Stop reusing passwords
Password managers and passkeys
One breached site becomes ten breached accounts when passwords repeat. Use a password manager to generate a different password everywhere, and switch to passkeys wherever a site offers them.
> cybersecurity for all
ctrlaltsecurity
Control. Adapt. Protect.
Security guidance written for people, not just for enterprise teams. Plain language, current threats, and steps you can actually take today.
> about
Fifteen years of defending, explained without the jargon
Who is behind this
I am Mark Blair, a cybersecurity professional with more than fifteen years spent on the defending side. My day to day has covered vulnerability management, incident response, threat detection, risk assessment, governance and compliance, and running security awareness programs for people who never asked to think about security.
CTRL-ALT-Security is my personal project. It exists because most security advice is either written for large security teams or watered down until it stops being useful. This site sits in the middle: real threats, current sources, and specific things you can do.
Why it matters outside work
The attacks that hit families, small businesses and volunteers are usually the same techniques that hit large organizations, minus the budget to respond. Phishing, reused passwords, unpatched devices and account takeover do not care how big you are.
Sharing what works, in language people actually use, is the highest leverage security work I know of.
> news
Global information security news
Headlines pulled from public feeds run by government agencies, research teams and independent reporters. Each one links straight to the source.
- Dark Reading [Virtual Event] What Every Enterprise Should Know About Securing Cloud Assets in the Age of AI just now
- Dark Reading [Virtual Event] Building a Secure AI Strategy for the Enterprise just now
- Dark Reading AI’s Vulnerability Surge May Be More Manageable Than First Feared New research suggests the coming Vulnpocalypse may not be so overwhelming for enterprise security teams — if they have the right strategies. 1 hour ago
- BleepingComputer Hackers exploit Sangoma Switchvox flaw to deploy reverse shells Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead t... 2 hours ago
- Dark Reading SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE The exploitation activity follows attacks earlier this summer on two other zero-day vulnerabilities in the vendor's edge devices. 2 hours ago
- Dark Reading AI Gives Cybercriminals a Dangerous Time Advantage Former cybercriminal Brett Johnson provides a look inside the mind of a threat actor and discusses where AI provides the most value for attackers. 3 hours ago
- BleepingComputer WordPress backup plugin flaw exposes millions of sites to takeover attacks An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote... 3 hours ago
- The Record Russian national facing 20 years for malware campaign that infected 80,000 freelancers Searzhudin Tamirlanovich Aktulaev appeared in a San Francisco federal court on Monday after being arrested in Cyprus in May 2025 and extradited to the... 4 hours ago
- Schneier on Security AI Agents Are Now Emailing Me with Their Security Concerns I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AI... 4 hours ago
> awareness
Security awareness you can use today
Short, practical habits that block most of what actually happens to normal people.
Turn on multifactor everywhere
App codes and security keys beat SMS
Multifactor authentication stops most account takeover attempts outright. An authenticator app or a hardware security key is far stronger than text message codes, which can be intercepted or redirected.
Slow down on urgent messages
Recognizing phishing and smishing
Urgency is the tell. A message that pressures you to act right now, pay immediately, or confirm your account is worth a pause. Go to the site or app directly rather than tapping the link you were sent.
Let your devices update
Patching is the quiet win
Most successful attacks use vulnerabilities that were already fixed. Turn on automatic updates for your phone, computer, browser and router, and replace hardware once it stops receiving security updates.
Back up like you will need it
Three copies, two formats, one offsite
Ransomware and dead hard drives both end the same way without backups. Keep at least one copy that is not permanently connected to the machine it protects, and test a restore once in a while.
Have the scam conversation early
Protecting relatives and kids
Grandparent scams, fake job offers, romance scams and gift card requests all rely on isolation and embarrassment. Agree in advance that anyone can call you to sanity check a strange request, no judgment.
> projects
Things I am building
Side projects that came out of real security problems.
CTRL-ALT-Security newsletter
Substack
Regular writing on current threats, breach lessons and practical defenses, aimed at readers who are not full time security professionals.
Self hosted app suite
PHP, MySQL, no frameworks
A growing set of personal web applications built and hosted from scratch, with a shared security pattern across all of them: passwords hashed with bcrypt, signed cookies, CSRF protection, rate limiting, and sensitive files stored outside the web root.
Continuous scanning pipeline
Static and dynamic analysis, one dashboard
A vulnerability scanning setup for my own applications, combining static analysis, secret scanning, dependency checks, TLS testing and dynamic scanning, with results collected in one dashboard.
> training
Training and free resources
Where to start, and where to go next. Everything listed here is free or has a free tier.
-
CISA free cybersecurity services
Government resources for individuals and small organizations
Advisories, guidance and no cost tools published by the United States Cybersecurity and Infrastructure Security Agency.
Free Open CISA -
STOP. THINK. CONNECT.
National Cybersecurity Alliance
Awareness campaign materials you can hand to family, a classroom or a small team without editing anything.
Free Open resources -
Hands on labs
Learn by doing
Guided browser based labs that teach attacking and defending concepts. Good next step once the basics feel comfortable.
Free tier Open TryHackMe -
NIST Cybersecurity Framework
Structure for organizations
The reference most security programs are measured against. Useful even for a small business trying to decide what to do first.
-
Check your exposure
Have I Been Pwned
Find out which breaches included your email address, then change those passwords and enable multifactor on the accounts involved.
Free Check now -
KnowBe4 Home Security Awareness Training
Password is "homecourse"
It’s very important to keep your whole family safe on the internet. That is why we created this training just for you.FREE Open KnowBe4
> connect
Follow the work
Same handle everywhere: @ctrlaltsecurity
> contact
Get in touch
Questions, speaking requests, or a topic you want covered. Messages come straight to me.
- No trackers and no third party scripts on this page.
- Reply usually within a few days.
- Do not send confidential or client data.