Cybersecurity Habits to Protect Yourself Online

Identity theft, scams, fraud, viruses, malware, tracking, data breaches, and more – there are all sorts of things in the digital world that can compromise our safety and our privacy. Even seemingly innocent things like browser extensions and trustworthy companies like Google can actually be spying on you and harvesting your data. These issues affect lots of people and can have huge impacts. Developing some cybersecurity habits can help you protect yourself, your information, and your assets.

Cybersecurity Habits to Prevent Malware

Malware, short for “malicious software,” are software programs designed to do something harmful on your device. Ransomware, spyware, and viruses are all types of malware. This group of cybersecurity habits is all about keeping malware off your devices and away from your sensitive data.

Keep Everything Updated

Updates often have security patches. These patches fix holes and vulnerabilities that criminals could use to get into your device and steal your information or attack you. Every time there’s an update available, install it. That includes apps, software, and operating systems.

Don’t forget to check the firmware on your smart devices and router, too! Those also get updates sometimes. If it’s too old to get updates (which happens with routers sometimes), it’s time to upgrade to a newer, more secure one.

It’s often difficult to remember this particular cybersecurity habit. One option is to update everything on “Patch Tuesday,” which is the second Tuesday of every month. (This is when Microsoft releases their security updates.) Or you can set a reminder for a different time that works for you to check and update everything.

Run an Antivirus

If you don’t already have an antivirus program on all your devices, do that now! (And check out our article on the best antivirus options if you need help picking one.) An antivirus is your device’s “immune system,” helping it defend against malware attacks. If it does get infected, the antivirus will spot it and work to clean it up.

Your antivirus should be set to run automatically on a frequent basis. But it’s good cybersecurity practice to get into the habit of checking your antivirus occasionally. Some antivirus programs generate suggestions for things you can do to make your device more secure. And some viruses are sophisticated enough to disable the antivirus before it can detect them. So it’s good to regularly make sure it’s running and check for any notifications or suggestions.

Don’t Install Malware Yourself

Sure, you’d never intentionally install malware on your own device. But if criminals can get you to do their work for them, they will. So they have all sorts of methods they use to trick you into downloading malware yourself. This series of cybersecurity habits is more a list of things to avoid to protect your devices:

Keep to trusted app stores. Apple and Google make reasonably sure apps for sale in the App Store and Play Store aren’t malicious. But there’s no way to know who’s verifying third-party app stores. Downloading apps only from these trusted stores means they’re less likely to be secretly malware.

Don’t install mystery files. APK files (for phones), .exe files (for Windows devices), and .pkg files (for Mac devices) are files that install a program on your device. If you aren’t expecting a file to install something, don’t open any of these files. And never install anything unless you’re 100% sure you know what it is, you got it from a trusted place, and you’re confident there’s no malware bundled with the legitimate program.

Don’t click links or open attachments. This is especially true for unsolicited emails or texts. But it’s good to be cautious of all links and attachments regardless. Who knows if a criminal has taken over your friend’s email account? Opening links or attachments can put malware on your device, so if in doubt, don’t click.

Cybersecurity Habits to Secure Your Accounts

Criminals love to get access to your accounts. Obviously, they like access to your bank accounts – they can just steal your money directly. But if they can get into your social media accounts, they can impersonate you to target your friends with scams. Your healthcare accounts are full of sensitive data. And since email is often a recovery option for all kinds of accounts, getting into your email is has many nefarious uses. Every account that matters should be secure. These cybersecurity habits will help you do that.

Use Passwords Better

Reusing passwords is one of the biggest mistakes you can make when it comes to securing your accounts. That’s because of the risk of credential stuffing. If your password shows up in a data breach, many criminals like to see what else it can unlock. Reusing passwords means every account where you used that password is at risk.

Weak passwords are also a risk. Birthdays, kids’ or pets’ names, and any variation on “Password123” is easy to guess. And with AI, hackers can crack any password that’s not complex and random enough in seconds. Which means that if it’s something you can easily remember, it’s easy enough for AI to crack.

