Five Daily Security Habits

A threat model starts with assets, not with fear. For most learners, three asset classes matter more than anything else. Identity and email: the inbox is the master key that resets banking, work, and social logins. Money: bank apps, payment cards, crypto wallets, and payroll deposits. Reputation: social accounts, cloud photo libraries, and work chat history that can be used for blackmail, doxxing, or career damage. Write those three headings on a note. Under each, list the concrete accounts and devices that hold that asset. If an item does not map to identity, money, or reputation, it is probably lower priority than you think. A PSOS that tries to protect "everything equally" protects nothing well — attention is the scarce resource.

Be concrete. "Email" is not enough — write the primary address that can reset money apps. "Phone" means the SIM and handset that receive SMS or authenticator prompts. "Bank" means the app or site where payroll lands, not every forgotten shopping login. Vague lists produce vague weekly checks. Named assets produce Yes/No outcomes you can actually mark.

Risk is not "what sounds scariest on the news." Rank each asset by two scores from 1–5: how likely an attacker is to try it against you, and how bad it would hurt if they won. Multiply. High scores get defenses first. Example: a student with one bank account and a school email may rank "email takeover" higher than "corporate espionage." A freelancing parent who invoices clients may rank "payment diversion" above "gaming account theft." Your PSOS is personal — copy someone else's ranking and you will defend the wrong doors. Nation-state drama on the news is almost never the correct Tier A for a personal device used for school and shopping.

Revisit ranks when life changes: new job, new bank, travel, a partner sharing devices, or a side hustle that takes payments. A static ranking from last year is a stale map. The monthly section of the runbook exists so likelihood × impact stays honest.

Security fails quietly. An unknown laptop can sit in Gmail sessions for weeks while you still "feel careful." Motivation after a scary video fades; a calendar block does not. A PSOS turns vague awareness into operations: fixed day, fixed checklist, Yes/No answers, one sentence if something fails. Fifteen minutes weekly is enough when the list is Tier A only. If your checklist takes an hour, you overbuilt it — cut Tier C work until the high doors are boringly green every week.

Copy the template into Notes, a local text file, or $HOME/cyberlium-lab if you already use that folder for labs. Fill blanks with YOUR accounts — never paste passwords, full card numbers, or recovery codes into Cyberlium chat. Mark Y/N with what you actually saw today.

Owner: _______________   Review day: _______________

Identity/Email: ________________________________
Money: ________________________________________
Reputation: ___________________________________

1) ______________________________  Score: ___
2) ______________________________  Score: ___
3) ______________________________  Score: ___

[ ] Email: open Security / Devices — unknown sessions revoked?
[ ] Phone: screen lock still strong; auto-lock ≤ 2 min?
[ ] Money: skim last 7 days of transactions — unknowns?
[ ] Updates: OS + browser + bank app current OR auto-update ON?
[ ] Recovery: still control the phone number + recovery email listed on Tier A accounts?

[ ] Re-rank risks if life changed (new job, new bank, travel)
[ ] Close 1 abandoned account in Tier C
[ ] Confirm backup/restore path still works for critical files

A week "passes" only if every weekly Y/N is answered — not guessed.

whoami
id
uname -a
mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"
date
cat > psos.txt << 'EOF'
assets_email:
assets_money:
assets_devices:
top_risk_this_week:
EOF

chmod 600 psos.txt
ls -l psos.txt
pwd

whoami
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\cyberlium-lab" | Out-Null
Set-Location "$env:USERPROFILE\cyberlium-lab"
Get-Date
@"
assets_email:
assets_money:
assets_devices:
top_risk_this_week:
"@ | Set-Content -Encoding utf8 psos.txt

You now have an operating system for personal risk — assets, ranks, and a measurable cadence. Feeling informed is no longer the finish line; a completed Y/N week is. Next — Phone & App Permission Safety — apply that same least-privilege mindset to the sensors and keys sitting in your pocket.