Simple Cybersecurity Habits That Can Save You From a World of Hurt

Your computer’s security is strongest when you first start using Windows. Over time, however, that initial protection can degrade due to user errors and evolving threats. Cybersecurity experts witness firsthand how people inadvertently compromise their own security, gaining valuable insights into common pitfalls. At this year’s RSAC Conference, Microsoft experts, including David Weston, CVP of Enterprise and OS Security, highlighted three particularly damaging habits and offered simple solutions to avoid them.

1. Exposing Your Devices to the Open Internet

Making your tech gear freely accessible from the internet opens the door to attackers. These malicious actors can exploit vulnerabilities in your devices to spread malware, spy on your activities, or steal your sensitive data.

How This Happens:

• Remote Desktop Exposure: Accidentally or intentionally enabling remote desktop on your PC without proper security measures.
• Unpatched Routers: Failing to keep your router’s firmware updated with the latest security patches, leaving known vulnerabilities unaddressed.
• Insecure IoT Devices: Connecting poorly secured internet-enabled devices (like baby monitors, smart home appliances, or IP cameras) to your home network, creating entry points for attackers.

The Solution:

The core principle is to limit unsolicited access to your devices from the internet. Here’s how:

• Block Incoming Internet Access: By default, block all incoming connections to your devices. Only enable access when actively needed and disable it immediately afterward. Think of it like only opening a door when you know who’s knocking.
• Keep Everything Updated: Regularly update the software and firmware on your PC, router, and all other internet-enabled devices. Updates often include critical security patches that address newly discovered vulnerabilities. Automate updates whenever possible.
• Be Smart About IoT Devices: Exercise caution when adding internet-enabled devices to your network. Research the security reputation of the device and manufacturer before purchasing. Change default passwords immediately and keep the devices’ firmware up to date. Consider isolating less secure devices on a separate network segment. If you do not need them, keep them offline.
• Router Security Best Practices: Change the default administrator password on your router to a strong, unique password. Enable the router’s firewall and keep it active. Consider disabling Universal Plug and Play (UPnP) if you don’t need it.

2. Downloading Software From Untrusted Sources

Malware is spread through many channels and is not just limited to obviously suspicious downloads. Attackers use increasingly sophisticated methods to deliver ransomware, spyware, information stealers, remote access trojans, and other malicious software. The primary goal is often financial gain, whether through stealing login credentials, extorting victims, or directly accessing financial accounts.

The Solution:

Cultivate a cautious approach to software installation.

• Stick to Reputable Sources: Only download and install software from trusted websites and recognized developers. Prioritize official sources like the developer’s website or well-established app stores.
• Seek Out Neutral Reviews: Before installing any software, search for unbiased reviews and feedback on forums, Reddit, or other reputable tech websites. Look for detailed, critical analyses that discuss both the pros and cons of the software.
• Beware of Generic Praise: Be wary of software that only receives generic, overly positive reviews (e.g., "This app is amazing!"). These could be fake or biased.
• Leverage Antivirus Software: Ensure that your antivirus software is active and up to date. While not foolproof, it provides an extra layer of protection against malware. Enable real-time scanning and automatic updates. Consider using a reputable anti-malware program in addition to your antivirus software.
• Sandbox Untrusted Software: When testing potentially risky software, consider using a virtual machine or sandbox environment. This isolates the software from your main system, preventing it from causing damage if it turns out to be malicious.

3. Clicking on Links in Emails and Text Messages

Clicking on malicious links in emails and text messages (phishing) can lead to a variety of problems, including revealing your login credentials to attackers or downloading malware onto your device. While some phishing attempts are easy to spot, others are incredibly convincing. Even security-conscious individuals can fall victim to sophisticated phishing scams.

The Solution:

Embrace a zero-trust approach to links in emails and text messages.

• Don’t Click on Links: As a general rule, avoid clicking on links in emails and text messages, especially if you weren’t expecting them or if they seem suspicious. This is the most effective way to protect yourself from phishing attacks.
• Verify Independently: Instead of clicking on a link, manually type the website address into your browser or use a search engine to find the site.
• Contact Customer Service Directly: If you receive a message asking you to download an app or extension, contact the company’s customer service department directly to verify the request before taking any action. Use a phone number or email address from the company’s official website, not the contact information provided in the suspicious message.
• Enable Multi-Factor Authentication: Enable multi-factor authentication (MFA) on all your important accounts (e.g., email, banking, social media). MFA adds an extra layer of security by requiring you to provide a second verification factor (e.g., a code from your phone) in addition to your password.
• Hover Before Clicking: If you must click a link, hover your mouse cursor over it (without clicking) to see the actual URL. Check if the URL matches the claimed destination and if it looks suspicious (e.g., misspelled domain names, unusual characters).
• Report Phishing Attempts: If you receive a phishing email or text message, report it to the relevant authorities, such as the Anti-Phishing Working Group (APWG) or your email provider.

By consistently practicing these habits, you can significantly improve your online security and protect yourself from a wide range of cyber threats. Remember that security is an ongoing process, not a one-time fix. Stay informed about the latest threats and best practices, and adjust your security measures accordingly.