With stories of hacking, data breaches, government surveillance, identity theft and invasion of online privacy littering the news, it has never been more important to protect yourself while using the internet. Even as new threats arise very day, many of the most effective barriers against them have been around for years. In this article, Jeff Grant of Comparitech explains ten steps you can take to be cyber secure in 2017.


While it’s no longer necessary to change your passwords every few months, it’s still vital to use strong and unique passwords. A strong password has a few key characteristics:

- Made up of lower- and upper-case letters, numbers and symbols
- At least twelve characters long
- Random enough that no predictable pattern can be identified

Not only do you need strong passwords, but you should be using a different one on every account. That way, even if your password is cracked or leaked in a data breach, it cannot be used to access any of your other accounts.

Memorising all of those random passwords can be difficult, so we recommend using a password manager. A password manager allows you to securely store all of you passwords in one app or browser extension. Then, when you need to input a password, you just need to enter one "master password", and the manager will input the correct password on your behalf. You can generate strong, random passwords and test password strength using our tools on Comparitech.


Two-step verification, sometimes called two-factor authentication, is a simple and effective way to prevent unauthorised access to your accounts online. It works like this: any time someone tries to log into your account from a new device or location, a PIN number is sent to you by some alternative means, which you must input to complete the login process.

These PINs can be sent via SMS, email, phone call, or using an authentication app like Google Authenticator or Authy. These PINS can be sent via SMS, email or phone. Two step verification is often optional, but we highly recommend adding it to all of your online accounts.


Phishing is a type of scam where the scammer poses as a trusted authority and attempts to trick you into giving up private information, often account credentials or financial info. Phishing is most common in emails, where the criminal provides an official-looking link that leads to a fake website where you input those details. With those details in hand, the criminal then has free reign to steal from or abuse your account.

Always check the email address (not the screen name) of the sender, never click on unsolicited links in emails, and don't give up any critical information over email. Email is not encrypted by default and is therefore not a safe way to transmit private information, so a reputable company or authority would never ask you to do this.

Learn more about how to spot phishing emailshere.


Before you input information on a website, always check that the page is protected with HTTPS. These letters are often accompanied by a green padlock symbol next to the URL bar. The 'S' stands for secure, and it means two things:

The information passing between you and the website is encrypted and secure
The party on the other end has been verified to make sure they are who they say they are

Not all pages are HTTPS encrypted, but any time you fill out a form, enter payment info, or input your login details, it should be there.

We also recommend using the HTTPS Everywhere browser extension, a tool made by the Electronic Frontier Foundation. HTTPS Everywhere will check every page to see if an HTTPS version is available and, if so, load it.


A VPN, or virtual private network, encrypts all of the internet traffic to and from a device and routes it through an intermediary server in a location of the user's choosing. This service has a few security benefits:

- On open wifi networks, no one can intercept and read your internet activity
- Your ISP cannot snoop on your internet activity
- Websites cannot use your IP address to identify your device or location
- You can bypass censorship and geographic restrictions on content

We strongly recommend subscribing to a reputable paid VPN service, which will allow you to connect to a wide range of secure servers without any restrictions on speed or amount of data. Good VPNs will not log your activity and will use strong encryption standards to keep your data safe as it travels across the internet.


Up-to-date antivirus software is a vital shield against malware such as viruses, worms, trojans, and ransomware. New smartphones and laptops come with antivirus built into their operating systems, but you might still want to avail of something stronger.

Keep your antivirus real-time scanning feature active, and perform regular full system scans to make sure nothing has sneaked through the firewall.

Additionally, you can protect yourself by being wary of what you download online. Don't click suspicious links or email attachments, which are the main avenues through malware infects computers.

If you believe you've contracted malware, immediately put your computer into hibernation mode and consult our malware removal guide on another device.


Many security vulnerabilities arise on deprecated or out-of-date software and firmware. Always be sure to install security updates to your programs and operating system as soon as they are available. Hackers know that many users won't bother updating their devices, and so they can easily take advantage of known vulnerabilities known as "zero days".

We recommend turning on automatic updates in your operating system and program settings where available.


By default, most social media accounts are not very private. Go through Facebook, Instagram, Twitter, Snapchat, and whatever other social media accounts you have and adjust the privacy and security settings. This includes who can see what you post, two-step verification, what apps have access to your data, what appears when people search you on Google, and much more.

We've written several extensive guides on how to do this at Comparitech, and there’s a useful guide over at Kaspersky too.


Encryption works. It's the process of scrambling the contents of a file using a cipher so that only a certain key, or password, can be used to decipher it. Modern encryption is extremely strong and cannot be broken under reasonable circumstances.

HTTPS and VPNs encrypt your internet connection, but when they're not in transit, files are still vulnerable whether they're stored on a cloud server or your local hard drive. We recommend encrypting your entire device so long as it is powerful enough. Encryption methods are built into most modern operating systems.

If you prefer to just encrypt specific files or folders, which is useful if you want to store sensitive files on the cloud..


No matter how careful you are, sometimes the worst happens. If your device is infected with serious malware, or it is damaged, lost, or stolen, much of your data might not be recoverable. That's why it's always important to maintain regular backups of your data.

You can back up files and folders to a local device, like an external hard drive, or to the cloud. You can create a full system, bare bones backup that includes the entire operating system and all of your programs, or just back up your user files including documents, downloads, images, music, and videos. The backup method you choose will depend on your choice.

Once you've made your way through this list, you can use the internet with peace of mind, knowing that you are safe from malware, hackers, and other threats. Be careful out there!

July 2017