Top 5 Cybersecurity Tips from a Hacker to Protect You Online

During my daily tasks as an ethical hacker (I lean towards the term penetration tester, though), I come across several frequent security errors that allow me to infiltrate your computer systems without permission. My job becomes significantly simpler when passwords are carelessly scribbled on desks. However, I’m certainly not alone in taking advantage of such oversights; others also seek shortcuts for convenience.

Financially motivated malicious hackers typically target the easiest prey, aiming for low-hanging fruit. However, making some simple adjustments can significantly increase the difficulty for an attacker trying to exploit your system and compromise your privacy. With this in mind, here’s a rundown of the top five practices you might want to modify when online—considering how hackers operate. Some points may seem familiar, yet adopting them all could mean the distinction between falling victim to hacking attempts and staying secure.

1. Use a VPN

Encryption is crucial, and ideally, each website should at least use TLS along with HTTP Strict Transport Security. However, since reality isn’t always perfect, for all other scenarios, we rely on alternative methods. virtual private networks (VPNs) They establish an encrypted channel that directs your online data from your device to the VPN server operated by the service provider. This is particularly important when you're traveling and frequently using public Wi-Fi hotspots. To really understand why this matters, try going out one day with Wireshark pre-installed on your laptop. You'll be able to observe all sorts of personal details being transmitted via free airport Wi-Fi networks through your mobile device. The view isn’t exactly reassuring.

It’s true that there is disagreement among security professionals about whether one should utilize a Virtual Private Network (VPN). Opponents often cite concerns related to handing control of your data traffic over to an unreliable third party as their primary objection. In my view, however, we're already placing our faith in Internet Service Providers (ISPs), which require governmental approval to function. Governments may well be monitoring us too. So why not add another layer of difficulty for them? That said, I do not recommend choosing just any random VPN service; instead, select one that has undergone thorough audits and scrutiny. no-log VPN can offer a level of safeguarding from governmental monitoring that would be unattainable without them.

More importantly, a top-notch VPN provides two main advantages: first, it conceals your IP address It considerably complicates efforts to pinpoint your real location; additionally, it prevents access to many known malicious sites and compromised advertising networks via DNS blocking. Ad-blocking itself diminishes a major pathway for malware, which makes it worthwhile to use even for that reason alone.

Test the top-rated VPN available with zero risk: NordVPN

In 2024, NordVPN leads the rankings as the top choice for VPNs due to its user-friendly interface, exceptional speed, high level of security, and ability to access all streaming services without restrictions based on our recent evaluations.

▶ Interested in learning more? Check out the details here: best VPN services on the market. View Deal

2. Use a JavaScript blocker or add sites to your whitelist

The structure of the internet implies that a significant portion of what you see in your web browser reaches you through JavaScript. Although this technology enhances website appearance and user experience, it simultaneously acts as a channel for numerous types of cyberattacks such as clickjacking, denial-of-service, cross-site scripting, and request forgery. In certain scenarios, it could potentially enable the execution of arbitrary code.

Using a JavaScript blocker or whitelist allows you to permit scripts only from reliable origins, thereby reducing vulnerabilities linked to harmful or invasive code. This approach helps protect against assaults originating from malevolent advertisements and significantly lowers the risk of losing your session credentials during a drive-by attack. NoScript It remains the gold standard for JavaScript-blocking tools. I use that one as well. uBlock Origin To ensure I have covered all my online fronts.

3. Stalk yourself

Hardly anyone realizes the extent of personal data floating around online, ready to be pieced together by others. I frequently utilize LinkedIn to gather details regarding a firm’s workforce, tech stack, and office sites; however, tackling sophisticated cyber attackers demands a somewhat distinct strategy.

Consider a piece of publicly available information like your email address or a username you frequently employ. Through simple open-source intelligence methods combined with targeted Google searches, you might be surprised at just how extensive the personally identifiable details can become, often revealing not only your true identity but also addresses and additional private facts about you.

After understanding the process another person might use to connect your virtual presence with your actual identity, eliminating or erasing such data from your digital profiles can break this connection. Consequently, it becomes significantly harder for nefarious individuals to misuse your private details (thus reducing the likelihood of encountering a crazy Call of Duty enthusiast who has plenty of free time).

It’s crucially significant for networks such as Facebook and Twitter. Believe it or not, numerous responses to security inquiries can easily be discovered with just a brief look through an individual's Facebook timeline or their Twitter updates. Additionally, take some time to investigate the privacy options provided by these social networking services so that solely acquaintances have permission to view your private data. Gaining expertise in open-source intelligence (OSINT) might require considerable time; however, implementing minimal protective measures still holds more value than none at all.

4. Update your apps

Indeed, this might seem like mundane guidance. However, these fundamental safety measures frequently play a pivotal role in determining whether organizations succeed or fail when it comes to cybersecurity. Failing to keep software up-to-date leads to numerous challenges for IT security teams globally. Therefore, ensure that both your operating system and all applications (particularly those with online connectivity) are updated consistently. Just taking a look at the Common Vulnerabilities and Exposures list can provide insight into how widespread software vulnerabilities really are.

This holds particular significance for mobile devices, as they frequently store extremely confidential data—making them an ideal target for hackers. You might be familiar with the Pegasus spyware, which exploited multiple sophisticated vulnerabilities within both iOS and Android operating systems to remotely infiltrate high-profile journalists’ smartphones through text messages.

However, phones are not the sole arena for such attacks. In particular, outdated browsers serve as prime targets for zero-click malware assaults, which can compromise your computer simply by visiting a dubious website.

Should you need to retain an outdated operating system for legacy reasons—like supporting obsolete software editions—it’s advisable to keep these isolated within virtual environments or entirely disconnected networks devoid of online access.

5. Stop recycling your passwords

I know people have probably mentioned this many times before, but here’s why it matters: numerous unsafe websites and applications ask you to share your passwords with them. Many of these platforms either store your passwords as plain text or use unsalted MD5 hashing (basically weak protection that doesn’t actually safeguard you effectively).

If you use the same passwords across multiple sites, it’s like having a time bomb waiting to explode if one of those platforms gets breached; once your password ends up on the dark web, it’s only a matter of time before someone tests that login information on major websites and strikes gold.

Even if your information hasn't been exposed, employing commonly used passwords leaves you open to attacks. In brute force assaults, attackers frequently utilize organized lists of passwords sourced from security breaches, significantly reducing the effort needed to discover functional login details.

Whenever I attempt to infiltrate a system, I avoid targeting just one user account with various passwords I have in mind. Instead, I use the top three commonly used passwords against all accounts within the system. It’s disheartening how frequently this approach succeeds. Make sure you update your password!

That being said, it can be challenging to recall a password for each website you might ever access. You may want to think about employing a password manager (Alternatively, at the bare minimum, enable two-factor authentication.) You can also use tools like these to verify whether any of your accounts have been compromised or if you’re employing a frequently attacked password. haveibeenpwned .

Trust nothing

There are many additional actions you can undertake online to protect your personal data, however the five steps mentioned earlier hold significant importance. Based on my experience, hackers frequently manage to breach security not because they possess exceptional technical skills or complex engineering abilities, but largely due to people’s negligence and carelessness. Why go through the trouble of picking the lock when someone hasn’t even closed the backdoor? Simple adjustments to your routines can substantially decrease the chances of becoming a target for hacking attacks (making things more challenging for me as well).

Here's a bonus tip: If you receive an odd email from someone you know requesting you to view a file, reach out to them via phone to confirm they were the ones who sent it. Take my word for it. spear phishing operates much more frequently than it ought to.