiltrates sensor data
Attacker in pairing range hijacks new devices
Cloud breach exposes home automation rules and routines

What protects you

MFA on platform account
Vet every community app before install
Pair devices in a controlled, brief window
Prefer hubs with strong local control (Hubitat, Home Assistant)

Good habits

Backup hub configuration regularly
Segment hub on IoT VLAN
Review automations and access quarterly

Home Assistant (self-hosted)Medium risk

Weak points

Web UI exposed via Nabu Casa or port forward
Custom integrations (HACS) increase attack surface
Add-on containers may run privileged
Backup contains all secrets if not encrypted

How attacks happen

Exposed UI brute-forced; full home control taken
Malicious HACS integration exfiltrates tokens
Unencrypted backup leak reveals API keys for every integration

What protects you

Use Nabu Casa or VPN — never raw port forward
MFA enabled on all admin users
Enable backup encryption
Run on dedicated hardware on IoT VLAN

Good habits

Audit installed integrations monthly
Review automations for unintended triggers
Subscribe to HA security advisories

Matter / Thread DevicesLow risk

Weak points

New protocol — implementation bugs likely
Border router becomes critical single point
Commissioning QR code phishing
Vendor cloud may still be required

How attacks happen

Malicious QR code commissions device into attacker fabric
Border router compromise affects entire Thread mesh
Vendor cloud breach despite local Matter control

What protects you

Buy from reputable vendors with security commitments
Pair only via trusted controllers
Keep border router firmware updated
Verify devices appear in expected fabric

Good habits

Prefer local-only operation when possible
Audit Matter fabrics on hub
Reset and re-commission suspicious devices

Smart Lighting & PowerBulbs, plugs, switches, energy monitors, solar inverters

Lighting

Smart Bulb (Hue / LIFX / Tuya)Low risk

Weak points

Insecure pairing protocols on cheap brands
Bulb leaks Wi-Fi credentials when factory reset (older Hue)
Cloud account compromise allows remote control
Telemetry to vendor reveals home occupancy

How attacks happen

Discarded bulb extracted to recover Wi-Fi password
Mass remote shut-off via compromised vendor account
Occupancy inference from on/off patterns

What protects you

Factory reset and physically destroy bulbs before disposal
MFA on vendor account
Use Zigbee/Matter local bulbs over cloud-only Wi-Fi bulbs

Good habits

Choose vendors that publish security policies
Place on IoT VLAN
Avoid no-name Tuya bulbs for sensitive areas

Smart Switch / DimmerLow risk

Weak points

Mains-powered — physical install hazard if vendor abandons firmware
Cloud account high-value
Some flash custom firmware (Tasmota) — risk and reward

How attacks happen

Vendor goes out of business — switches become unmanageable but still on mains
Compromised account turns off freezer or critical equipment

What protects you

Choose vendors with long support history
MFA on app account
Document a manual override path

Good habits

Prefer Matter/Zigbee for local control
Test failure modes (Wi-Fi down, cloud down)

Power & Energy

Smart PlugMedium risk

Weak points

Cheap brands ship with hardcoded backdoors
Telemetry reveals device usage patterns
Insecure web interfaces on local network
Vendor cloud breaches

How attacks happen

Researchers found hardcoded creds in TP-Link Kasa plugs
Energy data infers when residents are home
Compromised plug toggled to interrupt critical devices

What protects you

Buy from reputable vendors
Place on IoT VLAN
Disable cloud sync if local control suffices
MFA on vendor account

Good habits

Avoid plugs for life-safety equipment (medical, freezers)
Audit plug list monthly
Update firmware via app

Whole-Home Energy Monitor (Sense / Emporia)Low risk

Weak points

Granular load disaggregation reveals individual appliance use
Cloud-only data storage
Account compromise exposes full energy profile

How attacks happen

Insurance / utility uses leaked data to infer behavior
Burglar uses pattern analysis to time entry

What protects you

MFA on vendor account
Review data retention and sharing
Use local-only options where available

Good habits

Place sensor in main panel only — not sub-meters of sensitive areas
Periodically delete historical data

Solar Inverter / Battery SystemHigh risk

Weak points

Internet-connected inverters often default-credentialed
Vulnerabilities (e.g., SolarMan, Enphase) allow remote shutdown
Aggregated grid impact if many compromised
Firmware updated infrequently

How attacks happen

Researchers demonstrated remote shutdown of thousands of inverters via vendor cloud
Local network attacker disables home power
Battery firmware bug overheats cells

What protects you

Place inverter on isolated VLAN — block direct internet
Change defaults; enable MFA on vendor portal
Apply firmware updates promptly

Good habits

Choose vendors with published security disclosures
Maintain manual transfer / off-grid procedure
Monitor for unexpected production drops

Home SecurityCameras, doorbells, smart locks, alarms, garage openers

Cameras & Doorbells

Wi-Fi Indoor / Outdoor CameraHigh risk

Weak points

Default credentials never changed
Footage stored unencrypted in vendor cloud
Open RTSP streams exposed to internet
Firmware rarely updated

How attacks happen

Mirai-class botnet recruits insecure cameras
Unauthorized viewers access feeds via Shodan-discovered RTSP
Vendor cloud breach exposes weeks of footage

What protects you

Change default credentials; enable MFA on vendor account
Disable UPnP and direct internet exposure
Update firmware; verify vendor security commitments
Place cameras on isolated VLAN

Good habits

Avoid cameras in bedrooms / bathrooms
Notify household and visitors of recording
Review footage retention and sharing policy

Video Doorbell (Ring / Nest / Eufy)Medium risk

Weak points

Footage shared with law enforcement requests
Vendor employee access (historical Ring incidents)
Bluetooth pairing exploitable during install
Audio captures bystanders without consent

How attacks happen

Eufy was caught uploading thumbnails despite local-storage claims
Bystanders identified via facial recognition
Compromised account allows real-time monitoring

What protects you

Strong unique password + MFA
Review and limit law-enforcement sharing settings
Disable cloud features if local works

Good habits

Notify visitors that recording occurs (laws vary by province)
Audit shared users
Consider local-storage models

Locks & Access

Smart Lock (August / Yale / Schlage Encode)High risk

Weak points

Bluetooth relay attacks unlock doors
Cloud account compromise grants physical entry
Battery failure during attack window
Sharing codes via app may be over-permissioned

How attacks happen

Relay attack from outside with accomplice near phone unlocks door
Stolen / phished cloud credentials grant entry
Guest with one-time code arrives, then re-shares it

What protects you

Disable proximity auto-unlock
MFA on lock app account
Use time-limited, single-use codes
Pair with deadbolt + alarm

Good habits

Audit access log weekly
Rotate guest codes after use
Maintain physical key as backup

Garage Door Opener (MyQ / smart hub)Medium risk

Weak points

Old fixed-code remotes trivially replayable
Cloud account = remote door open
Companion app vulnerabilities
API integrations (Tesla, IFTTT) expand attack surface

How attacks happen

Replay attack on fixed-code opener allows entry
Compromised account opens door remotely for accomplice
Removed third-party API access disrupts integrations (MyQ history)

What protects you

Replace fixed-code with rolling-code opener
MFA on cloud account
Disable unused integrations
Audit "shared users" list

Good habits

Notification on every open/close event
Manual disconnect for travel periods
Combine with garage interior camera

Alarms & Sensors

Wireless Alarm System (SimpliSafe / Ring Alarm)Medium risk

Weak points

RF jamming disables sensor-to-base communication
Cellular failover may have weak signal
Default duress codes often unset
Cloud monitoring outage = no professional response

How attacks happen

Researchers demonstrated SimpliSafe jamming attacks
Burglar disables Wi-Fi at meter; alarm silenced
Account takeover disables system

What protects you

Choose systems with anti-jam detection
Set duress codes; train all family members
Cellular + Wi-Fi failover; UPS for base station
MFA on monitoring account

Good habits

Test system monthly
Combine with cameras for verification
Local siren that works without cloud

Smart Smoke / CO Detector (Nest Protect)Low risk

Weak points

Cloud dependency for notifications — no Wi-Fi = no alert to phone
EOL devices stop receiving updates
Battery failure silently

How attacks happen

User assumes alert reached phone but Wi-Fi was down
Compromised account hides alerts

What protects you

Verify local alarm sounds regardless of cloud
Test monthly per Canadian fire code
Replace per manufacturer end-of-life schedule

Good habits

Combine with traditional hard-wired detectors
MFA on Nest account
Maintain CO detector in every sleeping area (CSA recommendation)

Identity & AuthPasswords, MFA, SSO, email auth

Password Managers

1PasswordMedium risk

Weak points

Master password is single point of failure
Browser extension XSS risks
Cloud sync exposes encrypted vault
Phishing pages mimic 1Password unlock

How attacks happen

Master password phishing via fake unlock prompt
Compromised browser extension exfiltrates vault
Account takeover if MFA not enabled on 1Password account itself

What protects you

Use a long unique passphrase as master password (5+ random words)
Enable 2FA on 1Password account (hardware key preferred)
Keep Secret Key safely backed up offline
Update apps and extensions promptly

Good habits

Use Watchtower to monitor breached credentials
Enable Travel Mode when crossing borders
Audit shared vaults quarterly
Use unique passwords for every site (even low-value ones)

BitwardenMedium risk

Weak points

Master password reuse risk
Self-hosted instances poorly maintained
Browser extension supply chain
Free tier lacks MFA on every device

How attacks happen

Phishing master password via cloned login page
Self-hosted Vaultwarden exposed without HTTPS
Malicious extension update steals vault

What protects you

Use strong unique master password
Enable hardware key 2FA (YubiKey)
If self-hosting, use HTTPS + reverse proxy + fail2ban
Regularly export encrypted backups

Good habits

Subscribe to premium for emergency access
Review login history monthly
Disable browser auto-fill on untrusted sites
Use Bitwarden Send for secure file/text sharing

KeePass / KeePassXCLow risk

Weak points

Local database file can be stolen
No native cloud sync — users build risky workflows
Plugins are unvetted third-party code
KeeFarce-style attacks on running process

How attacks happen

Stolen .kdbx file brute-forced offline
Malicious plugin exfiltrates entries
Memory dump of unlocked KeePass process

What protects you

Use long passphrase + key file as composite key
Store .kdbx on encrypted volume only
Avoid third-party plugins unless audited
Lock workspace when away from device

