097 Digital Life Security #1: You Are Already the Security Administrator

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

Most of us would never describe ourselves as security administrators.

But think about everything you are responsible for protecting.

Your phone. Your computer. Your email. Your passwords. Your photos. Your banking information. Your home Wi-Fi network. Your social media accounts. Your cloud storage. Perhaps a smartwatch, television, security camera, thermostat, or other connected device.

Without realizing it, we have each become the administrator of a surprisingly large digital world.

That does not mean we need to become cybersecurity experts. But understanding a few basic principles can make that world considerably safer.

Welcome to Digital Life Security

This is the first topic in a series about protecting the technology we use every day.

We will look at browser security, email, passwords, phones, text messages, Wi-Fi networks, websites, servers, and many other parts of modern digital life.

Some topics will be simple and practical. Others will take us deeper into how security actually works.

The goal is not to make us afraid of technology.

The goal is to understand it.

Security Is More Than Antivirus Software

There was a time when computer security often meant installing antivirus software and hoping it caught anything dangerous.

Today our digital lives are much more complicated.

An attacker may never need to infect your computer.

They might instead convince you to enter your password into a fake website. They might send a text message pretending to be your bank. They might obtain a password leaked by another company and try it on your email account. They might attempt to reset your password by gaining access to your email or phone.

Modern security therefore involves more than protecting a computer.

It involves protecting identity, access, information, devices, and communication.

You Are Part of the Security System

One of the most important ideas in digital security is that technology cannot do everything for us.

Your browser can warn you about a suspicious website.

Your email provider can filter thousands of unwanted messages.

Your phone can require a fingerprint, face scan, or passcode.

A website can require multifactor authentication.

But eventually, a decision may reach you.

Should I click this link?

Should I install this program?

Why is this website asking me to log in again?

Does this email really come from my bank?

Why is someone asking me for a verification code?

Security technology is important, but understanding what is happening makes that technology much more effective.

Security Works Best in Layers

Good digital security rarely depends upon one perfect defense.

Instead, we use layers.

Imagine someone obtains one of your passwords. That is bad, but it does not necessarily have to become a disaster.

If every account has a different password, the stolen password may work only on one account.

If multifactor authentication is enabled, the password alone may not be enough to get in.

If the service recognizes an unusual login, it may block the attempt or alert you.

If you notice the alert quickly, you may be able to change the password and secure the account.

Each layer helps compensate for the possibility that another layer might fail.

This concept is often called defense in depth, and we will encounter it repeatedly throughout this series.

Updates Are Security Tools

Those software update messages can sometimes seem like interruptions, but many updates contain security fixes.

Researchers, developers, and sometimes attackers discover weaknesses in software. Once a vulnerability is known and a fix is available, continuing to run the vulnerable version can create unnecessary risk.

This applies to computers and phones, but also to browsers, routers, website software, plugins, smart devices, and other connected equipment.

A good general rule is simple:

If a device is connected to the internet, its ability to receive security updates matters.

Your Email Account Is Especially Important

Of all our digital accounts, email deserves special attention.

Why?

Because email is frequently the key to everything else.

Click “Forgot Password” on many websites and where does the reset message go?

Your email.

Someone who gains control of an email account may be able to use it to attempt to gain control of other accounts.

That makes protecting your primary email account with a strong unique password, modern authentication methods, and secure recovery options especially important.

We will devote an entire topic to email security.

Your Phone Has Become a Security Device

A modern smartphone is much more than a telephone.

It may contain your email, photos, contacts, authentication apps, saved passwords, banking apps, text messages, and access to cloud services.

It may even be the device that approves logins to your other devices.

That makes basic protections such as a strong screen lock, automatic locking, operating-system updates, account protection, and the ability to locate or remotely secure a lost device very important.

We will explore phone security and settings in another part of this series.

Convenience and Security Are Always Negotiating

Many security decisions involve a tradeoff.

Leaving a computer unlocked is convenient.

Entering a password is less convenient.

Using the same password everywhere is convenient.

Using unique passwords is safer.

Automatically connecting to networks is convenient.

Thinking about which networks we trust is safer.

The answer is not to make technology so secure that it becomes miserable to use.

The goal is to find sensible protections that become normal habits.

Good Security Should Become Boring

This may sound strange, but one of our goals should be to make security boring.

Locking your phone should not feel like a security procedure. It should simply happen.

Using unique passwords should not require remembering dozens of passwords. A password manager can handle much of that work.

Installing security updates should become routine.

Pausing before responding to an unexpected message should become instinctive.

The best security habits are often the ones we barely notice anymore.

Slow Down When Something Feels Urgent

Technology changes constantly, but one security principle has remained remarkably useful:

Be suspicious when someone tries to make you act before you have time to think.

Your account will be closed.

Your package cannot be delivered.

Your computer has a virus.

A payment has been made.

Your bank account has been locked.

Someone you know desperately needs money.

Attackers frequently use urgency because careful thinking works against them.

If something seems important, you usually do not need to follow the link or phone number contained in the message. Open the company's app, use a trusted bookmark, type the address you already know, or contact the person through a method you have used before.

We Are Going to Look Under the Hood

Digital Life Security will not stop with a list of things you should and should not do.

We are also going to ask why.

Why does HTTPS matter?

What does a browser actually check when you visit a secure website?

How can an email appear to come from someone else?

What do SPF, DKIM, and DMARC actually accomplish?

What happens when you connect to Wi-Fi?

What does a firewall really do?

What information can we learn from server logs?

How do websites protect passwords?

How do attackers find vulnerable websites?

And how can networks be designed so that one compromised device does not necessarily give access to everything else?

Some of those questions will take us considerably deeper into cybersecurity, but we will build the knowledge one layer at a time.

Security Is a Process, Not a Setting

There is no checkbox labeled “Make Me Secure.”

New devices appear. Software changes. New vulnerabilities are discovered. Criminal techniques evolve. And occasionally we make mistakes.

That is why good security is not about achieving perfection.

It is about reducing unnecessary risk, building multiple layers of protection, noticing when something unusual happens, and knowing what to do when a problem occurs.

Our Digital World Is Worth Protecting

Technology gives us extraordinary capabilities.

We can communicate around the world, operate businesses, manage finances, store decades of photographs, publish websites, control equipment, learn almost anything, and carry much of it in our pockets.

Those capabilities are worth protecting.

And the first step is realizing something important:

You are already the security administrator.

Now we are going to become better at the job.