October is Cybersecurity Awareness Month, and this year the National Cybersecurity Alliance picked a theme that sounds like it came out of my own notes: Don’t Make It Easy for Them. Their framing is that staying safe online comes down to small habits you repeat, not one perfect decision, and I agree with every word of that.
Here’s what it means in practice. Most attacks against regular people run on automation, so a bot tries a stolen password on thousands of accounts, or a scam text goes out to a million numbers, and whoever gives way first gets picked. Nobody sat down and chose you. You got picked because you were the easy one in the batch, and the fix is to stop being the easy one.
So this month I’m posting twice a week instead of once, and I’m starting with the five fixes that do the most work for the least time. Each one takes about ten minutes. Do one a night and you’re finished by Monday.
People put security off because it sounds like a weekend project. It isn’t. The fixes that stop most of what hits regular people are boring settings changes, and the government’s own cyber agency agrees: CISA boils its advice for everyone down to four things, strong passwords with a password manager, multifactor authentication, spotting and reporting phishing, and keeping software updated.
I’ve added a fifth that CISA leaves out because it lives with your money instead of your devices. None of the five require you to understand how any of it works under the hood. You just have to do them.
Fix 1: Turn on automatic updates (10 minutes)
Every update you put off is a known hole left open on a device you carry everywhere. The people who found the hole wrote it down, and some of them sell that list.
- iPhone: Settings, General, Software Update, Automatic Updates. Turn on both options.
- Android: Settings, System, System Update. Turn on automatic downloads if your phone offers it.
- Your computer: Windows Update and macOS Software Update both have an automatic option. Turn it on.
- Your browser: Chrome, Safari, Edge and Firefox update themselves if you restart them. Restart yours tonight.
Updates are the one fix that protects you from problems you’ll never hear about, which is why it goes first.
Fix 2: Put two-factor on your email (10 minutes)
Your email is the master key. Every “forgot password” link for your bank, your phone carrier and your shopping accounts lands there, so whoever controls your inbox can reset their way into everything else.
Go to your email account’s security settings and turn on two-step verification. An authenticator app beats a text message, and I explain why in my piece on SMS two-factor. But a text code still beats nothing, so if the app feels like too much tonight, take the text code and upgrade later.
Fix 3: Give your email and your bank their own passwords (10 minutes)
You don’t have to fix every password tonight. Fix two. Your email and your bank each need a password you’ve never used anywhere else, because the way most accounts fall is somebody else’s breach, and your reused password shows up on a list that bots test everywhere.
If you use a password manager, let it generate both. If you don’t, a long phrase of four or five random words works, written on paper and kept at home. Paper at home is safer than the same password on twelve sites. The free Password Reality Check shows how long a phrase like that would last.
Fix 4: Freeze your credit (10 minutes a bureau)
A credit freeze stops anyone from opening new credit in your name, and it has been free by federal law since September 2018. You have to set it at each of the three bureaus, Equifax, Experian and TransUnion, one at a time. It doesn’t affect your credit score, and you can lift it for a day when you need to apply for something.
This is the fix I push hardest because it’s the one that holds even after your data leaks, and your data has already leaked, from a breach you got a letter about and forgot. The step-by-step is in how to freeze your credit.
Fix 5: Decide now what you’ll do with the next scam text (5 minutes)
The scam text is coming, and the panic it’s built to cause works best on people who haven’t decided in advance what they’ll do. Decide now:
- Don’t tap the link and don’t call the number in the message.
- Forward the text to 7726, which spells SPAM, so your carrier can block the next one.
- If it claims to be your bank, a delivery company or the IRS, open their app or type their website yourself and check there.
- Delete it.
That’s the whole plan. Say it out loud once so it’s there when your heart rate goes up.
What the month looks like from here
Twice a week through October I’m going deeper on the four areas where people get caught: scams that impersonate companies you trust, passwords and the tools that store them, and what to do in the first hour after something goes wrong. Every post ends with steps you can finish the same day.
These five handle tonight. Once a year, the rest deserves a proper look, and The Annual Security Reset is the weekend version I built for that: the full tune-up, plus a briefing on what changed in the scams going around.
The bottom line
Attackers go where the work is easiest, and five ten-minute changes move you off the easy list: automatic updates, two-factor on your email, unique passwords on your email and bank, a credit freeze at all three bureaus, and a decided plan for the next scam text. Pick one tonight. That’s the whole idea behind this year’s theme, and it’s the whole idea behind everything I write here.
Want the full walkthrough? My book, Stop Doing Dumb Shit Online, covers what to do when something goes wrong in plain English with no jargon. It’s on Amazon in Kindle, paperback and hardcover.