The solution is to use a password manager. Password managers can create long, strong, random, and unique passwords for you, and saves them all for you so you don’t have to worry about remembering them. But making the switch to a password manager can be daunting.

That’s why we recommend making this a cybersecurity habit. Sign up for a password manager. Every time you log in to an account, change your password and save it to your password manager. For the cost of an extra minute when you log in, you’ll start better protecting your accounts.

Turn on Multi-Factor Authentication

Multi-factor authentication (MFA), two-factor authentication (2FA), dual-factor authentication, multi-step authentication … whatever you want to call it, it’s great for your account security. This process requires an additional step of entering a code after you put in your password. This code can be sent via text or email or generated by an app or a hardware token. Regardless, it keeps criminals who stole, bought, or cracked your password out of your account.

It’s best to turn on MFA on every account that offers the option. But like changing all your passwords, that can get overwhelming. So make a cybersecurity habit of checking the security settings every time you log in. If it has MFA options, pick one and turn it on. There are a lot of people who say using an app or a hardware key is more secure than getting a code texted to you. But getting a text is better than nothing!

The final essential part of MFA is that you shouldn’t give out that code to anyone, ever. That code is to let you log in. Treat it like your password. You shouldn’t give your password out to anyone. And you shouldn’t give out this code, either. If someone asks for your MFA code, it means they’re trying to log into your account.

Use Security Questions Securely

A lot of common security questions are based on information that’s easily available. How easy would it be for someone to find your mother’s maiden name, your high school, or the name of your first pet on social media? Well-known facts are easy to remember, but also not very secure. And if someone can find the answer to your security question, they can reset your password and access your accounts. So build a strong cybersecurity habit around securing your security questions.

Where you can, use questions that only you know the answer to. Do your best to use different questions for every account. This can be challenging sometimes, because many accounts only have a limited number of questions for you to choose from. When accounts let you set your own questions instead of using a pre-selected one, use that!

Better yet, don’t provide real answers to any of them. Set them to inaccurate or nonsense answers, and store the answers in your password manager. That way nobody but you will be able to answer your security questions, even if the real answer is available online.

Watch Your Devices

It seems like basic advice, but it’s still a good cybersecurity habit to build. Don’t make it easy for people who want to snoop on your accounts. And don’t make it easy for thieves to get in if they steal your device.

Make sure all of your devices are password-protected. Something biometric, like Face ID or a fingerprint, is great. Even a simple PIN is better than nothing. And make sure your screens are locked when you’re not actively using them, even if you’re only stepping away for a second. This will keep anyone from snooping while you’re gone.

Cybersecurity Habits to Keep Your Data Private

What do cybercriminals and big internet companies have in common? They both want your data. Cybercriminals want to make money by any means possible, and they can use your data to target you with scams, steal your identity, or sell it to other criminals who want to do those things. Companies want to increase profits, and they can use your data to target you with advertising or sell it to other companies who want to advertise to you.

Your data is immensely valuable to a lot of people. These cybersecurity habits will help you take control of it and protect your privacy.

Review Your Data Sharing

A lot of different things ask you to share data from your accounts. Whether that’s an app that wants access to something on your phone, a budgeting software that conveniently links to your payment apps, a tax prep program that offered to import data to make it easier to file your taxes, or because you didn’t want to read a whole notification and clicked “agree,” there’s all sorts of ways to and reasons for enabling third-party data sharing. And not all of them are bad. Some data sharing can be convenient or even beneficial.

But it’s a good cybersecurity habit to make sure you know what’s being shared, where, and why. Review all your apps and accounts on a regular basis. Make sure you recognize every place that’s accessing your data. Turn off any sharing that you don’t recognize or aren’t using anymore. And consider whether or not you really need to be sharing that data in the first place. Is it worth the potential privacy risk? Sometimes the answer is yes. But the key is to be conscious and intentional about it.

Limit App Permissions

When you download a new app, it’s probably going to ask you for permissions to access various things on your device. But giving them access lets the app owner – and any criminal who hacks in – see all of that data.

