When people hear “cybersecurity,” they picture a room full of screens, a vendor pitch, or a headline about a nation-state. That is a real field. It is not the field that gets most of us.
The ordinary version is personal. The phone in your pocket. The email you open because you are in a hurry. The password you have been recycling since a job you no longer remember. The laptop that has not been restarted in three weeks because it was doing something and you did not want to interrupt it.
I am lax about this. I will say that before I say anything else. I work in this world and I still let updates sit. I still recognize a bad email a beat later than I should. I still have a couple of logins that are not as unique as I would tell a client they ought to be. Knowing better and doing better are not the same habit.
That used to be a smaller problem. A stolen password twenty years ago might have meant a ruined Hotmail account and some embarrassment. Today the same sloppiness can mean a drained bank account, a hijacked payroll login, a photo library used as leverage, or a month of your life spent proving you are you. The tools got more serious. A lot of us did not.
And most of that no longer lives on the home computer. It lives in the pocket. Mail, banking, photos, the codes that open the rest of the logins — more access on the phone than on the desk, for most people I know, including me. Treat the laptop as the serious machine and the phone as a gadget and you have the problem backwards. The gadget is the house. I will write more on that. The common sense is the same: if you would not leave the front door unlocked, do not leave the screen unlocked.
I am not going to tell you the internet is a war zone and you need a bunker. Most of the trouble I see in ordinary life is not sophisticated. It is someone clicking something they would not have clicked if they had been less tired. It is a password that was good enough in 2011. It is a phone left unlocked on a table. It is a backup that exists only in theory.
Common sense still covers most of it.
If a message is in a hurry, it is lying. Banks, the IRS, your boss, and your shipping company do not need you to “verify now” from a link in an email you did not expect. Hover. Call the number you already have, not the one in the message. If it feels off, it is off. You do not need a certification to trust that feeling.
One password for everything is a single accident waiting to finish. You do not need a photographic memory. You need a password manager, or at least a unique password on email and banking, and you need to stop using the pet’s name plus a year. I have been slow to clean this up myself. That is not a virtue. It is a delay.
The extra step at sign-in is worth the extra step. A code from the phone, a prompt on a trusted device — not a text message if you can avoid it, but a text message is still better than nothing. The people guessing passwords in bulk are not guessing the second factor.
Updates are boring until they are not. The patch you skipped is often the hole that was already in the news. Restart the machine. Let the phone finish. You do not have to understand the bulletin. You have to let it install.
Public Wi-Fi is a courtesy, not a vault. Coffee-shop internet is fine for reading the news. It is a poor place to do banking, to log into payroll, or to sit in a shared folder. If you have to, use the phone as a hotspot. If that sounds fussy, compare it to rebuilding an account.
Keep a copy that is not on the same machine. A backup on the laptop you are about to lose is not a backup. Photos, tax PDFs, the one spreadsheet that is actually the business — somewhere else, and tested once so you know it opens. I have watched people discover they had a backup the day they needed it, and discover they did not.
Do not hand a stranger the keys because they asked politely. Tech support does not cold-call you. A pop-up that says your computer is infected and a calm voice will walk you through it is not Microsoft. Hang up. Close the window. If you were not already on the phone with someone you know, you are not on the phone with someone you should trust.
None of that is a product. None of it requires a war room. It is the same sense you already use on a dark street or a too-good deal: slow down, notice what does not fit, and do not give a stranger the run of the house.
The serious part is the stakes, not the jargon. The account is the house now. Mail, money, photographs, the login that opens the rest of the logins. Treating that casually is understandable. I do it. It is still a bad idea.
Start with one thing this week. Unique password on email. Sign-in codes on the bank. The update you have been postponing. A lock on the phone you actually use. You do not have to become a specialist. You have to stop pretending the old habits still match the world the phone is sitting in.
I am going to take my own advice. That is overdue.
