4. Network and Browsing

4.1 Browser Hygiene

Core Concepts: Protect Yourself, Minimize Your Exposure

Your web browser and email are your primary gateways to the internet, and the primary ways attackers try to reach you. Most cyber attacks start with either a malicious website or a phishing email. Good browser and email hygiene can stop the vast majority of these attacks before they start.

You don't need to be a technical expert. Most protection comes from recognizing common patterns, adjusting a few settings, and building good habits about what you click.

4.1.1. Understanding Browser Threats

Common browser threats:

4.1.2. The Basics

Use a Modern, Updated Browser

Modern browsers have built-in security features that older browsers lack. Keep your browser updated to get the latest protections.

Enable automatic updates:

Look for HTTPS and the Padlock Icon

HTTPS encrypts the connection between your browser and the website. Always check for it, especially on sites where you enter passwords or payment information.

What to look for:

Warning signs:

NEVER enter passwords or payment info on HTTP sites. Close the site and find a secure alternative.

Check URLs Carefully Before Clicking

Attackers create fake websites with URLs that look almost right. Always verify URLs before clicking or entering information.

How to check URLs:

Common tricks:

When in doubt, type the URL manually rather than clicking links.

Use Minimal Browser Extensions

Browser extensions have access to everything you do in your browser. Only install extensions you truly need from trusted developers.

Extension safety rules:

See the Software and App Safety section for additional extension guidance.

4.1.3. Better Protection

Configure Browser for Privacy

Browsers collect data about your browsing. Review and restrict this.

Chrome:

Firefox:

Safari:

Use a Privacy-Focused Search Engine

Search engines track your searches and build profiles. Consider alternatives that don't track.

Privacy-focused options:

How to change default search:

Install a Reputable Ad Blocker

Ad blockers prevent malicious ads and reduce tracking. Choose carefully - some ad blockers themselves track you.

Avoid: AdBlock, AdBlock Plus (these allow "acceptable ads," ads that pay them)

4.1.4. Extra Credit

Use Hardened Browser

For maximum privacy and security, use browsers with hardened default configurations.

Privacy-focused browsers:

Advanced Firefox hardening:

Use Browser Profiles or Containers

Separate your browsing into different profiles or containers to isolate activities.

Browser profiles (Chrome/Edge/Brave):

Firefox containers:

4.2 Home Wifi Security

Core Concepts: Protect Your Data, Minimize Your Exposure

Your home WiFi network is the gateway to everything in your digital life, your computers, phones, tablets, smart home devices, security cameras, and more. A compromised network means all your devices are at risk. Worse, your neighbors or someone parked outside could be using your internet for illegal activities, and it would trace back to you.

Securing your home WiFi doesn't require deep technical expertise. Most protection comes from changing a few default settings that take 15-30 minutes to configure.

4.2.1. Understanding WiFi Security Risks

Common WiFi threats:

4.2.2. The Basics

Change Your Router's Default Admin Password

This is the single most important thing you can do. Routers typically come with default passwords like "admin/admin" or "admin/password" that are publicly known. Anyone on your network can access your router's settings with these defaults.

Some more modern routers like what you would get from your Internet Service Provider (ISP) may come with a unique password on a sticker on the back of the device. It is still a good idea to change this password.

How to access your router:

Change the admin password:

Use WPA3 or WPA2 Encryption

WiFi encryption protects your wireless traffic from being read. WPA3 is the newest and most secure, but not all devices support WPA3 yet. WPA2/WPA3 (mixed mode) is fine if you have devices on your home network that don’t support WPA3.

How to enable:

NEVER use:

Create a Strong WiFi Password

Your WiFi password (also called the network key or passphrase) protects who can connect to your network.

Password requirements:

How to change:

Tip: Consider creating a passphrase from 4-5 random words: "Correct-Horse-Battery-Staple-47!" is both strong and easier to type on phones than random characters.

Keep Router Firmware Updated

Router firmware is like the operating system for your router. Manufacturers release updates to fix security vulnerabilities.

How to update:

Enable automatic updates if available:

If no auto-update: Check manually every 3 months.

Use a Custom Network Name (SSID)

Your network name (SSID) shouldn't reveal your router model or personal information.

