Security fundamentals that actually matter

Security can seem endless, but most real-world attacks succeed for a few boring reasons: reused passwords, missing updates, no backups, and someone getting tricked. Get these five habits right and you’ll be safer than most people, and most small businesses.

1. Use a password manager

The biggest password problem isn’t weak passwords. It’s reusing them. When one website gets breached (and they constantly do), criminals try those same email-and-password pairs everywhere else.

A password manager solves this. It creates a long, random, unique password for every site, remembers them all, and fills them in for you. You only remember one strong master password. Reputable options include Bitwarden, 1Password, and the managers built into Apple devices and Google Chrome.

Make that master password a long phrase you’ve never used anywhere else, and protect the manager with two-step sign-in.

2. Turn on two-step sign-in

Two-step sign-in (also called 2FA or MFA) means a password alone isn’t enough to get in. You also need something you have, like your phone. It stops the large majority of account takeovers, even when a password leaks.

From strongest to weakest:

• Passkeys or security keys: built into modern phones and computers, and resistant to phishing
• An authenticator app, like Microsoft Authenticator, Google Authenticator, or the one in your password manager
• Text-message codes: much better than nothing, but they can be intercepted or stolen through phone-number scams

Start with your email (it can reset everything else), then banking, then social media. There’s a step-by-step guide here.

3. Keep everything updated

Most attacks use security holes that already have a fix, on devices that simply never installed it. Turn on automatic updates for:

• Your operating system (Windows, macOS, iOS, Android)
• Web browsers
• Your router (see step 4)

When a device stops getting updates entirely, like Windows 10 since October 2025, plan to upgrade or replace it.

4. Back up with the 3-2-1 rule

Ransomware, theft, spilled coffee and dead drives all end the same way if you don’t have backups. The classic rule:

• 3 copies of your important data
• on 2 different kinds of storage
• with 1 copy kept somewhere else (off-site, or in the cloud)

One more piece people miss: test restoring a file now and then. A backup you’ve never restored from is a hope, not a backup. More on small-office backups here.

5. Learn to spot scams

Most attacks start with a message, not a hacker typing in a dark room. Watch for:

• Urgency or fear: “your account will be closed,” “unpaid invoice,” “suspicious login”
• Requests for money, gift cards, passwords or codes
• A sender address or link that doesn’t quite match the company it claims to be (hover over links before clicking)
• Requests to change payment details

The fix is simple: verify through a different channel. Call the company or person using a number you already have, not one in the message. More on spotting scam emails here.

If something does go wrong

Don’t panic, and don’t stay quiet about it. Disconnect the device from the network (unplug it or turn off Wi-Fi, but don’t power it off), change passwords from a different, clean device, and get help. There’s a first-hour guide here.

Key takeaways

• A password manager plus two-step sign-in stops most account takeovers.
• Automatic updates close the holes attackers actually use.
• 3-2-1 backups, tested now and then, make ransomware survivable.
• Verify any unusual request through a channel you already trust.