Stop Hackers and Protect Your Home Network and Data

The U.S. experienced over 3,000 data breaches in 2023, the largest of which affected over 30 million individuals. Cybercriminals found their way into some of the most secure institutions in the country, including banks and the nation’s largest internet service providers (ISPs). With our most sensitive information now living on the web, it’s on you to secure your personal data and devices. And this is no longer as simple as installing an antivirus and calling it a day. That doesn’t mean keeping your online activity secure needs to be expensive or time consuming, but you do need to cover all your bases.

There are three main areas to focus on when evaluating your internet security:

• Online accounts
• Devices and home network
• Online activity

Securing your accounts and hardware is fairly straightforward. Once you set up a decent defense, it runs itself with little maintenance—we’ll show you how to do this. But your online activity is a different story. It’s the only part of your online security you can’t automate and it’s the area most commonly exploited by cyber criminals. We’ll show how to develop good online practices to keep your data safe from bad actors.

Top 5 ways to improve your internet security

We go over, in detail, how to set up a robust defense against cyber criminals for all your online accounts, your devices, and your home network. But here’s a quick breakdown of the most crucial elements for your online security:

1. Use strong passwords

Your passwords are literally the key to your most sensitive data, and poor security practices like using personal details in your passwords and using the same password for multiple accounts introduce unnecessary risk. The fastest, easiest, and most effective way to secure your online accounts is by using a password management tool.

2. Use multi-factored authentication (two-step verification)

Multi-factored authentication requires an additional login credential before providing access to your account, usually in the form of a code sent to your phone or email. With two-step verification, cybercriminals can’t access your accounts even if they get your passwords, unless they also get access to your second verification method. Multi-factored authentication isn’t available for every account, but you should enable it for every account that offers it.

3. Enable automatic updates for all your devices and internet equipment

Automatic updates allow you to keep up with the nearly constant stream of security updates that keep your devices secure. Updates patch up new security threats as they are found, so it’s crucial to take advantage of these new securities as soon as possible, without any extra effort on your part.

4. Don’t allow downloads from untrusted sources

Initiating a download is as simple as clicking on a link on a website or in an email. When you download anything from the internet you’re letting code through your security firewall. Make sure you only download from reputable sites.

5. Be on the lookout for phishing emails, texts, and phone calls

Phishing scams pretend to be reputable or familiar contacts to get you to let your guard down. On the surface, these communications can look very legitimate, so avoiding them takes more than going with your gut. A few solid security practices, such as checking the sender’s actual email address, go a long way in keeping your network and data secure.

A little loose data can cause a lot of damage

Before we get into the nitty-gritty of setting up your cyber defenses, it’s important to acknowledge that all of your data and devices are worth protecting. Cybercriminals don’t need something really juicy, like your banking password or social security number to exploit you; you might be surprised at just how far someone can get with seemingly insignificant data.

As an experiment, I took a quick look at the account page of one of my video streaming accounts, just to see what someone could access if they obtained my login credentials for this account.

Right off the bat, the streaming profiles identify every member of my household, so they can see the names or nicknames of everyone I live with. Do you use any of those nicknames in your passwords?

One click away, the account page gives up a wealth of very scammable data: my subscription details, email, gender, birth date, payment history, and even my payment method. They wouldn’t have the payment account number, but they’d have the email attached to it. While this isn’t enough data to directly access anything else, it’s more than enough for a pro to work with. Not convinced? Let’s walk through how vulnerable each one of these mundane data points makes you.

Your name: Knowing your name gives scammer communications another level of authenticity which helps convince you a phony email, phone call, or text message is coming from a legitimate source.

Your family member’s names: A lot of scammers and cyber criminals impersonate family members to get you to act quickly before you have a chance to realize you’re being scammed. It might be something dramatic, such as a family member in trouble who needs quick cash, or something mundane, like a message from a family member saying they forgot a password.

Birthdays: This is perfect password-cracking fuel. With details like names and birthdays, a password-cracking program can make quick work of your security measures if you use any of these details in your passwords.

Subscription details and payment history: Knowing what subscriptions, plans, or products you have and how much you pay for them helps scammers make more convincing phishing emails. These emails might say your payment failed, or offer a free upgrade, among countless other scammer tricks.  A savvy scammer might even add that you’ll lose your lower rate or get a late fee if you don’t act quickly. Clicking a link in one of these phony emails could be all it takes to infect your device and subsequently your entire network.

Payment account method and email: Any details attached to a financial account are like hacker gold. Even if they don’t have the password to your payment account, many accounts use the email as the username—so the criminal already has half the keys to your finances. Pair this with the password-cracking tool and the info above, and it’s a homerun for the thief. A hacker could also just sell this information to the highest bidder on the dark web.

