Wofi Kɔmpiutadziɖoɖo alo Hardware Dedienɔnɔ Safui le Cafe alo Yameʋudzeƒe ƒe Xɔdɔme: Amewuwu Enumake¶

Be woaxɔ wò kɔmpiutadziɖoɖoa le kɔfidzraƒe ƒe kplɔ̃, dɔwɔhati ƒe kplɔ̃, alo yameʋudzeƒea ƒe xɔdɔme ƒe zikpui dzi enumake esime screen la le nyɔ eye womeʋui, alo nàkpɔe be fiafitɔ aɖe zɔ kple wò kɔmpiutakotokua dzo esime wò FIDO2 hardware security key (YubiKey) gakpɔtɔ nɔ USB-C-doa me, enye dedienɔnɔ ƒe nɔnɔme kpata si vɔ̃ɖi wu ɖesiaɖe si adzɔge dɔwɔla alo kɔmpiutadziɖoɖowɔla ate ŋu ado goe. To vovo na kɔmpiutadziɖoɖo si me elektrikŋusẽ le si wofi le amedzrodzeƒexɔ me (afisi disk blibo ƒe nya ɣaɣlawo abe FileVault alo BitLocker ene nana ʋua nɔa ʋuʋu ɖi le), kɔmpiutadziɖoɖo si me dzo le si womeʋu o tsɔa wò RAM si woɖe ɖa, si nye nyagbe ɣaɣla dzikpɔla si womeʋu o la dea asi na fiafitɔa (1Password / Bitwarden), web-browser ƒe kpeɖodzinana ƒe cookies siwo le agbe, siwo le dɔ wɔm AWS / GCP / Azure CLI ƒe ɖaseɖigbalẽwo, kple esiwo wometsɔ nya ɣaɣlawo ɣla o -/.ssh ame ŋutɔ ƒe safui siwo le klosalogba dzi.

Ne amedzidzedze kple adzodadaa lɔ amedzidzedze ŋutɔŋutɔ, adzodada, alo aʋawɔnuwo ƒe ŋɔdzidoname ɖe eme la, ʋu yi teƒe si le dedie enumake eye nàƒo ka na wò nutoa me xexlẽdzesi kpata (911 le United States kple Canada, 112 le Europa Dukɔwo ƒe Habɔbɔ bliboa me, 999 le United Kingdom; kpɔ xexlẽdzesi siwo wozãna kpata) eye nàto míaƒe adzodada kple adzodada ƒe agbetsitsi mɔfiala. Mègati kɔmpiutadziɖoɖo fiafitɔ si tsɔ tu alo si le sisim yome yi ablɔdzi alo ʋu me gbeɖe o. Ke boŋ, he wò smartphone do goe le wò kotoku me le sɛkɛnd 60 gbãtɔwo me eye nàwɔ session-kill kple hardware-lock ƒe ɖoɖo sia tututu esime nèle cross-reference wɔm dɔwɔwɔ ƒe kɔmpiutadziɖoɖo si wofi alo gbã esime wole mɔ zɔm: MDM lock kple zero-downtime recovery, . le vo me le nuwɔwɔ ƒe nyatakakadzraɖoƒe ƒe ɖiɖi, git adzame tsi si le dodom, kple nudzɔdzɔwo ƒe vovototodedeameme, kple adzɔge dɔwɔƒe ƒe dedienɔnɔ kple nyatakakawo ƒe adzamenyawo gbɔ kpɔkpɔ kpata.

Wɔ esia fifia¶

1. MÈGATI AFIAFIA LA yome o; he wò smartphone la do goe le sɛkɛnd 15 me eye nàʋu Remote Hardware Lock (Find My / . Find My Device / . Corporate MDM) HAFI fiafitɔa natsɔ kɔmpiutadziɖoɖoa ade Faraday akplo me alo atsi Wi-Fi. Ne fiafitɔ aɖe xɔ kɔmpiutadziɖoɖo si le ʋuʋu ɖi le kɔfi kplɔ̃ dzi la, kɔmpiutadziɖoɖoa nɔa cafe la ƒe Wi-Fi (alo wò telefon ƒe hotspot) ŋu zi gbãtɔ 30 to 90 seconds esime wole du dzi le xɔtunua dzi:
   • MacBook (iPhone Find My App): Ʋu Di Nye -> Mɔ̃wo -> [Wò MacBook] -> De dzesii Be Ebu (Activate) eye nàŋlɔ xexlẽdzesi 4 va ɖo 6 ƒe ʋuƒo ƒe PIN. Enumake sedede ma dze MacBook dzi to Wi-Fi dzi la, macOS wua zãla ƒe ɣeyiɣi si le dɔ wɔm nu, zia firmware/OS ƒe ʋuƒo ƒe screen dzi, eye wòbiaa FileVault ƒe nya ɣaɣlawo ƒe ɖaseɖigbalẽwo be woagage ɖe eme ake.
   • Windows 11 Laptop: Le wò telefon ƒe nyatakakadzraɖoƒea la, ʋu account.microsoft.com/devices -> tia wò kɔmpiuta -> zi **Di nye mɔ̃a -> Do ** dzi.
2. Ne wotsɔ wò kɔmpiutadziɖoɖoa do ka kple wò smartphone ƒe Personal Hotspot la, MÈGATSI wò hotspot la le sɛkɛnd 60 gbãtɔawo me VASEÐE BE nàzi "Mark As Lost / Remote Lock" dzi, emegbe nàtsoe enumake le ema megbe. Ne fiafitɔa gakpɔtɔ le meta 15 (afɔ 50) me tso gbɔwò le cafe la godo la, wò fon ƒe Wi-Fi hotspot si le dɔ wɔm ate ŋu anye ɖeka si le internet kadodoa tsɔm vɛ wò Mark As Lost kill sedede na laptop si le ʋuʋu ɖi. Lala sɛkɛnd 30 hafi lock ƒe sededea naɖo, emegbe nàtrɔ Personal Hotspot OFF kple Bluetooth OFF (si hã ʋãa macOS/Windows Dynamic Lock ne wotsɔe eve).
3. Ƒo ka na wò dɔwɔƒea ƒe IT Security / SOC Hotline le wò telefon dzi (0 to 3 minutes) be woaɖe asi le Xexeame Katã ƒe IdP Session Revocation (Okta / Microsoft Entra ID / Google Workspace) KPLEE MDM Adzɔge Tutuƒe (Jamf / Intune / Kandji). Ne fiafitɔa na kɔmpiutadziɖoɖoa ƒe screen le ŋudzɔ to trackpad la ʋuʋu me eye wòtsi Wi-Fi hã la, wò Single Sign-On (SSO) ƒe gbugbɔgawɔ kple mɔɖeɖe ƒe dzesiwo ɖeɖeɖa le alilikpo me dɔwɔƒea naa kakaɖedzi be zi alesi fiafitɔa gatsɔ kɔmpiutaa do ka kple any internet kadodoa be yeage ɖe Slack, Gmail, GitHub, alo AWS me la, dɔwɔƒea ƒe nyatakakadzraɖoƒe ƒe ɣeyiɣi ɖesiaɖe ku xoxo (401 Unauthorized).
4. **Ne wò Nyagbewo Dzikpɔla (1Password, . Bitwarden, . LastPass, . Dashlane, . Apple Passwords).
5. Ne Hardware Dedienɔnɔ Safui aɖe (YubiKey 5C Nano / . Titan Key) gblẽe ɖe kɔmpiutadziɖoɖoa ƒe USB-do me (alo wotsɔe kpe ɖe safui si wofi ŋu), tsɔ wò Backup Key alo Passkey ge ɖe wò akɔntabubuwo me tso wò fon dzi eye nàtutu FIDO2 ƒe ɖaseɖigbalẽ tɔxɛ ma ɖa. Togbɔ be FIDO2 ƒe xɔtunu safui hiã FIDO2 PIN (4 to 63 characters) na nyagbe ɣaɣla manɔmee resident-key logins, ne wozãe abe nu evelia (U2F / WebAuthn non-discoverable) le kɔmpiuta si dzi wò browser dzra wò zãŋkɔ kple nyagbe ɣaɣla ɖo xoxo dzi la, amesiame si aka asi sika capacitive contact si le YubiKey dzi la toa 2FA PIN manɔmee.
6. Te fli ɖe nutoa me dɔwɔla ƒe ɖaseɖigbalẽ ɖesiaɖe si wodzra ɖo ɖe wò aƒeme agbalẽdzraɖoƒe me eye nàtrɔe (-/.ssh/id_ed25519, . -/.gnupg, . -/.aws/credentials, . -/.kube/config, . .env files, and GitHub/GitLab Personal Access Tokens). Ne wowu alilikpo me SSO hã la, amedzidzela si naa kɔmpiuta si womeʋu o le ŋudzɔ la ƒe faɛlɖoɖo ƒe mɔɖeɖe xoxo le SSH safui ɖesiaɖe si womeɣla o kple alilikpo API dzesi si bɔbɔ nɔ wò terminal ŋutinya me (-/.zsh_history / . -/.bash_history).

