Security Considerations

Security advice ages quickly, so check current guidance before you rely on any detail below. Should you decide to act upon any information on this website, you do so at your own risk!

Jump to the Checklist

Watching a TED Talk on artificial intelligence reveals an interesting world. If you think about the amount of information stored digitally and the ways someone could misuse it, it’s easy to get worried. Since humanity embarked on the digital era, a great deal of security considerations has been discussed and implemented through regulations.

Worry alone does not help, though. The sections below start with a way of thinking (what do you actually need to protect, and from whom), then cover the law, cryptography, accounts, devices, data and networks, and end with a checklist you can work through in an evening.

Start With a Threat Model

Absolute security does not exist, so the useful question is not "am I secure?" but "secure against what?". A threat model answers four questions: what do I want to protect, who or what could threaten it, how likely and how bad would it be, and what can I do that costs less than the damage? A family photo archive, a company customer database and a door lock have very different answers.

The three classic goals of information security (the "CIA triad"):

Typical threats at home and what helps most (my own selection, not a complete list):

Law and Data Protection

General Data Protection Regulation (GDPR)

Anyone involved in storing, editing, or analyzing data must be aware of the applicable laws. The GDPR has applied across the European Union since 25 May 2018 to organisations (and to people acting in a professional capacity) that process personal data of people in the EU. Purely personal or household activity, such as the photos on your own home server, falls outside it. As soon as you store other people's data for a club, a business or a client, it may apply to you as well.

The principles of the GDPR (Article 5), in plain words:

People have rights over their data: access, correction, erasure, restriction, portability and objection (Articles 15 to 21). When a breach of personal data happens, an organisation generally has to notify the supervisory authority within 72 hours, and the fines for serious infringements can reach 20 million euros or 4 % of worldwide annual turnover, whichever is higher. In Slovenia the supervisory authority is the Information Commissioner; the guidance of the European Data Protection Board applies across the EU. Products with digital elements are also being brought under the Cyber Resilience Act, which is phased in over several years, so check the current dates.

Anonymisation and Pseudonymisation

The two words are often mixed up. Pseudonymised data has had direct identifiers (names, numbers) replaced by codes, but someone holding the key can still link it back to a person, so it remains personal data and the GDPR still applies. Anonymised data cannot reasonably be linked back to anyone, and then the GDPR no longer applies. The difficulty is that real anonymisation is hard: a combination of birth date, postcode and sex is often enough to single out one person, so check the method before you call a data set anonymous.

Physical or Digital: Always a Trade-off

Laws and regulations do not stop everyone: there will always be people who try to bypass them. If you store a photo in your home, that would be the only place you need to guard to keep it private. But if you store the photo or any other document digitally and connect to the internet, keeping it secure becomes an evolving challenge where it's hard to stay up to date with the latest developments.

There are always tradeoffs. Having a single physical copy of a picture is easier to protect, but if something happens to it, the picture is gone forever. Even if nothing unusual happens, time will leave its mark. A digital copy can be duplicated at no cost, which is good for survival and bad for secrecy, because every copy is one more thing to guard.

In the case of a traditional key, the lock somehow "must know" which key to trust. The lock "knows" it is the correct key based on the physical shape of the metal. Digitally, the most basic method is using a signal that no one else uses or can access. Since this is difficult for the average person to achieve, a second method is most commonly used.

Cryptography in Practice

Cryptography specializes in securing information. Regarding digital storage, some might argue it is more secure. Personally, answering this isn't straightforward because of the constant tradeoffs. Anyone addressing this question must analyze many different aspects. What you can rely on is that a few well-studied building blocks are used everywhere, and that the practical weak point is almost always the handling of keys, not the mathematics.

The building blocks you meet every day:

TLS is the combination of these parts that protects the web, and with free certificates from Let's Encrypt there is little excuse for any page that asks for a login to be served without it. To verify a download, compare its checksum with the one published by the project (and, if the project signs its releases, verify the signature with GnuPG):

sha256sum linux-image.iso
# compare the output with the value on the project's official site

Key management is where things usually go wrong:

• Where the key lives. A key stored next to the data it protects protects nothing. Keep keys in a password manager, a hardware token or the system's key store, and read about key management before you encrypt anything you cannot afford to lose.
• Lose the key, lose the data. That is the point of encryption, so keep a recovery key or passphrase on paper in a safe place.
• Do not invent your own. Use well-reviewed, maintained software and standard algorithms. Old ones have been broken and should be switched off: MD5 and SHA-1 for security purposes, DES, RC4, SSL, WEP.