Good habits

Use Argon2 KDF (not AES-KDF) for new databases
Sync via your own encrypted cloud (e.g., Cryptomator + Drive)
Keep offline backup copies
Use KeePassXC over original KeePass on Linux/macOS

Browser-built password managersHigh risk

Weak points

Vault tied to OS/browser account — single sign-on creates lateral risk
Weak master protection on Windows (DPAPI bypass)
Synced across all signed-in devices
Limited cross-browser portability

How attacks happen

Malware (RedLine, Vidar) extracts entire Chrome/Edge vault from disk
Family member with device access reads all saved passwords
Lost device with auto-login unlocks every saved site

What protects you

Disable browser password saving; use a dedicated manager
If using browser manager, enable OS biometric prompt before reveal
Enable strong device login + screen lock

Good habits

Migrate to dedicated password manager
Audit and clear saved passwords periodically
Never use browser manager on shared/family devices for sensitive accounts

Multi-Factor Authentication

Authenticator apps (Authy, Google, Microsoft)Medium risk

Weak points

Cloud-backup of TOTP seeds (Authy, Google Auth) creates a remote target
Lost device locks user out if no backup
Push-fatigue attacks on Microsoft Authenticator
Phone malware reads codes via screen capture

How attacks happen

Authy account hijack (2022 Twilio breach exposed seeds)
MFA-bombing tricks user into approving malicious push
Stolen device with no PIN gives codes immediately

What protects you

Disable cloud backup of TOTP seeds where possible
Enable Authenticator app PIN/biometric lock
Use number-matching MFA prompts (Microsoft)
Backup recovery codes in password manager

Good habits

Prefer hardware keys for high-value accounts
Maintain a backup authenticator on a second device
Periodically test recovery codes
Migrate to phishing-resistant methods (passkeys/WebAuthn)

Hardware security keys (YubiKey, Titan)Low risk

Weak points

Physical loss/theft of key
Limited site support for FIDO2
Older U2F-only keys lack backup options
Some keys vulnerable to side-channel (older Yubico FW)

How attacks happen

Lost key + no backup = account lockout
Coercion: physical adversary forces key tap
Supply-chain tampering on counterfeit keys

What protects you

Always register at least 2 keys per account
Buy from official vendor only (Yubico, Google, Feitian)
Enable PIN on FIDO2 keys for presence + knowledge factor
Store backup key in fireproof safe / safety deposit box

Good habits

Keep one key on keyring, one in secure storage
Use NFC-capable keys for mobile compatibility
Register passkeys where supported
Disable SMS fallback once hardware key is set up

Passkeys (FIDO2 / WebAuthn)Low risk

Weak points

Vendor-locked passkey sync (iCloud/Google) creates platform dependency
Cross-platform recovery still maturing
Family members on shared Apple ID could see passkeys
Lost-account recovery flows still rely on weaker factors

How attacks happen

Apple ID / Google account compromise unlocks all passkeys
Phishing of fallback recovery method bypasses passkey
Shared device on family Apple ID exposes accounts

What protects you

Use a strong unique password + hardware key on the parent platform account (Apple/Google)
Avoid family-shared Apple ID for sensitive logins
Maintain hardware-key passkeys (YubiKey 5, Titan) for portability

Good habits

Use passkeys for every site that supports them
Periodically review passkey list per account
Combine passkeys with strict device PINs and biometrics
Test the recovery flow before relying on it solely

SMS / Voice OTPHigh risk

Weak points

SIM-swap attacks at carrier
SS7 protocol weaknesses allow SMS interception
Codes visible on lock screen
Carrier insider risk

How attacks happen

SIM swap then drain bank account / hijack email
SS7 interception of SMS code (used by sophisticated attackers)
Shoulder surfing of code on lock screen

What protects you

Set carrier SIM PIN / port-out lock with provider (Bell/Rogers/Telus offer this in Canada)
Hide message previews on lock screen
Migrate critical accounts to TOTP/hardware keys

Good habits

Treat SMS MFA as legacy — replace where possible
Never use SMS MFA for crypto exchanges or password manager
Confirm carrier escalation procedures for port-out fraud

SSO & Federation

Weak points

IdP account compromise = mass account takeover
Disabled IdP account = lost access to dependent services
Phishable consent screens
Permissions creep across third-party apps

How attacks happen

Compromised Google account unlocks dozens of SSO services
Malicious OAuth app harvests Gmail/Drive scopes
Account suspension by IdP locks user out of unrelated services

What protects you

Maximum security on IdP account: hardware key + strong password
Quarterly review of OAuth-connected apps and revoke unused
Avoid using SSO for highest-value accounts (bank, password manager)

Good habits

Document where you used each SSO provider
Maintain a dedicated alternative email for critical accounts
Enable IdP account recovery options carefully

Corporate SSO (Okta, Azure AD/Entra)High risk

Weak points

IdP compromise = enterprise-wide breach (Okta 2022/2023 incidents)
Misconfigured SCIM provisioning leaks data
Token replay if session not bound to device
Stale accounts retain SSO access

How attacks happen

Okta admin compromise → lateral movement across SaaS apps
MFA-bombing of corporate users
Token theft via infostealer malware then replay

What protects you

Enforce phishing-resistant MFA (FIDO2) for all admins
Conditional access: device compliance + IP restrictions
Short session lifetimes; require re-auth for sensitive apps
Monitor IdP audit logs continuously

Good habits

Adopt Zero Trust principles
Deprovision leaver accounts within hours
Quarterly access reviews
Use PIM/PAM for admin role activation

Email Authentication

SPF / DKIM / DMARCMedium risk

Weak points

Domain without DMARC easily spoofed
Misconfigured DKIM key length (<2048) is brute-forceable
Subdomain takeover bypasses parent SPF
Loose `p=none` policy provides no protection

How attacks happen

Spoofed invoice email from your domain to your CFO
Phishing of customers using lookalike subdomains
BEC fraud via spoofed CEO email

What protects you

Publish strict DMARC policy (`p=reject` after monitoring period)
Use 2048-bit DKIM keys; rotate annually
Configure SPF with `~all` then upgrade to `-all`
Subscribe to DMARC reporting service (Postmark, EasyDMARC)

Good habits

Add BIMI record once DMARC is enforced (logo in inbox)
Monitor reports monthly for unauthorized senders
Document all legitimate sending services
Audit subdomains for SPF/DMARC inheritance

Financial TechBanking apps, POS, crypto wallets, contactless

Banking Apps

Mobile banking app (RBC, TD, Desjardins, etc.)High risk

Weak points

SMS-based 2FA susceptible to SIM swap
Overlay attacks on Android (banking trojans like Anatsa)
Rooted/jailbroken device bypasses app security
Public Wi-Fi MITM if app pins are absent
Saved login on shared family device

How attacks happen

Banking trojan overlays login form, captures credentials and intercepts SMS code
SIM swap → password reset → emptied account
Stolen unlocked phone with biometric set to a family member

What protects you

Use authenticator app or hardware key over SMS where supported
Set carrier port-out PIN with Bell/Rogers/Telus
Install bank app only from official store
Enable transaction alerts for every debit/credit
Use cellular data, not public Wi-Fi

Good habits

Maintain a daily transfer limit appropriate to your needs
Enable biometric login but require PIN for transfers
Review monthly statements line-by-line
Report any unrecognized device under My Devices in app

Online banking web portalHigh risk

Weak points

Credential stuffing from breached passwords
Browser auto-fill exposes login on shared computers
Old browser without TLS 1.3
Phishing emails mimic bank notifications

How attacks happen

Reused password from breach allows attacker login
Phishing email leads to fake portal that captures credentials + 2FA
Browser session hijack via XSS in third-party banner

What protects you

Unique strong password from password manager
Enable all available MFA options (especially hardware keys)
Always type bank URL or use a bookmark — never click email links
Use a dedicated browser profile for banking

Good habits

Sign out and close browser after each session
Enable account lockout notifications
Monitor accounts via independent service (Credit Karma, Borrowell in Canada)

Payment Terminals & POS

Smart POS terminals (Square, Clover, Moneris)Medium risk

Weak points

Default merchant credentials
PIN-pad shimming/skimming attacks
Outdated terminal firmware
Network segmentation gaps allow lateral movement from POS to back office

How attacks happen

Card-skimmer overlay captures swipes and PINs
Compromised POS pivots to corporate network (Target 2013 precedent)
Malicious USB peripheral on terminal exfiltrates card data

What protects you

Change default credentials immediately
Inspect terminals daily for tampering/skimmers
Keep terminal OS/firmware updated
Segment POS network from corporate network and Wi-Fi

Good habits

PCI-DSS compliance baseline
Use P2PE-validated solutions where available
Train staff to recognize tampering
Review terminal logs weekly

Mobile card readers (Square Reader, SumUp)Medium risk

Weak points

Bluetooth pairing vulnerabilities
Lost reader paired to attacker phone
Companion app permissions overreach
Counterfeit reader sold via marketplaces

How attacks happen

Unpaired Bluetooth reader hijacked by nearby attacker
Stolen paired phone processes fraudulent refunds
Fake reader skims card data before forwarding

What protects you

Buy directly from vendor — never marketplaces
Pair only over secure Bluetooth and verify reader serial
Lock companion app with biometrics

Good habits

Daily reconciliation of transactions
Disable unused payment methods in companion app
Restrict admin accounts to owner only

Crypto Wallets

Hardware wallet (Ledger, Trezor)Low risk

Weak points

Seed phrase exposure (photo, cloud, paper theft)
Counterfeit devices from unauthorized resellers
Supply-chain tampering before delivery
Companion app phishing prompts
Ledger Recover service controversy (key shards held by 3 parties)

How attacks happen

Stolen seed phrase drains entire wallet
Malicious firmware update via compromised companion app
Address-substitution malware on host PC swaps destination
Coercion attack with $5 wrench to reveal seed

What protects you

Buy only from official vendor (ledger.com, trezor.io)
Verify device authenticity on first boot
Always verify destination address on the hardware screen
Never type seed into any device — write on paper/steel and store offline

Good habits

Use a passphrase (25th word) for plausible deniability
Distribute seed using SLIP-39 or Shamir Backup
Store backups in geographically separate locations
Decline Ledger Recover if you don't want key shards held by third parties

Hot wallets (MetaMask, Phantom, Trust)High risk

Weak points

Browser extension supply-chain attacks
Malicious dApp drains via signTypedData phishing
Seed phrase stored on device disk
Clipboard hijacking on host OS

