The order, and why it is in this order
The ranking below reflects two things: how many realistic problems a measure prevents, and how much of that prevention survives a mistake by the person using the computer. Measures that work without ongoing attention rank higher than measures that depend on vigilance, because vigilance is the resource that runs out first.
| # | Measure | Chiefly prevents | Cost |
|---|---|---|---|
| 1 | Automatic updates for the operating system, browser and applications | Exploitation of flaws that already have a fix | None |
| 2 | Unique passwords held in a password manager | One breach turning into several account takeovers | None to modest |
| 3 | Two-factor authentication on email and banking | A stolen password being sufficient on its own | None |
| 4 | A backup that is disconnected between runs | Permanent loss from ransomware, theft or drive failure | Hardware only |
| 5 | Daily use of a standard, non-administrator account | Silent system-wide changes by anything that runs | None |
| 6 | Installing only from vendors' own channels | Bundled adware and repackaged installers | None |
| 7 | Antivirus, whether built in or third party | Known and resembling malware reaching execution | None to a subscription |
| 8 | Reviewing browser extensions and connected apps | Long-forgotten permissions being abused | None |
Six of the eight are free, and the one that costs a subscription sits seventh. That ordering is not an argument against buying a product; it is an argument for doing the first six as well, since a purchase made instead of them buys much less than it appears to.
1. Updates, and why they outrank everything else
Most successful attacks on ordinary computers use an exploit against a flaw that the vendor has already fixed. The fix exists; the machine has not taken it. Turning on automatic updates converts an ongoing task into a background one, and it covers the three places that matter: the operating system, the browser, and applications with their own updaters, particularly document readers and media software.
Two habits undermine this. The first is postponing a restart indefinitely, which leaves updates staged but not applied. The second is keeping software that is no longer supported, where no fix will arrive at all. Removing an unused program is not housekeeping — it removes that program's share of the attack surface permanently. General guidance for individuals is published by the Australian Cyber Security Centre at cyber.gov.au.
2 and 3. Passwords that are not reused, and a second factor
Passwords leak in bulk from services that are breached. The leak itself is out of your control; what you control is whether the leaked password opens anything else. Reuse is what makes credential stuffing worth an attacker's effort, and a password manager removes reuse without requiring anyone to memorise anything beyond one passphrase.
Two-factor authentication then makes a stolen password insufficient by itself. Two accounts deserve it before any others: the email address used to reset every other password, and anything financial. An authenticator application or a hardware key is stronger than a code by SMS, because SMS can be intercepted through number transfer fraud, but a code by SMS is still a substantial improvement on nothing.
Worked example: securing an email account in ten minutes
- Set a new, long, unique passphrase for the email account and store it in the password manager.
- Enable two-factor authentication in the account's security settings, preferring an authenticator app.
- Save the recovery codes the provider issues somewhere that is not the computer itself — printed, or in the password manager on another device.
- Review the list of devices and applications with access, and revoke anything you do not recognise or no longer use.
- Check that the recovery phone number and alternate address on file are still yours.
4. A backup that is not always connected
A backup is the only measure on this list that helps after prevention has failed, which is why it belongs above antivirus rather than below it. The widely used shorthand is three copies of anything you would miss, on two kinds of storage, with one kept in another place.
The detail that does the work is disconnection. Ransomware encrypts what the computer can write to, so a drive left permanently plugged in is inside the blast radius and a drive unplugged after each run is not. A cloud sync folder is convenient but is not automatically a backup either, since it faithfully replicates the encrypted versions; whether it saves you depends on the provider's version history and how far back it goes, which is worth checking now rather than during an incident.
A backup nobody has ever restored from is an assumption. Once a year, open a file from the backup and confirm it is intact.
5 and 6. Everyday accounts and where software comes from
Running as an administrator every day means anything that executes inherits that authority. Using a standard account for ordinary work, and authenticating only when the system genuinely asks for it, means a program that wants system-wide change has to ask in a visible way — which turns a silent installation into a prompt you can refuse.
Where software comes from matters just as much. Repackaged installers on download portals are a well-known distribution route for adware and potentially unwanted programs, and a search result is not evidence of a vendor's own site. Download from the vendor's own domain or the operating system's app store, and read installer screens rather than clicking through, since bundled extras are usually pre-ticked.
7. Antivirus, in its place
An antivirus product catches known malware and code resembling it before it executes, which is worth having, and it does not address anything in the first six items. Whether the one built into your operating system is sufficient or a third-party product is worth a subscription depends on what you want added — that question is worked through on choosing protection, and the mechanism is described on how antivirus works.
Two settings matter more than the choice of product. Real-time protection should be on, having often been switched off to solve a performance problem and never switched back. And definition updates should be automatic, since a product that has not updated in weeks is running on an old catalogue.
8. Extensions and connected applications
Browser extensions run with access to the pages you visit, and an extension installed for a reason that stopped applying two years ago still has it. Extensions also change hands: a useful tool can be sold, after which an update introduces behaviour the original author never wrote. Reviewing the list twice a year and removing what you no longer use is a small task with a real effect.
The same applies to third-party applications connected to your email, cloud storage and social accounts. Each connection is a standing permission. Revoking the ones you do not recognise costs nothing and closes a route that no scanner on the computer can see.
If you think something has already gone wrong
Suspicion is not a diagnosis, and the steps below are useful whether or not anything is actually wrong. They are ordered to protect accounts first, because account access usually matters more than the computer.
- Change the password on your email account from a different device you trust, and enable two-factor authentication if it is not already on.
- Change passwords for financial accounts next, again from the other device, and contact your bank directly using the number on your card if you see a transaction you did not make.
- Run a full scan on the affected computer with the product already installed, and read the detection names rather than only the count.
- Check for remote access software you did not install, and for unfamiliar programs set to start automatically.
- Report it. Cyber incidents affecting Australians can be reported through cyber.gov.au, and scams through Scamwatch.
- Where a rootkit is confirmed or the machine's behaviour stays unexplained, reinstalling the operating system from trusted media and restoring documents from a backup made before the trouble began is more reliable than cleaning.
What this site will never do is tell you that your device is currently affected. No page here examines your computer, and any web page claiming to have scanned it is describing a result it has no way of obtaining — a tactic covered under scareware and on scams, rights and help.