I found this to have a lot of holes at best. If this is for end-users working with a campaign some of this might be appropriate, but really the campaign should

I found this to have a lot of holes at best. If this is for end-users working with a campaign some of this might be appropriate, but really the campaign should have people in charge of security and a lot of things should be funneled through them. If this is for end-users then the advice about antivirus, etc. should be removed because that should NOT be an end-user decision. First thing: How is the campaign going to be operating and handling documents? Security for the scenarios is going to be different. * If it's going to be in one or more offices with tightly restricted access from outside those offices that's probably the best for security but may be less convenient. Primary approach: restrict access to a limited pool of "trusted" devices and keep those secure. * Entirely cloud-based (e.g. GMail, Google Docs, etc. or perhaps the business/enterprise Office365 and OneDrive). Primary approach: Tightly control document access at the storage side, probably primarily based on user accounts, while allowing many devices. * Using online storage but traditional desktop programs, etc. is a second option, but may be harder to control. Primary approach: None, this is a hybrid and I think it has all the weaknesses of both other approaches. Second, be aware of the kinds of threats you need to be ready for. Big areas of concern that jump out at me: * Data theft/exfiltration of sensitive campaign documents. * Data loss/destruction - via malicious trashing by an intruder or via failure of key systems. * Loss of access at key times - are there times where temporary loss of access to systems has a major impact? (I'm used to thinking in terms of electronic medical records for doctors' offices, where at the least a down EMR puts a huge crimp in ability to see patients.) * Possibly addressing of faked documents, but I'm not sure that's an internal security matter that can be addressed beyond being able to say with confidence "Our network has not been breached and we have access/audit logs to prove it." Focusing on what I'd recommend as the best option from a security standpoint (documents, etc. are stored within the network, documents can be accessed only from within the network, network access is tightly controlled, document storage is appropriately partitioned with security groups to limit access) some thoughts. This is also the kind of network I'm most familiar with - I'd never consider having any medical client using any kind of cloud storage for practice documents that could contain PHI/PII (Protected Health Information/Personally Identifiable Information). Re: Updates, absolutely, everything should be kept up-to-date. Ideally patch status, etc. should be monitored for all systems. This includes network equipment as well, most notably routers and any wireless equipment. Re: Anti-virus, I disagree - Choose a good managed AV product, use it, have someone whose job includes getting alerts from it and reviewing logs it generates. I'm partial to Bitdefender, but Emsisoft may also be a good choice and also uses Bitdefender's virus definitions as one component. I'd avoid Kaspersky these days. I say this because I see the logs for managed Bitdefender blocking of known and suspected phishing and malware sites and I get alerts when malware is blocked. A good AV product should also help protect against both hacked websites visited by campaign staff and spearphishing. Re: Email, why is this document talking about personal email? Do not use personal email for campaign work. Do not use personal email on campaign systems (assuming the "closed network" approach). If staff need to deal with personal email because their sister-in-law just sent them the newest Elf Bowling, they can do it on their phones and/or their own time. Re: Email, if using an email system that supports 2-factor auth, use it. Re: Email Attachments, assume malice. The advice to open documents on a phone instead is not unreasonable since the phone viewer is unlikely to have the same vulnerabilities as a desktop program. Viewing documents in a different program may also be a viable option, particularly if your internal use of that program isn't well known (e.g. Word-based attacks are unlikely to impact LibreOffice). Re: Email, Inbound email should be going through all sorts of filtering which may not stop all attacks but should at least be able to cut down on possible noise. As an example with Office365 Exchange, there are a bunch of options (under "International Spam") to block messages based on the language encoding, the country/region it was sent from, etc. Re: Passwords, 1Password is a good option. 1Password Teams is probably a better one. Re: Phones, the advice to use iPhones is probably good, particularly because current-enough iPhones all get software updates where Android phones from different vendors are all over the map. Possible exception: If you're using the all-cloud approach on Google services, the Pixel phones should be a viable choice. If feasible, something that can be remotely wiped (at least email) by a mail administrator is probably not a bad idea. Re: Laptops, yep, full disk encryption, etc. and never plug in USB devices, but on a management side assume that laptops are a weak point and take steps to ensure that the damage from a compromised laptop can be limited. Re: Wireless access for Phones, Laptops, Tablets, etc.: Consider not using Wifi AT ALL. If Wifi is used, lock it down to recognized devices, which should not include ANY personally owned devices, particularly including phones, tablets, etc. Any device that end-users are allowed to install software on is a device that should not be connecting directly to your network. If you're unfortunate enough to have a campaign office in the basement of a steel building, set up a separate "Devices" network (still with authentication) that those devices can connect to. Re: Messaging, yep, Signal. Regard just about anything else particularly including SMS as being plain-text that a skilled attacker could read. Also be wary of apps like Join, MightyText, etc. that allow handling of messages and device notifications from desktops. Re: Browser, I'm not sure I agree with a Chrome-only approach (why no Firefox?), but I don't have a big problem with it. One advantage particularly for individual installations is that it will auto-update in the background, and with process-per-tab I believe new tabs will get created on updated versions (can anyone who's read this wall of text confirm?). I agree with the use of uBlock Origin and HTTPS Everywhere - compromised ad networks particularly with targeted ads could be a real risk. Re: Mobile Browser, Even more than incognito mode, Firefox Focus may be a good choice as a default for browsing that doesn't require logins to sites. Did I leave any gaping holes? This is kind of off the top of my head.