Locking Down Your Accounts: How to Keep the Keys to Your Kingdom Safe Cerberus Sentinel Blog

Some of you may work in highly technical roles, with a slew of devices, complex systems to manage, and specialized software. Others of us may keep it simple–maybe just a laptop and O365. Either way, we all intersect at one point. Nearly all of us have a Google account and/or a Microsoft account. Gmail, Google’s email platform, is that magical place you can send all of your unwanted advertisements and solicitations when signing up for newsletters. It’s the account you use to sign up for your kids’ team updates or daily school notifications. Further, you may take advantage of other Google platforms (like the calendar), all of which are managed under the same Google login. Google is free, convenient, and allows you to keep your personal messages separate from work accounts. In fact, you probably set that account up right about the time you quit using Yahoo and have probably given its management an equal amount of thought. When you’re at work, though, you’re logging into Microsoft products, almost inevitably. In fact, your phone may sync with your Microsoft account, allowing you to edit a document while on the train, commuting to work, or check out a spreadsheet on the fly while eating lunch with friends. The widespread user base of these two account types, as well as the device and account interconnectivity most of use employ for our daily lives, point to why they are the two most frequently hacked account types. If you are a threat actor, you know how to leverage access to these accounts to do a lot–a LOT–of damage.

In our last blog for this series, TRUE Security Consultant, Steven Anderson, detailed the importance of personal security as paramount in working into professional security. Simply put, if threat actors can get into your personal account, it’s very simple for them to pivot into your work accounts, either through spyware, information they glean while reading your emails, or even something as simple as a reused password. In this installment, Anderson walks us through, step-by-step, how to lock down your Google and Microsoft accounts. Be safe out there, kids, so you can avoid that sinking feeling of discovering a breach.

Locking down your Google account

1. Create a new, secondary google email account
   1. Never use this email account for anything other than recovering your main account
   2. Use your password manager (1Password, LastPass, KeePass) to generate a random password
      1. Recommended to use numbers, lowercase letters, uppercase letters, and special characters
      2. Recommended to create password with minimum of 12 characters
   3. Ensure credentials are properly saved in your password manager
   4. Navigate to https://myaccount.google.com
   5. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   6. Scroll down to “Ways we can verify it’s you”
   7. Click on 2-Step Verification
   8. Follow the appropriate steps to activate an authenticator app (use 1Password or LastPass – If you don’t have either of those apps, Google Authenticator will work as well) or voice or text message with your cell phone
2. Set up recovery email in your primary Google account
   1. Navigate to https://myaccount.google.com
   2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to “Ways we can verify it’s you”
   4. Click on “Recovery email”
   5. Change the recovery email address to the new secondary email address you just created
3. Ensure your recovery phone number is set and correct
   1. Navigate to https://myaccount.google.com
   2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to “Ways we can verify it’s you”
   4. Click on “Recovery phone”
   5. Change the recovery phone to your current cell phone number if necessary
4. Update password
   1. Navigate to https://myaccount.google.com
   2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to “Signing in to Google”
   4. Click on Password
   5. Use your password manager (1Password, LastPass, KeePass) to generate a random password
      1. Recommended to use numbers, lowercase letters, uppercase letters, and special characters
      2. Recommended to create password with minimum of 12 characters
5. Turn on 2-Factor Authentication
1. Navigate to https://myaccount.google.com
2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
3. Click on “2-Step Verification”
4. Click “TURN ON”
5. Follow the appropriate steps to activate an authenticator app (use 1Password or LastPass – If you don’t have either of those apps, Google Authenticator will work as well) or voice or text message with your cell phone
6. Update Google PIN
   1. Navigate to https://myaccount.google.com
   2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   3. Click on Google Account PIN
   4. Update pin to a unique pin that is not shared with other accounts or debit card
7. Remove outdated and questionable third-party apps
   1. Navigate to https://myaccount.google.com
   2. Click on the “Security” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to section “Third-party apps with account access”
   4. Click on “Manage third-party access”
   5. Remove any apps that:
      1. You do not use anymore
      2. You do not recognize
      3. Seems to have access to parts of your google account that they shouldn’t
      4. Seems to have access to parts of your google account that they shouldn’t
8. Remove questionable subscriptions
   1. Navigate to https://myaccount.google.com
   2. Click on the “Payments & subscriptions” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to section “Subscriptions”
   4. Click on “Manage subscriptions”
   5. Cancel any subscriptions that:
      1. You do not use anymore
      2. You do not recognize
9. Check privacy settings and ensure Google is only managing data you would like them to
   1. Navigate to https://myaccount.google.com
   2. Click on the “Data & personalization” tab in the navigational panel on the left-most portion of the screen
   3. Scroll down to “Activity controls”
   4. Click on “Manage your activity controls”
   5. Turn off Google storage of personal info you don’t care for them to have access to
   6. Navigate to https://myaccount.google.com
   7. Click on the “People & sharing” tab in the navigational panel on the left-most portion of the screen
   8. Scroll down to “Choose what others see”
   9. Click on “About me”
   10. Modify each section appropriately

Locking down your Microsoft account

1. Change your password
   1. Visit https://account.microsoft.com and login
   2. Scroll down to “Security”
   3. Under “Update your security info”, click on “Update”
   4. Click on “CHANGE PASSWORD >”
   5. Use your password manager (1Password, LastPass, KeePass) to generate a random password
      1. Recommended to use numbers, lowercase letters, uppercase letters, and special characters
      2. Recommended to create password with minimum of 12 characters
2. Change your recovery email
1. Visit https://account.microsoft.com and login
2. Scroll down to “Security”
3. Under “Update your security info”, click on “Update”
4. Click on “UPDATE INFO >”
5. Remove email addresses that you would not like to use for recovery purposes
6. To add a new email address, click on “Add security info” and follow the prompts
3. Turn on 2-factor authentication
   1. Visit https://account.microsoft.com and login
   2. Scroll down to “Security”
   3. Under “Update your security info”, click on “Update”
   4. Scroll to the bottom and click on “more security options”
   5. Under “Two-step verification”, click “Turn on two-step authentication”
   6. Follow the appropriate steps to activate an authenticator app (use 1Password or LastPass – If you don’t have either of those apps, Google Authenticator will work as well)

 Download our free 'How To Lock Down Your Apple ID' guide!