How attacks happen

Fake Uniswap site asks for unlimited token approval, drains wallet
Malicious browser extension impersonates MetaMask
Address-replacing clipboard malware
Drainer-as-a-Service kits empty wallet on first signature

What protects you

Use hardware wallet to sign all transactions originating from hot wallet
Revoke unused token approvals (revoke.cash) regularly
Install only verified extensions from official store
Use a dedicated browser profile for crypto

Good habits

Limit hot wallet to small operating balance only
Maintain a separate cold-storage wallet for the bulk
Verify every signature payload before approving
Bookmark dApp URLs — never use search engines

Centralized exchange accounts (Coinbase, Kraken, Newton, Bitbuy)High risk

Weak points

Exchange insolvency risk (FTX, Celsius, QuadrigaCX in Canada)
SIM-swap → password reset → withdrawal
Withholding of funds during disputes
KYC data breach exposes identity

How attacks happen

Exchange bankruptcy locks all customer funds
SIM swap drains exchange wallet
Phishing of exchange credentials + 2FA
Insider exfiltration of KYC data

What protects you

Use Canadian-regulated exchanges (Newton, Bitbuy, Coinsmart) and only keep trading balance
Enable hardware key 2FA
Set withdrawal address allow-listing
Set carrier SIM-swap protection

Good habits

Not your keys, not your coins — withdraw to self-custody for long-term holdings
Diversify across exchanges if you must keep funds there
Monitor news for exchange solvency
Save exchange tax records (CRA reporting)

Contactless & Mobile Wallets

Apple Pay / Google WalletLow risk

Weak points

Lost device with weak passcode allows transactions
Express Transit mode bypasses biometric (Apple Pay)
Family Sharing exposes payment methods to children
Relay attacks on contactless cards stored in wallet

How attacks happen

Stolen iPhone with shoulder-surfed passcode → unlimited Apple Pay spend (well-documented attacks 2023-24)
Child uses Family-shared payment method without limits
NFC relay attack at checkout

What protects you

Use 6+ digit passcode (alphanumeric strongly preferred)
Disable Express Transit if you don't need it
Enable Stolen Device Protection (iOS 17.3+)
Set spending limits on Family Sharing

Good habits

Enable transaction notifications
Review wallet activity weekly
Add only cards with strong fraud monitoring
Use Find My to remotely wipe if lost

Tap-to-pay credit/debit cardsLow risk

Weak points

Skimming via concealed handheld NFC reader (limited per-tap value)
Lost card abused below tap limit ($250 in Canada per tap)
Multiple stolen cards in same wallet
Card details leaked via merchant breach

How attacks happen

Pickpocket uses stolen card for sub-limit purchases until reported
NFC skimmer in crowded transit reads card data
Merchant breach leaks PAN for online fraud

What protects you

Use RFID-blocking sleeve/wallet for high-risk environments
Enable transaction alerts on each card
Report loss within minutes (most banks have in-app card freeze)
Set lower tap limits if your bank allows

Good habits

Use mobile wallet (Apple/Google Pay) instead — tokenized PAN
Review statements weekly
Activate fraud alerts via Equifax/TransUnion in Canada

CommunicationsMessengers, email clients, video conferencing

E2EE Messengers

SignalLow risk

Weak points

Endpoint compromise (malware on phone) reads decrypted messages
Linked desktop client expands attack surface
Backup files (if enabled) stored locally
Phone number is the identity (privacy concern)

How attacks happen

Stalkerware on device captures messages despite E2EE
Linked-device approval phishing
Compromised phone backup exposes message history

What protects you

Set Registration Lock PIN to prevent SIM-swap takeover
Enable Screen Lock in Signal app settings
Review and remove unused linked devices monthly
Use Signal usernames (2024+) to hide phone number

Good habits

Enable disappearing messages for sensitive chats
Verify safety numbers in person for high-stakes contacts
Disable message previews on lock screen
Use a dedicated number (Google Voice/MySudo) if privacy is critical

Matrix / ElementLow risk

Weak points

Default homeservers vary in security posture
Cross-signing setup is complex; users skip verification
Federation metadata leaks
Bridges to non-E2EE networks expose content

How attacks happen

Compromised homeserver admin reads room metadata (membership, timing)
Unverified device joins room and reads new messages
Bridge to Discord/Slack leaks messages to non-E2EE channel

What protects you

Self-host Synapse/Conduit for sovereignty
Always verify all your own devices and contacts via emoji/QR
Disable bridges in sensitive rooms
Use private rooms with required device verification

Good habits

Encrypt every room (default in Element)
Maintain offline backup of recovery key
Review room membership periodically
Prefer matrix.org alternatives if metadata privacy matters

Mainstream Messaging

WhatsAppMedium risk

Weak points

Meta metadata collection (contacts, groups, timing)
Cloud backups (iCloud/Google Drive) historically not E2EE by default
Linked-device sessions persist
SS7/SIM-swap attacks on registration

How attacks happen

Cloud backup search by law enforcement (now optional E2EE)
Account takeover via SIM swap and SMS code
Group invite link harvested by adversary

What protects you

Enable two-step verification with PIN
Enable end-to-end encrypted backups (settings → chats → backup)
Hide last seen, profile photo, and groups from non-contacts
Avoid public group invite links

Good habits

Migrate sensitive conversations to Signal
Review linked devices monthly
Block unknown numbers
Disable message previews

iMessageMedium risk

Weak points

SMS fallback to non-iMessage contacts is unencrypted
iCloud Messages sync exposes content if iCloud account compromised
NSO Pegasus zero-click exploits historically targeted iMessage
Family Sharing surfaces conversations partially

How attacks happen

iCloud breach exposes archived messages
Pegasus-style zero-click exploit installs spyware
Stolen unlocked device reads all conversations

What protects you

Enable Advanced Data Protection (iOS 16.2+) for E2EE iCloud
Enable Lockdown Mode if you're a high-risk target
Strong unique iCloud password + hardware-key 2FA
Disable iCloud Messages if you don't need cross-device sync

Good habits

Keep iOS updated within 24h of releases
Verify Contact Key Verification (iOS 17.2+) for sensitive contacts
Use Signal for highest-stakes conversations
Hide message previews on lock screen

Email Clients

Outlook / Apple Mail / ThunderbirdMedium risk

Weak points

Auto-load remote images leaks open notifications + IP
Attachment auto-preview can trigger exploits
OAuth tokens cached locally
Add-ins/plugins have broad mailbox access

How attacks happen

Tracking pixels confirm email opened and approximate location
Malicious attachment exploits Office vulnerability
Compromised add-in exfiltrates entire mailbox

What protects you

Disable remote image auto-load
Disable preview pane for unknown senders
Audit and remove unused add-ins/plugins
Enable encryption (S/MIME or PGP) for sensitive correspondence

Good habits

Use a dedicated email client profile per account
Run email client with reduced privileges where possible
Subscribe to vendor security advisories

Web mail (Gmail, Outlook.com, ProtonMail)Medium risk

Weak points

Browser session hijack via XSS or malicious extension
OAuth-connected third-party apps have persistent access
Auto-forward rules abused by attackers
Saved password in browser

How attacks happen

Malicious extension reads inbox content
Attacker creates auto-forward rule after compromise to maintain access invisibly
OAuth grant phishing for full mailbox scopes

What protects you

Use hardware key 2FA on email account (THE most important account to protect)
Quarterly review of OAuth-connected apps
Quarterly review of forwarding rules and filters
Use a dedicated browser profile for email

Good habits

For maximum privacy: ProtonMail or Tutanota with E2EE
Enable login alerts
Review account activity / IP history monthly
Set up account recovery carefully (it's the bypass for everything else)

Video Conferencing

Zoom / Teams / Google MeetMedium risk

Weak points

Meeting links shared publicly enable Zoom-bombing
Recording stored in cloud with default permissions
Background image leaks
Plugin/integration access to entire account

How attacks happen

Public meeting link shared → harassment and disruption
Recorded confidential meeting accidentally publicly accessible
Compromised user account joins all upcoming meetings

What protects you

Require meeting passcode + waiting room
Restrict screen sharing to host
Review recording storage permissions
Use SSO + MFA for corporate accounts

Good habits

Lock meetings once all expected attendees join
Disable cloud recording for sensitive meetings (use local with encryption)
Audit installed apps/integrations in admin console
Enable end-to-end encryption where supported (Zoom E2EE)

EntertainmentSmart TVs, gaming, VR/AR, audio devices

Smart TV & Streaming

Smart TV (Samsung Tizen, LG webOS, Android TV)Medium risk

Weak points

Always-on microphone for voice control
ACR (Automatic Content Recognition) tracks every frame watched
Pre-installed apps with broad permissions
Vendor stops firmware updates after 2-3 years
Default credentials on developer/debug interfaces

How attacks happen

ACR data sold to advertisers (well-documented for Vizio, Samsung)
Compromised app on TV pivots to home network
Voice data leaked from compromised vendor cloud
TV botnet enrollment after EOL

What protects you

Disable ACR / Smart Interactivity in settings (Samsung: 'Viewing Information Services')
Disable always-on microphone if not used
Place TV on isolated IoT VLAN
Use external streaming device (Apple TV) instead of built-in apps

Good habits

Review and uninstall pre-installed apps
Decline marketing/personalization opt-ins on first setup
Replace TV when vendor stops security updates
Disable Wi-Fi entirely if TV is used only via HDMI

Streaming sticks (Roku, Fire TV, Chromecast, Apple TV)Low risk

Weak points

Companion app permissions overreach
Cast/AirPlay open to local network without auth
Account compromise enables fraudulent rentals
Side-loaded apps on Fire TV

How attacks happen

Cast bombing: any guest on Wi-Fi sends content to TV
Compromised account purchases fraudulent rentals
Malicious sideloaded APK on Fire TV

What protects you

Require PIN for purchases
Disable Cast / AirPlay when not in use, or restrict to trusted devices
Avoid sideloading on Fire TV
Place on guest VLAN

Good habits

Strong password + 2FA on associated account
Audit subscriptions monthly
Sign out from accounts on shared/rental devices
Update device firmware regularly

Gaming

Gaming consoles (PS5, Xbox, Switch)Medium risk

Weak points

Account credentials reused from other breaches
Voice chat captures background audio
Fraudulent gift card / V-Buck phishing
Saved payment methods accessible by family members
Stalking via Friends list / online status

