Cybersecurity for Everyone:
Protect Yourself Online Without Being a Tech Expert

Contents

• 1. Introduction
• 2. What Is Cybersecurity, And Why Should You Care?
• 3. Common Online Threats
• 4. Passwords: Your First Line of Defense
• 5. Multi-Factor Authentication (MFA)
• 6. HTTPS
• 7. Software Updates
• 8. How to Detect and Defend Against Phishing Attempts
• 9. Some Best Practices and Habits to Stay Safe Online
• 10. Cryptography: A Very Brief Overview
• 11. Summary
• 12. Conclusion
• 13. Additional Resources

1. Introduction

In today's digital age, cybersecurity is more important than ever.
With online threats and scams on the rise, it's crucial for everyone to understand the basics of online security.

Unfortunately, cybersecurity isn't as common as it should be.
Many people assume that it is only for tech experts or large organizations.
Others might feel intimidated by the term "cybersecurity" itself, especially for those who are not tech-savvy.

But here's the truth: cybersecurity is for everyone.
You don't need to be a tech expert or know how to code.
Even the most basic knowledge, best practices, and habits can go a long way in protecting against online threats.

In this blog post, we will go over some simple and practical tips to help you stay safe online, and show that cybersecurity doesn't have to be complicated.

This is Cybersecurity for Everyone.

2. What Is Cybersecurity, And Why Should You Care?

In simple terms, cybersecurity is the art of defending against online threats.
It involves keeping yourself and your information safe from hackers, scammers, and other malicious actors.

You might be wondering, "Why should I care about cybersecurity? I'm just a regular person. I'm not a likely target."

The truth is: EVERYONE is a potential target for cyber attacks.
You don't need to be a celebrity or part of a large corporation. You don't need to be a small business owner or a government official. You don't even need to have anything valuable online.
Cyber attacks can happen to anyone.
And the consequences can be severe, including identity theft, financial loss, and damage to your reputation.

You still think attackers wouldn't care enough to target you? Think again.
Your personal data is more valuable than you think.
Attackers can use your information for identity theft, financial fraud, or even to launch attacks on others.
They can also use your accounts to spread malware or phishing scams to your contacts, or sell your information to other criminals.
Even the device you're using to read this blog post can be a potential resource for attackers if they can get access to it. They can use your device for malicious purposes, such as launching large-scale cyber attacks, or mining cryptocurrencies.

By taking simple steps to protect yourself online, you can reduce your risk of falling victim to cyber attacks.
And the best part is, you don't need to be a tech expert to do so.

3. Common Online Threats

Before we dive into the tips and best practices, it's important to understand some of the most common online threats.
This is not a list of every threat there is, but these are some of the most common ones that you should be aware of:

• Phishing
• Malware
• Password Attacks
• Social Engineering
• Man-in-the-Middle Attacks

By understanding these common threats, you can better recognize them and better protect yourself against them.

3.1 Malware

Malware (short for "malicious software") is any software that is designed to harm your computer, steal your information, or spy on you without your consent.
There are many types of malware, including:

• Viruses
• Worms
• Trojans
• Ransomware
• Spyware

3.2 Phishing

Phishing (pronounced "fishing") is by far the most common online threat.
It involves tricking you into giving away your personal information, such as passwords, bank account details, or Social Security numbers.
Phishing attacks can come in many forms. They can show up as:

• Emails that look like it comes from a trusted source, but are actually fake.
• Text messages asking you to verify your account or click on a link.
• Phone calls pretending to be from your bank or a government agency.
• Fake websites that look like a real website from a trusted company, but are designed to steal your information.
• Social media messages from fake accounts pretending to be someone you know.

As shown above, phishing attempts often pretend to be from a trusted source, such as your bank, a government agency, or a popular website. They often use urgent language to create a sense of panic, with messages like "Your account has been compromised, click here to reset your password".
The goal is to get you to click on a link or download an attachment that will install malware on your computer, or take you to a fake website that looks like the real one, where you'll be asked to enter your personal information.

Phishing attacks can be so convincing that even the most tech-savvy individuals can fall for them.
The best defense against a phishing attack is to always be skeptical of any messages, calls, emails, or websites that ask for your personal information.

We will go over how to spot phishing attempts in the How to Detect and Defend Against Phishing Attempts section.

3.3 Password Attacks

Password attacks are attempts to gain access to your account by guessing or cracking your passwords.
There are several types of password attacks, including:

• Brute Force Attacks
• Dictionary Attacks
• Credential Stuffing

More about strong passwords in the Passwords: Your First Line of Defense section.

