Most people don't need to become computer security experts to stay reasonably safe online.
You don't need to understand firewalls, encryption, malware analysis, or all the other technical terms computer professionals throw around. You just need to develop a few good habits and learn to recognize when something doesn't look right.
Windows 11 already includes some very good security tools. The problem is that no antivirus program can completely protect you if someone tricks you into giving away your password, clicking a dangerous link, or allowing a stranger to remotely control your computer.
That's why computer security isn't just about protecting the computer.
It's also about protecting you.
Start With Better Passwords
Passwords are still one of the most important parts of computer security.
Unfortunately, they're also one of the places where people make the biggest mistakes.
Passwords like:
password123
12345678
your dog's name
your birthday
your children's names
or your telephone number
may be easy to remember, but they're also easier for criminals to guess.
Another common mistake is using the same password everywhere.
Suppose you use the same password for Facebook, Gmail, Amazon, and your bank. If one of those passwords is stolen, the criminal can try that same email address and password on your other accounts.
Suddenly, one stolen password can become several stolen accounts.
A better password is long and unique.
The Cybersecurity and Infrastructure Security Agency, or CISA, recommends passwords that are at least 16 characters long and using a different password for every account.
That doesn't necessarily mean you have to memorize something that looks like:
X7#pQ92!zR4@Lm8$
Instead, consider a long passphrase made from several unrelated words that are easy for you to remember but difficult for someone else to guess.
Don't use my example, but think of something along the lines of four or five completely unrelated words mixed together.
Length is your friend.
Don't Try to Remember Every Password
If you're using a different strong password for every website, you can quickly end up with dozens of passwords.
You're probably not going to remember all of them.
Neither am I.
That's where a password manager can help.
A password manager stores your passwords for you and can create long, random passwords that you don't have to memorize. CISA specifically recommends password managers as a practical way to maintain strong, unique passwords.
Modern browsers and other reputable password managers can also automatically fill your password when you visit the correct website.
That can actually provide another layer of protection. If you're on a fake website pretending to be your bank, for example, the password manager may not recognize it as the real site and may not automatically enter your password.
That should be a warning sign.
Turn On Two-Factor Authentication
A strong password is good.
A strong password plus another form of verification is much better.
You've probably already encountered this.
You enter your password and then the website sends a code to your phone, asks you to approve the login through an authenticator app, or asks for your fingerprint.
That's called multi-factor authentication, usually shortened to MFA or 2FA. You may also see it called two-factor authentication or two-step verification.
The idea is simple.
A criminal might steal your password, but they would still need the second method of identification to get into your account.
Microsoft recommends two-step verification for Microsoft accounts, and CISA recommends enabling MFA on accounts that offer it.
I especially recommend using it on your email, banking, social media, shopping, and Microsoft accounts.
Your email account deserves special attention because password-reset messages for many of your other accounts are probably sent there. If someone takes control of your email, they may be able to reset passwords for several other accounts.
Protect your email account first.
Learn to Recognize a Scam
Some of the most dangerous computer attacks don't start with a virus.
They start with a message.
It might be an email.
It might be a Facebook message.
It might be a text message.
It might even be a telephone call.
The person contacting you may claim to be from Microsoft, your bank, Amazon, PayPal, Facebook, the government, or another organization you trust.
Then comes the pressure.
"Your account will be closed."
"Someone purchased $900 from your account."
"Your computer has a virus."
"Your package cannot be delivered."
"You've won a prize."
"Click here immediately."
The goal is to make you react before you have time to think.
That sense of urgency is one of the biggest warning signs of a scam. CISA and the Federal Trade Commission both warn that phishing messages frequently use alarming language, suspicious links, unexpected attachments, or requests for personal information.
Here's one of the simplest security rules you can learn:
Don't use the link in the message.
If you receive an email supposedly from your bank saying there is a problem with your account, don't click the button in the email.
Open your browser yourself and go to the bank's website the way you normally do.
Better yet, use the bank's official app.
If Amazon supposedly says there's a problem with an order, open Amazon yourself and check your orders.
If PayPal says someone sent money, log into PayPal yourself.
Don't let the message decide where you go.
Your Bank Doesn't Need Your Password
Legitimate companies already have ways to access and manage their systems.
They don't need you to tell them your password.
They also shouldn't need the verification code that was just sent to your telephone so they can "verify your identity."
That code may actually be the final piece a scammer needs to get into your account.
Never give someone a password, PIN, or security verification code because they called, emailed, or texted you asking for it.
And be extremely suspicious of anyone who wants you to install remote-control software so they can "fix" your computer.
Once you give someone remote control of your computer, you're giving them tremendous access to your information.
Windows 11 Already Has Antivirus Protection
I've heard people say that they don't have antivirus software installed on their Windows computer.
They often do.
They just don't realize it.
Windows 11 includes Microsoft Defender Antivirus as part of Windows Security. It provides real-time protection and automatically scans for viruses, malware, spyware, and other threats.
You can check it yourself.
Click Start and type:
Windows Security
Open the Windows Security application.
You'll see several areas of protection.
For most home users, you don't need to start changing advanced settings. You're mainly looking for warnings telling you something needs your attention.
If everything looks good, leave it alone.
Run a Virus Scan
If your computer suddenly starts behaving strangely, you can manually run a scan.
Open:
Windows Security
Then select:
Virus & threat protection
Then click:
Quick scan
Microsoft Defender will check your computer for common threats. Windows Security also provides additional scan options if you need a more thorough examination.
You don't need to run a manual scan every day. Windows Security normally works in the background.
But if something suspicious happens, running a scan is a good place to start.