What about quantum computers? A large enough one could break today's public-key algorithms (RSA, elliptic curves), while symmetric encryption with long keys and strong hashes would be much less affected. There are two answers. Quantum key distribution uses quantum physics to exchange keys, but it needs special hardware and links, so it is for governments and large companies. For everybody else the practical answer is post-quantum cryptography: new algorithms that run on ordinary computers. NIST standardised the first ones in 2024, and browsers and libraries are already adopting them. The reason to care now is "harvest now, decrypt later": data recorded today may be readable in the future, which matters only if it will still be secret in 10 or 20 years.

Security Risks in the Digital Space

• Hardware – Due to its complexity, it is very difficult for a single person to produce hardware components without external cooperation. The open-source hardware movement helps raise awareness and shifts focus toward transparency. Features such as a TPM chip and Secure Boot help, and flaws built into processors, such as Spectre and Meltdown, show that even correct software can be undermined from below (see Reviving an Old Computer).
• Software – With open-source code, an open mindset, and modern security tools, most security issues can be mitigated to some extent. Even Microsoft has released some of its code. Open does not automatically mean safe, only inspectable: the XZ Utils backdoor of 2024 was hidden in a widely used open-source component for years and was caught by a developer who noticed a small delay in logins. Vulnerabilities are published in public databases such as CVE, and fixing them is only useful if you install the update.
• Network – The physical properties of communication mediums leave us vulnerable: radio waves can be received by anybody and cables can be tapped. Encryption in transit (TLS, WPA3, VPN) is the answer that works today, and the post-quantum algorithms above are the answer for the longer term. More on routers, VLANs and VPNs in Computer Networks.
• People – The most common attack does not break any technology; it persuades a person. Phishing, fake support calls and urgent requests from a "boss" work because they target attention, not software.
• Data and its whole life – Data is at risk when it is created, stored, copied, backed up, moved and finally discarded, so every one of those steps needs a decision.

It is a personal decision, but also a legal and financial issue. Either way, without a team of cybersecurity experts, absolute security is difficult to achieve. Nevertheless, complete indifference is not a good approach either. In a broader scope, you can never be 100% secure, but you can significantly limit risks through smart choices. For highly sensitive data, it is best to limit hardware and software usage, eliminate network connections, or restrict machines to a secure local area network (LAN).

Fortunately, few people require that level of security. By limiting software, keeping devices up to date, using secure connections, and making informed choices regarding firewall and security settings, most users will be safe. Encrypting the entire file system isn't always strictly necessary, but encrypting specific files and connections with proper key management is a good practice. Be aware that if your drive is unencrypted, anyone with physical access can easily retrieve your files.

Accounts and Authentication

Most break-ins start with an account, so this is the cheapest place to improve. Current guidance such as NIST SP 800-63B prefers length over complexity rules, advises against forced periodic changes, and recommends checking new passwords against lists of breached ones.

• One password per account, generated and stored by a password manager. You then remember only one long passphrase (several random words) for the manager itself.
• Turn on a second factor for e-mail first, because whoever controls your e-mail can reset every other password. Then bank, cloud storage and anything that holds payment data.
• Check whether your address was in a breach with Have I Been Pwned, and change the password on that service and anywhere you reused it.
• Protect the recovery path. A strong password does not help if "forgot password" goes to an old mailbox or a phone number that can be hijacked. Keep recovery codes offline.
• Use separate accounts. Day-to-day work should not run as administrator, and every person or device gets its own login, so a lost phone can be locked out alone.

Second factors, from weakest to strongest:

Devices, Updates and Smart Things

A device that no longer gets security updates is a known weak spot, not a neutral object. When the manufacturer stops publishing fixes, you either replace the device, isolate it, or move it to a system that is still maintained; Reviving an Old Computer shows how to do the last one on an old computer. Updates are also the one measure that works against threats you have not heard of yet, so enable automatic updates wherever they exist.

Smart devices deserve a separate thought. They are small computers with a network connection, often shipped with default passwords and rarely updated. The Mirai botnet of 2016 was built mostly from cameras and routers that still had their factory credentials. Practical rules: change default passwords, give such devices their own network segment so that a compromised light bulb cannot reach your computer, prefer devices that can work locally without a vendor cloud, and switch off the features you do not use. The router side of this is described in Computer Networks.

A door lock is the case where the consequences of a mistake are physical. The strike in Network Door Opener is fail-locked, so an empty battery leaves the door locked, not open. The electronics that can release it sit on the secure side of the door, only the energy source that cannot open anything is outdoors, every phone has its own account on the broker, and the release time is limited in the firmware. The same logic applies to the sensors and switches in Microcontroller Communication: decide what the worst outcome of a failure or an attack is, and design so that it is the harmless one. The same note shows the difference between control through a vendor cloud and control through your own server, which is at the heart of data ownership.

