Cybersecurity for beginners: protect yourself in one evening
On 29 October 2026 about $6.3 billion left Binance's hot wallets in a few hours, the biggest crypto theft on record. By the exchange's first account, nobody broke the blockchain: attackers took over one engineer's work laptop and used it to reach the service that sends withdrawals. Big hacks start with people and their devices, and so do small ones. The good news: basic protection stops almost all attacks on ordinary people, and it takes one evening. Here is the order.
Free course on this topicCybersecurity from Scratch: free courseStart the course →
Step 1: understand why you are a target
Most attacks are bulk, not personal. A website's database leaks, bots try those email and password pairs everywhere, and wherever the password matches, they are in. Attackers come through three doors: your account (a guessed or stolen password, an intercepted SMS code), your device (malware, theft, a phone with no lock) and you (talked into giving a code or installing a program).
"I have nothing to steal" is a myth: a hijacked account gets used to ask your friends for money in your name. Start with the three keys to everything: your email, your phone number and your main device. Lesson: How one laptop cost $6.3 billion
Step 2: one unique password per site, and length wins
When one site leaks, bots try the same password on email, banks and exchanges. This is called credential stuffing, and one reused password opens every door. "Dan2004!" looks complex but bots try names and years first. Six random words from a 7,776-word list give about 2·10²³ combinations: easy to remember, impossible to guess. Pick the words with a generator, not your head.
NIST, the US standards body, says length beats "complexity", a password that is the only protection should be at least 15 characters, and scheduled password changes are not needed unless there are signs of a leak. Check your email on Have I Been Pwned: if it shows up in a breach, change that password everywhere it was reused. Lesson: Passwords nobody can guess
Step 3: let a password manager remember them
You can't remember 100 different passwords, and you don't need to. A password manager stores a random 20+ character password for each site in an encrypted vault; you remember one long master phrase. Built-in options are Apple Passwords and Google Password Manager; standalone ones include Bitwarden, 1Password and Proton Pass.
Bonus: it catches phishing. The manager ties each password to the exact address, so on a lookalike site it stays silent. If it doesn't offer a password on a "familiar" site, stop and check the address. Move email, bank and exchange passwords first, the rest on your next login. Lesson: A password manager: remember just one
Step 4: turn on 2FA, ideally a passkey
In Google's 2019 study, against targeted attacks an SMS code stopped 76% of attempts, an on-device prompt 90% and a security key 100%. SMS is the weakest rung: in January 2024 scammers talked a carrier into moving the US SEC's number to their SIM and hijacked its X account. An authenticator app is better. A passkey is best: it is tied to the exact site address and simply won't work on a fake. Save backup codes on paper at home. Lesson: 2FA: from SMS to passkeys
Step 5: lock your email and phone number
Almost every "Forgot password?" link goes to your email, so whoever owns it gets in almost anywhere. Do a 10-minute check-up: unique password plus passkey or authenticator, your own recovery email and phone, no forwarding rules or filters you didn't create, and sign out unknown devices.
Protect your number from a SIM swap: ask your carrier for a port-out PIN or a block on SIM changes (often called Number Lock or SIM Protection) and set a PIN on the SIM itself. If your signal vanishes for no reason, call the carrier from another phone at once. Lesson: Email and phone number: the master keys
Step 6: update, don't "remind me tomorrow"
Microsoft patched a Windows hole on 14 March 2017. On 12 May the WannaCry ransomware used that same hole to hit more than 200,000 computers in 150 countries. The same year Equifax lost the data of 147 million people through a bug that already had a fix. Turn on automatic updates for your phone, laptop, browser and banking apps, and don't keep money apps on a device that no longer gets security updates. Lesson: Updates: the boring superpower
Step 7: protect your phone from theft
The nastiest scheme: a thief watches you type your unlock code, then steals the phone and resets your accounts. Use six digits or more (four digits is only 10,000 combinations), cover the screen when typing, and turn on Stolen Device Protection on iPhone or theft protection on Android. Hide message previews on the lock screen so codes don't show, and install apps only from the App Store or Google Play. Lesson: Your phone: lock, theft and apps
Step 8: spot phishing and fake support
Read an address right to left up to the first "/": in binance.com.login-check.io the owner is login-check.io. Better still, one habit: never follow links from emails or messages to anywhere you log in or pay; open the app or your bookmark yourself. Lesson: Phishing: how not to take the bait
Real support will never ask for a code, your password or a seed phrase, never ask you to install remote access apps like AnyDesk, and never tell you to move money "to a protected account". Hear one of these and hang up. Lesson: Fake support
Step 9: have a plan if you get hacked
Order beats speed. Grab a clean device, lock the affected account (for an exchange, in security settings or in-app support), change your email password and sign out everywhere. Ignore "crypto recovery experts" who show up after you post about it: the FBI has warned about these upfront-fee schemes. File a report with the exchange and the police: stolen funds can sometimes be frozen. Lesson: Your plan if you get hacked
FAQ
Where should a beginner start with cybersecurity?
With your own accounts: a unique password for every site in a password manager, 2FA (a passkey where possible) on email, bank and exchange, and automatic updates. That covers the doors most attacks use and takes about one evening.
What is the most important cybersecurity tip?
Secure your email first. It resets the passwords of everything else, so give it a unique password, a passkey or authenticator app, and check for forwarding rules you didn't create.
Is SMS two-factor authentication safe?
It is much better than no 2FA, but it is the weakest kind: your number can be stolen with a SIM swap and the codes go to the scammer. Use an authenticator app or a passkey wherever the service allows it.
Free course on this topicCybersecurity from Scratch: free courseStart the course →