Bad actors will take any advantage they can get in their efforts to exploit you. This is why it’s important secure everyone of your online accounts, and not just the obviously sensitive ones like your online banking and email.

Luckily, most devices and online accounts come with security tools you can use to protect yourself. We’ll show you how to set those up. But first, let’s go over how most cybercrimes happen.

The most vulnerable part of your network

When you think of cyber criminals, you might imagine a hooded assailant fervently tapping away at lines of computer code, but most cyber crimes take a simpler approach. According to the FBI’s latest Internet Crime Report, social engineering attacks are, by far, the most common, accounting for three of the FBI’s top-five cybercrime complaints. Social engineering hacks you, not your computer, conning you into giving up your sensitive info, providing access to your network, or even directly sending money.

FBI’s top 5 cybercrimes of 2023

One social engineering hack in particular, phishing, accounted for more reported cybercrime complaints than any other. Phishing is when a cybercriminal tricks you into providing sensitive information (like login credentials) with a phony email, text, or phone call. These fraudulent communications insist on urgent action with severe consequences if you don’t act immediately. The goal here is to get you to click and type faster than you think because, if you study these cyber traps for just a minute or two, you usually can tell something’s up.

Learn how to protect yourself against phishing.

Types of hacks

While phishing attacks are the most common, here are some other ways hackers exploit weaknesses in your cybersecurity.

Viruses

Viruses are self-executing programs that infect your devices and spread to other devices. Once a virus gets access, it may steal or destroy data, impair crucial systems, or even render your device inoperable.

Tojans

Trojans are disguised malware that sneaks through your security by appearing to be legitimate programs or data.

Adware

Adware is covert marketing software that burrows into your system and bombards you with ads. Some adware even tracks your online activity to display personalized ads.

Bots and botnets

Bot viruses steal and redirect your computer’s processing power and networking capabilities toward a hacker’s agenda. Hackers use botnets to assemble entire armies of user’s computers without their knowledge to carry out cyber attacks.

Spyware

Spyware accesses your device’s activity and reports data back to the hacker. One of the most common instances of spyware is keyloggers, which capture user input and relay everything you type and click to bad actors. Spyware may also capture your communications or view your computer screen.

Password cracking

Hackers use password-cracking programs to essentially guess millions of passwords in seconds. If your passwords use common word and number combinations, password crackers can be an effective way for hackers to access your online accounts.

Malware

Malware is a catch-all term used to describe any malicious software. Every hack in this list is a form of malware.

Zero-day attacks

Cybercriminals are constantly discovering and exploiting new vulnerabilities; these discoveries are called zero-day attacks, and despite the rigorous efforts of cybersecurity professionals, it’s always a threat. Like a brand new biological virus to which there’s no existing immunity, zero-day attacks have a field day with our security measures. Cybersecurity experts then patch up these vulnerabilities, and all is well, until the next hits.

Protecting your online accounts and data

Usually, cybercriminals are after your accounts and data. A hacker may want to access your financial accounts to steal money or your shopping accounts to make fraudulent purchases. Sometimes the data itself is the prize, as the hacker sells your critical info to the highest bidder.

Your data doesn’t live in your home or on your devices; it’s in the cloud. This means that security measures on the home network level, like anti-virus software and high-tech routers, won’t necessarily help protect your data. Your best defense here is a robust set of login security measures and a watchful eye for social engineering attacks. Let’s go over how to protect your accounts and data in more detail.

Use strong passwords

Tough passwords are your main defense against unauthorized access to your accounts. While it’s easier to remember passwords with familiar terms and numbers, such as a pet name and birthday, these are the easiest passwords for hackers to crack. The tools used by hackers can guess millions of passwords in seconds, but that’s usually not good enough to crack even slightly complicated passwords.

The real danger comes when a hacker combines these tools with your personal information, like the password-crippling personal details we’ve mentioned above. Once the password-cracking program has some terms to latch onto, it’s much more effective at guessing the right password.

How to create strong passwords

The short answer here is that you should create and manage your passwords with a password manager app, as this single step provides you with an endless supply of highly secure passwords for all your online accounts with effortless recall. With that said, let’s get into what makes up a really tough password.

The strongest passwords are long, randomly generated, and complex containing letters (upper and lower case), numbers, and symbols. For length, a 2010 cyber security study by the Georgia Technical Research Institute found that 12 characters is the magic number to obtain a reasonable level of security.

The use of numbers, lower case, and upper case letters, as well as symbols in your passwords increases complexity, driving up the number of possible combinations to such a high number that it makes it very unlikely that a password-cracking program would land on the right guess.  And be sure to leave out personal details, such as birthdays, address details, area codes, and zip codes.

See the table below to learn how skimping out on any of these requirements dramatically reduces the security of your passwords.