Nyametsotsoti: Unlocked laptop snatch vs. hardware dedienɔnɔ safui fifi vs. abɔta surfing¶

Wɔ ɖe triage flowchart sia si zɔna kabakaba dzi le miniti 15 gbãtɔ siwo le cafe, coworking space, alo yameʋudzeƒea ƒe dedienɔnɔ ƒe nudzɔdzɔ aɖe megbe.

flowchart TD
    A["Dutoƒo Dɔwɔƒe ƒe Dedienɔnɔ Kpata (Cafe, Coworking Space, Yameʋudzeƒe ƒe Xɔdɔme, Keteke)"] --> B{"Nuka tututue dzɔ?"}
    B -->|"Woxɔ Laptop Esi Woʋu / Ʋuʋu"| C["0-60s: Le wò fon dzi la, ʋu Apple Di Nye 'Dzesi Abe Bubu' alo Microsoft 'Ʋu Mɔ̃' -> Yɔ Dɔwɔƒe IT SOC na MDM Ʋu / Tutu + Xexeame katã ƒe SSO Ɣeyiɣi Wuwu"]
    B -->|"Wofi Laptop Esi Wotu / Nutsyɔnu Tu / Wotsi Ŋusẽ"| D["FileVault / BitLocker kpɔa disk ta le ɖiɖiɖemeɣi -> Trigger Di Nye / MDM Adzɔge Tutu -> Trɔ SSO nyagbegbɔgblɔ & te fli ɖe alilikpo me ɣeyiɣi siwo le dɔ wɔm"]
    B -->|"Wofi Hardware Security Key (YubiKey) (Eɖeka alo Wotsɔe De Kɔmpiutadziɖoɖo Me)"| E["Ge ɖe IdP (Okta/Entra/Google), GitHub, AWS, kple Password Manager me tso wò fon dzi to Backup Key/Passkey zazã me -> Tutu YubiKey ƒe ŋkɔ ŋɔŋlɔ si wofi la ɖa"]
    B -->|"Shoulder Surfing / Ame aɖe Ðe Wò Screen alo Keyboard Ƒe Film"| F["Do screen enumake (Cmd+Ctrl+Q / Win+L) -> Ʋu yi ame ŋutɔ ƒe teƒe -> Trɔ nyagbe tɔxɛ/PIN si nèŋlɔ + API safui ɖesiaɖe si dze le screen dzi"]
    C --> G["Ðe mɔɖeɖe ɖa le kɔmpiuta si wofi ŋu le 1Password / Bitwarden Web Vault me -> Trɔ Google / Microsoft / Okta / Slack / GitHub nyatakakadzraɖoƒe ƒe ɣeyiɣiwo katã nu"]
    E --> G
    G --> H{"Ðe nutoa me dɔwɔla ƒe safuiwo nɔ laptop la si (aƒeme .ssh, .aws, .gnupg, Git PATs, Docker/K8s dzesiwo)a?"}
    H -->|"Ẽ: Mɔ̃ɖaŋudɔwɔla / Admin / Gɔmeɖoanyila Laptop"| I["Tutu .ssh dutoƒo safuiwo tso GitHub/GitLab & production servers (`authorized_keys`) -> Tsɔ AWS IAM safuiwo ɖa le Console me -> Te fli ɖe GPG safuia me"]
    H -->|"AO: Asitsatsa / Browser Zãla si Woɖo Ðe Ðoɖo Nu"| J["Kpɔ egbɔ be browser sync (`Chrome/Edge/iCloud Keychain`) de asi ete le didiƒe -> File nutoa me Kpovitɔwo ƒe Nyatakaka & Cafe CCTV takpɔkpɔ biabia"]
    I --> J

Akpa 1: Aɖabaƒoƒo 5 ƒe "Wuwu Kɔsɔkɔsɔ" na kɔmpiutadziɖoɖo si wofi si womeʋu o (Nuƒolanɔƒe ɖesiaɖe ƒe sededewo)¶

Ne woxɔ kɔmpiutadziɖoɖo aɖe le ame si esime womeʋui o la, mègalala vaseɖe esime nàzɔ ayi aƒeme alo aƒle kɔmpiuta yeye hafi adze asiɖeɖe le eŋu gɔme o. Woate ŋu awɔ afɔɖeɖe vevi siwo le ete la dometɔ ɖesiaɖe tso wò iPhone alo Android smartphone dzi tẽ esime nèle tsitre ɖe kɔfidzraƒea me.