Protecting and Disposing of Data

Encryption at rest, the common options:

Back up by the 3-2-1 rule: three copies, on two kinds of media, one of them in another place, and one of them offline or read-only so that ransomware cannot reach it. A backup that was never restored is only a hope, so test the restore. Backups hold the same data as the original, so they must be encrypted too. A home server or small cloud, as built in Constructing a Cloud, is a good place for one of the copies, as long as you also keep an off-site one.

If you discard a hard drive, USB stick, memory card, or any other medium, make sure to properly erase it—simply deleting files is not enough. Even an unskilled person can recover deleted data using freely available open-source tools. Overwriting works reasonably on magnetic disks, but on SSDs and memory cards the controller moves data around, so overwriting is unreliable. If the disk was encrypted from the start, destroying the key is a fast and effective erase; otherwise use the drive's secure-erase function or destroy it physically. The NIST guidelines for media sanitization describe the options.

Network Safety

The router is the one device that faces the Internet directly, so it decides much of your exposure. The detailed settings, VLANs, VPN and a do-it-yourself router are in Computer Networks; in short:

• Change the router's default password, keep its firmware updated, and turn off remote administration, WPS and UPnP unless you need them.
• Use WPA3 (or WPA2 with AES) for Wi-Fi, and a separate guest or IoT network for devices you do not trust.
• Instead of forwarding a port for every service, open one VPN port and reach everything else through the tunnel.
• Know what is listening. On a Linux machine ss -tulpn lists open ports, and on your own network you can look from the outside with Nmap. Scan only networks you own.

When Something Goes Wrong

Sooner or later something happens: a strange login alert, a phishing link that was clicked, a lost phone. A calm sequence helps more than a perfect prevention plan:

1. Contain. Disconnect the affected device from the network, and do not switch it off if you may need to investigate.
2. Change passwords from a clean device, starting with e-mail, then banking, and sign out of all sessions. Revoke tokens and keys that were on the affected device.
3. Check the second factor and recovery settings of the account, because attackers often add their own.
4. Restore from a backup made before the problem. For ransomware, check the No More Ransom project for free decryptors, and avoid paying.
5. Tell the right people. Your bank for money, your provider for accounts, and the national CERT (SI-CERT in Slovenia). If you handle other people's personal data, remember the 72-hour rule from the GDPR section.
6. Learn from it. Write down what happened and what would have prevented it.

A Checklist for One Evening

• Install a password manager and move at least your e-mail, bank and cloud accounts into it with unique passwords.
• Switch on a second factor (passkey, security key or authenticator app) for those accounts and store the recovery codes offline.
• Enable automatic updates on every phone, computer and router, and list the devices that no longer get them.
• Turn on disk encryption on laptops and phones, and set a screen lock.
• Make a backup by the 3-2-1 rule and restore one file from it to prove that it works.
• Change the router's default password, turn off WPS and remote administration, and check the Wi-Fi security mode.
• Move cameras, TVs and other smart devices to a guest or IoT network.
• Check your e-mail addresses on Have I Been Pwned.
• Remove apps, accounts and old devices you no longer use, and erase or encrypt drives before you pass them on.
• Write down where recovery keys and backups are, so that someone else could find them.

Some resources:

• NCSC – top tips for staying secure online
• CISA – Secure Our World
• ENISA – European Union Agency for Cybersecurity
• EFF Surveillance Self-Defense
• Privacy Guides
• OWASP Top 10 – the most common web application risks
• GDPR full text, article by article
• NIST – Post-Quantum Cryptography
• Have I Been Pwned

A Few More Thoughts

Maintaining privacy in a world full of connected devices is a complex topic. Whether it's a Smartphone, Smartwatch, Smart car, or any other Smart device, they can only function by gathering information about their environment and users. Sometimes these devices are co-owned, which sparks broader debates about data collection rights. While progress is being made in regulatory fields, the discussion is far from over, as it involves individual worldviews and evolving legal frameworks.

Security and convenience pull in opposite directions, and the right balance depends on what you protect. A few habits (unique passwords, a second factor, updates, encryption and tested backups) remove most of the realistic risk for most people, and they cost far less than the best technology bought after the damage is done. Understanding the layers helps as well: how people talk to machines is the subject of Communication with the Machines, and the machines themselves are only as trustworthy as the choices made around them.