Cybersecurity Basics: What Actually Protects You

Security advice for ordinary people tends to swing between total fatalism and vague reassurance. Both are unhelpful, because attackers do not break encryption — they log in as you. In practice the overwhelming majority of successful attacks against individuals are credential-based, opportunistic, and automated. That is genuinely good news, because the countermeasures are small in number and mostly free.

A realistic threat model

Ignore the idea that someone is targeting you specifically. Automated attacks run against enormous numbers of people and succeed by volume, which means your actual risk is a function of your exposure — how many accounts you have, how much is on them, and how reachable you are — not your notoriety.

The threats worth planning for, roughly in order of likelihood:

Credential stuffing. Reused passwords tried against other sites automatically. The single most common cause of a personal account takeover.
Phishing. A convincing message, often with a real login page on a real domain, or a one-time code relayed to you by a caller.
Malicious downloads. A cracked application, a fake installer, a document that asks you to enable macros, a browser extension you did not need.
Ransomware through a single machine, usually from an attachment or an ad, and increasingly from remote access to an unmaintained device.
Data exposure through a service you used. Not something you can prevent; something you limit by not putting everything in one account.

Nation-state actors, targeted implants and zero-days are real and are not the thing that will happen to you. Understanding this is not complacency — it is what allows you to spend a limited amount of attention on the things that matter.

The four controls that do most of the work

Unique generated passwords, in a manager

Defeats credential stuffing and makes every other breach harmless to you. Covered in detail in the password and second-factor guide.
A second factor on everything that matters

Defeats password reuse even where a password has leaked, and defeats most phishing entirely.
Automatic updates, everywhere

The majority of successful intrusions exploit a vulnerability that already had a patch available. Updates are the highest return per minute of attention of anything on this list.
A working backup that is not on the same device

Ransomware that reaches your computer cannot encrypt a backup it cannot reach. This is what turns a bad day into an inconvenience.

Four controls. Everything else on the internet is refinement. The genuinely difficult part is not knowing what to do — it is that these are all ongoing, and anything requiring ongoing effort tends not to survive a busy month. So set them up once, automate what can be automated, and check twice a year.

Phishing: the specifics

Modern phishing is not broken English and an odd domain. It is a message about an invoice, a failed delivery, a shared document or a password reset, sent to the address a company would really use, leading to a login page that is genuinely on the company's real domain because the attacker registered a lookalike or used a compromised account.

Three habits handle almost all of it:

Never act on a link in an unexpected message

Open the service yourself, by typing the address or using a bookmark. This one habit defeats most phishing, because the fraudulent page is usually only reachable through the link.
Treat any unexpected code as a compromise, not a confirmation

An unsolicited one-time code means somebody has your password. Do not enter it anywhere, and change that password immediately.
Be more suspicious on the phone than at the desk

Voice phishing works because you cannot see a suspicious address bar. If somebody calls claiming to be your bank, hang up and call the number on your card.

Device hygiene

Let the operating system and the browser update themselves, including the mobile ones, which is where automatic updates most often get disabled.
Keep the platform's built-in protection on. On a modern phone or laptop the default configuration is genuinely good, and antivirus suites installed on top frequently make things worse by adding a privileged background process.
Install from official sources only. A cracked application is the most reliable malware delivery mechanism still in use.
Be suspicious of browser extensions. They have full access to every page you visit, and permission prompts are routinely clicked through.
Lock the screen, and on a shared or portable device use full-disk encryption so a lost machine is an inconvenience rather than a disclosure.

When something has already gone wrong

Work through these in order, and do not panic-search for advice first, because search results advertising fake recovery services are one of the more reliable follow-on attacks. Go directly to the service's own site from a device you trust.

If it is financial, contact your bank's fraud line immediately

Speed genuinely matters. Most banks can freeze a transaction or recall a transfer, and the window is short. There is no downside to calling early.
If an account is compromised, change the password from a trusted device

Not from a link in the notification. Then sign out of all sessions, remove unknown app passwords and connected applications, and add a second factor.
If a device is infected, disconnect it from the network

Do not power it off if you may need it for evidence, and do not keep using it to change passwords. Use a different, clean device.
If you clicked and entered credentials on a fake page

Change the password immediately and check for a second factor you did not enable yourself, which is how a session cookie is stolen. Then change it anywhere else you reused it.
If you think identity details were taken

Record a fraud marker with your national identity fraud service. This is separate from changing passwords and it stops new accounts being opened in your name. See how your credit file works.
Then write down what happened

How it reached you, what you clicked, what you entered. It is the shortest route to not repeating it, and it genuinely helps if you need to report it.

Common questions

Frequently asked questions

Do I still need antivirus software?

On a current operating system with updates on, the built-in protection is good and dedicated third-party suites tend to add background process privilege without adding much detection. The exception is an old machine you cannot update, where the risk profile genuinely is different. Phishing resistance and updates matter far more than the choice of scanner.

How do I know whether my details have been exposed?

Services that check your email address or phone number against known breaches exist, and a notification from a service you already use about a breach involving it is the most reliable signal. Treat both as a prompt to check the account directly rather than as a reason to panic, and never act on a breach notification link.

Is public Wi-Fi dangerous?

Much less than it was, because HTTPS is nearly universal, so your traffic to a normal site is encrypted regardless of the network. The real exposure on shared networks is fake captive portals and DNS manipulation, both of which look like a login page. The practical rule is to avoid entering anything important, and use your phone's own connection for anything sensitive.

Should I worry about my smart devices?

Yes, within reason. Many consumer devices ship with default credentials, no update path and an open management interface, and once one is on your network it can be a route to the rest. Practical steps: change default passwords, keep the firmware updated, and put untrusted devices such as a smart television or a games console on a separate guest network if your router supports it.

Where to go next

These are the services referenced above. Compare them on your own terms before you sign up for anything.