Actionable steps to protect yourself and your organization
Use these practices as your personal security checklist. The more you have in place, the better protected you are.
Tools like Bitwarden, 1Password, or KeePass generate and store unique strong passwords. You only remember one master password.
If one site is breached, credential stuffing attacks try your password on hundreds of other sites. Unique passwords per account prevent this cascade.
Minimum 12 characters. Mix uppercase, lowercase, numbers, and symbols. Alternatively, use a passphrase: Horse!Correct$Battery#Staple
Prioritize: email, banking, social media, work accounts, cloud storage. MFA blocks 99.9% of automated account compromise attacks (Microsoft research).
Google Authenticator, Microsoft Authenticator, or Aegis (open-source) are far safer than SMS. SMS can be intercepted via SIM swapping attacks.
When enabling MFA, you receive backup codes. Print them and store in a secure physical location — never in an email or unencrypted notes app.
Enable automatic updates for your OS, browser, apps, and router firmware. 60% of breaches exploit known vulnerabilities with available patches.
Your OS has a built-in firewall. Make sure it's enabled. For home networks, use your router's firewall and change the default admin password.
Public Wi-Fi is unencrypted. A reputable VPN (Mullvad, ProtonVPN) encrypts your traffic, protecting passwords and data from eavesdroppers.
3 copies of data, on 2 different media, with 1 stored offsite or in the cloud. Test restores regularly to ensure backups actually work.
Enable full-disk encryption (BitLocker on Windows, FileVault on Mac, built-in on modern phones). Protects data if your device is lost or stolen.
Modern endpoint security goes beyond virus detection. Tools like Windows Defender, Malwarebytes, or CrowdStrike catch behavioral threats in real-time.
Always verify the padlock icon and HTTPS before entering any sensitive information. Never submit passwords or payment details on HTTP (non-encrypted) sites. Note: HTTPS means the connection is encrypted, not that the site is necessarily trustworthy.
Firefox, Brave, or even Chrome with hardened settings offer better privacy. Install extensions: uBlock Origin (ads/trackers), Privacy Badger, and HTTPS Everywhere.
Check haveibeenpwned.com to see if your email was in a data breach. Set up Google Alerts for your name. Review privacy settings on all social media accounts quarterly.
Social media oversharing fuels social engineering attacks. Avoid posting: your location in real-time, full birthdate, home address, financial information, or answers to common security questions (mother's maiden name, first pet, etc.).
Check the boxes above to see your security score.