3.4 Social Engineering

Social engineering is a type of attack that relies on manipulating people to gain access or to steal information.
It often involves building trust with the victim using deception, psychological manipulation, or impersonation of a trusted entity.
Unlike typical cyber attacks that exploit technical vulnerabilities, social engineering exploits human psychology.
It can take many forms, with phishing being one of the most common examples.
Other examples include pretexting (creating a false sense of trust), baiting (offering something enticing to lure victims), and tailgating (following someone into a secure area).

An example of social engineering is when an attacker pretends to be a tech support and convinces you to give them access to your computer.

Always be cautious with unexpected requests for information or access, even if they seem to come from a trusted source.
Always verify the identity of the person or organization before sharing any sensitive information.

More about this in the How to Detect and Defend Against Phishing Attempts section.

3.5 Man-in-the-Middle Attacks

Man-in-the-middle (MitM) attacks occur when an attacker intercepts communication between two parties, such as between you and a website, or between you and someone else online.

This can happen on unsecured Wi-Fi networks, where an attacker can listen in on your internet traffic and steal your information.
Attacks like MitM are why it's important to avoid using public Wi-Fi for sensitive activities, such as online banking, shopping, or work-related tasks.
If you must use public Wi-Fi, consider using a Virtual Private Network (VPN), and ensure that the website you're visiting uses a secure connection (HTTPS).
Some examples of trusted VPNs include NordVPN, Surfshark, and Proton VPN.

More about this in the HTTPS section.

4. Passwords: Your First Line of Defense

Passwords are the most common way to protect your accounts.
They are the first line of defense against attackers.
Thus, having strong, hard-to-guess passwords is absolutely crucial for your online security.

4.1 Common Password Mistakes People Make

Common mistakes many people make with passwords:

• Using weak or easy-to-guess passwords, which makes it easy for attackers to gain access to their accounts.
• Using the same password across multiple accounts.
• Including personal information, such as their name, birthdate, or address, as part of their password.
• Using most commonly used passwords, such as "password", "123456", or "qwerty".
  (If any of these are your passwords, CHANGE THEM RIGHT NOW.)
• Believing that weak passwords are safe as long as they don't share them.
• Believing that their accounts are not worth targeting, so strong passwords are not needed.
• Not changing their passwords regularly.
• Not changing their passwords immediately after a data breach or security incident.
• Writing down their passwords in an insecure place, such as on a sticky note on their computer.
• Sharing their passwords with friends or family members.

Avoid these mistakes at all costs.
Your password is like a key to your house, and having a weak password is like leaving your key out in the open, or leaving it under the doormat and thinking no one will find it.

4.2 Tips for Creating Strong Passwords

Here are some tips for creating strong passwords, according to the National Institute of Standards and Technology (NIST):

• Passwords should be at least 8 characters long, but longer is better.
• Use a mix of uppercase and lowercase letters, numbers, and special characters.
• Do NOT use common words or phrases, such as "password" or "123456".
• Do NOT personal information, such as your name, birthdate, or address.
• Do NOT use hints in passwords.

Of course, strong passwords can be difficult to remember, especially when you have a lot of them.
This is where password managers come in.

4.3 Password Managers

A password manager is a software that helps you generate, store, and manage your passwords.
It can create strong, unique passwords for each of your accounts, and store them securely so you don't have to remember them all.
All you need to remember is one strong password to access your account, and the password manager takes care of the rest.

Password managers can also help you identify weak or reused passwords, and alert you if any of your accounts have been compromised in a data breach.

The key takeaway here is that using a password manager is one of the best things you can do for your online security.
So, if you're not already using one, consider getting a reputable password manager.
(Some popular options include Bitwarden, 1Password, or LastPass.)
Note that many web browsers, such as Google Chrome, Firefox, have built-in password managers. However, it is generally recommended to use a trusted, third-party password manager, as it often offers superior security and better features.

5. Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) is an additional layer of security that requires you to provide two or more forms of verification to prove it's really you.
This typically involves something you know (like your password), and something you have (like a code sent to your phone).
Some common forms of MFA include:

• Biometric authentication (e.g. fingerprint or facial recognition)
• Text or email codes
• One time passwords (OTP) generated by an app or sent via SMS
• Physical security keys, like a USB security key or a hardware token
• App-based authentication (like Google Authenticator or Duo Mobile)

MFA can significantly reduce the risk of unauthorized access to your accounts.
Even if an attacker manages to guess or steal your password, they would still need the second form of identification to access your account.
Many popular services, such as Google, Facebook, and Microsoft, and even banks, email providers, and online shopping sites offer MFA options.