Why you should use a password manager

Creating and remembering a 12-character-long password with a completely random assortment of numbers, letters, and symbols is a tall order, especially when you factor in a different password for each of your online accounts. This is where password manager apps come in. These programs automatically generate a unique and extremely robust password for each account—this is one of the single most powerful tools at your disposal for securing your data. Let’s review the benefits in greater detail.

Randomly generated passwords vs user-created passwords

A password you create using familiar terms or anything easy to remember will never be as secure as one created by a password manager. By throwing out grammatical rules, and recognizable words, and introducing long lengths, randomly generated passwords establish a level of complexity making it next to impossible for a hacker to come up with the right guess. These passwords aren’t vulnerable to common dictionary attacks because they don’t contain any words, and they’re too long for brute-force hacking attacks to have any reasonable odds of success.

Use a different password for every account

Using the same password for every account places only one point of failure between you and complete data intrusion. Even an extremely complex password is a potential security risk if reused for multiple accounts. With a password manager, you can generate a unique hyper-secure password for every account with little effort.

Effortless recall

The reason people use weak passwords is because they are easy to remember. Password managers remove this risky motivation entirely by storing and recalling your passwords whenever you need them.

Password manager apps compared

Enable multi-factor authentication (a.k.a. two-step verification)

Multi-factor authentication takes your security to the next level by requiring both your password and an additional credential, often a temporary code sent via text or email. This extra step goes a long way to increasing your security, as a cybercriminal won’t be able to log in to your accounts without access to your second verification method, even if they have your password.

You should enable multi-factor authentication on every account that offers it. This may be an extra step when accessing your accounts, but you get a lot of added protection in return.

Don’t fall for phishing emails, texts, or phone calls

As we explored earlier, phishing attacks are by far the most common method used by cybercriminals to access your data. Be very skeptical of urgent emails asking you to do anything out of the ordinary. Big services like Amazon or Walmart will never outright ask you for your login credentials or sensitive information. They have more secure ways of confirming your identity.

You can often detect a phishing email by looking at the sender’s email address. Make sure to view the actual email address and not the contact name which can be very easily spoofed. Look for numbers, misspelled words, and odd phrasings, like Amazonsupport2334@[public domain].com.

Securing your home network and devices

Protecting your accounts and data is paramount to your online security, but home Wi-Fi hacking does happen. Luckily, securing your home network is much easier. After initial setup, most of the following security measures manage themselves.

Use WPA3 or WPA2/WPA3 Wi-Fi security settings in your router

Wi-Fi Protected Access (WPA) are the security standards that protect access to your router and Wi-Fi traffic. WPA-3 is the newest and most secure version of WPA, with several substantial improvements over WPA-2. But to use WPA-3, you need both a WPA-3 capable router and devices that support WPA-3. So, if you’re running older devices, it’s possible they aren’t compatible with WPA-3. After July 2020, all Wi-Fi-certified devices are required to have WPA-3 compatibility, but Wi-Fi certification is an optional standard, so there’s a chance even a brand-new device doesn’t support WPA-3.

To get around WPA-3 incompatibilities, many routers use a WPA-2/WPA-3 split mode that will default to WPA-3 for compatible devices but still use WPA-2 on devices without WPA-3 support. You should enable the WPA2/WPA3 mode on your router if possible. If your router only has WPA-2, this setting is still far superior to WEP. See our router login guide to learn how to log into your router and access its settings.

Disable WPS in your router settings

WPS allows devices to connect to your Wi-Fi network without using a password. Instead, WPS uses either a PIN or a touch button. Pin WPS is far less secure as it’s susceptible to brute force hacking attacks that can guess every possible pin combination to gain access. WPS that uses a button on the router is more secure as it can only be initiated with physical access to the router, but hackers can find ways around this. At the minimum, a WPS-enabled router means you need to trust everyone with potential access to your router.

While WPS isn’t necessary for connecting devices with screens and keyboards, like phones and laptops, it’s very handy for connecting smart devices without displays or cumbersome data entry methods. One workaround is to enable WPS to connect smart devices and disable it once you’ve connected the device to your network.

Use a guest Wi-Fi network

Guest Wi-Fi networks provide a separate network you can share with visitors. This keeps all your devices protected on your main network. It’s a good practice, even if you trust your guest. It’s also a no-brainer if you ever need to share Wi-Fi with people you don’t know well. You can’t predict everything, but with a guest Wi-Fi network, you don’t have to.

Put IoT devices on a separate network

Internet of Things (IoT) devices are notoriously insecure, so it’s a good idea to keep these devices on a network separate from your computers, phones, and other main devices with access to your sensitive data. Some routers allow you to create separate virtual networks (VLANs) specifically for this purpose. By setting up a separate Wi-Fi network for your IoT devices, your computers, tablets, and phones will still be protected even if someone is able to break through the weaker security of an IoT device.