How attacks happen

Account takeover drains stored payment method on game purchases
Voice phishing in voice chat targets minors
Doxxing via leaked Gamertag → real identity
Fortnite-style phishing for in-game currency

What protects you

Enable 2FA on PSN / Xbox Live / Nintendo account
Require password for all purchases
Set up child accounts with parental controls and spending limits
Restrict friend requests and online visibility

Good habits

Use a dedicated gaming-only email
Educate kids on chat phishing
Review Friends and blocked lists periodically
Update console system software

PC gaming (Steam, Epic, mods)Medium risk

Weak points

Game mods can contain malware
Steam phishing via fake trade offers
Saved Steam credentials in steam_login_users token
Game launchers run with broad privileges

How attacks happen

Steam Stealer malware exfiltrates session token, hijacks account
Malicious mod on Nexus/Workshop installs RAT
Phishing trade offer drains inventory of valuable skins

What protects you

Enable Steam Guard Mobile Authenticator (NOT email)
Download mods only from official Workshop / vetted sources
Run games as standard (non-admin) user
Use a dedicated browser for gaming community sites

Good habits

Periodically clear Steam login sessions
Don't accept random Discord/Steam friend requests
Use Family Sharing carefully
Keep antivirus active even when gaming

VR/AR Headsets

Meta Quest / Apple Vision Pro / PicoMedium risk

Weak points

Eye-tracking and biometric data sent to vendor
Room-scan / spatial mapping reveals home interior
Always-on cameras for passthrough
Account tied to broader vendor ecosystem (Meta/Apple)
Children's biometric data collection concerns

How attacks happen

Meta account compromise → eye-tracking + spatial data exposed
Inappropriate content access by minors via shared headset
Spatial map of home leaked from vendor breach

What protects you

Review and minimize data sharing in headset settings
Use guest mode for visitors
Set up parental controls / age-appropriate accounts
Cover passthrough cameras when not in use

Good habits

Decline biometric/research opt-ins
Limit room-scan to necessary areas only
Update headset firmware regularly
For Meta Quest, use a dedicated Meta account separate from Facebook

Audio Devices

Bluetooth headphones / earbuds (AirPods, Sony, Bose)Low risk

Weak points

Bluetooth always-on broadcasts MAC for tracking
BLE pairing vulnerabilities (KNOB, BIAS attacks)
Find My / vendor cloud account exposes location history
Companion app permissions

How attacks happen

Bluetooth tracking via persistent MAC across stores/cities
Eavesdropping via BIAS attack on vulnerable firmware
Vendor account breach exposes paired device locations

What protects you

Update firmware via companion app regularly
Disable 'always discoverable' modes
Strong password + 2FA on vendor account
Disable Bluetooth when not in use

Good habits

Use random/private MAC where supported
Review vendor app permissions
Erase devices before resale
For AirPods, enable Find My's Lost Mode if misplaced

Smart speakers (Echo, Google Nest, HomePod)High risk

Weak points

Always-listening microphone
Voice purchases without confirmation
Drop-In / intercom features can be abused
Voice match weak — children or guests trigger purchases
Vendor cloud stores voice recordings

How attacks happen

Accidental purchase via overheard advertising
Drop-In abused by family/ex-partners for surveillance
Voice recording leak from vendor breach
Compromised account streams audio surreptitiously

What protects you

Require voice PIN for purchases
Disable Drop-In / restrict to specific contacts
Mute mic physically when not in use
Set voice recording auto-delete (3 months)

Good habits

Review voice history monthly
Disable third-party skills you don't use
Place on isolated IoT VLAN
Strong password + 2FA on Amazon/Google/Apple account

Health & WellnessWearables, medical devices, health apps, telehealth

Wearables & Smart Rings

Fitness trackers (Fitbit, Garmin, Whoop)Medium risk

Weak points

Continuous health data (HR, sleep, location, menstrual) in vendor cloud
Account compromise reveals daily routines
Strava-style heatmaps revealed military bases historically
Vendor acquisition (Google bought Fitbit) changes privacy terms
BLE tracking via persistent identifier

How attacks happen

Stalker uses leaked location/route data to predict whereabouts
Insurance discrimination based on inferred health metrics
Compromised vendor cloud leaks reproductive health data
Heatmap publicly exposes home address

What protects you

Disable public sharing of activity/location
Set workout privacy to 'private' by default
Review and minimize data shared with third-party apps
Strong password + 2FA on vendor account

Good habits

Read vendor privacy policy before purchase
Audit connected third-party apps quarterly
Export and delete data when leaving the platform
Avoid posting workout maps starting/ending at home

Smart rings (Oura, Galaxy Ring, Ultrahuman)Medium risk

Weak points

Highly sensitive biometric data (fertility, sleep stages, body temp)
Subscription model means data captive to platform
BLE pairing vulnerabilities
Vendor business model may pivot to data monetization

How attacks happen

Reproductive health data subpoenaed (post-Roe US precedent — relevant for cross-border travel from Canada)
Vendor cloud breach exposes detailed biometric profiles
Insurer purchases aggregated health data

What protects you

Use a privacy-respecting account (separate email, no real name where possible)
Disable cloud sync if local-only mode is supported
Decline research / data-donation opt-ins
Strong password + 2FA

Good habits

Choose vendors with clear privacy commitments (Oura has stronger track record)
Periodically export and delete historical data
Be aware of vendor jurisdiction (US vs EU vs Canadian data residency)

Medical Devices

Continuous Glucose Monitor (CGM — Dexcom, Libre)High risk

Weak points

BLE communication historically unencrypted on some models
Cloud-shared data with caregivers
Companion app permissions
Smartphone OS vulnerabilities affect data integrity

How attacks happen

BLE eavesdropping intercepts glucose readings
Compromised companion app sends false alarms
Caregiver portal account takeover exposes patient data
Disruption attack on insulin pump pairing (life-safety risk)

What protects you

Update CGM firmware via official app immediately
Strong password + 2FA on Dexcom/Libre account
Restrict caregiver sharing to verified contacts
Use a dedicated phone if possible

Good habits

Backup CGM data export monthly
Be aware Diabetes Canada / Health Canada device advisories
Disable Bluetooth when CGM is removed
For pumps, follow vendor cybersecurity guidance strictly

CPAP / Smart medical wearablesMedium risk

Weak points

Cloud-uploaded sleep / breathing data
Insurance compliance reporting reveals usage patterns
Mobile app account often weak password reset flow
Device firmware rarely updated by patients

How attacks happen

Insurance denies coverage based on usage data
Vendor cloud breach exposes detailed sleep patterns
Health employer wellness program access

What protects you

Strong password + 2FA
Understand insurance data-sharing requirements before consenting
Update firmware when prompted
Review what data is shared with employer/insurer wellness programs

Good habits

Request data export and audit access logs annually
Use device offline if cloud features aren't medically required
Document any unusual device behavior

Health Apps

Period / fertility trackers (Flo, Clue, Natural Cycles)High risk

Weak points

Reproductive health data is legally sensitive (cross-border concerns)
Free apps monetize data via ads/analytics
Account-less / pseudonymous modes may still leak via SDK telemetry
Data sales to brokers

How attacks happen

Reproductive health data subpoenaed in legal proceedings (cross-border US travel risk)
Data broker resale reveals pregnancy to advertisers
Compromised account exposes intimate health timeline

What protects you

Choose privacy-first apps (Euki, Drip — local-only, no cloud)
Use anonymous mode if available
Avoid logging in with social accounts (Facebook/Google)
Review data-sharing settings strictly

Good habits

Read privacy policy and data location specifically
Avoid US-hosted apps if cross-border privacy is a concern
Periodically delete historical data
Consider paper tracking for highest sensitivity

Telehealth

Telehealth platforms (Maple, Telus Health, Dialogue)Medium risk

Weak points

Video session quality varies in encryption
Health record stored in vendor cloud
Provincial privacy law applies (PHIPA in Ontario, etc.)
Account credentials reused from breaches
Family-shared accounts blur record ownership

How attacks happen

Account takeover exposes full medical history
Insecure home Wi-Fi exposes telehealth video
Vendor breach exposes diagnoses (e.g., 23andMe-style)
Phishing posing as Telus Health appointment reminder

What protects you

Strong unique password + 2FA
Use VPN on public Wi-Fi for any telehealth session
Verify telehealth URLs carefully — never click email links
Use private room and headphones for confidentiality

Good habits

Confirm vendor stores data in Canada (PIPEDA / provincial residency)
Request data export rights before signing up
Separate accounts per family member (no sharing)
Review account activity logs

TransportationConnected cars, EV chargers, mobility apps

Connected Cars

Connected vehicle (Tesla, Ford, GM, BMW)High risk

Weak points

Telematics collect location, driving behavior, in-cabin audio
Companion app account compromise enables remote unlock/start
CAN bus attacks via OBD-II port
Wireless key fob relay attacks
Insurance/manufacturer data sharing without clear consent
End-of-life vehicles still report to vendor

How attacks happen

Tesla account takeover unlocks and drives away vehicle (multiple documented incidents)
Key fob relay attack enables theft from driveway
Insurance company purchases driving data and raises premiums
Used car still linked to previous owner's account leaks personal data

What protects you

Strong password + 2FA on manufacturer account (Tesla, FordPass, etc.)
Use Faraday pouch for key fobs at home
Disable PIN-to-Drive bypass features
Wipe vehicle infotainment + remove account linkage when selling
Review and decline telematics data sharing where allowed

Good habits

Cover OBD-II port with locking cap
Be aware of insurance data programs (Drivewise, Snapshot) before opting in
Update vehicle software promptly
Use guest mode for valets and rentals

In-car infotainment & Wi-Fi hotspotMedium risk

Weak points

Connected phone exposes contacts, messages, call history (stored in unit)
Public Wi-Fi hotspot exposes occupants
Apps installed in infotainment lack security review
Bluetooth pairing remembered indefinitely

How attacks happen

Used/rental car still has previous user's phone data accessible
Compromised infotainment app pivots to vehicle CAN bus
Public hotspot user MITM'd on long road trips

What protects you

Always factory-reset infotainment when selling/returning
Decline contacts/messages sync if not needed
Use VPN on in-car hotspot
Remove Bluetooth pairings after use

Good habits

Don't pair work phone with rental cars
Disable hotspot when not in use
Audit installed apps periodically
Use guest profile if available