The key takeaway here is that enabling MFA on your accounts is one of the best things you can do for your online security.
Don't rely on just passwords alone to protect your accounts. They can be guessed, stolen, or cracked.
So, if you're not already using it, consider enabling MFA on all of your accounts that support it.
Yes, it can be annoying to set up MFA and go through multiple devices and apps to verify it's you, but protecting yourself is always worth a little inconvenience.

5.1 Do NOT use security questions

Another important thing to keep in mind: do NOT use security questions as a form of MFA.
In case you're not familiar, security questions are questions that you answer to verify your identity, such as "What school did you attend for sixth grade?" or "What was the name of your first pet?".
Security questions are one of the weakest forms of authentication.
They're often easy to guess. They can be easily social engineered off of you. Worse, the answers can be found with a quick search through your social media.

6. HTTPS

In simple terms, HTTP (Hypertext Transfer Protocol) is essentially a way your web browser talks to websites, and
HTTPS (Hypertext Transfer Protocol Secure) is a secure version of that communication.

Unlike HTTP, HTTPS uses encryption to protect your data from being intercepted or tampered with by attackers.
This means that when you use HTTP, any data you send (like passwords or messages) is sent in plain text.
Thus, anyone who is eavesdropping (especially on public Wi-Fi) can see exactly what you are sending.
On the other hand, when you use HTTPS, your data gets "scrambled" into a mess of characters while it travels over the internet.
That way, only the website you're sending it to can unscramble the message and read it properly.
This ensures your information is secure as it travels from your computer over the internet.
(More about this in the Cryptography: A Very Brief Overview section).

You can tell if a website is using HTTPS by looking for the padlock icon in the address bar of your web browser, or by checking if the URL starts with "https://" instead of "http://".

Figure 1. Example of HTTPS in Google Chrome

If there's one thing you should take away from this section, it's this:
always look for HTTPS when visiting websites, especially before entering personal or financial information.

If a website does NOT use HTTPS, do NOT enter any sensitive information on that website.

In general, it is best to avoid websites that do not use HTTPS.

7. Software Updates

Keeping your software up to date is one of the simplest and most effective ways to protect yourself online.
Software updates often include security patches that fix vulnerabilities that could be exploited by attackers.
This includes your operating system, web browser, antivirus software, and any other apps you use regularly.

Don't ignore software update notifications. They matter more than you think.
Many people delay or ignore software updates because they find them inconvenient or annoying.
However, this can leave your computer vulnerable to attacks.

The key takeaway here is: keep your software up to date. It is one of the best things you can do for your online security.

So, if you're not already doing it, make sure to enable automatic updates whenever possible, and regularly check for updates for all of your software.
Yes, updates can be annoying, but protecting yourself is always worth a little inconvenience.

8. How to Detect and Defend Against Phishing Attempts

As mentioned earlier, phishing is one of the most common online threats.
It can be difficult to spot a phishing attempt, especially if it looks like it's coming from a trusted source.

Here are some tips to help you spot scams and phishing attempts, and protect yourself from them:

8.1 Be Skeptical of Urgent Requests

Phishing attempts often use urgent language or tone to create panic, making users respond to an emergency that never actually existed.
Be skeptical of any messages that ask you to take immediate action, such as
"Your account has been compromised, click here to reset your password".
Always be suspicious of urgent requests for personal information or access, even if they seem to come from a trusted source.

8.2 Check the Sender's Email Address or Phone Number

Phishing messages often come from email addresses or phone numbers that closely resemble those of legitimate sources but are actually fake.
Always double-check the sender's details before trusting the message.

8.3 Look for Spelling and Grammatical Errors

Many phishing messages contain spelling or grammatical errors, while legitimate organizations usually have professional communication standards.
So, check for any spelling and grammatical errors.

However, be aware that some phishing attempts can be very well-written and free of errors.
So, don't rely solely on this tip to spot phishing attempts.

8.4 Hover Over Links to See the URL

Before clicking on any link, no matter where you found it (email, text message, website, social media, etc.),
hover your mouse over it to see the URL.
This will show you the actual URL that the link will take you to, which you can usually see in the bottom left corner of your web browser.

For example, hover over (but don't click) the following link that looks like it leads to Google:

Notice how even though the link says "https://www.google.com", it actually leads to YouTube.

This example is harmless, but you can imagine how this technique can be used for malicious purposes.
The link can say anything, but the actual URL can take you to a completely different website, usually a fake one designed to steal your information.

If the URL looks suspicious or doesn't match the text of the link, don't click on it.
Instead, go directly to the website by typing the URL into your web browser's address bar.

8.5 Be Cautious of Lookalike Websites

Be careful of websites with names very similar to that of legitimate ones.

