Let's Not Mess Around with Security on our Personal Systems Either!

Essential Security Practices for Your Personal Systems

Ensuring a minimal level of cybersecurity, privacy, and availability on your personal systems means you need to manage the following essential practices. This is a brief overview of recommendations from sources like CISA, NSA, etc., focused on personal laptop, phone, and other systems' security.

Anti-virus 

I've found you'll get the best anti-virus protection and usability from a paid product - I've always had good luck with Norton labeled products. If you are looking for current vendor offerings see: https://www.pcmag.com/picks/the-best-antivirus-protection

Regardless of whether you choose to use a commercial product or open-source anti-virus tool, it is absolutely something you need to use. This is the minimally needed level of system security. Once installed, ideally, it should be invisible until there's a security problem it can't prevent or solve.

 Backups

You need to have at least a minimal level of backup of the files you care about on your systems. This protects your work and information from errors, system problems and crashes, as well as mitigating any cybersecurity concerns such as malevolent ransomware or other data exfiltration.

Personally I dislike managing and performing backups. I understand it can be a time consuming and easy to forget aspect of personal systems management. It's also one of the most easily automated aspects of system management. I've used BackBlaze (https://www.backblaze.com/cloud-storage/solutions/backup-and-archive) for the last decade, due to its combination of price and capability.  Some options are listed and reviewed here: https://www.pcworld.com/article/407149/online-cloud-backup-services-carbonite-idrive-backblaze-livedrive.html. This is not any form of endorsement and you should seek out the particular tool that meets your needs in-terms of price, convenience and ease of use.

 If you have more than a single form of backup, that is ideal - often an onsite backup to a physically connected USB drive is a low-impact backup that you can usually automate on a schedule easily.

Storage

For most systems to operate at an acceptable level of responsiveness, you need to pay attention to the amount of storage space you have available. On most systems, particularly Windows, you want at least 20% available space. Before jumping up and defending a different amount, just note this is simply a heuristic I've used and found workable. More available space is always going work better, because the less you have to think about it, the better.

Users

If you have multiple logins on your system (such as a laptop), are they all active? If not, you can save space and improve security by removing unused users on your laptop. 

For the numerous other systems you use (such as Facebook, LinkedIn, IRS.gov, Reddit, Instagram, etc., etc., etc.), and which you have login credentials for, do you use a Password Management tool? This area is my weakness, I have many logins that I rely on memory for, and I know they are less complex than needed as a result. The solution for a situation like this, including the frustrations of getting locked out when you forget a login, is a password manager like those described here: https://www.pcworld.com/article/394076/best-free-password-managers.html

Privacy

Consider the number and breadth of all your logins and think about the overall 'informational footprint' you have. This can be a window into your life for hackers to peek through and provides more entry points into your identity that can be misused. You can reduce this risk, by taking a look into scrubbing your information from across the interwebs using a service, which might even integrate with other tools you are already using such as your antivirus - see this for more ideas: https://www.zdnet.com/article/best-data-removal-services/ . 

Ideally, you should ensure accounts you don't use anymore are closed and deleted as a standard practice. 

This is integral to the overall handling of Personally Identifiable Information (PII) which is best to minimize (US Federal Trade Commission - protect PII) and important to protect. For instance there are few good reasons to give your Social Security Number (SSN) to anyone or any service that you don't have a direct relationship with. Often, it is sufficient to provide only the last four digits of your SSN until you have had a chance to verify the organization you are giving this information to and vice-versa. If you do give this identifier away (SSN), feel free to ask (or otherwise investigate) how it will be used, how long it will be retained, and how it and associated information will be disposed of.

Whenever you give out your PII (particularly SSN, birthdate, credit card numbers, license number, address... you get the idea):  Remember it's YOUR information, it's your right and responsibility to know how and why it will be used.

Software Auditing

When you are exceedingly bored and looking for something to do, or when you are installing new software, or when an OS update as been forced upon you and is causing you to reboot, think about these two (2) things:

1- Versioning and Updating:

Are you keeping up with the latest versions of the software you use, particularly key applications like your operating system (OS), word processing, browsers, etc.? Save yourself trouble and set them up for automatic updates - often you get a free service for updates for security and bug fixes from the vendor. This can be really important: https://www.cisa.gov/secure-our-world/update-software. 

It is assumed, that at a bare minimum you are using Windows Update or whatever automatic update system your OS uses to facilitate automatic, unattended updates on a frequent schedule. If this isn't turned on, stop reading and enable it now... Good. Now that we are sure that's set, we can continue.

2- Excess Software:

If you are like me, sometimes you find software that meets a one-time need or that simply sounds interesting and you try it by installing it. A professional technique for managing security risks is to keep up-to-date on the inventory of software your system has on it. Know what is installed on your computer and get rid of older, unused programs. Make sure all the software you use is the latest, newest, version - because it should be safest - the makers of it closed should have any serious vulnerabilities they know about. 

Without any specialized tools you can easily run a quick manual scan to check versions using the "Settings" app for windows (within the "Apps & Features" app) that does a competent job of  allowing you to see the versions of installed windows software. In addition, there are many open source tools for this which I will discuss in follow-up posts. Professional tools for getting this information include https://snipeitapp.com/ and GLPI (which can be a lot, though with a very full range of capabilities).

In short, if you don't need it, get rid of it. And now that's done - right? So we can continue.

Since this was meant to be a minimal list, it's time to finish. There are many other aspects of personal systems security to think about (for instance if your phone has a password lock and screen timeouts, they should be enabled) but this covers some items I've seen overlooked and that are crucial as a basic level of security. Ideally, you'll review your systems and find these items are taken care of, and if not you are alert to things you really should attend to.