Leave Real-Time Protection Turned On
Under Virus & threat protection you'll also find settings for Real-time protection.
For most people, this should stay turned on.
Real-time protection allows Windows to examine programs and files as you're using the computer instead of waiting until you manually run a scan.
If some website or stranger on the telephone tells you that you need to disable Windows Security before installing their software, that's a huge red flag.
Stop.
There are legitimate situations where experienced computer professionals temporarily disable security software, but the average home computer user rarely has a reason to do it.
Don't Turn Off the Firewall
Windows 11 also includes Windows Firewall.
Think of a firewall like a security guard standing between your computer and the network.
Its job is to control which network connections are allowed.
Open Windows Security and select:
Firewall & network protection
Your firewall should normally be turned on.
Microsoft specifically warns that opening unnecessary firewall ports or allowing unknown programs through the firewall can make your computer less secure.
If some program you've never heard of suddenly asks for permission through the firewall, don't automatically click Allow.
Ask yourself whether you know what the program is and why it needs network access.
When you don't know, choosing Cancel is usually safer than guessing.
Pay Attention When Windows Warns You
Windows 11 also includes protections designed to warn you about suspicious programs, websites, and downloads.
Open:
Windows Security > App & browser control
Windows uses technologies such as Microsoft Defender SmartScreen and reputation-based protection to identify suspicious websites, downloads, phishing attempts, and potentially unwanted applications.
Sometimes people treat security warnings like annoying advertisements.
Click.
Click.
Click.
Whatever makes the warning disappear.
Don't do that.
Read the warning.
Windows may be trying to tell you that something you're about to install is unknown or dangerous.
Security software doesn't know everything, and occasionally a legitimate program can trigger a warning. But unless you understand why you're receiving the warning and know the program is trustworthy, don't override it just to make the message disappear.
Be Careful What You Download
A virus has to get onto your computer somehow.
One common way is through something you download.
It might pretend to be a useful program, free game, browser extension, video player, driver update, PDF utility, or some other software.
Download software from the company that actually makes it whenever possible.
Be especially careful with websites that cover the screen with several brightly colored DOWNLOAD buttons.
Which one is the real download?
Sometimes that's exactly what the bad guys are hoping you'll wonder.
If you don't know what you're downloading, don't download it.
Keep Windows Updated
Security problems are constantly being discovered in Windows, browsers, and applications.
Companies fix many of those problems through updates.
That's one reason you shouldn't continuously postpone Windows Update.
In Windows 11, open:
Settings > Windows Update
Check for updates and install them.
You may occasionally need to restart the computer before an update is completely installed.
Microsoft and CISA both recommend keeping software updated because security updates repair vulnerabilities that criminals may otherwise exploit.
Updates aren't just about getting new features.
Some of the most important updates are fixing problems you'll never see.
Protect Your Personal Information
Identity theft doesn't necessarily require someone to break into your computer.
Sometimes we simply give away too much information.
Your full name, birthday, address, telephone number, email address, Social Security number, banking information, passwords, and answers to security questions can all become valuable pieces of information.
One piece may not seem important.
Several pieces put together can become very important.
Be careful about what you post publicly on social media.
That cute birthday announcement tells people your birthday.
Pictures of your first car, hometown, high school, pets, children, and family members may also reveal answers to common security questions.
The Federal Trade Commission recommends limiting the personal information you give out and using strong passwords and multi-factor authentication to help protect against identity theft.
What If You Think You Made a Mistake?
Maybe you clicked something and realized afterward that you probably shouldn't have.
Don't panic, but don't ignore it either.
If you only opened a suspicious webpage, close it and run Windows Security.
If you downloaded a suspicious file but haven't opened it, don't open it. Delete it and run a scan.
If you entered a password into a suspicious website, change that password immediately using the legitimate website. If you've used that same password anywhere else, change it there too.
If you gave someone financial information, contact your bank or credit-card company using the telephone number printed on your card or statement—not a telephone number the suspicious caller gave you.
If you approved an unexpected login request, change the account password and review the account's security settings.
Acting quickly can make a big difference.
Security Doesn't Have to Be Complicated
You could spend years learning computer security.
You don't have to.
For the average Windows 11 user, a few basic habits will eliminate a lot of unnecessary risk:
Use long, unique passwords and consider using a password manager.
Turn on multi-factor authentication, especially for email and financial accounts.
Don't click unexpected links in emails, texts, or social-media messages.
Never give someone your password or verification code.
Leave Windows Security, real-time protection, and Windows Firewall turned on.
Pay attention when Windows warns you about a suspicious website, download, or program.
Download software only from sources you trust.
Keep Windows and your other software updated.
Think before giving anyone personal or financial information.
When something doesn't feel right, stop before clicking.
That last one may be the most important.
Scammers want you to hurry.
They want you frightened, excited, curious, or confused.
You don't have to play their game.
Close the message. Hang up the telephone. Open the company's legitimate website yourself. Call your bank using a number you already know is correct. Ask someone you trust if you're unsure.
Your computer already has tools designed to help protect you.
Give those tools a chance to do their job—and don't let a scammer talk you into opening the door for them.
Sign up for ExtraHelp.us email updates so you will be notified when I publish new articles about creating a strong résumé, using LinkedIn, building a home lab, protecting yourself online, and developing practical technology skills.
If you found these suggestions helpful, please support this blog by subscribing, leaving a comment, asking questions, or sharing the article with someone who may need it. It only takes a few minutes, and you may help someone change the direction of their life.
I will never share your email address with anyone.
Get New Posts by Email
Return to the Master Series
