Reading time: 5 Minutes
MWi Hack
- Open the recovery settings on your main email account and read them. Not the password. The recovery options: the backup phone number and the alternate address that a reset code gets sent to. Most people set those once, years ago, and have not looked since. If either one points at a phone you no longer carry or an address you no longer check, fix it now. That is the door everything else in your life opens through, and it is usually the one nobody has checked.
MWi Summary
- October is Cybersecurity Awareness Month. The advice that comes with it is usually framed as vigilance, which is the wrong model and the reason most of it does not stick.
- Vigilance depends on attention, and attention runs out. The attempt that works is the one that arrives on a day you are tired, distracted, or expecting a message that looks exactly like it.
- This community already knows the alternative. Equipment was not inspected when someone felt like it. It was inspected on a schedule, whether or not anything looked wrong.
- Digital hygiene is that, applied to accounts. The word hygiene is exact. It is not what you do about a threat, it is what you do so the threat does not land.
- CISA, the federal agency that runs Cybersecurity Awareness Month, names four core steps for individuals and notes that AI is accelerating how fast attackers find weak spots.
- Start with the account that opens the others. For almost everyone that is email, because every password reset in your life ends up there.
The Wrong Model
Every October brings a wave of advice about staying safe online, and almost all of it is framed the same way. Be alert. Be careful. Think before you click. Watch out for anything suspicious.
That framing asks you to be permanently switched on, and nobody is. Attention is finite and it gets spent on the things in front of you, which is why the attempt that works is never the obvious one. It is the one that arrives on a Thursday afternoon when you are tired, in the middle of something else, and already waiting on a message that looks a great deal like it.
Vigilance loses that exchange every time, because it only has to fail once and it is being asked to hold for years.
You Already Know the Right One
The alternative is not a mystery to anyone who served, and it is not a technology idea at all.
Equipment did not get inspected when someone felt concerned about it. It got inspected on a schedule, in the same order, whether or not anything seemed wrong, and the entire point was that it did not depend on anyone’s judgment or mood that morning. You did not have to notice a problem for the check to find one.
That is the model that works for accounts, and almost nobody applies it there. Security gets treated as a state of alertness rather than as a task with a date on it, which is why it fails in the same way and for the same reason that vigilance-based anything fails.
The word hygiene is doing real work in the phrase digital hygiene. Hygiene is not a response to illness. It is the routine that means illness does not get a foothold, and it is boring by design.
Why This Community Specifically
There is a reason this matters more here than it does for the general population, and it is worth saying plainly without turning it into a lecture.
A person who served has a set of accounts that sit on top of things civilians do not have. Benefit payments. Medical records going back decades. A home loan entitlement. For some, a clearance. Those accounts are worth more to somebody else than an ordinary consumer login, and that shows up in who gets targeted.
CISA, the federal agency that runs Cybersecurity Awareness Month, also points out that the pace has changed. AI is accelerating how quickly attackers find and exploit weak spots, which means the gap between a weakness existing and a weakness being found is shorter than it used to be. That argues for maintenance on a schedule rather than a response after something goes wrong.
Start With the One That Opens the Others
If the whole thing is going to be a routine, it needs a first item, and there is an obvious one that people consistently skip.
Most people protect their bank account carefully and treat email as a place where messages arrive. It is not. Email is the master key. Every account you own has a password reset function, and that reset goes to your email, which means anyone with your email has a path into everything else without needing any of the other passwords.
Which makes the recovery settings on that account the single highest-value thing to check, and the thing almost nobody has looked at since the day they set it up. A backup number for a phone you stopped carrying in 2019 is a door standing open. So is an alternate address you have not signed into for years and would not notice a login on.
CISA’s four core steps for individuals are strong passwords, multifactor authentication, recognizing phishing, and keeping software updated. All four are worth doing. None of them help if the recovery path around them is still pointing somewhere you no longer control.
Putting It on a Schedule
The point of all this is that it becomes a date rather than a state of mind.
Pick one day a year that you will not forget and will not move. Not a resolution, an anniversary you already remember, and October is as good as any. On that day, check the recovery settings on your email, confirm that multifactor authentication is on where it matters most, and look at whether any account is still reachable through a phone number or address you have given up.
That is twenty minutes once a year, which is less time than most people have already spent worrying about it, and it does not require being alert for the other three hundred and sixty four days.
Resource
U.S. Department of Veterans Affairs, VA Privacy Service. “What VA is doing to Protect Your Privacy.” VA Privacy Fact Sheet, Office of Information and Technology. This official fact sheet explains how VA protects Veterans’ and employees’ personal information. It covers the difference between privacy and security, Veterans’ rights under the Privacy Act of 1974 and HIPAA, VA’s policy, awareness and training requirements, and how to file a privacy complaint. Available at https://department.va.gov/privacy/fact-sheet/what-va-is-doing-to-protect-your-privacy/
