Highlighted wordsare glossary terms — tap one for a plain-language definition.
Messages, browsing, and cloud services are where most of your daily exposure happens. CISA's fourth module is about choosing encrypted tools and tightening the defaults.
Use encrypted messaging and calling
End-to-end encrypted apps mean the provider — and anyone watching the network — can't read your conversations.
- Pick a reputable end-to-end encrypted messaging and calling app.
- Verify contacts through a second channel before sharing sensitive details.
- Turn on disappearing messages for sensitive threads.
- Assume SMS is readable in transit.
Harden the browser and vet cloud services
Browsers ship permissive by default, and cloud providers vary wildly in how they protect what you upload.
- Adjust browser privacy and security settings; block third-party TrackingWhat it means: Collecting information about a person's online behavior across websites, apps, or devices.Example: Ads for a product following you from site to site.What to do: Turn on your browser's tracking protection and limit ad tracking on your phone.Important: The same profiles are also used to make scams feel personal and believable.What does this mean?.
- Insist on HTTPSWhat it means: A protected connection between your browser and a website. It encrypts the connection but does not prove that the website itself is trustworthy.Example: The padlock and “https://” shown in your address bar.What to do: Read the domain spelling carefully, not just the padlock.Important: Scam sites use HTTPS too — the padlock is not a trust badge.What does this mean? connections and stop at certificate warnings.
- Recognize unsafe sites and refuse unexpected downloads.
- Assess a cloud provider's EncryptionWhat it means: Converting information into a protected form that unauthorized people cannot easily read.Example: The storage on your locked phone, unreadable without the passcode.What to do: Turn on device encryption and use a passcode or biometric lock.Important: Encryption won't help if someone learns your account password.What does this mean? and Multifactor authenticationWhat it means: Using more than one type of authentication evidence before an account grants access.Example: Entering your password and then approving the login through an authenticator app.What to do: Turn it on first for your email, financial, social-media, and cloud accounts.Important: Never give an unexpected login code to someone who contacts you.What does this mean? support before entrusting sensitive data.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary