Cybersecurity advice for everyone

Introduction

Whilst we mostly work with companies, we often get asked about personal cybersecurity. In fact, I had the question last week from a plumber who asked what I do, and when I told him, he asked what he should be doing to be secure. So we thought it would be a good idea to write a quick guide to the cybersecurity essentials for everyone.

The guidance below is organised around five key areas:

Accounts — your online accounts are the most important part of your online life. Even a basic email account can be key if it is then used to log in to lots of other services. For most people it is even more than that: a typical Google or Apple account can be central to device control, data syncing and app logins. As well as being central to everything else online, your accounts — whether for email, shopping, banking or anything else — are also the most commonly attacked digital assets you own.
Devices — alongside accounts, I could also argue that your devices are central to most of what you do online. From people who do everything on their phones to those with five computers on the go, there is a wide variety of approaches to device use. But regardless, all devices you use must be sensibly managed and maintained.
Apps — our devices are not much use without the apps we use on them. Whether they are in the web browser or installed on a device, key applications are therefore crucial to much of what we do online. They are the principal way in which we interact with data.
Data — whether it’s a meticulous photo collection, that 80% finished manuscript or your favourite videos, everyone has data they do not want to lose. And whilst everyone has access to cloud sync or backup functionality, we do not always use it, and it can be hard to keep track of where your data actually is.
Local network — finally, while it sits a little apart from the other categories, your local network is only as secure as the router that runs it all and how it interacts with the wider internet. Finally, many of us have lots of connected home devices, from televisions to toasters, that also need configuration and maintenance.

Hopefully you can see from this list that it’s all interconnected: devices are managed by key accounts, which are also used to back up data and log in to key applications, which create more data in those accounts and on those devices. And so on.

Our Advice

We’ve tried to keep the advice to simple, ordered bullet points.

But this is a complicated topic, so there are, of course, caveats and complications to much of the advice. Regardless, we’ve tried to stick to the broadest applicable advice.

Accounts

Enable multi-factor authentication (MFA, or 2-Step Verification, aka 2SV on Google) on any account that matters to you.
1. Any MFA is better than none. But some methods are more secure:
  1. Ideally, avoid SMS or calls, as they are only as secure as your SIM and phone network (i.e. not very),
  2. MFA apps are better (Google Authenticator or Authy are good options, as they support backup),
  3. Passkeys or security tokens (e.g. YubiKeys) are best.
2. It’s worth having a backup MFA method, especially when using a passkey or security key, as these are linked to a specific device.
Password management is still important:
1. Overall, passwords are less important than MFA, especially as passkeys gain adoption and we move to passwordless authentication.
2. They should be unique to each service and generated securely,
3. and stored in a password manager.
  1. The Apple or Google password manager is fine, but that email account is then key to accessing all your passwords.
4. Use easily typed and memorable passphrases for device accounts and your password manager password. Writing them down and storing them at home is not a terrible idea if you struggle with memory.
Recovery codes can be downloaded and stored securely for many services.

Devices

Operating system updates (Windows, macOS, Android, iOS/iPadOS) should be installed as soon as possible.
1. Especially security and other critical updates.
2. Check how long a device will receive updates and support before buying a new phone; don’t buy devices that no longer receive updates.
Encryption is needed on all devices.
1. It’s on by default for Windows, macOS, iOS and Android. Apple and Microsoft accounts can be helpful for backing up device recovery keys if the device is registered to the account.
All devices need a decent PIN or password, and biometrics are fine for convenience on most modern devices (and are typically backed up by a password).
A reputable antivirus (AV) product is important on all computers.
1. It must be kept up to date to be effective.
2. AV is worthwhile on Mac.
3. Windows Defender is perfectly good.
4. But AV is mostly ineffective on mobile devices.
Don’t use shared user accounts on devices.
Avoid administrator accounts for children, and make use of parental controls.
VPNs are useful for privacy.

Apps

Keep key apps up to date, especially your web browser and office apps.
Use browser profiles to separate work and personal browsing, or multiple accounts of the same type.
Be cautious about installing any extensions, add-ons or plugins in your browser, especially, but also in other apps.
Ideally, only install software from the main app stores: there is a much greater risk away from other stores and from pirated software.
Within every key app, make sure to carefully go through the security, authentication, recovery and backup settings. This is especially important for email and chat applications.

Data

Don’t ever have a single copy of key data — use a cloud sync app such as OneDrive, iCloud, Google Drive or Proton Drive. But make sure the account behind that software is secure.
For the most important files, keep a second offline backup, for example on a hard drive or USB stick. Make sure it is encrypted.
Do reasonable research before you start to use a new and important app: what data do you need to give it, what control do you have over that data, and how can you cancel or delete it.
You can password-protect any sensitive PDFs or documents.
Be careful how you share anything important — email is not a secure file transfer mechanism.

Home Network

Make sure your internet/Wi‑Fi router is receiving updates — this is not always the case for routers from smaller ISPs.
Change the admin and Wi‑Fi passwords for your router if they are easily guessable.
Don’t forget to look after any smart devices on your home network — smart TVs, doorbells, Bluetooth toothbrushes and anything else with a Wi‑Fi connection needs keeping up to date and at least an initial look over its settings.

Again, this is a complicated topic with many overlapping priorities, concerns and consequences. So please do not read this blog as all you need to do about cyber security. For example, we’ve not really covered any aspects of online privacy. But hopefully the above advice serves as at least a starting point.

There are great resources on the NCSC website, including advice for high-risk individuals. There’s also the relatively new Stop Hacklore! project, which aims to dispel common cybersecurity myths and misconceptions.

Finally, feel free to get in touch if you’d find a shareable or customisable document version useful.