15. Use DNS-level filtering. Quad9 (9.9.9.9) or Cloudflare Family (1.1.1.3) automatically blocks known-malicious domains for every device on your network.
16. Use a VPN on public Wi-Fi. Reputable paid options: Mullvad, ProtonVPN, ExpressVPN. Avoid free VPNs.
17. Isolate IoT devices. Put smart speakers, cameras, and connected appliances on a guest network.
Data and Backups (Tips 18–21)
18. Follow the 3-2-1 backup rule. Three copies of your data, on two different media types, with one stored offsite (cloud or external drive kept disconnected).
19. Encrypt your backups. Backups without encryption are a high-value target if stolen.
20. Test backups quarterly. A backup you have never restored from is not a backup. Verify yours.
21. Use cloud services with strong security defaults. For business data, prefer services that offer SAML SSO, audit logs, and customer-managed encryption keys.
Behavior and Awareness (Tips 22–25)
22. Hover before you click. On desktop, hover over links to see the actual URL. On mobile, long-press. The visible text and the actual destination should match.
23. Verify unusual requests out-of-band. If your "CEO" emails from a personal address asking for gift cards, call them at a number you already trust before acting.
24. Limit what you share publicly. Oversharing on social media gives attackers the ammunition for targeted phishing and credential guessing. Birthdays, pet names, school names, and employer details all show up in security questions.
25. Trust your instincts. If an email creates urgency, asks for credentials, or feels off — pause. Most phishing is identifiable when you give yourself five seconds to think.
Summary: Habits That Prevent 90% of Incidents
- Passwords: unique long passphrases via a manager.
- 2FA: authenticator app or hardware key on every important account.
- Updates: automatic and timely on every device and app.
- Phishing: hover before clicking; verify unusual requests out-of-band.
- Backups: 3-2-1 with quarterly restore tests.
Common Mistakes That Defeat Good Habits
Even careful users undo their own defenses with a few recurring mistakes. Watch for these:
- Trusting saved passwords in browsers. Browser-stored passwords lack the encrypted vault and cross-device sync of a real password manager. Use a dedicated manager instead.
- Saving backup codes in a phone notes app. If your phone backs up to cloud accounts that are not separately secured, your 2FA backup codes may be reachable to anyone who breaches that cloud account.
- Posting security-question answers publicly. Photos that show your first car, the street you grew up on, your first pet, or your favorite teacher reveal the answers to common security questions.
- Ignoring small bank-account charges. Fraudsters test stolen cards with tiny charges first; missing these lets larger fraud follow.
- Assuming physical access is safe. USB drives found in parking lots are a classic social-engineering tactic. Plugging one in can deploy malware within seconds.
Avoiding these five mistakes plus adopting the 25 tips above puts you in the top 10% of personal cybersecurity hygiene across most surveys. The returns compound year over year.
For depth on the most targeted threat — phishing — see our guide to spotting phishing emails. For depth on your home perimeter, see our home network security guide. For hands-on training that builds defensive skills into a career, the TutorsBot Cyber Security Analyst Foundation course covers threat detection, incident response, and SOC operations.
Fazlur Rahman