For example:

Attackers use this to their advantage. They use tricks like these to create fake websites that look identical to legitimate ones, often using names that look very similar to those of trusted sources.
This is an attack known as a homograph attack.
If you're not paying close attention, you might accidentally visit a malicious website that looks exactly like a trusted website, and give away your info.

8.6 Be Cautious of Shortened URL

Another thing to keep in mind: be cautious of shortened URLs (like bit.ly links), as they can hide the true destination. Use a URL expander service to see the full URL before clicking on it.

Get into the habit of NEVER trusting anything you see, ALWAYS verifying everything.

8.7 Verify the Website's Security

Before entering any sensitive information on a website,
make sure the website is using HTTPS (recall the HTTPS section earlier).
If the website is not using HTTPS, do NOT enter any sensitive information.

8.8 Trust Your Instincts

If something seems off, or too good to be true, it probably is.
Trust your instincts and be cautious when something doesn't feel right.
It's better to just ignore it, rather than risking a phishing attack.

8.9 NEVER Trust, ALWAYS Verify

NEVER trust anything or anyone by default.
ALWAYS verify the identity of anyone asking for sensitive information.
ALWAYS verify the legitimacy of a website, link, email, etc. before interacting with it.
Even if it seems to come from someone you know, or from trusted sources, ALWAYS verify their identity and the legitimacy of their requests.
Make "NEVER trust, ALWAYS verify" your default online habit. It's one of the best habits to build, and one of the best ways to stay safe online.
So, get into the habit of "Never Trust, Always Verify".

9. Some Best Practices and Habits to Stay Safe Online

Here are some recommended best practices and habits to help you stay safe online:
(Note that many of these are repeats of what has been said earlier, but these are worth repeating)

NEVER trust, ALWAYS verify:

• Make "NEVER trust, ALWAYS verify" your default online habit. It is one of the best ways to stay safe online.
• NEVER trust anyone or any link, message, email, file, etc. you see or receive online.
• ALWAYS verify links, sender identities, and the legitimacy of requests.

Avoid using public Wi-Fi:

• Public Wi-Fi are often unsecured, which makes it easier for attackers to intercept and steal your data (MitM attacks).
• Avoid doing sensitive activities (such as online banking, shopping, or work-related tasks) on public Wi-Fi.
• If you must use it, use a VPN to encrypt your connection and keep your data safe.

Limit the amount of personal information you share online:

• Be cautious about sharing personal information online.
• Sharing too much personal info can make it easier for attackers to use social engineering to access your accounts.
• Avoid sharing sensitive information, such as your home address, phone number, or financial information.
• Adjust privacy settings to control who can see your posts.

Regularly back up your data:

• Regularly back up your important files to an external hard drive or cloud storage service.
• This can help you recover your data in case of a cyber attack, data loss, natural disasters, or human errors.

Do NOT post or share your job badge or work devices with others:

• If you use a work device, such as a laptop or smartphone, do NOT share it with others. This can help prevent unauthorized access to your work accounts and data.
• If you have a job badge, do NOT post pictures of it online or share it with others.
  Posting it online can lead to serious security breach, since attackers will know the design, font type, and other details that can help them create a convincing fake badge.

Be cautious with email attachments and downloads:

• Only download attachments or files from trusted sources.
• If you receive an unexpected attachment or file, verify its legitimacy before opening it.

Use privacy settings on social media:

• If possible, change privacy settings on your social media accounts to limit who can see your posts and information.

Educate yourself and others:

• Stay informed about the latest online threats and best practices for staying safe online.
• There are many resources available online, including blogs, articles, and online courses.
• Share this information with your friends and family to help them stay safe online as well. After all, cybersecurity is a shared responsibility.

Trust your instincts:

• If something seems off or too good to be true, it probably is.
  Trust your instincts and be cautious when something doesn't feel right.

Log out of accounts when you're done:

• Especially on shared or public computers, make sure to log out of your accounts when you're finished using them.

Monitor your accounts regularly:

• Regularly check your bank and credit card statements, as well as your online accounts, for any suspicious activity.

Use different email addresses for different purposes:

• Consider using separate email addresses for personal, work, and online shopping accounts. This can help limit the impact of a compromised account.

Be cautious with browser extensions and plugins:

• Only install extensions and plugins from trusted sources, as they can potentially access your data and compromise your security.

Secure your home Wi-Fi network:

• Change the default username and password for your router, and regularly update your router's firmware.