EV Charging

Public EV chargers (Electrify Canada, FLO, ChargePoint, Tesla Supercharger)Medium risk

Weak points

RFID card data captured by skimmers
Charger app account stores payment method
Compromised charger could (in theory) push malicious firmware to vehicle
Plug-and-Charge (ISO 15118) certificate management complexity
Location tracking via charging history

How attacks happen

Skimmer on RFID reader captures card credentials
App account takeover drains stored payment method
Driving pattern inference from charging history sold to advertisers

What protects you

Use app-based charging over RFID where possible
Strong password + 2FA on charging account
Inspect chargers for tampering
Review charging history privacy settings

Good habits

Limit stored payment to a low-limit credit card
Decline marketing opt-ins
Avoid public chargers for sensitive trips (clinics, etc.)
Update vehicle and charger app firmware

Home EV charger (Wallbox, ChargePoint Home, Tesla Wall Connector)Medium risk

Weak points

Default credentials on web interface
Wi-Fi connectivity to vendor cloud
Firmware rarely updated by homeowner
Outdoor unit physically accessible

How attacks happen

Default-credential exploit takes over charger
Compromised charger enrolled in botnet
Neighbor exploits weak Wi-Fi to use your charger
Vendor cloud breach exposes home charging schedule

What protects you

Change default credentials immediately
Place charger on isolated IoT VLAN
Enable auto-updates
Strong WPA3 on charging Wi-Fi network
Lock physical access where possible

Good habits

Review installer's default settings before they leave
Subscribe to vendor security advisories
Audit allowed user list quarterly
Disable cloud features if you don't use them

Mobility Apps

Ride-share apps (Uber, Lyft)Medium risk

Weak points

Stored payment method in account
Trip history reveals home/work address
Account takeover enables fraudulent rides
Driver-side app collects passenger data
Phone number visible to drivers (some regions)

How attacks happen

Account takeover books rides to attacker's destination charged to victim
Trip history leaked from breach reveals patterns
Stalker driver uses pickup location to locate victim later

What protects you

Strong password + 2FA
Use anonymized phone number features (Uber masks both directions)
Set pickup/drop-off slightly off your exact address for sensitive trips
Review trip history privacy settings

Good habits

Limit stored payment methods
Use one-time payment cards for rides
Review and remove old payment methods
Report and block any uncomfortable driver interactions

E-scooter / bike-share apps (Lime, Bird, Bixi, Communauto)Low risk

Weak points

Account compromise rides at victim's expense
Location tracking of all rides
Identity verification documents stored in vendor cloud
Wallet/credit charges if vehicle 'damaged' fraudulently

How attacks happen

Account takeover unlocks scooters and racks up rides
ID document leak from vendor breach (multiple e-scooter vendors breached historically)
Fraudulent damage charge after legitimate use

What protects you

Strong password + 2FA
Photograph scooter/bike condition before and after each ride
Monitor for unauthorized charges
Limit stored payment to low-limit card

Good habits

Verify vendor data residency
Delete account after extended non-use
Check ride history for anomalies
Use Communauto / Bixi (Canadian) where data residency matters

Cloud & StorageCloud drives, self-hosted storage, backup

Consumer Cloud

iCloudMedium risk

Weak points

By default not E2EE for many data types — Apple holds keys
Family Sharing exposes purchase history and location
Account compromise = full Apple ecosystem breach
Recovery via SMS or email
Photo Stream may sync sensitive content

How attacks happen

iCloud account compromise via password reuse leaks photos, contacts, location
Celebrity photo leaks (2014 Fappening) via credential stuffing + recovery flow
Family member accidentally exposed to private content via shared library

What protects you

Enable Advanced Data Protection (iOS 16.2+) for E2EE on most data
Strong unique password + hardware key 2FA
Set up trusted recovery contact (not via email/SMS)
Audit Family Sharing permissions

Good habits

Review devices signed into iCloud quarterly
Enable Stolen Device Protection (iOS 17.3+)
Disable Photo Stream for sensitive folders
Use Hide My Email for new sign-ups

Google Drive / OneDrive / DropboxMedium risk

Weak points

Vendor holds encryption keys (server-side encryption)
Shared link permissions overly permissive (anyone-with-link)
Third-party OAuth apps have persistent access
Sync clients store credentials locally
Old shared files retain access for departed colleagues/partners

How attacks happen

Public 'anyone-with-link' file indexed by search engines
OAuth-connected app exfiltrates entire drive
Departed employee retains access via shared folder
Sync client compromise on endpoint exposes all files

What protects you

Strong password + 2FA (hardware key for primary account)
Use 'specific people' sharing — never anyone-with-link for sensitive files
Quarterly review of OAuth-connected apps and shared folders
Encrypt sensitive files locally before upload (Cryptomator, age)

Good habits

Use a vault tool (Cryptomator) for client-side encryption
Set link expiration where supported
Enable file activity audit logs
Audit external shares quarterly

Self-Hosted Storage

NextcloudMedium risk

Weak points

Default install lacks hardening (HTTPS, fail2ban, headers)
Apps from third-party store unvetted
Outdated PHP / web server
Public sharing links default to long-lived
Server compromise exposes all data

How attacks happen

Brute-force on exposed login (no fail2ban)
Compromised app from store steals data
Outdated PHP CVE exploited via web
Server takeover via misconfigured file permissions

What protects you

Use HTTPS with strong TLS config (Let's Encrypt)
Enable 2FA for all users
Install fail2ban + reverse proxy with rate limiting
Audit installed apps; remove unused

Good habits

Apply security advisories within 24h
Enable server-side encryption
Regular off-site encrypted backups
Document recovery procedures

Synology / QNAP NAS as cloudHigh risk

Weak points

DSM/QTS exposed to internet historically heavily targeted by ransomware
Default admin account enabled
DDNS reveals IP location
Quick Connect routes traffic through vendor cloud

How attacks happen

DeadBolt, Qlocker ransomware encrypted thousands of NAS units
Brute-force on internet-exposed admin
Vendor cloud breach exposes data behind Quick Connect

What protects you

Disable admin account; use named admin with strong password
Enable 2FA
Never expose DSM/QTS port directly to internet — use VPN (Tailscale, WireGuard)
Enable auto-update and apply security advisories same-day

Good habits

Immutable / snapshot backups for ransomware recovery
Disable Quick Connect if you don't need it
IP block-listing after failed login
Test restore from backup quarterly

Backup Services

Backblaze / Arq / DuplicatiLow risk

Weak points

Encryption key recovery model varies (some vendors hold keys)
Backup endpoint compromise affects all data
Cost surprises if storage class misconfigured
Restore time can be slow

How attacks happen

Vendor account compromise initiates malicious restore
Ransomware deletes both source and backup if backup is online + writable from source
Encryption-key loss = unrecoverable data

What protects you

Use private encryption key (Backblaze B2, Arq with passphrase)
Backup to immutable / object-lock storage
Strong password + 2FA on backup account
Test restores quarterly

Good habits

Follow 3-2-1 rule: 3 copies, 2 media, 1 off-site
Document encryption key recovery in safe location
Monitor backup completion alerts
Periodic restore drills

AI & ProductivityAI chatbots, browser extensions, note apps, office suites

AI Chatbots & Assistants

ChatGPT (OpenAI)High risk

Weak points

Conversations used for training by default (consumer plans)
Memory feature persists data across sessions
Plugins / GPTs grant broad data access
Account compromise exposes conversation history
Sensitive data (PII, code, secrets) routinely pasted in prompts
Custom GPTs may exfiltrate user input

How attacks happen

Employee pastes proprietary source code → data leaves organization
Compromised account reveals strategic conversations
Malicious custom GPT exfiltrates user-supplied data via tool calls
Memory feature retains sensitive personal data indefinitely

What protects you

Disable training on your data (Settings → Data Controls)
Use ChatGPT Team/Enterprise for work — never consumer for company data
Disable Memory for sensitive accounts
Strong password + 2FA
Treat every prompt as if it could become public

Good habits

Establish a personal data-classification rule before pasting
Use API access (no training by default) for sensitive workflows
Quarterly audit of installed GPTs and connected apps
Avoid plug-ins that demand broad scopes

Claude (Anthropic)Medium risk

Weak points

File uploads stored on Anthropic infrastructure
Projects feature persists context
API key exposure via desktop apps
Account credential reuse

How attacks happen

Sensitive document uploaded to Claude leaks via account compromise
API key leaked in shared screenshot or git commit
Data residency concerns for non-US users

What protects you

Strong password + 2FA
Anthropic does not train on consumer chat by default — verify settings
Use API for programmatic access; rotate keys regularly
Be aware data is processed in the US

Good habits

Delete sensitive conversations after use
Use Workspaces for organization-level controls
Avoid uploading regulated data (PHIPA, PIPEDA-sensitive) without proper agreements

Microsoft Copilot (M365)Medium risk

Weak points

Inherits permissions of user — over-permissioned users now over-permissioned with AI
Surfaces sensitive data from forgotten SharePoint sites
Prompt injection via document content
Audit logs may not capture all interactions

How attacks happen

Copilot surfaces HR / salary data the user technically had access to but never opened
Indirect prompt injection in malicious document hijacks Copilot output
Departing employee uses Copilot to mass-summarize sensitive data

What protects you

Audit and tighten SharePoint/OneDrive permissions BEFORE rollout (Microsoft Purview)
Enable sensitivity labels and DLP policies
Restrict Copilot rollout by group during initial deployment
Train users on prompt injection awareness

Good habits

Enable Microsoft Purview audit logs for Copilot
Establish DLP policies for AI interactions
Quarterly access reviews on shared sites
Have a Copilot acceptable use policy

Browser Extensions

General browser extensions (Chrome/Firefox/Edge)High risk

Weak points

Extensions with broad permissions (read/change all data on all sites)
Sold/abandoned extensions push malicious updates
Sideloaded extensions bypass store review
Extension manifest v2 → v3 transition leaves abandoned tools
Companion server reads aggregated user data

How attacks happen

Popular extension sold to malicious actor pushes update with credential stealer (multiple documented cases — The Great Suspender)
Extension exfiltrates browsing history to ad broker
Malicious extension reads password manager autofill data
Extension reads internal corporate dashboards

What protects you

Audit installed extensions; remove anything unused
Review permissions before install — broad permissions are red flag
Pin extensions and review updates
Use a separate browser profile for sensitive work
Prefer extensions from reputable publishers with active maintenance

