Security Guides for Beginners

1. Keep Your System Up to Date

Updates, updates and more updates

Always keep your system up to date. This makes it more difficult for unauthorized third parties to exploit the software you use as an entry point. Operating systems and server applications should, of course, receive the highest update priority. Thanks to Windows Update and automatic update mechanisms, which are now included even in smaller software products, this is easier than ever before.

2. Use Unique Passwords

Always use a different password for every service and every account.

Almost every week, databases belonging to major providers are stolen, along with the customer and user passwords stored in them. Suppose you use the same password for common services such as Gmail, Hotmail, eBay and Amazon, and also use it for a fictional provider called “MyNewEmailProvider.com”. If this fictional provider’s database is stolen because of inadequate security measures or a disgruntled employee, the potential attacker may now possess a master key to all your other accounts.

Unfortunately, providers still store passwords far too often using inadequate hashing algorithms—or none at all—which means they are potentially always at risk. As a user, the best way to mitigate this risk is to use a unique password for every service.

Of course, this significantly reduces convenience, but this is precisely why password managers such as 1Password, which is a paid service, or KeePass, which is free, exist. These programs allow you to manage your passwords conveniently and relatively securely.

3. Use MFA

Multi-factor authentication, often available through an authenticator app.

Major providers such as Google and Microsoft offer their users authenticator apps. These add another authentication factor that users must provide in addition to their username and password when signing in to a service. This is usually implemented through a separate app on the user’s smartphone.

This offers the major advantage that, even if your username and password are stolen—for example, from another platform, by a Trojan or through a similar method—an attacker will still be unable to sign in to a service that supports this authentication method.

A brief explanation of how it works: When you sign in using your credentials, the service requests confirmation through a separate channel to determine whether the sign-in attempt is authorized. Since an attacker will rarely also be able to intercept the communication between your smartphone and the service provider, this is a relatively secure method of preventing unauthorized access even after your login credentials have been stolen.

4. Trust Nothing—Especially Emails

First of all: Nobody on the internet is going to give you money or power, and nothing on the internet is completely impossible to forge. You should therefore be particularly careful when dealing with financial matters. This does not apply only to online banking, but also to services such as Amazon and eBay.

You should therefore always keep the following points in mind:

1. Never respond to emails in which a service asks you to correct or confirm your information. Legitimate services would not normally ask you to do this in such a way. This is known as phishing and is intended to persuade you to enter your login credentials or payment information on a fraudulent website. The destination website usually does not belong to the actual provider, but to someone who intends to use the information you enter to make purchases at your expense.

2. Do not open attachments in Microsoft Office formats. No reputable provider should send Word or Excel attachments to its customers without a clear reason. No matter how authentic the sender appears—anything can be forged—do not open attachments in these formats. However, if your curiosity is too strong, contact the provider by telephone or through a known email address and inform them about the message. This allows the provider to take appropriate measures to prevent further harm to other customers and to its own organization.

5. Firewall

Always useful

Modern Windows operating systems include a preconfigured firewall that already provides an extremely good level of protection for end users. At home, users are usually also located behind a router and are therefore not directly accessible from the internet. This means that there are often already two significant barriers protecting against unwanted external visitors. However, the situation is different when a computer is regularly used on unfamiliar networks, such as public Wi-Fi networks, or when unauthorized devices or users are already present within the local network.

As a general rule, it is always a very good idea to place as many barriers as possible between your system and the internet. A properly configured software firewall, such as Windows Firewall, is an excellent starting point because it provides ordinary users with solid basic protection without requiring them to understand the technical details.

However, a firewall primarily protects against attacks originating from outside. If you ignore some of the other points in this guide, an attacker may bypass this protection. At that point, the attack is no longer coming from outside—the attacker is already inside the system, and even the best firewall can provide only limited assistance. It may still help by making it more difficult for the attacker to transmit stolen data back to their own systems.

6. Less Is More

Reducing the attack surface

Unfortunately, we live in a society of excess, and just as in real life, this is not always healthy on the internet either. Install and use only the software you genuinely need.

Software that is no longer required should be removed immediately. Simply because the software is no longer needed, it is also less likely to receive the user’s attention and may no longer be properly maintained—for example, through regular software updates. As a result, it naturally presents an even greater potential security risk.

This is in addition to the unnecessary consumption of system resources.

7. Encryption in Transit

Useful even when you have nothing to hide

Encryption for ordinary web content is finally available almost everywhere in the form of SSL, often indicated next to the website address in your browser. This allows content to be transmitted more securely between you and the web server. The certificate also helps confirm that the web server is the server it claims to be.

Unfortunately, the situation is still somewhat different when it comes to email encryption and digital signatures because of their complicated handling and limited adoption. However, increasing efforts are being made to make these technologies practical for ordinary users without requiring a degree in information technology. Many email applications, such as Outlook, support standards including PGP and S/MIME, but support in the mobile sector is still less mature—particularly within the Apple ecosystem.

8. Storage Encryption

This can make theft “almost” irrelevant

Who has not lost a smartphone or similar device, or had one stolen? We certainly have not! In most cases, the most painful part is not the loss of the device itself, but the fact that someone else may now possess the data stored on it. This is in addition to the fact that the data is also lost to the owner when regular backups have not been created.

Returning to the main topic: Storage encryption can help minimize the impact of losing any device. This includes encrypting the internal storage of a smartphone, the hard drive or SSD inside a computer, and similar storage media. Many smartphone manufacturers provide this functionality as a preinstalled feature. Windows offers BitLocker. All these solutions ensure that the contents of an encrypted storage device can subsequently be read only by a user who possesses the appropriate key. Nowadays, encryption also has no significant impact on performance, as almost all modern devices have sufficient processing power to handle the additional workload.

If a device is stolen, the thief can do very little with the encrypted data.

Particularly in business environments, the loss of a storage device can also be financially painful. Sensitive trade secrets may have been lost, but the loss of personal customer data may also result in substantial fines.

Of course, the best approach is not to lose the data in the first place, even when encryption is enabled. Encryption is only secure according to current standards. The situation may look very different in five or ten years. Unlike stolen credit card details, personal data may still be valid and valuable many years later.

9. Antivirus Software

Better than nothing

Antivirus software is useful, but it is often ineffective when the previous points are ignored. However, users who follow the rules described above can generally rely on the basic protection provided by Microsoft. Because of its close integration with the operating system, it is often more suitable in many areas than third-party security products.