In 1981 a college professor caught me trying to break into the school’s computer system. He didn’t suspend me. He said, since you hacked our computer, you’re now in charge of system security, and handed me the job.
That was the most useful thing anyone has ever done for my career, and not because it taught me about computers. It taught me that the only reliable way to protect a system is to look at it the way somebody trying to get in would look at it. Not the way the person who built it sees it, and definitely not the way the brochure describes it.
Thirty-three years in enterprise technology later, twenty of them running computer operations at Trader Joe’s, that habit has never stopped paying. It’s also the reason I find most home security advice close to useless. It describes products. It doesn’t describe how anybody gets in.
How does a company with cameras and card readers still get breached?
The company had spent thousands on card readers, security cameras and alarm systems. Every door logged every entry. Every corridor was covered. On paper it was excellent.
An employee got tired of digging his badge out every time he stepped outside for a smoke break, so he propped the door open with a brick. That was the whole breach. Everything upstream of that door became decoration.
I’ve thought about that brick for years, because it’s the shape of nearly every failure I’ve seen since. The technical controls were fine. The seam was a person doing something reasonable to make his day slightly easier.
Criminals know this better than most security professionals do. They don’t build attacks around beating your antivirus. They build attacks around what you already know and keep postponing. You know you should install that update. You keep clicking remind me later, because you’re busy and it’ll restart your machine and you have things to do.
What does an ordinary neighborhood look like from the attacker’s side?
Some years ago I drove through a suburban neighborhood with a laptop running network scanning software. Not doing anything, just looking, the way somebody who wanted in would look.
In twenty minutes I found 127 home networks still using their default passwords and 43 with no password at all. Dozens of routers hadn’t been updated in years. Any teenager with ordinary computer skills could have been inside most of those houses’ internet connections that afternoon.
None of those families thought of themselves as targets. That’s precisely why they were easy ones.
I ran a version of the same test at a cybersecurity conference, a room full of people who do this for a living. I set up a wireless network called Free Conference WiFi and left it running. Within an hour I’d captured login credentials from seventeen different smart devices, because their owners’ phones had connected automatically and the devices had followed. Most of those people had no idea their gear hands over credentials to anything that looks familiar enough.
How many connected devices are in your house right now?
I counted the devices using my own internet connection once, expecting maybe fifteen. There were 47. Phones, tablets, computers, smart speakers, security cameras, thermostats, the refrigerator.
I’d bought every one of them separately, over several years, each for its own reason. At no point did I sit down and design a network. It assembled itself out of individual purchases that each made sense on their own.
Most families are somewhere between 25 and 60 devices without ever having counted. Each one contains a computer more capable than the systems that ran entire corporations in the 1980s. Each one talks to servers belonging to companies you have never heard of.
The strangest one I’ve found belonged to a family who called me about mysterious activity on their router. We checked every computer, every phone, every obvious smart device, and found nothing. It turned out to be their two-year-old microwave. It had never been set up for internet access, so it had quietly attached itself to a neighbor’s unsecured network and was phoning the manufacturer every night.
You cannot protect an inventory you have never taken. That’s the first real step, and almost nobody does it.
The book on this: Family Cybersecurity is 231 pages on protecting a household instead of a company: the devices, the habits, the backups, and the conversations with the people you live with.
Does paid security software protect you better than the free one?
I ran a comparison of Windows Defender against four commercial antivirus products. Defender detected 99.2 percent of the malware samples, had the lowest false positive rate of anything tested, and used less memory and processor than most of the paid alternatives. The free thing already on the machine outperformed the subscriptions.
It’s an argument that the money is usually going to the wrong place. The spend feels like protection. The dull maintenance is the protection.
A small business owner I know of postponed his updates for three months because restarting interrupted his work. Criminals eventually exploited a vulnerability Microsoft had patched two months earlier. The attack encrypted everything and the ransom demand was fifty thousand dollars. He paid it and never received working decryption keys. Three years of customer records, gone, and the business rebuilt from nothing.
Ten minutes of restart, spread across three months, against the whole company. That’s the real exchange rate, and it never feels like that in the moment.
Why do so many breaches start with somebody being helpful?
A family I helped donated an old computer to a charity. They’d deleted their files first and believed it was clean. Deleting isn’t erasing, and whoever bought that machine from the charity recovered five years of tax returns, bank statements and personal photographs. The identity theft that followed cost them fifteen thousand dollars and two years of credit repair.
Nothing technical failed there. They did a generous thing and didn’t know that the delete key is a suggestion instead of an instruction.
Even my own network taught me this one. I noticed a gaming console connecting at three in the morning, every night. It was my neighbor’s teenager, who had guessed my WiFi password and had been downloading games for months. He’d consumed nearly half my monthly data before I looked.
What should you do first, and in what order?
If you take one thing from this, take the order. Most people start with the most visible step instead of the most effective one.
Count your devices. Open your router’s admin page and look at the list. You’ll find things you forgot about and probably something you don’t recognize. That list is what you’re protecting.
Change the router’s default password. Then check when it was last updated. This is the front door and it’s the one people skip.
Turn on automatic updates and stop postponing them. The restart is the price. It’s a low price.
Back up the things you cannot replace, and keep one copy somewhere that’s not attached to your network. Ransomware encrypts what it can reach.
Talk to the people you live with. Every technical control in your house runs through somebody’s judgment at some point. The brick is always a person, and the fix is a conversation instead of a purchase.
None of that is exciting and none of it costs much. That’s rather the point. The professor who caught me in 1981 was right about the method: look at your house the way somebody trying to get in would look at it. What you find will be duller and more fixable than you expect.