For twenty years, 'be safe online' meant a lecture aimed at one person: don't reuse password1, don't click the fake invoice, install the update. That lecture is still correct. CISA's Shields Up note for families is the same four moves, written in civilian English. Multifactor authentication, including a hardware key if you will use one. Automatic updates on phones and browsers. Pause before a link. A password manager instead of a spreadsheet. The agency even puts a number on phishing: it says more than 90 percent of successful cyber-attacks start with a phishing email. Treat that as CISA's operational warning, not a laboratory constant.
What changed is the unit that has to carry those habits. A household is a small network with shared Netflix, a shared Amazon, a school portal, a doorbell camera, and one person who set up the Wi-Fi in 2019 and never wrote down the admin password. When that person is unavailable, the CISA checklist is still true and completely unusable. Security became a household practice when accounts did, whether anyone scheduled a meeting about it or not.
What changed
Multifactor, updates, and a password manager assumed a single person who could recover the account.
Shared streaming, school portals, and a router nobody else can log into. The checklist fails at the family boundary.
| Layer | The individual how-to | What the household still has to decide |
|---|---|---|
| Passwords | Unique strings in a manager (CISA). How to choose and adopt a password manager is the product page. | Who is the organizer. Which logins live in a shared vault (utilities, streaming, Wi-Fi). Which stay private (mail, bank, work). |
| Multifactor | Turn it on; prefer an authenticator app or a FIDO key over SMS (CISA). | A second person who can complete recovery. A hardware key in a drawer nobody else knows about is a single point of failure with better cryptography. |
| Phishing | Think before you click. How to recognize and contain phishing is the incident page. | A household rule for money and password resets: no one approves a transfer or a code from a text that arrived during dinner without a second channel. |
| Updates | Automatic updates on OS and browsers (CISA). How to make software updates routine is the habit page. | Who owns the shared tablet, the TV, the router. An unpatched smart TV is not 'someone else's device' if it sits on the same Wi-Fi. |
Family password-manager plans exist because shared credentials and private credentials are different social objects.
- 01Shared vault
Streaming, Wi-Fi, the domain registrar, the town tax portal, the printer. When the password changes, everyone who needs it gets the change without a group chat of screenshots.
- 02Private vaults
Each adult's email, bank, medical portals, work. Teenagers get their own vault, not a copy of yours. Sharing the mortgage login 'for convenience' is how a phishing hit on one phone becomes a household event.
- 03Emergency access
A designated recovery person, a sealed note of the master password or account-recovery path in a place a trusted adult can find, plus the platform legacy-contact tools on Apple and Google. This is estate hygiene, not paranoia.
The cultural shift is not that criminals got more sophisticated in a cinematic way. It is that ordinary life concentrated more money and identity into accounts that several people touch, while the advice industry kept addressing a solo power user. A reused password on a shopping site used to be an individual embarrassment. It is now a way someone orders packages to the porch. A parent who is the SMS target for every family MFA prompt is a single SIM-swap away from becoming the household's outage.
Fear campaigns make this worse when they imply that only a paranoid setup counts. CISA's own tone is the opposite: four actions, done, on the accounts that matter, including gaming and streaming. A household that turns on MFA for email and banking, puts shared logins in a manager, and updates the router firmware twice a year has done the work. A household that buys a $300 'military-grade' VPN and still shares one password by text has bought a story.
Kids change the diagram. They need enough access to function and not enough access to drain a card. A shared vault item for the streaming app is appropriate. A shared vault item for the tax software is not. School accounts often forbid password sharing; follow the school. The household practice is the conversation about what is shared, not a lecture about never being online.
When someone dies or is incapacitated, the gap between 'we were careful' and 'we can still pay the electric bill' is this infrastructure. Password-manager emergency access, Apple Legacy Contact, Google Inactive Account Manager, and a paper backup of the few secrets that unlock the rest are unglamorous on purpose. They are also the adult version of the fridge list, without leaving the bank password next to the takeout menus.
The home is the perimeter now
- 01
CISA's four habits still apply to each person. They fail if only one person can operate them.
- 02
Shared vault for shared life. Private vault for money and mail. Write down recovery.
- 03
A gadget that nobody else can log into is not hardened. It is fragile.
Questions
- 01Should we write passwords on paper?
CISA prefers a password manager to a file on the computer. A sealed emergency sheet for the master password and the router, stored like spare keys, is a known-tradeoff backup. A sticky note of the bank password is not.
- 02Is a family VPN the household practice?
A VPN changes the path to the internet. It does not replace unique passwords, MFA, or updates. What a VPN does and does not hide is a separate Technology piece.
- 03What if someone in the house will not use a password manager?
Then the shared accounts still need a manager the willing adult runs, and the unwilling person's email still needs MFA. You cannot outsource their clicks. You can stop putting the mortgage in a group text.
