Every week brings news of another data breach. Schools, factories, websites, and even government agencies are under protection, and we all suffer. There’s not much you can do to prevent these remote violations, but instead of bemoaning the fact, get busy! There are many things you can do to protect your device, data, and privacy.
It doesn’t take much to make your devices, online identity and activities more secure. The following few tips come down to common sense, but they will help you stay safer online.
1. Install antivirus software and keep it updated
We call this type of software antivirus software, but protecting against actual computer viruses is only a small part of what they do. Ransomware encrypts your files and demands payment to restore them. Trojan horse programs appear to be effective programs, but behind the scenes, they steal your private information. Bot turns your computer into a soldier in a zombie army, ready to carry out a denial of service attack, send spam, or whatever the bot herder commands. Effective antivirus software protects against these and many other types of malware.
In theory, you could set and forget the antivirus protection, leaving it humming in the background, downloading updates, etc. In practice, you should check it every now and then . Most antivirus utilities display a green banner or icon when everything goes bonkers. If you open the utility and see yellow or red, follow the instructions to get things back on track.
You might be thinking, wait, isn’t there antivirus software built into Windows? Not only is Microsoft Defender Antivirus baked into the operating system, but it automatically takes over protection when it detects no other antivirus, and it also automatically quits when you install third-party protection. The problem is, this built-in antivirus is no match for the best third-party solutions. Even the best free versions are much better than Defender. Don’t rely on it; you can do better.
Whether you choose a simple antivirus or a full security suite, you’ll need to update it every year. Your best bet is to sign up for auto-renewal. For some security products, doing this can keep malware free. If you ever feel the urge to switch to another product, you can opt-out at any time.
And one more thing. If your antivirus or security suite doesn’t have ransomware protection, consider adding a separate layer of protection. Many ransomware-specific utilities are completely free, so there’s no reason not to try some of them and choose the one that works best for you.
2. Explore your installed security tools
There are lots of great apps and settings that help protect your device and your identity, but they’re only valuable if you know how to use them properly. To get the most protection from these tools, you must understand their features and settings. For example, your smartphone almost certainly includes an option to find it if you lose it, and you might even have it turned on. But have you actively tried it so you know how to use it when you need it?
Most antivirus tools protect against potentially unwanted applications (PUAs), troublesome apps that aren’t exactly malware but don’t do anything beneficial. But not all products enable PUA detection by default. Check the detection settings and make sure they are configured to block these annoyances. Likewise, your security suite may have components that were not active until you turned them on. When installing a new security product, go through all the pages of the main window and at least glance at the settings. If it offers an initial introductory tour, don’t skip it—instead, walk through it methodically, noting all the features.
Antivirus tools usually include some form of browsing protection, usually in the form of browser extensions. If you accidentally try to visit a dangerous page or a phishing scam, they divert your browser to a safe warning page. Many of them flag search results so you don’t even click on dangerous links. All of this won’t help you at all if you don’t have a browser extension installed and working. Check each browser you use to make sure it is protected.
To further ensure that your antivirus is configured and working properly, you can turn to the AMTSO (Anti-Malware Testing Standards Organization) security feature check . If your antivirus fails, it’s time to contact tech support and find out why .
3. Use a unique password for every login
One of the easiest ways for hackers to steal information is to take a batch of username and password combinations from one source and try the same combinations elsewhere. For example, suppose a hacker obtained your username and password by hacking into your email provider. They might try to log into the bank’s website or major online store using the same username and password combination. The single best way to prevent a data breach from having a domino effect is to use a strong, unique password for every online account you have .
Our Preferred Password Manager
It’s not a human’s job to create a unique and strong password for each account. That’s why you use the random password generator built into your password manager . Several very good password managers are free , and it takes very little time to get started with one. However, paid password managers often offer more features.
When using a password manager, the only password you need to remember is the master password that locks the password manager itself. Once unlocked, the password manager automatically logs you into your online accounts. Not only does this help keep you safer, it also increases efficiency and productivity. You no longer need to spend time entering login information or deal with the time-consuming frustration of resetting a forgotten password.
There is one more thing to consider. If you were freaked out by a self-driving car tomorrow, how would your heirs manage to access your accounts? The most advanced password manager lets you identify the password heir who will gain access to your account after you shuffle this deadly coil.
4. Get a VPN and use it
You should use a virtual private network, or VPN, anytime you connect to the internet using a Wi-Fi network that isn’t yours . Let’s say you go to a coffee shop and connect to a free Wi-Fi network. You know nothing about the security of that connection. Others on that network could start viewing or stealing files and data sent from your laptop or mobile device without your knowledge. The hotspot owner could be a scammer, sniffing out secrets from all Wi-Fi connections. A VPN encrypts your internet traffic and routes it through servers owned by the VPN company. This means that no one, not even the owner of the free Wi-Fi network, can snoop on your data.
Using a VPN also hides your IP address. Advertisers and trackers looking to identify or geotarget you by that IP address will see the VPN company’s address. Spoofing your location using a VPN server in another country can also be used to unblock content that is not available in your region. What’s more, journalists and activists in authoritarian countries have long used VPN technology to communicate securely.
The upshot is that if you’re connecting via Wi-Fi — whether on a laptop, phone, or tablet — you really do need a VPN.
5. Use multi-factor authentication
Multi-factor authentication can be a pain, but it definitely makes your accounts more secure. Multi-factor authentication means you need to go through another layer of authentication, not just a username and password, to get into your account. If the data or personal information in the account is sensitive or valuable, and the account offers multi-factor authentication, it should be enabled. Gmail, Evernote, and Dropbox are a few examples of online services that offer multi-factor authentication.
Multi-Factor Authentication verifies your identity using at least two of three different forms of authentication: who you are, what you have, or what you know. The stuff you know is naturally the password. Your identity may mean authentication using fingerprint or facial recognition. Something you own might be your phone . You may be asked to enter a code sent via text message or tap a confirmation button on the mobile app. Something you own can also be a physical security key ; Google and Microsoft have announced pushes for this type of authentication.
If you only use a password for authentication, anyone who knows that password has your account. Passwords alone are useless when multi-factor authentication is enabled. Most password managers support multifactor, although some require it only when they detect a connection from a new device. Multi-factor authentication must be enabled for the password manager.
6. Use passwords, even if they are optional
Apply passcode lock where available, even if it’s optional. Think of all your personal data and connections on your smartphone. It is unimaginable without a combination lock.
Many smartphones offer a four-digit PIN by default. Don’t settle for that. Use biometric authentication when available, and set strong passwords instead of silly four-digit PINs. Remember that even if you use Touch ID or equivalent, you can still use a passcode for authentication, so it needs to be strong.
Modern iOS devices offer a six-digit option; ignore it. Go to Touch ID & Passcode > Settings, then select Change Passcode (or Add Passcode if you don’t have Add Passcode). Enter your old password if required. On the screen to enter a new code, select Custom alphanumeric code. Enter a strong password, then record it as a secure note in your password manager.
Different Android devices offer different paths to setting strong passwords. Find the screen lock settings on your device, enter your old PIN, and choose a passcode (if available). As with iOS devices, add a strong password and record it as a secure note.
7. Pay with your smartphone
The credit card usage system is outdated and not secure at all. It’s not your fault, but there is something you can do about it. Instead of whipping out your old credit card, use Apple Pay or the Android equivalent whenever possible. There are many options when it comes to applications. In fact, we have a whole suite of mobile payment applications .
Setting up a smartphone as a payment device is usually a simple process. It usually starts with taking a picture of a credit card that you will use to support an app-based payment. Setup is almost there; you’re ready to go.
Point-of-sale terminals that support smartphone-based payments often represent facts with icons, from a picture of a hand holding a smartphone to a stylized representation of radio waves. Just hold your device over the terminal, authenticate using fingerprint or facial recognition, and you’re paid.
What’s better than using the credit card itself? The app generates a one-time authentication code that is only valid for the current transaction. Even if someone stole that code, it wouldn’t do them any good. Paying with a smartphone app eliminates the possibility of data being stolen by credit card skimmers .
Some smartphone payment apps allow you to pay online using similar one-time codes. If not, check with your credit card provider . Usually, you will be given a temporary number in place of your real credit card, and the charge will go to your regular account. After the temporary card number expires, it will no longer be valid. The next time your credit card company or bank calls to try to sell you an upgrade, ask for the single-use card number.
You can also use third-party apps to gain protection for one-time credit card numbers. For example, IronVest can mask credit card numbers, email addresses, and phone numbers. You shop and communicate as usual, but the merchant doesn’t receive your actual information.
8. Use different email addresses for different types of accounts
People with highly organized and methodical security often use different email addresses for different purposes in order to keep the online identities associated with them separate. If a phishing email claiming to be from your bank lands on an account you only use for social media, you’ll know it’s fake.
Consider keeping an email address dedicated to signing up for apps you want to try, but may have questionable security or spam you with promotional messages. After reviewing a service or application, sign up using one of your permanent email accounts. If the dedicated account starts getting spam, close it and create a new one. It’s a do-it-yourself version of the masked emails you get from IronVest and other disposable email account services.
Many sites equate your email address to your username, but some allow you to choose your own username. Consider using a different username each time – hey, your password manager will remember it! Now, anyone trying to get into your account will have to guess usernames and passwords.
9. Clear cache
Never underestimate how much your browser cache knows about you. Saved cookies, saved searches, and web history may point to home addresses, family information, and other personal data.
To better protect information that may be lurking in your web history, be sure to delete browser cookies and clear your browser history regularly. It’s easy. In Chrome, Edge, Firefox, Internet Explorer, or Opera, simply press Ctrl+Shift+Del to open a dialog that lets you select which browser data elements to clear. If you use another browser, try that key combination anyway; it might work. Otherwise, search the menu.
Deleting cookies may cause problems for some websites and you may lose any personalization settings you may have applied. Most browsers allow you to list favorite websites whose cookies should not be discarded.
10. Turn off the “save password” function in the browser
Speaking of what your browser may know about you, most browsers include built-in password management solutions. However, we at PCMag don’t recommend them . We think it’s best to leave password protection to the experts who make password managers.
think about it. When you install a third-party password manager, it usually offers to import your passwords from your browser’s storage. If a password manager can do this, you can be sure that some malware can too. Plus, save your passwords in a single central password manager so you can use them across all browsers and devices.
11. Don’t fall prey to clickbait or phishing scams
Part of protecting your online life is clicking wisely. Clickbait isn’t just about cat compilation videos and catchy titles. It can also contain links in emails, messaging apps and Facebook. Phishing links masquerade as secure websites, hoping to trick you into providing them with your credentials. Drive-by download pages can cause malware to automatically download and infect your device.
Do not click on links in emails or text messages unless they are from a source you trust. Even so, be cautious; your trusted sources may have been compromised, or the mail may be fake. The same goes for links on social media sites, even posts that appear to come from your friends. If the post doesn’t look like your social media friends’ style, it’s probably a hack.
12. Protect your social media privacy
There’s a saying: If you’re not paying for the service, you’re not the customer; you’re the product. Social media sites make it easy to share your thoughts and pictures with your friends, but it’s easy to share too much.
You can download your Facebook data to see what the social media giant knows about you. This can be eye-opening, especially if you’re the type of person who often clicks on quizzes that require access to your social media accounts. Really, you don’t need to know which Disney princess or dog breed you are.
Also beware of hackers posing as your social media friends. A common scam starts with a private message and ends with the hacker taking over your account and using it to continue the scam . If you receive a strange or unexpected personal message from a friend, ask via email or other type of communication. Your friend may have been scammed.
You can drastically reduce the amount of data going into Facebook by disabling the sharing platform entirely. Once you do this, your friends can no longer divulge your personal data. You can’t lose app’s data because you can’t use app. And you can’t use your Facebook credentials to log into other sites (always a bad idea).
Of course, other social media sites also need attention. Google probably knows you better than Facebook, so take steps to manage your Google privacy, too . Make sure you have configured each social media site so that your posts are not public (well, except for Twitter and other broadcast media services). Think twice before revealing too much in a post , as your friends may share it with others. With care, you can preserve your privacy without losing the entertainment and connections of social media.
