The habits that outrank the software
Four practices do more for a household than any subscription, and none of them costs anything. They are also the ones nobody advertises, because there is no product attached.
Updates, applied rather than postponed
Software flaws get found, fixed, and then published — and publication is what makes an unpatched machine attractive, because the fix describes the problem. The gap between a fix being released and being installed on your device is the window that matters, and on a home machine that window is entirely under your control.
The practical version of this habit is short. Turn on automatic updates for the operating system, the browser, and any application that offers it. Restart when asked rather than deferring for the fourth week running; many updates are not actually applied until the restart happens. Check the devices that do not nag — routers, printers with network features, smart televisions, anything bought several years ago. And retire what no longer receives updates at all: an operating system past its support date does not get fixes no matter what security product you install over the top of it. The Australian Cyber Security Centre's guidance for individuals and families at cyber.gov.au makes the same point in more detail and is free to read.
Passphrases, and never the same one twice
The mechanism that turns a stranger's data breach into your problem is reuse. Credentials exposed at one organisation are tried, automatically and at scale, against banks, email providers and shopping accounts. A password used in only one place cannot be reused against you anywhere else, however badly the organisation that lost it behaved.
Length beats complexity theatre. Four or five unrelated words are easier for a person to remember and harder to attack than a short string tortured with symbols, which is why passphrases have replaced the old advice in most current guidance. The more useful move, though, is to stop remembering them at all: a password manager generates a distinct credential for every account and you memorise one strong passphrase to open it.
Which accounts to fix first
Not all accounts are equal. Start with the email address that can reset all the others — it is the master key, and it deserves the longest passphrase and the strongest second factor. Then your banking and superannuation logins, then anything holding payment details, then the rest as you happen to sign in to them. Trying to change ninety passwords in one weekend is how the project gets abandoned at password nine.
A second factor on everything that offers one
Multi-factor authentication means a password alone is not enough: something else is needed, typically a code from an app on your phone, a hardware key, or a prompt you approve. It is the single most effective control available to a household, because it breaks the attack that actually happens — somebody, somewhere, using a password that is genuinely yours.
The forms are not equal. A code from an authenticator app or a hardware security key is stronger than a code sent by SMS, because text messages can be intercepted or diverted through number-porting fraud. SMS is still far better than nothing; if it is all an account offers, use it. Keep the recovery codes an account gives you at set-up somewhere physical, because they are what gets you back in when a phone is lost, and losing both at once is the failure mode people actually experience.
A backup you have actually restored from
Backups are the answer to ransomware, to theft, to a dropped laptop, and to the ordinary accident of deleting a folder. The widely used shorthand is three copies of anything that matters, on two different kinds of storage, with one of them somewhere else — a second drive plus a cloud service, or two drives with one kept at a relative's house.
Two refinements make the difference between a backup and a comfort. The first is that at least one copy should not be permanently connected to the computer: storage that is always mounted and always writable is storage that ransomware can encrypt along with everything else. An external drive that is plugged in weekly and then unplugged satisfies this simply. The second is that you have to try a restore. Pull a handful of files back from the backup and open them. A backup that has never been read is an assumption, and this is the only way to find out whether it is a correct one.
| Copy | Where it lives | What it protects against |
|---|---|---|
| The working copy | On the device you use every day | Nothing — this is the copy at risk |
| Local backup | External drive, connected on a schedule and then disconnected | Deletion, drive failure, ransomware, and it restores quickly |
| Off-site backup | A cloud backup service, or a drive kept at another address | Fire, flood, theft of the whole house's equipment |
The pause, which is a skill rather than a setting
Almost every successful scam depends on the target acting immediately. The message says the account will be closed today, the delivery needs a fee now, the invoice is overdue, the relative is stranded. Urgency is not incidental to the technique — it is the technique, because it prevents the thirty seconds of checking that would end it.
So the habit is procedural: when a message creates pressure, stop and verify through a channel you already had. Ring the bank on the number on your card, not the number in the message. Open the parcel service's app rather than the tracking link. Call the family member on the number already in your phone. This costs a minute and it is the defence that works against the attacks no scanner sees, because no malicious file is ever involved.
Shared devices and younger users
A family computer used by several people is a different problem from a personal laptop. Separate user accounts are worth the small inconvenience — they keep files apart, limit what an accidental installation can change, and make it obvious whose session did what. Keep the day-to-day account a standard one rather than an administrator account where the platform makes that easy; software that needs administrator rights can still be installed, but it has to ask.
Where children use the devices, the eSafety Commissioner publishes age-specific guidance for parents and carers, along with the reporting routes for cyberbullying and image-based abuse, at esafety.gov.au. Those are matters of online safety rather than malware, and they are not solved by anything in a security suite.
A maintenance routine that fits in a year
- Weekly: let the scheduled scan run; glance at whether updates applied.
- Monthly: connect the backup drive, run the backup, disconnect it. Check that the cloud backup is actually current rather than paused.
- Quarterly: restore two or three files from the backup and open them. Review which devices are signed in to your main email and remove any you do not recognise.
- Twice a year: check the router for firmware updates and confirm its administration password is not the factory one.
- Annually: before the renewal reminder you set in step four, reconsider the subscription against the criteria in step three, and delete accounts you no longer use so their data stops being your exposure.
None of this is dramatic, which is precisely why it works. The software you chose in the earlier steps handles the malicious file; these habits handle everything else, and everything else is most of it.