Good habits

Quarterly extension audit
Disable extension auto-update for high-trust extensions and review updates manually
Use enterprise policy to allow-list extensions in work browsers
Avoid 'convenience' extensions (PDF, screenshot, coupon) that demand broad access

Note & Knowledge Apps

Notion / Obsidian / EvernoteMedium risk

Weak points

Notion/Evernote: vendor holds keys; cloud sync exposes all notes if account compromised
Obsidian Sync end-to-end encrypted but third-party sync (Dropbox) is not
Public sharing links indexed by search engines
API keys, passwords, secrets often pasted into notes
Workspace member access creep

How attacks happen

Compromised Notion account exposes years of personal/professional knowledge base
Obsidian vault synced via Dropbox without encryption is exposed in Dropbox breach
Public Notion page indexed by Google reveals internal docs
Departing employee retains workspace access

What protects you

Strong password + 2FA on note app account
For Obsidian: use Obsidian Sync (E2EE) or wrap third-party sync in Cryptomator
Audit shared/public pages periodically
Never paste passwords or API keys into notes — use a password manager
Quarterly workspace member review

Good habits

Use a separate vault for sensitive notes
Enable account activity logs
Document workspace ownership transition procedures
Consider local-first apps (Obsidian, Logseq) for highest privacy

Office Suites

Microsoft 365 / Google WorkspaceMedium risk

Weak points

Document sharing scopes overly permissive
Macros/scripts in Office documents
OAuth third-party apps with broad scopes
Conditional access misconfigured
Forgotten anonymous links remain valid

How attacks happen

Malicious Excel macro installs malware (still common attack vector)
Anyone-with-link document indexed by search engine
OAuth phishing grants attacker persistent mailbox access
Departed contractor retains access via shared drive

What protects you

Disable macros from internet sources (Office default since 2022 but verify)
Use 'specific people' sharing — disable anyone-with-link for sensitive content
Quarterly OAuth-app audit (admin console)
Conditional access: device compliance + MFA

Good habits

Enable activity audit logs
Use sensitivity labels and DLP
Periodic external-share review
Train users on phishing recognition

Browsing & PrivacyBrowsers, VPN clients, DNS, privacy tools

Browsers

Chrome / EdgeMedium risk

Weak points

Heavy telemetry to Google/Microsoft
Sign-in syncs history, passwords, autofill across all devices
Extension supply-chain risk
Third-party cookies still partially supported
Frequent zero-days (V8 engine targeted)

How attacks happen

Compromised Google/MS account exposes browsing history and saved passwords
Malicious extension reads all site data
Zero-day in V8 used in drive-by attack
Cross-device sync leaks work data to personal device

What protects you

Update browser within 24h of releases (zero-days are common)
Use separate browser profiles for work / personal / banking
Disable third-party cookies
Audit extensions monthly
Strong password + hardware key on Google/MS account

Good habits

Disable telemetry where possible (chrome://settings/privacy)
Avoid signing into the browser if you don't need sync
Use Enhanced Safe Browsing
Review sync data scope carefully

FirefoxLow risk

Weak points

Default config still sends some telemetry
Third-party extensions can still be malicious
Sync requires Mozilla account
Older versions on EOL Linux distros

How attacks happen

Compromised Mozilla account exposes synced data
Malicious extension via AMO (rare but happened)
Outdated Firefox vulnerable to known CVEs

What protects you

Enable Strict tracking protection
Use Firefox Containers to isolate sites (Facebook, Google, banking)
Disable telemetry in privacy.* about:config
Strong password + 2FA on Mozilla account

Good habits

Use ESR for stability on managed devices
Enable HTTPS-Only mode
Review extension permissions
Subscribe to Mozilla security advisories

BraveLow risk

Weak points

Built-in crypto wallet broad attack surface
Brave Rewards / BAT introduces tracking trade-offs
Tor mode is convenience-only, not full Tor
Chromium upstream zero-days

How attacks happen

Brave wallet phishing drains crypto
Chromium zero-day affects Brave too
Misuse of Tor mode believing it offers full anonymity

What protects you

Disable Brave Wallet if you don't use it
Disable Brave Rewards for maximum privacy
Use real Tor Browser for actual anonymity needs
Update promptly when Chromium patches release

Good habits

Enable Shields aggressive mode
Use separate profiles for sensitive activity
Don't treat Tor mode as Tor Browser

Tor BrowserLow risk

Weak points

Exit-node operators can see unencrypted traffic
JS enabled by default on Standard mode introduces fingerprinting
Slow speed encourages users to drop back to Chrome for 'quick' lookups (mixing identities)
Visiting Tor itself is suspicious in some jurisdictions

How attacks happen

Malicious exit node injects content into HTTP
De-anonymization via JS-based fingerprinting
User browses logged-in account on Tor → links Tor identity to real identity

What protects you

Use Safest security level for anonymity-critical browsing
Never log into real-name accounts on Tor
Use HTTPS sites only
Use bridges if Tor itself is blocked/suspicious

Good habits

Combine with VPN for ISP-visibility concerns (VPN-over-Tor or Tor-over-VPN, understand trade-offs)
Don't resize browser window (fingerprinting)
Use Tails OS for highest-stakes work

VPN Clients

Commercial VPN (Mullvad, ProtonVPN, IVPN, NordVPN)Low risk

Weak points

Provider can see all traffic — choose carefully
Free VPNs monetize user data
DNS leaks bypass tunnel
WebRTC leaks real IP
Account-based VPNs link identity to traffic

How attacks happen

Free VPN sells browsing data to brokers
DNS leak reveals queries despite VPN
Compromised VPN provider hands logs to law enforcement
Phishing site mimics VPN client install

What protects you

Choose audited no-log providers (Mullvad, IVPN — anonymous accounts; Proton — Swiss)
Enable kill switch and DNS leak protection
Block WebRTC in browser settings
Avoid free VPNs entirely

Good habits

Pay anonymously where possible (Mullvad accepts cash)
Verify provider has been audited and stood up to subpoenas
Use VPN at router level for whole-home coverage
Test for leaks (ipleak.net) regularly

Self-hosted VPN (WireGuard, Tailscale, Headscale)Low risk

Weak points

Server compromise exposes all peers
Misconfigured WireGuard peers route traffic incorrectly
Tailscale uses Microsoft/Google/Apple OAuth as identity
Coordination server (Tailscale) sees metadata

How attacks happen

Compromised home server pivots to all VPN peers
Tailscale OAuth account compromise gives mesh access
WireGuard config file leaked allows attacker to join network

What protects you

Strong server hardening (fail2ban, automatic security updates)
Use Headscale for sovereignty over coordination
Strong password + hardware key on identity provider
ACLs in Tailscale to limit lateral movement

Good habits

Audit connected nodes monthly
Rotate WireGuard keys when devices are decommissioned
Use ephemeral keys for guests
Subscribe to upstream security advisories

DNS Resolvers

NextDNS / Cloudflare 1.1.1.1 / Quad9Low risk

Weak points

Resolver sees all DNS queries (browsing intent)
Default ISP DNS even worse — sells data
Provider jurisdiction matters
Encrypted DNS (DoH/DoT) not always enforced

How attacks happen

ISP DNS used as advertising data source
Resolver compromise enables mass redirection
Plaintext DNS queries leak browsing despite VPN

What protects you

Use NextDNS with custom profile for blocking + privacy
Enable DoH/DoT system-wide (router or device level)
Choose Quad9 (Swiss, no logs) for privacy or Cloudflare for speed
Avoid ISP defaults

Good habits

Configure DNS at router level for whole-home
Test with dnsleaktest.com
Use NextDNS for malware/ad/tracker blocking + family filtering
Review NextDNS query logs (or disable logging)

Privacy Extensions

uBlock Origin / Privacy BadgerLow risk

Weak points

Manifest v3 transition (Chrome) hampers uBlock Origin filtering
Misconfigured filter lists can break sites
Some content publishers detect blockers and lock content

How attacks happen

Manifest v3 reduces extension capability — users get worse blocking on Chrome
Malicious lookalike (uBlock vs uBlock Origin) installs adware

What protects you

Use uBlock Origin (by gorhill — verify publisher) — NOT 'uBlock'
On Chrome, monitor v3 transition; consider Firefox for full blocking
Keep filter lists updated

Good habits

Combine with NextDNS for redundant blocking
Avoid duplicating blockers (causes site breakage)
Whitelist sites you trust and want to support

Kids & EducationKids tablets, EdTech, parental controls, school devices

Kids Devices

Kids tablets (Amazon Fire Kids, iPad with Family Sharing)Medium risk

Weak points

Pre-installed apps with broad data collection
COPPA / Bill C-27 (Canada) compliance varies by app
In-app purchase exposure
Social features expose minors to strangers
Camera/mic always available

How attacks happen

Child accidentally racks up in-app purchases
Predator contacts child via in-game chat
App over-collects data on minor (multiple FTC settlements)
Compromised parental account enables purchases

What protects you

Use Amazon FreeTime / Apple Screen Time strict mode
Disable in-app purchases or require parent approval
Disable social/chat features in apps
Strong password + 2FA on parent account

Good habits

Allow-list approved apps only
Daily/weekly screen time limits
Cover camera when not in use
Review activity reports weekly

EdTech Platforms

School platforms (Google Classroom, Microsoft Teams for EDU, Seesaw)Medium risk

Weak points

School-managed account often weak password reset
Account credentials persist after graduation
Activity/grade data sold or shared with third parties (varies by district)
Phishing via official school domains

How attacks happen

School account compromise reveals all assignments and communications
Phishing of parent via spoofed school email
Outdated student account abused after graduation
Data broker scrapes 'public' student work

What protects you

Enforce strong password + 2FA where school allows
Verify school district's privacy policy and data residency (Canadian provinces vary)
Decommission accounts after graduation
Use a dedicated email for school communication

Good habits

Train children on phishing recognition
Review what apps the school requires
Advocate for FERPA/PIPEDA-compliant tools
Audit account activity periodically

Parental Controls

Parental control software (Qustodio, Bark, Apple Screen Time, Family Link)Medium risk

Weak points

Software has deep device access — vendor breach exposes child's activity
False sense of security (kids find workarounds)
VPN bypass on tablets
Adversarial co-parent abuse of monitoring tools

How attacks happen

Vendor breach exposes detailed child surveillance data
Child uses second device to bypass controls
Co-parent uses parental control to monitor ex-partner
Software updates introduce new tracking

