By Bruce Schneier, from the 15may2001 CRYPTO-GRAM News Letter.
You can't memorize good enough passwords any more, so don't bother. Create long random passwords, and write them down. Store them in your wallet, or in a program like Password Safe. Guard them as you would your cash. Don't let Web browsers store passwords for you. Don't transmit passwords (or PINs) in unencrypted e-mail and Web forms. Assume that all PINs can be easily broken, and plan accordingly.
Use it. Download and install the updates every two weeks, and whenever you read about a new virus in the media. Some antivirus products automatically check for updates.
Use it. There's usually no reason to allow any incoming connections from anybody.
Delete spam without reading it. Don't open, and immediately delete, messages with file attachments unless you know what they contain. Don't open, and immediately delete, cartoons, videos, and similar "good for a laugh" files forwarded by your well-meaning friends. Turn off HTML mail. Don't use Outlook or Outlook Express. If you must use Microsoft Office, enable macro virus protection; in Office 2000, turn the security level to "high" and don't trust any sources unless you have to. If you're using Windows, turn off the "hide file extensions for known file types" option; it lets Trojan horses masquerade as other types of files. Uninstall the Windows Scripting Host if you can get along without it. If you can't, at least change your file associations so that script files aren't automatically sent to the Scripting Host if you double-click them.
SSL does not provide any assurance that the vendor is trustworthy or that their database of customer information is secure. Think before you do business with a Web site. Limit financial and personal data you send to Web sites; don't give out information unless you see a value to you. If you don't want to give out personal information, lie. Opt out of marketing notices. If the Web site gives you the option of not storing your information for later use, take it.
Limit the applications on your machine. If you don't need it, don't install it. If you no longer need it, uninstall it. If you need it, regularly check for updates and install them.
Back up regularly. Back up to disk, tape, or CD-ROM. Store at least one set of backups off-site (a safe-deposit box is a good place) and at least one set on-site. Remember to destroy old backups; physically destroy CD-R disks.
Keep your laptop with you at all times when not at home; think of it as you would a wallet or purse. Regularly purge unneeded data files from your laptop. The same goes for palm computers; people tend to keep even more personal data, including passwords and PINs, on them than on laptops.
Install an e-mail and file encryptor (like PGP). Encrypting all your e-mail is unrealistic, but some mail is too sensitive to send in the clear. Similarly, some files on your hard drive are too sensitive to leave unencrypted.
Turn off the computer when you're not using it, especially if you have an "always on" Internet connection. If possible, don't use Microsoft Windows.