Secure a newsroom’s accounts in layers. Require multi-factor authentication (MFA) on email and every other high-value work service. Move administrators and high-risk reporters to FIDO2 security keys or supported passkeys. Give every account a unique password, and set up recovery options before you need them. Lock down messaging apps and the phones they run on. Treat joining and leaving the newsroom as a documented access process. Decide in advance who to call if an account is taken over.
Encryption helps, but it is only one layer. It protects message content in transit and at the service. It does not protect an unlocked or compromised device, and it may not hide who talked to whom and when. The sections below cover the steps in the order a newsroom can carry them out, using guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Committee to Protect Journalists (CPJ) and Google.
As an Amazon Associate I earn from qualifying purchases.
Start with an inventory and a risk assessment
You cannot protect accounts you have not listed. Build a simple inventory covering:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Work email, including shared and group mailboxes
- Cloud file storage and any remote-access tools
- Messaging accounts used for reporting and internal coordination
- Social accounts used to publish for the organization
- Administrator accounts for your email, identity and publishing systems
- The recovery email addresses and phone numbers attached to each of the above
Mark the accounts that give access to source material, staff data, publishing systems, or the ability to reset other passwords. Those come first. An email account is usually the most valuable target because password resets for other services land there.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Then ask who in the newsroom faces targeted phishing or surveillance. CPJ’s Digital Safety Kit advises journalists to weigh the capabilities of the people who might attack them and the sensitivity of the information involved. A metro reporter handling routine tips and an investigative team working with a leaked archive do not need identical controls. The assessment decides how far up the protection ladder each person should go.
Turn on MFA, and choose the strongest method you can support
CISA advises organizations to require MFA and to use the strongest method available. Begin with administrators and anyone who handles sensitive material, then extend to everyone with a work account.
How the methods rank
CISA’s business guidance lists options from strongest to weakest. Only the first is phishing-resistant in the sense CISA uses the term:
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| CISA rank | Method | What to know |
|---|---|---|
| 1 | FIDO/WebAuthn security key (or supported passkey) | The phishing-resistant option. Needs provider and device support. |
| 2 | Authenticator app with number matching | Stronger than plain approve/deny prompts, but a user can still be tricked into entering a number. |
| 3 | One-time codes | A code can be typed into a fake login page. |
| 4 | Biometrics | Ranked below codes in CISA’s list. |
| 5 | Text message or email codes | Weakest of the listed options, but far better than a password alone. |
“The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” — CISA, More than a Password
If a service cannot support the top option, use the strongest one it does support and plan to upgrade. Weak MFA still beats none.
Security keys are not universally plug-and-play
A FIDO2 security key is a concrete, physical option, and CPJ suggests a key such as a YubiKey for journalists at high risk. Before buying for the whole desk, check that your identity provider or email service supports security keys or passkeys. Check the phones and laptops your staff actually use, too. Do not assume one model works with every account.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not rely on a single key for critical accounts. Arrange a recovery route or a separately stored backup key. Google’s Advanced Protection guidance, for example, recommends adding recovery information and keeping an optional backup passkey or security key safe.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Consider enhanced protection for elevated-risk staff
Google says its Advanced Protection Program is meant for people at elevated risk, including journalists, and requires security keys or passkeys to sign in. This is specific to Google accounts. Eligibility, device support and recovery options can change, so read Google’s current page and check it against your newsroom’s policy before enrolling anyone. Enrolling someone without a recovery plan can lock them out of their own account.
Handle passwords and recovery deliberately
- Unique and long. CPJ recommends long, unique passwords for each account. Staff should never reuse a personal password for work.
- Consider a password manager. CPJ suggests considering one. It makes unique passwords practical, but it does not replace MFA.
- Keep backup codes. Store one-time backup codes somewhere protected that staff can still reach if the phone or key is lost.
- Set up recovery first. Confirm a safe recovery method exists before you change authentication settings on any account.
Train staff to recognize phishing that targets MFA
CPJ warns that phishing can imitate two-factor authentication. Attackers send fake alerts, fake login pages and unexpected prompts to get a code or an approval. Set a few rules:
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
- Do not approve an MFA prompt you did not trigger.
- Do not enter credentials after following a link in an unsolicited account alert.
- If a prompt or recovery attempt is not yours, open the service through a known address, or contact your administrator.
- Report suspicious prompts instead of quietly dismissing them. A prompt you did not request can mean someone already has the password.
Harden messaging accounts and source conversations
For sensitive conversations, use an end-to-end encrypted messaging app where appropriate. Remember that the recipient’s device is part of your security boundary. Menu names differ between apps and change over time, so check each app’s current settings rather than relying on a fixed walkthrough. Review these areas in whichever app you use:
- App lock. Require a PIN, passcode or biometric to open the app.
- Registration lock or account PIN. This makes it harder for someone to register your number on another device and take over the account.
- Contact or safety-number verification. Verify sensitive contacts through a separate channel so you know you are talking to the right person.
- Disappearing messages. Use them when the newsroom’s retention policy and the source’s needs allow.
- Backups. Check whether chats are backed up to the cloud and whether those backups are encrypted. Minimize how much sensitive material sits on devices and in backups.
What encryption does not do
Encryption protects message content. Metadata, such as who communicated and when, may remain visible to providers or others. CPJ also warns that anyone with access to a sending or receiving device, or to the linked account, may be able to read the content. A reporter should never promise a source that an app makes a conversation anonymous or safe from a compromised phone. Keep the device itself locked, updated and under your control, because that is where this layer breaks.
Recommended Free Tools
Make access a newsroom process
CPJ’s 2024 U.S. journalist safety kit specifically recommends documenting onboarding and offboarding. The risk is practical: former staff and freelancers keep access to mailboxes, shared drives and group chats long after the work ends. A written checklist keeps this from depending on someone’s memory.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Onboarding checklist
- Create the work account and assign the minimum access the role needs.
- Enroll the person in MFA, using a security key or passkey where supported.
- Record where backup codes and any spare key are kept.
- Add the person to the shared mailboxes and groups they need, and no others.
- Set or confirm recovery contacts.
- Walk through the phishing rules and the incident contact below.
Offboarding checklist
- Revoke access promptly on the person’s last working day, including freelancers at the end of a contract.
- Remove them from shared mailboxes, group chats, shared drives and publishing tools.
- Reset credentials on any shared accounts they used.
- Collect or deactivate hardware keys and managed devices.
- Update the account inventory.
If an account may be compromised
Speed matters, and so does where you act from. Follow these steps:
- Use a known-good device and a trusted route. Do not work from the device you suspect is compromised. Contact newsroom IT or the provider through a channel you already trust.
- Get support. CPJ advises journalists with organizational technical support to contact it immediately. It directs freelancers and others without that support to the Access Now Helpline.
- Secure recovery options. Check the recovery email and phone number. Attackers often change them to keep access.
- Revoke unfamiliar sessions and app access.
- Reset credentials, then confirm MFA is still set up by you and nobody else.
- Preserve relevant evidence under newsroom policy before deleting anything.
- Do not use links from the alert itself. Go to the service directly.
Match the controls to the risk
This is general security guidance. It does not replace a risk assessment for a newsroom facing targeted surveillance or a live compromise. For those cases, CPJ advises seeking suitable support. CPJ’s Digital Safety Kit, last updated February 20, 2026 according to its page, is the most direct journalist-specific reference. App settings and provider policies change, so check current in-app settings and provider documentation before you finalize a policy.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