Build the cybersecurity habit of saying no as much as you can. Sure, some apps do actually need permissions. It’s hard for a photo-editing app to do anything if you don’t give it permission to access your photos. But does it need access to your messages or to make and manage phone calls? Probably not! Give all apps the bare minimum of permissions they need to do what you want. If they don’t need it, turn it off. (And if that photo editing app won’t work if you don’t give it access to your phone calls, it might be time to uninstall it and find a different one.)

Be Cautious on Social Media

We’re not saying you have to give up social media altogether. (Although if you’re really committed to privacy, that might be the way to go.) But if you want to protect your privacy, you have to be careful. Criminals can use all kinds of social media data against you. Scammers can use it to do targeted phishing and craft scams you’re more likely to fall for. If you reveal enough, enterprising thieves can use it to steal your identity. And some burglars even will watch social media to find out when you’re out of town so they can break in.

It’s always good to start with the basics. Check your privacy settings, set profiles to private where you can, and consider “scrubbing” your accounts to clear out any existing information that you don’t want available. But an important cybersecurity habit to get into is thinking before you post. It seems obvious that things like your social security number, your ID, tax information, and medical information should stay off the grid. But you should also be cautious about posting about your children, “checking in” to places you go, putting too much data about your past in your profile (e.g. high school, work history), sharing a lot of personal info in posts, or posting about your future plans. There’s nothing wrong with sharing those travel pics – just maybe wait until you get home.

Don’t Share Your Info

One of the best cybersecurity habits you can get into is just not sharing your personal data as much as you can. That’s especially true if the person asking for it is someone you’ve never interacted with before or if you didn’t initiate the contact. But even if you know who it is, data breaches happen all the time. The safest thing is to avoid giving it out.

See how much you can get done without sharing it. You might be surprised. An unfortunate number of forms ask you to provide information they don’t really need. Consider leaving as much as possible blank – if they really need it, they’ll let you know. Or you can ask if the information is really needed, and if so, for what and what they’re doing to protect it.

And if anyone asks you to share personal information, whether the conversation is on the phone, via email or text, or even on a video call, verify it before you act. Scammers and fraudsters are really good at pretending to be someone they’re not. Even if you think you’re speaking to a boss or a friend, verify. If you’re on a Zoom call, send them a text. If you’re on the phone, send them an email. If it’s really them, it will only take a second for them to confirm. And if it’s not, you’ll have saved yourself a lot of trouble.

Don’t Store Your Info

The best way to keep someone from getting your data is if you don’t have it, either. That doesn’t mean you can’t keep important information. But it does mean you should be careful what you keep and where you keep it. It’s a good idea to get into the cybersecurity habit of thinking twice before you save any information, and if you decide you need to, carefully choosing where to store it.

Think about the worst-case scenario. What if a hacker gets into your device, or someone steals it? If you’re keeping photos of your social security card and driver’s license, they have everything they need to steal your identity. Or if you have a document full of passwords, they can now get into all of your accounts. If you don’t have to save it, it’s best not to. If you do, choose a secure and encrypted place to keep it where it will be safe even if the worst happens.

Cybersecurity Habits to Stay Secure On the Go

Cybersecurity at home is one thing. But most of us go places that aren’t our homes. Which means we also need to think about building cybersecurity habits that will protect us while we’re out and about, too.

Use Caution on Free Wifi

Free and public wifi networks, like the kind available at coffee shops, airports, and hotels, are convenient and useful. But they can also be risky. From a privacy standpoint, you have no way of knowing if the network owners are tracking or logging your activity. And from a security standpoint, it’s easy for hackers to intercept whatever you do while connected – including getting passwords if you log into anything and your financial data if you make a purchase.

It’s a good cybersecurity habit to always be a little suspicious of free and public wifi. If possible, avoid it. Use your mobile data, or create a wifi hotspot from your phone. Alternatively, you can connect to these networks while using a VPN. A VPN will protect your data from snoopers and thieves alike.

Don’t Use Public Chargers or Ports

Some places make USB ports or charging cords available for your convenience. And if your phone is dying, that’s pretty convenient! But phones use the same cables to transmit power and data. Which means that a complementary charging cable or USB port could also steal your data or download malware to your device.