Afɔɖeɖe 1: Zi dɔwɔɖoɖoa dzi le didiƒe (0 to 60 seconds) .¶

1. Apple ƒe MacBook (macOS):
   • Ʋu Di Nye dɔwɔnua le wò iPhone dzi (alo ge ɖe icloud.com/find le telefon ƒe nyatakakadzraɖoƒe ɖesiaɖe dzi, si toa 2FA ŋu ale be nàte ŋu azãe ne wofi wò fon hã gɔ̃ hã).
   • Zi Mɔ̃wo -> [Wò MacBook] -> De dzesii be Bu -> Wɔ dɔ dzi.
   • Ke ne fiafitɔa tsi Wi-Fi enumake alo tu nutsyɔnu la ɖe? The Mark As Lost alo Erase This Device sedede ɖoa fli ɖe Apple ƒe APNs dɔwɔƒewo eye wòdoa dzo le sɛkɛnd ƒe mama si MacBook la ka asi Wi-Fi network ɖesiaɖe ŋu (alo to Find My network dzi) emegbe. MacBook ƒe nutsyɔnu tutu hã ʋua screen la le eɖokui si ne wowɔ Require password enumake le alɔ̃dɔdɔ alo screen saver gɔmedzedze vɔ megbe ŋudɔ.
2. Windows 10 / Windows 11 ƒe kɔmpiutadziɖoɖo:
   • Le wò telefon dzi nyatakakadzraɖoƒea la, ʋu ** .account.microsoft.com/devices**, tia wò kɔmpiuta, eye nàzi **Di nye mɔ̃a -> Do ** dzi.
   • Ne enye dɔwɔƒe ƒe Windows kɔmpiuta si dzi Microsoft Intune kpɔna la, ge ɖe Intune Company Portal (portal.manage.microsoft.com) le wò fon dzi -> tia wò kɔmpiuta dzi -> zi Actions -> Remote Lock alo Reset Passcode / Wipe dzi.

Afɔɖeɖe 2: Wu alilikpo me Single Sign-On (SSO) kple browser ƒe ɣeyiɣiwo katã (1 to 3 minutes) .¶

Ne fiafitɔa wɔ Wi-Fi le kɔmpiutaa dzi nuwɔametɔe be wòate ŋu aʋu wò nutoa me hard drive la le Internet dzi o hã la, woatsɔ kɔmpiutaa aƒo ka na asitelefon dzi hotspot mlɔeba alo awɔ wò web-browser tɔ ƒe kɔpi Cookies kple Local Storage SQLite faɛlwo ɖe mɔ̃ bubu dzi be woaxɔ wò nyatakakadzraɖoƒe ƒe ɣeyiɣi siwo nège ɖe eme la le ame si. Tsɔ session token mawo le server ƒe akpa dzi fifia tso wò fon dzi:

--- .

Akpa 2: Ke ne wofi wò YubiKey alo Hardware Security Key ya ɖe?¶

Adzɔge dɔwɔla geɖe gblẽa YubiKey 5C Nano si mebɔ o si wotsɔ de woƒe kɔmpiutadziɖoɖo ƒe axadzi USB-C ʋɔtrua me tegbee, alo tsɔa YubiKey 5 NFC ɖe ka si woxɔna kple woƒe kɔmpiutadziɖoɖo ƒe akplo dzi. Dzidzi ƒona zi geɖe be: "Ðe fiafitɔ ate ŋu azã nye YubiKey atsɔ age ɖe nye akɔntabubuwo katã mea? Eye aleke mawɔ age ɖe nye akɔntabubuwo me nye YubiKey manɔmee?"

1. Nusi fiafitɔ ATEŊU awɔ kple wò YubiKey si wofi la gɔmesese¶

Egbegbe xɔtunuwo ƒe dedienɔnɔ ƒe safui (YubiKey 5 Series, . Google Titan, . Token2, . Nitrokey) doa alɔ ɖaseɖiɖi ƒe ɖoɖo vovovo ene, siwo dometɔ ɖesiaɖe ƒe afɔku ƒe nɔnɔme to vovo ne wofi wo ŋutɔŋutɔ:

1. FIDO2 ƒe Ðaseɖigbalẽ Siwo Woate Ŋu Ake Ðe (Passkeys / Nyagbegbɔgblɔ Manɔmee Geɖe):
   • Wokpɔ eta to wò FIDO2 PIN (4 to 63 alphanumeric characters). Ne fiafitɔ aɖe tsɔ wò YubiKey si wofi la de woawo ŋutɔ ƒe kɔmpiuta me eye wòdze agbagba be yeazã FIDO2 Passkey si me nyagbe aɖeke mele o la, YubiKey hardware chip la abia wò FIDO2 PIN. Le PIN ƒe akɔntabubu gbegblẽ 8 siwo kplɔ wo nɔewo ɖo megbe la, FIDO2 applet si le YubiKey dzi tɔa tegbee eye wòtsɔa brik wɔa eɖokui (Factory Reset Required), tsɔ tutua ɖaseɖigbalẽwo katã ɖa.
2. FIDO U2F / WebAuthn Evelia-Nu (Username + Password + Touch YubiKey):
   • NO PIN REQUIRED BY DEFAULT on most websites. Ne fiafitɔ la ko fi wò YubiKey le wò awudziwui kotoku me (eye me wò laptop alo wò passwords mele esi o), YubiKey la meɖea vi aɖeke na wo o elabena U2F safui meɖea nyatakakadzraɖoƒe siwo me woŋlɔ ŋkɔ ɖo la fiana o.
   • AFƆKU VEVIE NE WOFI WO ƑE ƲUƲU DO WÒ KƆKPƆKPƆKPƆKPƆ SI WOÐO ƲUƲU: Ne fiafitɔa fi wò kɔmpiutadziɖoɖo si womeʋu o KPLE YubiKey si wotsɔ do ɖe axadzi la, wò browser ƒe autofill alo password manager naa zãla ƒe ŋkɔ kple nyagbe ɣaɣla xoxo, eye ɖeko wòle be fiafitɔa na ka asi woƒe asibidɛ ŋu ɖe sika ga ƒe abɔta si le YubiKey la ŋu be wòatsɔ 2FA ayi wò gadzraɖoƒe, AWS ke ƒe akɔnta, alo crypto exchange.
3. YubiKey Ʋuʋu PGP (gpg SmartCard) & PIV ( .X.509 Ðaseɖigbalẽ) Applets:
   • Wokpɔa eta to xɔtunu aɖe dzi Zãla ƒe PIN (si woɖo ɖi 123456 ne mètrɔe kpɔ o) kple Admin PIN (si woɖo ɖi 12345678) be ʋuƒo le agbagbadzedze gbegblẽ 3 megbe. (Ne ègblẽ OpenPGP PIN ɖe dɔwɔƒea ƒe gɔmedzedze 123456, tsɔe be PGP safui si le YubiKey ma dzi la gblẽ eye nàte fli ɖe eme enumake.)
4. YubiKey Static Password / Yubico OTP (Ŋɔŋlɔdzesi 44 didi ccccc... ka si dona ne woka asi eŋu):
   • Ne èɖo wò YubiKey ƒe Slot 1 alo Slot 2 be wòaŋlɔ nyagbe si meʋãna o alo Yubico OTP ɣesiaɣi si woka asi sika ƒe agbalẽvi la ŋu sɛkɛnd 1 va ɖo 3 la, amesiame si lé safuia ɖe asi ate ŋu aʋu Notepad, aka asi safuia ŋu, eye wòaxlẽ ka ma si meʋãna o.

2. Afɔɖeɖe ɖesiaɖe ƒe ɖoɖowɔɖi be woaɖe YubiKey si wofi ƒe ŋkɔ ŋɔŋlɔ ɖa le miniti 5 me¶

1. Lé wò Backup Hardware Security Key (alo zã wò iPhone/Android Passkey / Authenticator App / Backup Codes):
   • Nu nyuitɔ kekeake (si NIST SP 800-63B de se) enye be nàŋlɔ ŋkɔ ɣesiaɣi dedienɔnɔ ƒe safui ŋutɔŋutɔ eve ya teti (ɖeka le wò safui/kɔmpiutadziɖoɖo dzi, ɖeka le dedie alo mɔzɔzɔ ƒe agba me) kpe ɖe mɔ̃ ƒe Passkey ŋu le wò asitelefon dzi.
2. Ge ɖe wò akɔntabubu siwo le vevie wu me eye nàtutu YubiKey si wofi la KO ɖa to eƒe Ŋkɔnyawo dzi:
   • Google / Gmail (myaccount.google.com/signinoptions/two-step-verification): Zi Passkys kple dedienɔnɔ ƒe safuiwo -> di safui si wofi -> zi Trash Can ƒe dzesi dzi be nàɖee ɖa.
   • Microsoft / Entra ƒe ID (mysignins.microsoft.com/security-info): Di Dedienɔnɔ ƒe safui si wofi la -> zi Tutu dzi.
   • Apple ID (Settings -> [Your Name] -> Sign-In & Security -> Two-Factor Authentication -> Security Keys): Zi safui si wofi dzi -> Ðe Safui ɖa.
   • GitHub (github.com/settings/security): Le Passkeys kple Two-factor methods -> Security keys te la, zi Delete dzi le safui si wofi la xa.
   • AWS Ke / IAM (IAM Console -> Users -> Security credentials -> Multi-factor authentication): Tia FIDO dedienɔnɔ ƒe safui si wofi eye nàzi Ðe dzi.
   • 1Password / Bitwarden / Cloudflare / Coinbase / Kraken: Ʋu subɔsubɔdɔ ɖesiaɖe ƒe 2FA ɖoɖowo eye nàtutu hardware token ƒe ŋkɔ ŋɔŋlɔ si wofi la ɖa.

--- .

Akpa 3: Developer, DevOps, kple SSH/GPG safui ƒe tɔtrɔ (The... -/.ssh kple -/.aws nudzɔdzɔ kpata) .¶

Ne ènye kɔmpiutadziɖoɖowɔla, DevOps/SRE dzikpɔla, nyatakakaŋutinunyala, alo gɔmedzedze ƒe gɔmeɖola si ƒe kɔmpiutadziɖoɖo si womeʋu o fi la, browser cookies ɖeɖeɖa nye aʋa la ƒe afã ko. Fiafitɔ si tsɔa wò aƒeme nyatakakadzraɖoƒe ƒua gbe la kpɔa mɔ akpɔ nya ɣaɣlawo ƒe safui ɖesiaɖe si nɔa anyi didi kple CLI dzesi si wodzra ɖo abe nuŋɔŋlɔ dzrowo ene le wò SSD dzi.

Wɔ Afɔɖeɖe 5 Developer Credential Purge sia tso telefon si wotsɔ dzraa nu ɖo alo ƒuƒoƒo me tɔ ƒe kɔmpiuta dzi le aɖabaƒoƒo 15 gbãtɔwo me:

1. SSH Safuiwo (-/.ssh/id_ed25519 / . -/.ssh/id_rsa): Ne wotsɔ nyagbegbɔgblɔ takpɔkpɔ ta hã la, tsɔe be SSH safui ɖesiaɖe si wotsɔ de eme ssh-agent le RAM me le kɔmpiutadziɖoɖo si womeʋu o dzi la gblẽ. Yi ** .github.com/settings/keys** kple gitlab.com/-/user_settings/ssh_keys eye nàtutu kɔmpiutadziɖoɖoa ƒe SSH dutoƒo safui enumake, eye nàna ƒuƒoƒoa me tɔ aɖe naɖe wò dutoƒo safui ɖa le -/.ssh/authorized_keys le wɔwɔme Linux dɔdzikpɔlawo kple bastion hostwo katã dzi.
2. Alilikpo me CLI ƒe Ðaseɖigbalẽwo (-/.aws/credentials, . -/.config/gcloud, . -/.azure): Ʋu AWS IAM Console -> Zãlawo -> [Wò] -> Dedienɔnɔ ƒe ɖaseɖigbalẽwo eye nàzi Deactivate / Delete dzi le Access Keys katã dzi (AKIA...). Te fli ɖe Google Cloud me gcloud auth OAuth gbugbɔa dzesiwo gbugbɔna toa wò Google Account Third-Party Connections ƒe axa dzi (Google Cloud SDK).
3. GitHub, GitLab, npm, PyPI, kple Docker Ame ŋutɔ ƒe Mɔɖeɖe ƒe Dzesiwo: Yi github.com/settings/tokens eye nàzi Revoke all dzi le Fine-Grained PATs kple Classic siaa dzi ghp_... dzesiwo. Te fli ɖe eme -/.npmrc dzesiwo ( .npmjs.com) kple -/.pypirc dzesiwo.
4. Kubernetes (-/.kube/config) & Terraform ( .-/.terraform.d): Trɔ Kubeconfig asitsalawo ƒe ɖaseɖigbalẽ siwo meʋãna o alo OIDC dzesiwo eye nàɖe Terraform Cloud API dzesiwo ɖa (app.terraform.io).
5. GPG / PGP Asidede Asi ƒe Safuiwo (-/.gnupg): Ta wò GPG Revocation Certificate si nèwɔ do ŋgɔ (gpg --import revoke.asc kple gpg --keyserver keys.openpgp.org --send-keys [KeyID]) eye nàtutu GPG safuia ɖa le GitHub me.

--- .

Akpa 4: Ŋuɖoɖo na "Shoulder Surfing" (Ame aɖe ɖe video alo kpɔ wò screen le cafe/yameʋu me)¶

Ke ne ame aɖeke mefi wò kɔmpiuta ŋutɔŋutɔ o, gake esi nèle dɔ wɔm le yameʋudzeƒe ƒe agbo nu, le yameʋu me, alo le kɔfidzraƒe aɖe la, èlé ame si bɔbɔ nɔ megbewò alo le zikpui si te ɖe ŋuwò dzi wòle wò screen alo keyboard film wɔm kple woƒe smartphone camera (alo wòle ŋku lém ɖe ʋuʋu ŋu tẽ .env faɛl, nyagbe ɣaɣla ƒe nyabiase, alo nya ɣaɣla slide deck)?

1. Tsɔ wò screen enumake kple reflex keystroke ɖeka:
   • macOS: Zi ** dzi.Cmd + Ctrl + Q** (etua screen la enumake evɔ metu apps o).
   • Fesrewo: Zi ** dzi.Win + L**.
   • Linux: Zi ** dzi.Super + L** alo ** .Ctrl + Alt + L**.
2. Mègadze nyaʋiʋli ŋutɔŋutɔ gɔme o: Tsɔ wò kɔmpiutaa bla wò kɔmpiuta dzi fafa, ʋu yi zikpui si dzi ame aɖeke mele o dzi eye nàtsɔ wò akɔta aɖo gli sesẽ aɖe ŋu, eye nàto nusiwo wokpɔ le wò screen dzi alo woŋlɔ ɖe wò keyboard dzi le miniti 10 siwo va yi me la me.
3. Trɔ nya ɣaɣla ɖesiaɖe si klẽ ɖe screen dzi:
   • Ne èŋlɔ wò laptop login password alo password manager Master Password esime ame aɖe te ŋu kpɔ wò asibidɛwo la, trɔ nyagbe ma enumake tso teƒe si ame aɖeke mele o.
   • Ne terminal fesre aɖe la, . .env file, Postman header, alo cloud console nɔ dzedzem le screen dzi, tsɔe be eƒe nɔnɔme deŋgɔ ɖesiaɖe 4K smartphone fotoɖemɔ̃ si le meta 3 (afɔ 10) me ɖe wò API safuiwo ƒe foto si me kɔ, si woate ŋu adzi ɖe edzi, eye nàtrɔ safui mawo enumake (kpɔ Zoom alo Teams screen-share leak le vo me).

6-Point "Cafe & Yameʋudzeƒe Kpeɖodzi" Laptop Hardening Checklist (Ðo Egbe)¶

Trɔ asi le hardware kple OS ƒe ɖoɖo ade siawo ŋu fifia ale be ne fiafitɔ aɖe xɔ wò kɔmpiuta si le ʋuʋu ɖi le kplɔ̃ dzi etsɔ hã la, kɔmpiutaa nado eɖokui hafi fiafitɔa naɖo kɔfidzraƒea ƒe ʋɔtru nu:

• 1. Na Bluetooth ƒe Teteɖeanyi ƒe Auto-Lock (Dynamic Lock le Windows dzi / . Near Lock alo Apple Watch ƒe Auto-Lock le Mac dzi):
  • Windows 11: Tsɔ wò iPhone alo Android telefon la kpe ɖe wò kɔmpiuta dzi to Bluetooth dzi, emegbe yi Settings -> Accounts -> Sign-in options -> Dynamic lock eye nàde dzesi "Na Windows be wòaxe wò mɔ̃a le eɖokui si ne mèle adzɔge o". Ne fiafitɔ aɖe ƒu du meta 10 tso kplɔ̃a gbɔ kple wò kɔmpiuta (alo ètsi Bluetooth le wò fon dzi le wò kotoku me) ko la, Windows tua screen la le eɖokui si.
• 2. Ðo "Dzogoe Dzodzoe" kple Sɛkɛnd 60 ƒe Batri Idle Screen-Lock Timer:
  • Le macOS (System Settings -> Lock Screen) kple Windows (Settings -> System -> Power & battery -> Screen and sleep), ɖo Tsi nukpɔkpɔ / Bia nyagbe ɣaɣla le batri dzi ɖe aɖabaƒoƒo 1 alo 2 ne èle dɔ wɔm le dutoƒo.
• 3. Trɔ asi le 1Password / Bitwarden ŋu be wòaʋu enumake Ne System la tutu alo Le Aɖabaƒoƒo 1 ƒe Dɔmawɔmawɔ megbe:
  • Le 1Password -> Settings -> Security me la, ɖo Lock le kɔmpiuta ƒe dɔmawɔmawɔ vɔ megbe na 1 minute, kpɔ Lock on sleep, eye nàna Touch ID / Windows Hello nawɔ dɔ ale be màŋlɔ wò Master Password kple safui siwo woate ŋu akpɔ le dutoƒo gbeɖe o.
• 4. Bia Hardware Touch KPL Passphrase na Amesiame ssh kple git Dɔwɔwɔ (1Password SSH Agent alo FIDO2 ed25519-sk Safuiwo):
  • Le esi teƒe be nàgblẽe ɖi si wometsɔ nya ɣaɣlawo ɣla o -/.ssh/id_ed25519 faɛl siwo le wò hard drive dzi, dzra wò SSH safuiwo ɖo ɖe 1Password SSH Agent (si bia biometric Touch ID ƒe mɔɖeɖe ɖe ɖesiaɖe dzi git push alo ssh kadodo) ALOO woawɔ hardware-bound ** .ssh-keygen -t ed25519-sk -O verify-required** safui siwo womateŋu awɔ kɔpi na tso wò YubiKey dzi o eye wobia wò FIDO2 PIN le zazã ɖesiaɖe me.
• 5. Tsɔ Magnetic Kpe Ðe Eŋu Ɣesiaɣi 60-Degree Micro-Louver ƒe Ameŋunyatakakawo Ŋuti Nukpɔmɔ̃ (3M / Kensington) le Dutoƒo:
  • Magnet ƒe adzamenyawo ƒe screen doa viviti ɖe wò nukpɔkpɔa ŋu wòzua yevu sesẽ na amesiame si le nu kpɔm tso dzogoe si lolo wu 30 degrees off-center, si gbãa ŋku na abɔta ƒudzidela siwo le yameʋu alo cafe zikpui si kplɔe ɖo dzi.
• 6. Mègagblẽ Kɔmpiutadziɖoɖo aɖe ɖi Gbeɖe "Sɛkɛnd 30 Ko" Be Nàxɔ Kɔfi Alo Azã Nugododeƒea O:
  • Ewu enu 70 percent ƒe cafe kple yameʋudzeƒe ƒe xɔdɔmewo fififi dzɔna ne dɔwɔla aɖe gblẽ woƒe kɔmpiuta si dzi wotsɔa nu ƒoa nui ɖe kplɔ̃a dzi sɛkɛnd 45 be yeaxɔ latte le kplɔ̃a dzi alo bia amedzro aɖe be "Àte ŋu akpɔ nye nuwoa?" Tsɔ kɔmpiutadziɖoɖoa de wò akplo me ɣesiaɣi eye nàtsɔe ɖe asi, alo nàtsɔ Kensington NanoSaver Steel Cable Lock aƒo xlã kplɔ̃ si wotsɔ gaviwo blae.

--- .

Nutome ƒe xexlẽdzesi siwo ku ɖe nudzɔdzɔ kpatawo ŋu kple dɔwɔƒea ƒe ɖoɖowo¶

Ne ètu kɔmpiutadziɖoɖo si wofi la eye nète fli ɖe alilikpo me ɣeyiɣi siwo le dɔ wɔm (aɖabaƒoƒo 5 gbãtɔwo) me vɔ la, gblɔ fififi ŋutɔŋutɔa na nutoa me dziɖuɖumegãwo eye nàdzra cafe/yameʋudzeƒe ƒe CCTV-ɖeɖefiawo ɖo hafi woaŋlɔ wo ɖe edzi (cafe akpa gãtɔ ŋlɔa CCTV ɖe edzi gaƒoƒo 24 va ɖo 72 ɖesiaɖe):

United States kple Canada¶

• Kpovitɔwo ƒe Dɔwɔwɔ Kpata (Adzodada / Ame si Wosusu be Ewɔa Dɔ Le Nukpɔkpɔ Me): Ƒo ka na 911. (Ne èle yameʋudzeƒe ƒe ʋudzeƒe aɖe me la, te ɖe Yameʋudzeƒe Kpovitɔwo / Melidzeƒea ƒe Kpovitɔwo ŋu enumake le agbo nuƒolanɔƒe si te ɖe ŋuwò ale be kpovitɔwo nate ŋu axe mɔ na fiafitɔa hafi ado le dedienɔnɔ me alo aɖo keteke).
• Kpovitɔwo ƒe Nyatakaka si Menye Kpata o (Ehiã na Dɔwɔƒe ƒe Nugblẽfexeɖoɖo & Gaxɔgbalẽvi ƒe Kpekpeɖeŋu): Ƒo ka na 311 alo nutoa me dugã me kpovitɔwo ƒe ka si menye kpata o be nàxɔ Kpovitɔwo ƒe Nudzɔdzɔ Ŋuti Nyatakaka Xexlẽdzesi.
• Dukɔa ƒe Internet Dzi / Dɔwɔƒewo ƒe Fififi Ŋuti Nyatakaka: Ne dɔwɔƒe ƒe mɔ̃ aɖe si wofi si womeʋu o na ame ge ɖe kɔmpiuta dzi alo xɔ ga le ame si si ŋu womeɖe mɔ ɖo o la, gblɔe na FBI Internet Nuvlowɔwɔ Ŋuti Nyatoƒoetoto Dɔwɔƒe (ic3.gov) kple CISA (cisa.gov/report) le U.S.A., alo Canada ƒe Internet Dzi Dedienɔnɔ Ŋuti Dɔwɔƒe (cyber.gc.ca) le Canada.

United Kingdom¶

• Kpovitɔwo ƒe Dɔwɔwɔ Kpata (Adzodada / Fiafitɔ Gakpɔtɔ Le Eme): Yɔ 999.
• Kpovitɔwo ƒe Nyatakaka si menye Kpata o & Ketekemɔ/Yameʋudzeƒe ƒe Ʋɔnudrɔ̃ƒe:
  • Le cafewo alo ablɔdzi teƒewo: Ƒo ka na 101 (alo tsɔe de asi na kpovitɔwo ƒe ha si le mia gbɔ to Internet dzi) be nàxɔ Nuvlowɔwɔ Ŋuti Nyatakaka Xexlẽdzesi (CRN) enumake.
  • Le ketekewo me alo le keteke/Tube ʋudzeƒewo me: Text British Transport Police (BTP) le 61016 alo ƒo ka na 0800 40 50 40.
• Nyatakakawo ƒe Dzidada Ŋuti Numekuku (UK GDPR): Ne woxɔ kɔmpiutadziɖoɖoa esime woʋui eye asisiwo alo dɔwɔlawo ƒe ameŋunyatakaka siwo womeɣla o le eme la, na wò Nyatakakawo Takpɔha nanya (DPO) enumake be woatsɔ akpɔe ɖa be gaƒoƒo 72 ƒe UK ICO ƒe sedzidada ŋuti nyatakaka (ico.org.uk) hiã.