Avoid using public charging stations or USB ports:

• Public charge stations or USB ports can be compromised by attackers to steal data from your device or install malware. Instead, use your own charger and plug it into a wall outlet.
• If you must use a public USB port, consider using a USB data blocker, which prevents data transfer while allowing charging.

10. Cryptography: A Very Brief Overview

In simple terms, cryptography is the mathematical science of securing information in the presence of adversaries.
It involves using complex math and algorithms to protect information from being intercepted or modified by attackers.

The details of cryptography and how it works are beyond the scope of this blog post.
You don't need to understand how cryptography works to stay safe online, but it helps to know it's working in the background to protect your data.
That said, here are some key concepts to understand:

• Encryption:
  The process of converting plaintext (human-readable data) into ciphertext (unreadable data) using a mathematical algorithm and a key. This ensures that only those with the key can read the original data.
• Decryption:
  The opposite of encryption: converting ciphertext back into plaintext using the appropriate key.
• Symmetric cryptography:
  Uses the same key for both encryption and decryption. This is fast and efficient, but sharing the same key securely can be difficult.
• Asymmetric cryptography:
  Uses a pair of keys: a public key and a private key.
  The public key is used for encryption, while the private key is used for decryption.
  As the name suggests, public keys can be shared with anyone, while privates key must be kept secret at all times.
• Hybrid cryptography:
  is a combination of both symmetric and asymmetric cryptography, combining the strengths of both cryptographic systems.
• Many secure websites uses hybrid cryptography through HTTPS, which allows your browser to encrypt data sent to the server without needing a shared key.

Once again, you do not need to understand how cryptography works, or the math behind it.
As a matter of fact, you should not try to implement your own cryptographic systems. These are best left to experts, mathematicians, and computer scientists who dedicate their lives to rigorously researching and improving cryptography.
The key takeaway here is that cryptography is a powerful tool for your online security, and it's good to be aware of the mathematics and algorithms that help to keep our data secured.

If you are interested in learning more about cryptography, there are many resources available online, including books, articles, videos, and online courses. It's a fascinating field, and if you're curious, I highly recommend exploring it.

11. Summary

To recap, here are the key points covered in this blog post:

• What is Cybersecurity, and why it matters to you
  It's not just for tech experts; everyone is a potential target.
• Common online threats
  Such as malware, phishing, password attacks, and social engineering.
• The importance of strong passwords & password managers
  Plus how to avoid common password mistakes.
• Multi-factor authentication
  An extra layer of protection that makes your account much more secure than just using passwords.
• Why secure connection matters (HTTPS)
  Look for the padlock icon and "https://" to keep your data safe.
• Keeping your software up to date
  Updates patch security holes and protect you from known threats.
• How to detect and defend against phishing attempts
  Stay alert to scams and never trust messages or links blindly.
• Smart online habits and best practices
  Including "Never Trust, Always Verify", avoiding public Wi-Fi, and limiting the info you share.
• A very brief overview on cryptography
  The math and algorithms that help keep your data secure.

12. Conclusion

This blog post has covered the essentials of cybersecurity:
including common online threats, best practices and habits, the importance of strong passwords, software updates, multi-factor authentication, and even a brief look at cryptography.

The key takeaway is simple: cybersecurity is for everyone, regardless of technical expertise.
It's a shared responsibility, and by taking even basic steps, you can dramatically reduce your risk and help protect yourself and others online.

In fact, by following the tips and best practices outlined here, you will already be more secure than the vast majority of users online.

Of course, there is no such thing as 100% secure. But cybersecurity isn't about perfection; it's about awareness, preparation, and smart habits and practices.

Remember: cybersecurity is not a one-time action. It's an ongoing process. Stay informed, stay curious, and continue to develop good security habits.
If you've made it this far, you now have a solid foundation in the basics of cybersecurity. But this is just the beginning. I encourage you to keep learning, stay updated on emerging threats, share this blog post, and share what you've learned with others.

Together, we can create a safer and more secure digital world for everyone.
Thank you for reading, and stay safe online!

13. Additional Resources

To learn more about cybersecurity, here are some additional resources:

• CISA: Cybersecurity Tips
• FTC: Privacy, Identity & Online Security
• Harvard University CS50's Introduction to Cybersecurity

I really hope you didn't blindly click on those links, especially after reading this blog.
If you clicked on those links without checking them first...consider this a friendly wake-up call.
If I had been a malicious actor, those links could have taken you to dangerous sites.
If you trusted me just because I wrote this blog and seem like a helpful source, that's exactly how social engineering works.

Remember:
NEVER trust. ALWAYS verify.

Get in the habit of hovering over links, checking the URL, and verifying everything you see, no matter where you found it.
Let's break your bad security habits starting today.