NCSC advice and guidance
Visit ncsc.gov.ukThe National Cyber Security Centre's practical advice, aimed at individuals and small organisations rather than security teams. The password and phishing guidance in particular contradicts a lot of received wisdom and is worth reading properly.