Europa Dukɔwo ƒe Ðekawɔha¶

• Pan-European Emergency Number: Ƒo ka na 112 hena kpovitɔwo ƒe kpekpeɖeŋu enumake le EU dukɔwo katã me.
• Kpovitɔwo ƒe Nyatakaka (Procès-Verbal / Strafanzeige / Denuncia): Yi kpovitɔwo ƒe dɔwɔƒe si te ɖe ŋuwò wu (Commissariat de Police, Polizeiwache, Comisaría de Policía, Questura) be nàxɔ fififi ŋuti nyatakaka si dzi woŋlɔ nutrenu ɖo, eye nàna wò dɔwɔƒea ƒe DPO nanya enumake le GDPR ƒe Se 33 te nenye be woʋu mɔ̃a le fififiɣia.

Australia kple New Zealand¶

• Dɔdɔdɔ Kpata: Ƒo ka na 000 le Australia alo 111 le New Zealand.
• Kpovitɔwo ƒe Nyatakaka si Menye Kpata o: Ƒo ka na 131 444 (Kpovitɔwo ƒe Kpekpeɖeŋunamɔ̃ le Australia) alo 105 (New Zealand Kpovitɔwo ƒe Nyatakaka kpata) be nàxɔ Kpovitɔwo ƒe Nudzɔdzɔ Xexlẽdzesi, eye nàgblɔ dɔwɔƒe ƒe ɖaseɖigbalẽ ƒe asiɖeɖe le eŋu to cyber.gov.au (ACSC) alo CERT NZ (cert.govt.nz).

India kple Asia-Pacific-ƒukpowo dzi¶

• India: Ƒo ka na 112 (Emergency) alo 100 (Kpovitɔwo), eye nàŋlɔ e-FIR / Lost Article Report enumake to dukɔa ƒe kpovitɔwo ƒe dukɔmeviwo ƒe nyatakakadzraɖoƒea dzi ale be dziɖuɖua ƒe nuŋlɔɖiwo nanɔ asiwò na dɔwɔƒewo ƒe MDM nunɔamesiwo ŋɔŋlɔ kple CERT-In ƒe sedziwɔwɔ.
• Singapore & Japan: Le Singapore la, ƒo ka na 999 (Emergency) alo nàŋlɔ nyatakaka aɖe ɖe internet dzi le Singapore Police Force e-Services Portal (police.gov.sg). Le Japan la, tsɔ nya ɖe Koban (Kpovitɔwo ƒe Aɖaka) alo Yameʋudzeƒe Kpovitɔwo ƒe dɔwɔƒe si te ɖe ŋuwò enumake be nàxɔ Tounan-Todoke (Fififi Ŋuti Nyatakaka Xexlẽdzesi).

--- .

Nya siwo wobiaa amewo enuenu¶

Ðe wòle be mazi "Erase This Device" (Remote Wipe) alo "Mark As Lost" (Remote Lock) dzi gbã ne wofi nye MacBook alo Windows laptop si womeʋu oa?¶

Ɣesiaɣi la, ʋu **Dzesi Be Ebu / Adzɔge Ʋuʋu GBÃTƆ**, eye nàlala vaseɖe esime woaɖo kpe gaƒoɖokui la dzi (alo nàwɔ ɖoɖo kple wò dɔwɔƒe ƒe IT ƒuƒoƒo) hafi aʋu Tutu / Tutu blibo, le susu vevi eve ta. Gbã la, a `Remote Lock` packet le sue eye wòwɔa dɔ enumake le microsecond si wòɖo laptop la gbɔ to Wi-Fi dzi, si wua desktop session si le dɔ wɔm nu eye wòtua screen la ɖe FileVault alo BitLocker encryption megbe esime wòkpɔa laptop ƒe ŋutete be wòatsɔ beacon eƒe GPS/Wi-Fi teƒea atrɔ ayi Find My. Evelia, ne èzi "Remove From Account" (si to vovo na Erase) dzi la, àtsi Activation Lock le vo me, si ana fiafitɔa te ŋu tutu MacBook la hegbugbɔ dzrae dzadzɛ. Mègazi "Ðe Mɔ̃ Sia" dzi gbeɖe tso Di Nye O.

Ne FileVault (Mac) alo BitLocker (Windows) le nye kɔmpiuta dzi la, ɖe ema mekpɔa nye faɛlwo ta ne wofi wo esime screen la le ʋuʋu gɔ̃ hã oa?¶

Disk blibo ƒe nya ɣaɣla (FileVault 2 kple BitLocker) kpɔa nyatakakawo ta **le ɖiɖiɖemeɣi** (ne laptop la tsi, le vuvɔŋɔli, alo wotu le pre-boot/login screen). Gake esi nège ɖe wò kɔmpiuta dzi eye womeʋu screen la o la, encryption master key la nɔa volatile system RAM me ale be wò dɔwɔɖoɖo kple dɔwɔɖoɖowo nate ŋu axlẽ faɛlwo ahaŋlɔ wo. Ne fiafitɔ aɖe le wò kɔmpiuta dzi esime screen la le ŋudzɔ eye wòyi edzi le trackpad la ƒom ale be screen la nagaʋu gbeɖe o la, FileVault kple BitLocker mexea mɔ na wo be woagawɔ wò faɛlwo ƒe kɔpi o, si tae sedede si woatsɔ axe mɔ ɖe didiƒe ʋĩi enumake ɖoɖo ɖa tso wò fon dzi kple alilikpo me ɣeyiɣiwo ɖeɖeɖa le sɛkɛnd 60 gbãtɔwo me le vevie ŋutɔ ɖo.