What protects you

Use platform-native controls (Apple Screen Time, Family Link) over third-party where possible
Strong password + 2FA on parent control account
Discuss monitoring openly with children (age-appropriate)
Audit data the vendor collects

Good habits

Adapt controls to child's age — over-monitoring backfires
Pair with conversations about online safety
Read vendor's data retention policy
Migrate to lighter controls as kids mature

Work-from-HomeCorporate VPN, MDM, collaboration, webcams

Corporate VPN

SSL VPN appliances (Fortinet, Pulse, Cisco AnyConnect)High risk

Weak points

Heavily targeted by ransomware groups (Fortinet/Pulse/Citrix CVEs)
Slow patch cycles on appliances
Credential stuffing on internet-exposed portals
Split tunneling exposes corporate traffic

How attacks happen

Pre-auth RCE in Fortinet/Pulse used by ransomware actors as initial access (well-documented 2021-2024)
Credential-stuffing attack on VPN portal
Compromised VPN account pivots to internal network

What protects you

Patch VPN appliances within 24h of advisories
Enforce phishing-resistant MFA (FIDO2)
Move to Zero Trust Network Access (ZTNA) — Cloudflare Access, Tailscale, Twingate
Disable split tunneling for sensitive segments

Good habits

Monitor VPN login anomalies (impossible travel)
Subscribe to vendor PSIRT advisories
Decommission legacy VPN access for departed users immediately
Plan migration off legacy SSL VPN entirely

ZTNA (Tailscale, Cloudflare Access, Twingate)Low risk

Weak points

Identity provider compromise = mesh compromise
Coordination server sees connection metadata
Misconfigured ACLs allow lateral movement
Personal devices with corporate ACL

How attacks happen

Okta/Entra compromise grants attacker access to entire ZTNA mesh
Misconfigured ACL exposes prod database to all employees
Personal device on mesh becomes pivot point if compromised

What protects you

Hardware-key MFA on identity provider
Strict ACLs by group/role
Device posture checks (encryption, OS version) before allowing connection
Separate work and personal nodes

Good habits

Quarterly ACL review
Enable session logging
Use ephemeral nodes for guests/contractors
Test least-privilege regularly

MDM-Enrolled Devices

Corporate-managed laptops/phones (Intune, Jamf, Kandji, Workspace ONE)Medium risk

Weak points

MDM admin compromise = mass device compromise
Personal use of corporate device blurs data ownership
BYOD enrollment may give employer access to personal data
Lost device + weak passcode

How attacks happen

Compromised MDM admin pushes malicious payload to all enrolled devices
Personal data on BYOD wiped during termination
Stolen unencrypted laptop exposes corporate data

What protects you

Strong MDM admin RBAC + hardware key MFA
Enforce full-disk encryption + strong passcode policy
Separate work profile on personal devices (Android Work Profile, iOS User Enrollment)
Document acceptable personal use clearly

Good habits

Regular MDM admin access reviews
Test wipe procedures
Enforce automatic OS updates
Educate employees on what employer can see on BYOD

Collaboration Suites

Slack / Teams / Discord (corporate)Medium risk

Weak points

Sensitive content in DMs persists indefinitely
Public channels indexed if workspace is exported
Apps/integrations have broad scopes
Guest accounts retain access after engagements end
Discord especially weak for corporate use

How attacks happen

Slack workspace breach exposes years of internal discussions (multiple high-profile leaks)
Departed contractor retains channel access
Compromised integration exfiltrates messages
Phishing via DM from compromised colleague

What protects you

Enable SSO + MFA for workspace
Set message retention policies
Audit and remove unused integrations quarterly
Decommission guest/contractor accounts immediately on engagement end
Use Discord only for community — never corporate IP

Good habits

DLP scanning for sensitive data in messages
Review channel public/private settings
Ban credentials/secrets in messages — use password manager sharing
Train users on what belongs in chat vs ticketing/docs

Webcams & Mics

External webcams & USB micsMedium risk

Weak points

No physical privacy shutter on many models
Always-on standby with mic enabled
Cheap brands ship with vulnerable firmware
USB-attack surface (BadUSB)

How attacks happen

Compromised laptop activates webcam without indicator (rare but documented)
Cheap webcam with backdoored firmware exfiltrates video
BadUSB-style mic poses as keyboard

What protects you

Use webcam with physical shutter (or apply tape/sliding cover)
Disconnect mic when not in use
Buy from reputable brands with firmware update support
Watch for indicator LED activity

Good habits

Use OS-level camera/mic permissions (macOS, Windows 11)
Audit which apps have camera/mic access monthly
Mute mic in collaboration apps by default
Replace EOL devices

TravelHotel Wi-Fi, eSIM, border hygiene, travel routers

Hotel & Public Wi-Fi

Hotel Wi-Fi & captive portalsHigh risk

Weak points

Captive portal can MITM TLS via fake CA prompt
Other guests on same VLAN sniff traffic
Hotel staff IT often unmonitored
Compromised hotel network is common (DarkHotel campaign targeted execs)

How attacks happen

DarkHotel-style targeted attack on traveling exec via hotel Wi-Fi
Captive portal pushes fake software update
Same-VLAN guest scans your laptop for open shares

What protects you

Always use VPN before any other traffic on hotel Wi-Fi
Disable file/printer sharing while traveling
Refuse any prompt to install hotel CA certificate
Use cellular data for sensitive work

Good habits

Use a travel router with built-in VPN
Enable firewall on laptop (set network as 'Public')
Forget hotel Wi-Fi when checking out
Avoid logging into banking/email on hotel networks

eSIM & Travel SIM Apps

eSIM apps (Airalo, Holafly, Nomad)Low risk

Weak points

Account stores travel patterns (where/when)
Payment method stored
ICCID stored against your identity
KYC documents required by some carriers
Second eSIM line bypasses primary security

How attacks happen

Account breach reveals travel itinerary
Stolen ICCID enables minor service fraud
KYC documents leaked from breach

What protects you

Strong password + 2FA on eSIM app
Delete eSIM profiles after trip
Use prepaid card for purchases
Decline marketing data sharing

Good habits

Choose providers with clear data policies
Avoid linking eSIM apps to social logins
Review installed eSIM profiles periodically
Consider local prepaid SIM for highest privacy

Border-Crossing Hygiene

Device search at border (CBSA, US CBP)High risk

Weak points

Border officers can demand device unlock (CBSA: limited grounds; US CBP: broader powers)
Cloud accounts accessible from device may be searched
Disk encryption doesn't help if device is unlocked
Refusal can mean device seizure or denied entry

How attacks happen

CBP forensic copy of unlocked device retained for years
Cloud documents accessed via signed-in apps
Sensitive client data (legal, journalism, medical) seized
Encrypted disk powered down and unmodified is your best protection

What protects you

Travel with a clean 'travel laptop/phone' that contains minimal data
Sign out of all cloud services before crossing
Power down devices fully before approaching border (cold-boot resists most attacks)
Know your rights (CBSA grounds vs CBP discretion)

Good habits

Carry data via encrypted cloud, download after crossing
Use a separate eSIM/phone profile for travel
Document any device search incident
Consult lawyer if you carry privileged data (legal/medical)

ePassport & biometric border controlMedium risk

Weak points

RFID chip in ePassport readable at short range
Biometric (face/fingerprint) data in government databases
Biometric data is irrevocable
Cross-border biometric sharing agreements

How attacks happen

RFID skimming of ePassport (limited data but possible)
Border agency database breach exposes biometrics permanently (OPM precedent)
Biometric used beyond declared purpose

What protects you

Use RFID-blocking passport sleeve
Understand biometric collection rights at each border
Know what data is on your ePassport (ICAO 9303)

Good habits

Request RFID-blocking cover from travel retailer
Stay informed on CBSA/IRCC biometric policy changes
Decline optional biometric programs unless needed

Travel Routers

Travel routers (GL.iNet, Slate AX)Low risk

Weak points

Default credentials
Firmware updates lag
Misconfigured Wi-Fi repeater leaks main credentials
Some firmware bundles unwanted services

How attacks happen

Default-credential exploit on hotel-deployed router
Outdated firmware exploited via known CVE
Wi-Fi repeater leaks original SSID/password to anyone within range

What protects you

Change default credentials immediately
Update firmware before each trip
Use built-in OpenVPN/WireGuard client to tunnel all traffic
Disable unused services (USB sharing, etc.)

Good habits

GL.iNet with custom OpenWrt firmware for trust
Use as your only network on hotel Wi-Fi
Reset to factory before disposal
Subscribe to OpenWrt security advisories

Pro/Prosumer HomelabHypervisors, containers, self-hosted SIEM, reverse proxies

Hypervisors

Proxmox VEMedium risk

Weak points

Web UI on port 8006 often left exposed
Default root login enabled
Missing 2FA setup
VM-to-host escape via misconfigured devices/PCI passthrough
Backup target without immutability

How attacks happen

Brute-force on exposed Proxmox web UI
VM escape via vulnerable QEMU CVE
Ransomware encrypts both VMs and PBS backups

What protects you

Place Proxmox UI behind reverse proxy + VPN
Disable root login over web; use named admin
Enable TOTP 2FA
Apply security advisories within 48h
Use Proxmox Backup Server with immutable retention

Good habits

Network-segregate management interface (vmbr0 separate VLAN)
Subscribe to Proxmox security mailing list
Test VM restore monthly
Enable cluster fencing if HA

VMware ESXiHigh risk

Weak points

Heavily targeted by ransomware (ESXiArgs, Akira, Black Basta)
SLP service vulnerabilities
Web UI exposed to management network
Stale snapshots accumulate

How attacks happen

ESXiArgs ransomware encrypted thousands of internet-exposed ESXi hosts in 2023
SLP CVE-2021-21974 exploited mass-scale
Compromised vCenter pivots to all hosts

What protects you

Disable SLP
Never expose ESXi/vCenter to internet
Patch within 24h of advisories
Use jump host + MFA for admin access

Good habits

Migrate to supported alternative (Proxmox, Nutanix) given Broadcom licensing changes
Immutable backups
Monitor host logs for anomalies
Decommission unused VMs and snapshots

Container Platforms

Docker / Docker ComposeMedium risk

Weak points

Containers run as root by default
Bind-mounting /var/run/docker.sock = root on host
Pulling :latest tags = unpredictable supply chain
Privileged containers escape easily
Exposed Docker API (port 2375) is critical