Keep all your devices updated

Cybersecurity is a constant battle between security experts and hackers. Hackers find vulnerabilities to exploit and security experts quickly move in to close the gaps with software and firmware updates. This makes it extremely important to install the newest security updates onto your devices. This is usually as simple as enabling automatic updates on every one of your devices. We know the constant updates and restarts get tedious, but it’s one of your best defenses against the latest cybersecurity threats.

How to enable automatic updates on all your devices

Access Windows update settings:

Automatic security updates are not an option on Windows 10 and Windows 11, so your Windows PC should be set. You can pause updates for seven days and configure when your computer restarts to finish an update. You may also check that you have the latest updates.

Step 1: Click the Start button and select Settings.

Step 2: Select Windows Update.

From here, you can view if your computer has the latest updates, check for new updates, and pause updates.

At the top of the update window, you’ll see a message indicating your device is up-to-date, or it needs to install updates. Click Check for updates if you want to be 100% positive you have the latest updates. This is where you can check that updates are paused or initiate an update pause if needed, though we don’t recommend it.

Access update settings on Mac:

Step 1: Click the Apple menu button in the top left corner and select System Settings in the drop-down menu

Step 2: Click General from the settings sidebar in the pop-up window.

Step 3: Select Software Update.

Step 4: At the top, click the “i” info icon next to Automatic updates.

Step 5: Toggle on Install Security Responses and system files.

Access Android (Samsung) update settings:

Samsung Android phones have automatic updates turned on by default, so you probably don’t have to do anything. Here’s how to make sure automatic updates are enabled:

Step 1: Open the Settings app.

Step 2: Select Security and privacy.

Step 3: Select Other security settings and the Hexagonal gear icon.

Step 5: Toggle on Install Galaxy System Update. Note: This setting is on by default, so make sure you don’t toggle it off if it was already on.

Access iPhone iOS update settings:

Step 1: Open the Settings app.

Step 2: Select General.

Step 3: Select Software Update.

Step 4:  Make sure automatic updates are set to On.

Activate your computer’s firewall

Your computer’s firewall is its main defense against external cybersecurity threats. Both Windows and Apple computers have a robust firewall built in, but you need to keep these features activated to stay protected. Here’s how to make sure your firewall is enabled:

Activate firewall on Windows 10:

Step 1: Select Settings from the Start menu.

Step 2: Select Update & Security. Then, from the left-hand menu, choose Windows Security.

Step 3: Under Protection areas, select Firewall & network protection.

Step 4: You’ll see a menu displaying three networks: Domain network, Private network, and Public Network. The firewall status is displayed beneath each network name.

Step 5: If your firewall is off, select the network, and under Microsoft Defender Firewall, toggle the switch to On.

Activate firewall on Windows 11:

Step 1: From the Start menu, select Settings.

Step 2: Under Privacy & Security, select Windows Security, then choose Firewall & Network Protection.

Step 3: You’ll see three networks: Domain network, Private network, and Public network.

Step 4: To turn on the firewall for a network, select the network, and under Microsoft Defender Firewall, toggle the switch to On.

Activate firewall on Mac:

Step 1: From the Apple menu, select System Settings.

Step 2: From the pop-up window’s sidebar, choose Network, then click Firewall.

Step 3: Toggle on the firewall (if it’s off).

Do you need third-party Antivirus software?

You probably already have all the antivirus software you need built right into your computers and devices. Most cybersecurity experts agree that third-party antivirus software isn’t any better than the security measures companies like Microsoft and Apple supply with their products. Programs like Windows Defender do a fine job of protecting your computer as long as you keep them updated.

Decades ago, built-in security like Windows Defender had trouble keeping up with hackers, creating opportunities for third-party security companies like McAfee and Norton to offer products that filled in significant security gaps. Large tech entities like Microsoft have since significantly stepped up their cybersecurity game.

“We test it regularly (Windows Defender), and it’s one of the top products we’ve seen. It has improved a lot,” cybersecurity expert Simon Edwards, told NBC in 2021.

In response, third-party security companies have been bundling additional services with their products, such as identity theft scanning, enhanced email security, and security extensions for popular web browsers. You may gain some additional protection from these add-ons, but you still need to be vigilant and practice good cybersecurity hygiene, like using strong passwords, timely updates, and avoiding phishing emails.

Keep your guard up

The challenges of cyber security are always evolving, as evidenced by the constant stream of security updates that seem to pour into our devices on a daily basis. Internet security is a marathon, not a sprint. To stay secure, you must maintain good cybersecurity practices over time. Don’t get lazy or complacent, as it’s easy to normalize constant threats.

When you get a new device, make sure auto-updates are enabled. Don’t use the easy but risky password habits of yesteryear, keep up on your updates (which mostly means not disabling auto-updates), and be careful about what you click in your inbox and on the web.