Ke nenye be woxɔ nye iPhone KPLEE nye MacBook si womeʋu o siaa le kplɔ̃ ɖeka dzi ya ɖe: aleke mawɔ aƒo wo nu nye telefon manɔmee hena 2FA?¶

Apple tu mɔ aɖe koŋ si dzi woato ato vovo tso nudzɔdzɔ kpatawo gbɔ na nɔnɔme sia tututu: do cafe dɔwɔla aɖe ƒe telefon, amedzro aɖe ƒe telefon, alo dɔwɔhati aɖe ƒe kɔmpiuta dzi mɔ̃ eye nàʋu **`icloud.com/find`** tẽ (de dzesii be `/find` le URL la ƒe nuwuwu). To vovo na vevitɔa `icloud.com` agbo nu, **`icloud.com/find` ɖea mɔ na wò be nàtsɔ wò Apple ID e-mail kple nyagbe ɣaɣla KO age ɖe eme MELE be nàzã xexlẽdzesi 6 ƒe Two-Factor Authentication code** o. Ne ènya ge ɖe eme ko `icloud.com/find`, àte ŋu atsɔ wò iPhone kple wò MacBook siaa ade **Lost Mode** me enumake, axe screen eveawo siaa eye nàwɔ Apple Pay nuwɔametɔe le sɛkɛnd 30 teti me.

Ðe fiafitɔ ate ŋu aɖe nye SSH ame ŋutɔ ƒe safuiwo alo nyagbe ɣaɣlawo tso YubiKey 5C Nano si wofi mea?¶

Ao, YubiKey vavãtɔ dzraa FIDO2, U2F, PIV, kple OpenPGP ƒe safui ɣaɣlawo katã ɖo ɖe cryptographic Secure Element hardware chip si me woate ŋu atrɔ asi le eŋu o me (`EAL6+` woɖo kpe edzi). Le ŋutilã kple akɔntabubu gome la, manya wɔ be woawɔ kɔpi, aɖoe ɖe duta, alo axlẽ ame ŋutɔ ƒe safui *do go* tso YubiKey me ɖe kɔmpiuta dzi o. Afɔku ɖeka si le YubiKey si wofi ŋu koe nye be ame aɖe si si safuia le ŋutɔŋutɔ ate ŋu atsɔe ade eme eye wòaka asi sika ƒe abɔta ŋu be *azãe* vaseɖe esime nàge ɖe wò akɔntabubuwo me (GitHub, Google, AWS, SSH `authorized_keys`) eye nàtutu YubiKey ƒe dutoƒo ŋkɔ ŋɔŋlɔ ma ɖa.

Ðe wòle dedie be magblẽ nye kɔmpiuta si dzi wotsɔa nu ƒoa nui ɖe kɔfidzraƒe ƒe kplɔ̃ dzi sɛkɛnd 60 be mazã nugododeƒea ne metu screen la (Cmd+Ctrl+Q / . Win+L) gbã?¶

Ao, esime nèle wò screen la tum kple `Cmd + Ctrl + Q` alo `Win + L` kpɔa wò dijitaal nyatakakawo ta le FileVault alo BitLocker megbe, ewɔa zero be wòaxe mɔ na fiafitɔ be wòagado go le ʋɔtrua nu kple wò... `$2,500` ŋutilã me laptop le sɛkɛnd 4 me. Ne ègblẽ kɔmpiutadziɖoɖo si wotu ɖe kplɔ̃ dzi ame makpɔmakpɔe hã la, ana woate ŋu atrɔ asi le eŋu ŋutɔŋutɔ (abe amedzidzela vɔ̃ɖi aɖe si tsɔ O.MG Cable, USB Rubber Ducky, alo hardware keylogger de wò USB-C-do me esime nèle nugododeƒe ene). Tsɔ wò kɔmpiutaa ƒu gbe ɖe wò akplo me ɣesiaɣi eye nàtsɔe ayi nugododeƒe ɣesiaɣi.

--- .

Dzɔtsoƒewo kple dziɖuɖumegãwo ƒe mɔfiame¶

• **Dukɔa ƒe Dzidzenuwo Kple Mɔ̃ɖaŋununya Ŋuti Nusrɔ̃ƒe (NIST.
• Internet Dzi Dedienɔnɔ Kple Dɔwɔƒewo ƒe Dedienɔnɔ Dɔwɔƒe (CISA, United States) & UK Dukɔa ƒe Internet Dzi Dedienɔnɔ Dɔwɔƒe (NCSC): Mɔ̃wo ƒe Dedienɔnɔ le Ʋuʋu me (Ŋutilã me Session Lock, Bluetooth Proximity Lock, Abɔta-Surfing Mitigation, kple Remote MDM Wipe Protocols).
• Yubico AB: Nusi Nàwɔ Ne Wò YubiKey Bu (support.yubico.com) (FIDO2 8-Tete PIN Ʋuʋu, U2F Evelia-Nu Afɔku Kpɔɖeŋu, OpenPGP 3-Tete PIN Ʋuʋu, kple Backup Safui Xɔtuɖaŋu).
• Apple Inc. & Microsoft Corporation: Apple Platform Dedienɔnɔ Mɔfiame (FileVault Volume Encryption, T2 / Apple Silicon Dedienɔnɔ Enclave, kple icloud.com/find No-2FA Bu Mode Xɔtuɖaŋu) kple Microsoft Windows 11 BitLocker DMA Takpɔkpɔ & Dynamic Lock Mɔ̃ɖaŋununya Nuŋlɔɖiwo.
• Europatɔwo ƒe Nyatakakawo Takpɔha (EDPB): Mɔfiame 9/2022 ku ɖe Ameŋunyatakakawo Dzi Dada Ŋuti Nyatakaka le GDPR te (Vovototo Dede Mɔ̃ Siwo Wotu Ðe Eme Si Woɣla Le Gbɔɖeme Me Kple Mɔ̃ Siwo Wotu Ðe Dɔwɔwɔ Me Si Womeʋu O Ƒe Fififi).

Mɔfiame siwo do ƒome kplii¶

• Dɔwɔwɔ ƒe kɔmpiutadziɖoɖo si wofi alo gbã esime nèle mɔ zɔm: MDM ƒe gaƒoɖokui kple zero-downtime recovery
• Vodada me nuwɔwɔ ƒe nyatakakadzraɖoƒe ƒe ɖiɖi, git ɣaɣla ƒe sisi, kple nudzɔdzɔ ƒe vovototodedeameme
• Adzɔge dɔwɔƒe ƒe dedienɔnɔ kple nyatakakawo ƒe adzamenyawo gbɔ kpɔkpɔ kpata
• Dɔwɔwɔ le adzɔge tso amedzrodzeƒe alo ɣeyiɣi kpui aɖe ƒe teƒe
• Adzodada kple adzodada ƒe agbetsitsi
• Xexlẽdzesi siwo woatsɔ awɔ nudzɔdzɔ kpatawoe