How attacks happen

Compromised container with docker.sock mount escapes to host
Malicious public image (Docker Hub typosquat) installs cryptominer
Exposed Docker API on internet → instant takeover

What protects you

Run containers as non-root user
Never mount docker.sock unless absolutely necessary
Pin images to specific digests, not tags
Never expose Docker API to internet — use SSH
Use rootless Docker or Podman

Good habits

Scan images with Trivy/Grype before deploy
Subscribe to image vendor security advisories
Use private registry for production
Apply seccomp/AppArmor profiles

Kubernetes / K3sHigh risk

Weak points

Misconfigured RBAC grants over-broad cluster-admin
kubelet exposed without authentication
Secrets stored unencrypted in etcd by default
Public container registries pulled without verification
Compromised pod with hostPath escape

How attacks happen

Tesla cluster cryptojacked via exposed Kubernetes dashboard (2018 — still relevant pattern)
etcd theft exposes all cluster secrets
Compromised admission controller deploys malicious workloads

What protects you

Enable etcd encryption at rest
Strict RBAC: namespace-scoped roles, no cluster-admin for humans
Network policies (Calico/Cilium) for pod isolation
Image signing (Sigstore/cosign) and admission control (Kyverno/OPA)
Disable anonymous kubelet access

Good habits

Regular cluster security scan (kube-bench, kube-hunter)
CIS Kubernetes Benchmark compliance
Audit logs forwarded to SIEM
Patch within 30 days of advisories

Self-Hosted SIEM & Monitoring

Wazuh / Security OnionLow risk

Weak points

Manager exposed to agent network on management ports
Default credentials on Kibana/dashboards
Index growth fills disk quickly
Agent compromise pivots to manager
Alerting fatigue masks real incidents

How attacks happen

Wazuh manager compromised via exposed API
Disk full causes log loss during active incident
Default Kibana credentials grant full visibility to attacker

What protects you

Change all default credentials (Kibana, indexer)
Place dashboards behind reverse proxy + auth
Enforce mTLS between agents and manager
Enable index lifecycle management to prevent disk fill

Good habits

Tune detection rules to minimize alert fatigue
Forward critical alerts to email/Slack/Teams
Test detections quarterly
Document incident response playbooks

Reverse Proxies & Ingress

Caddy / Traefik / Nginx Proxy ManagerLow risk

Weak points

Default config may not enforce HSTS / security headers
Wildcard certs cover too much surface
Misconfigured upstream exposes admin panels
ACME DNS-01 token leaks from CI

How attacks happen

Misconfigured proxy exposes Nextcloud admin to internet
Stolen wildcard cert enables MITM across all subdomains
ACME token in public git repo allows attacker to issue certs

What protects you

Enable HSTS, CSP, X-Frame-Options by default
Use per-service certs (Caddy auto-handles this)
Restrict admin-panel ingress by IP allow-list or VPN-only
Rotate ACME credentials regularly

Good habits

Subscribe to proxy security advisories
Audit exposed routes monthly
Use Cloudflare Tunnel or Tailscale Funnel for safer ingress
Test with securityheaders.com

Emerging & WearablesAR glasses, BCI, drones, robotaxi rider apps

AR Glasses

Meta Ray-Ban / Apple Vision Pro / Snap SpectaclesHigh risk

Weak points

Always-on cameras / mics in public — bystander privacy concerns
Indicator LEDs can be defeated or ignored
Captured imagery synced to vendor cloud
Tied to broader vendor ecosystem account
Facial recognition concerns (Meta Ray-Ban + AI integration)

How attacks happen

Bystanders unknowingly recorded; criminal liability in two-party-consent jurisdictions (Quebec)
Compromised vendor cloud exposes recorded imagery
AI-on-glasses identifies strangers in real time (privacy concern)
Stolen glasses access cloud-synced library

What protects you

Disable cloud auto-upload of media
Respect local recording laws (Quebec requires consent)
Use Lockdown Mode (Vision Pro) for high-risk targets
Strong account password + 2FA

Good habits

Visibly indicate when recording
Decline AI features that identify people
Review captured media before any sharing
Be aware of evolving Canadian privacy law on always-on cameras

Drones

Consumer drones (DJI, Skydio, Autel)Medium risk

Weak points

Telemetry sent to vendor (DJI especially scrutinized — US ban context)
Captured imagery uploaded to vendor cloud
Geo-fencing can be bypassed
Live video feed unencrypted on some links
Drone broadcasts Remote ID (publicly readable)

How attacks happen

DJI telemetry shared with foreign government concerns
Compromised vendor account exposes flight history and footage
Live video intercepted via SDR
Remote ID enables tracking of operator location

What protects you

Disable vendor cloud sync if possible
Local SD card storage only
Strong account password + 2FA
Comply with Transport Canada drone regulations (RPAS)
Be aware of Remote ID broadcasts

Good habits

Choose Skydio/Autel if DJI vendor risk is concern
Update firmware before flights
Maintain flight logs locally
Respect privacy of overflown areas

Brain-Computer Interfaces

Consumer BCIs (Muse, Neurable, future Neuralink)Medium risk

Weak points

Neural data is the most intimate biometric — irrevocable
Wireless transmission of neural signals
Vendor cloud stores meditation/cognitive patterns
Limited regulation of neural data privacy
Side-channel inference of intent/emotion

How attacks happen

Vendor breach exposes detailed cognitive/mental-state data
Insurance discrimination based on inferred neural patterns
Coercive use in workplace/legal contexts (early-stage concern)

What protects you

Use BCIs that store data locally only
Decline cloud sync and research opt-ins
Strong account password + 2FA
Stay informed on Canadian neural-data regulation development

Good habits

Treat as highest-sensitivity health data
Demand transparency on data retention
Advocate for Bill C-27 neural data protections
Choose vendors with clear privacy commitments

Robotaxi & Autonomous

Robotaxi rider apps (Waymo, Cruise, future Tesla Robotaxi)Low risk

Weak points

Trip history reveals home/work/medical addresses
In-cabin cameras record passengers
Account stores payment method
Data shared with municipal authorities (incident reporting)

How attacks happen

Account breach exposes detailed trip history
In-cabin footage subpoenaed in legal proceedings
Vendor data sale reveals movement patterns

What protects you

Strong password + 2FA
Drop-off slightly off home address for sensitive trips
Review trip history privacy settings
Decline marketing data sharing

Good habits

Verify in-cabin recording disclosures
Limit stored payment methods
Use one-time payment cards
Stay informed on regulatory developments (Canada lags US on robotaxi)

Physical & Supply ChainUSB attack devices, hardware tokens, firmware supply chain, e-waste

Malicious USB & Cables

Malicious USB devices (Rubber Ducky, O.MG cable, Bash Bunny)High risk

Weak points

Looks like legitimate cable/drive but injects keystrokes or exfiltrates data
Found-USB attack remains effective (60%+ pickup rate in studies)
Charging cables can be malicious (O.MG cable indistinguishable)
Conference giveaway cables/drives are untrusted

How attacks happen

Found USB in parking lot plugged in by curious employee
Malicious O.MG cable received as 'gift' enables remote keystroke injection over Wi-Fi
Conference USB swag installs cryptominer
Public charging port (juice jacking)

What protects you

Never plug in unknown USB devices
Use USB data blocker for charging in public
Buy cables only from known brands and direct sources
Disable USB auto-run / autoplay
Use endpoint protection that blocks HID-class device anomalies

Good habits

Carry your own charger and cable when traveling
Wall power > USB charging in public
Train employees on found-USB risks
Consider USB port-blocking policy on sensitive workstations

Hardware Security Tokens

YubiKey / Titan / FeitianLow risk

Weak points

Counterfeit keys from unauthorized resellers
Lost key without backup = lockout
Some older firmware vulnerable to side-channel (YubiKey 5 ECDSA pre-2024)
Physical coercion to tap key

How attacks happen

Counterfeit YubiKey from marketplace contains backdoor firmware
Lost sole key locks user out of every account
Side-channel attack on stolen key extracts ECDSA private key (2024 EUCLEAK research)

What protects you

Buy direct from vendor (yubico.com, store.google.com) only
Always register at least 2 keys per account
Store backup key in fireproof safe / safety deposit box
Update firmware where supported

Good habits

Use FIDO2 with PIN for presence + knowledge factor
NFC keys for mobile compatibility
Periodically test backup key works
For highest assurance, use newest hardware revisions

Firmware Supply Chain

IoT firmware & supply-chain attacksHigh risk

Weak points

Firmware signed with stolen vendor keys (D-Link, Asus historic precedents)
OTA update channels themselves can be hijacked
Outsourced manufacturing introduces backdoors
Vendor SDK vulnerabilities propagate across hundreds of brands
Counterfeit chips with modified firmware

How attacks happen

SolarWinds-style supply-chain attack on consumer router vendor
Compromised OTA pushes malicious firmware to thousands of devices
Counterfeit electronics with hidden backdoors (multiple US DoD findings)
Vendor SDK CVE affects every product using it

What protects you

Buy from reputable vendors with active security lifecycle
Verify firmware signatures where possible
Keep firmware current via official channels only
Subscribe to vendor security advisories
Replace EOL devices — no patches = unfixable risk

Good habits

Maintain inventory of devices and their firmware versions
Network-segment IoT devices
Plan device replacement before EOL
Avoid no-name brands for sensitive contexts

E-Waste & Data Sanitization

Old devices, drives, smartphonesMedium risk

Weak points

Factory reset insufficient on many flash storage devices
SSD wear leveling leaves data recoverable
Phones with non-removable storage retain data after reset
E-waste recyclers may resell devices with data intact
Trade-in programs do not always wipe properly

How attacks happen

Recovered drive from recycler reveals years of personal/business data
Resold smartphone contains accessible photos and accounts
Donated laptop with quick-format leaks tax records
Office equipment lease return retains scanned documents

What protects you

For HDDs: secure erase via tool (DBAN, manufacturer utility) or physical destruction
For SSDs: vendor secure-erase tool, then ideally physical destruction
For smartphones: full factory reset → encrypt → reset again; remove SIM/SD
Use a certified e-waste recycler (Recycle My Electronics in Canada)

Good habits

Maintain disposal log for sensitive devices
Physical destruction (drill, shred service) for highest sensitivity
Sign out of all accounts before reset
Remove from Find My / vendor account before disposal
For business: certificate of destruction from recycler