The best cybersecurity habit to get into is to bring your own cable and plug it directly into a power source, not a port. That way you know there’s nothing lurking in the cable and the only thing you’re putting into your phone is power. But carrying around cables and charger blocks can get cumbersome. The easier option is to carry a USB condom. It’s a funny term for a tiny device that you plug into your phone and then plug the charging cable into it. The USB condom lets power through, but no data. So you can charge your devices with any cable or port without risking attack.

Other Cybersecurity Habits to Stay Protected

Every comprehensive list has to have a “miscellaneous” category. These cybersecurity habits don’t necessarily fit into any of the above categories, but they’re still good habits to get into to protect yourself.

Don’t Unsubscribe from Spam

This one may seem counterintuitive, but let us explain. When a spam email makes its way past your email spam filters and into your inbox, you should never click anything in the messages. Ideally, you shouldn’t even open them. Get into the cybersecurity habit of reporting them as spam or junk and deleting them.

Why? Because spammers can track emails. If you click “Unsubscribe,” you’re trusting that the people sending the email will do what you ask them to. And scammers and spammers aren’t interested in doing that. They can see that you clicked something in their email. And that means they know that the email address works and goes to a real person. They’ll end up targeting you more.

And sometimes unsubscribe links can go to fake websites or download malware, too It’s just better to report, delete, and move on.

Monitor Your Accounts and Credit

One of the best ways to figure out if you’ve been a victim of fraud or identity theft is to monitor your financial accounts and your credit report. The first sign of identity theft is often things you don’t recognize showing up on your credit report. This cybersecurity habit may not be explicitly computer-based, but it’s still important. It’s easier to fix and repair a single issue than years and years of fraud.

Also consider freezing your credit. A freeze will stop anyone from opening up new accounts in your name. Which means someone stealing your identity won’t be able to open fraudulent accounts. But it will also stop you from opening up new accounts. So if you want to get a new credit card or loan, you’ll have to un-freeze it temporarily.

Back Up Critical Files

Cybersecurity isn’t just about preventing bad things from happening. It’s also about making it easier to recover when bad things do happen. That’s why backing things up is also a crucial cybersecurity habit. Making sure you have another copy of crucial files and information makes it easier to recover if hackers, malware, or ransomware get into your device and lock or destroy your files. You can choose a cloud backup program or periodically copy your data to external storage. The safest option is the 3-2-1 rule: Three copies, in two separate formats, one of which is stored in a different location.

The best thing about backups is it’s useful in situations beyond criminal attacks, too. What happens if your phone gets stolen, your laptop hard drive fails, or there’s some kind of natural disaster? All of these things can mean you just lose important data or files on your devices. Backing everything up keeps that from happening.

Key Takeaway: Get Started Now

You may be overwhelmed with all the different cybersecurity habits that you “should” be doing to keep yourself safe and your data private. But you don’t have to tackle everything at once. (In fact, you definitely shouldn’t.) Pick one or two that seem doable and just get started. As those things start to become second nature, you can add more. The worst response is to do nothing – even a tiny step will boost your protection.

Things you can do right now:

• Check for updates on your devices
  • If there’s an auto-update option, turn that on
  • Start planning to replace anything that’s too old to receive updates
• Install an antivirus and schedule it to run regularly
• Choose a password manager, sign up, and start figuring out how it works
• Turn on two-factor authentication on your key accounts
  • “Key” accounts include anything financial, anything with your private info, social media, and email
• If you’re a public wifi user, get a VPN

Create a routine or reminder to do these things regularly:

• Check for updates on things that don’t auto-update (especially firmware on things like routers and smart devices)
• Check your antivirus to make sure it’s running and see if it has recommendations
• If your password manager has a feature that checks if your passwords are exposed on the dark web, check that report
• Review data sharing settings on your accounts and disable any connections you no longer need
• Review the app permissions on your phone and turn off any you don’t need
• Look at what data you’re storing on your devices and delete any you don’t need anymore
• Check your credit report and investigate and dispute anything you don’t recognize
• Back up your data, or check backups if using a service that does backups automatically