These 3 crucial Windows security mistakes can wreck your PC

Your PC is secure the first time you start up Windows—but it doesn’t always stay that way. You can make mistakes that break that protection.

Cybersecurity experts see a lot, and as a result, they know exactly how people get themselves in trouble. When I spoke with folks from Microsoft at this year’s RSAC Conference (formerly known as RSA), they had quick answers for what the biggest issues are. That included three particular habits that cause a world of hurt, according to David Weston, CVP, Enterprise and OS Security.

What’s the good news? Dodging these pitfalls is pretty simple. Read on for the problems—and their solutions.

Leaving internet devices exposed

Wlan Router — When’s the last time you confirmed your router is on the most current firmware?

New Africa/Shutterstock.com

Your tech gear shouldn’t be freely accessible to anyone on the internet. Attackers can exploit your devices to spread malware, spy on everything you do, or steal your data.

How does this happen? Maybe you turned on the remote desktop on your PC, either purposely or accidentally. Or you didn’t patch your router with the latest security updates. Or you connect a poorly secured internet-enabled device to your home network (e.g., a baby monitor).

The solution: Block incoming internet access to your devices. If you must allow it, turn on access only when actively using it. Also keep the software and firmware up to date on your PC, router, and other online-enabled products. And leave cheap or unnecessary gear offline.

The short answer is that you should block random strangers from connecting to your devices.

Installing malware

solarseven/Shutterstock.com

These days, malware can land on your PC and devices in more ways. You need to keep an eye out for more than just a download that seems suspicious.

Attackers use these methods to spread ransomware, spyware, infostealers, remote access trojans, and the like. Typically, the goal is to steal money from you. Maybe the hacker will grab information like login credentials or just go for outright extortion.

The solution: Only install software from reputable websites and recognizable developers. You should be able to find neutral, detailed feedback about the app on forums or Reddit. If you can only find generic positive comments about the software (“omg it’s amazing, changed my life”), proceed with caution.

Also, make sure your antivirus software is active and up-to-date. It’s helpful as an extra safeguard, though not foolproof.

Getting phished

Phishing-Mails mit der Warnung zum iCloud-Account im Umlauf — An example of a phishing email related to an iCloud subscription.

Halyna Kubiv

Click a bad link, and you could end up giving away your login info to a service—or downloading malware. While some phony emails and text messages are pretty easy to spot, others can sound pretty convincing. Even if you’re normally careful, the best of us can still slip up unexpectedly.

The solution: Don’t click on links in email and text messages. Period. Until recently, common advice was to avoid links you don’t trust. But with AI making scam messages sound more convincing (and harder to spot), multiple experts recommend full skepticism at all times.

Instead, independently navigate to a website before logging in. Or, contact customer service directly to confirm the necessity of an app or extension you’re being told to download.

It can be easy to forget or have an off day, though—so these other helpful steps act as extra safety nets:

Switch to passkeys as your login method wherever possible, especially for valuable accounts. They’re phishing-resistant.
For all other services, enable two-factor authentication (2FA), preferably a phishing-resistant method like Yubikeys. Otherwise, make sure that a login page is official before entering a one-time code or authorizing a 2FA request.
Slow down and take a breath if an urgent or scary message comes through. Scammers want you to be panicked and not thinking straight so they can more easily take advantage of you.
Periodically confirm your antivirus and browser are up to date. They won’t block every phishing attempt—some spin up and then vanish within minutes, long before software can be updated—but they can help add to your defenses.