Why change it:

What NOT to use:

Good options:

How to change:

4.2.3. Better Protection

Disable WPS (WiFi Protected Setup)

WPS was designed to make connecting devices easier, but it has a critical security flaw that makes it easy to crack your WiFi password.

Why disable it:

How to disable:

Set Up a Guest Network

A guest network gives visitors internet access without exposing your main network and devices.

Benefits:

How to set up:

What to put on guest network:

Disable Remote Management

Remote management allows you to access router settings from outside your home network. Unless you specifically need this, disable it.

Why disable:

How to disable:

Disable Universal Plug and Play (UPnP)

UPnP allows devices to automatically open ports in your router. This is convenient but can be exploited by malware.

Why disable:

How to disable:

Note: Some gaming consoles and P2P applications prefer UPnP. If you have issues, you can manually configure port forwarding instead, or enable UPnP again.

Review Connected Devices Regularly

Check what's connected to your network to spot unauthorized devices.

How to check:

If you find an unknown device:

Do this monthly: Set a calendar reminder to review connected devices.

4.2.4. Extra Credit

Use VLANs to Segment Your Network

VLANs (Virtual LANs) separate devices into isolated network segments. This is advanced but powerful.

Example segmentation:

Benefits:

Requirements:

Note: This is advanced. Most people should use guest networks instead, which provide similar isolation with much easier setup. You will need to search online to contact an IT support person for specific instructions for your equipment.

Install a Custom Router

You can turn any PC into a custom router by installing open source router software, such as OPNSense. This is relatively advanced, so not for the faint of heart, but worth the effort if you are willing to learn a bit about networking and OK with spending a few hundred dollars for a truly secure, custom solution. You can view my guide on TheDen Home Network Runbook if you are curious about what is involved.

4.3 Smart Home and IoT Devices

Core Concepts: Minimize Your Exposure, Protect Your Data

Smart home and other Internet of Things (IoT) devices make life convenient; smart speakers, security cameras, thermostats, door locks, light bulbs, refrigerators, and more. But these devices are often the weakest link in your home network. Many ship with poor default security, rarely get updated, and connect to the internet 24/7.

A compromised smart device can become a gateway for attackers to access your entire network, spy on you through cameras and microphones, or recruit your devices into a botnet (an army of hacked devices used for cyberattacks).

With some basic precautions, you can enjoy the convenience of smart devices without compromising your security.

4.3.1. Understanding IoT Security Risks

What are IoT devices?

Any device that connects to the internet but isn't a traditional computer or phone:

Common IoT security problems:

Real-world consequences:

You don't need to avoid IoT devices, they're useful and can make life easier. But treat them with appropriate caution. An IoT device is basically a tiny computer, running software, connected to the internet 24/7. Would you leave a computer with default password "admin" connected to the internet? No? Then don't do it with your TV either.

4.3.2. The Basics

Change All Default Passwords

Default passwords are publicly available and attackers scan for devices using them.

For each IoT device:

Keep Firmware Updated

IoT devices need security updates just like computers. Enable automatic updates where possible.

How to update:

For devices without apps:

Create a quarterly reminder to check for updates for your IoT devices that don't auto-update.

Disable Unnecessary Features

IoT devices often have features enabled by default that you don't need. Turn them off.

Common features to disable:

How to find these:

Review Device Permissions and Privacy Settings

IoT device apps request permissions on your phone. Review and restrict them.

Check app permissions:

Common unnecessary permissions:

Use Strong Authentication for Device Apps

The apps that control your IoT devices should have strong passwords and MFA.

For each device manufacturer account:

See the Authentication section for detailed password and MFA guidance.

4.3.3. Better Protection

Research Security Before Purchasing

Not all IoT devices are created equal. Buy from manufacturers with good security track records.

Before buying, check:

Good signs:

Red flags:

Put IoT Devices on Your Guest Network

IoT devices shouldn't have access to your computers and phones. Use your guest network to isolate them.

Why this matters:

What to do:

Exception: Devices that need to communicate with your phone/computer (like Chromecast, AirPlay, or printer) may need to be on the main network. This is a tradeoff where you weigh convenience against security for each device.

Use Physical Controls for Cameras and Microphones

Cameras and microphones in IoT devices can be compromised. Use physical controls.

For cameras:

For microphones:

Review Smart Speaker Voice History

Smart speakers record your voice commands. Review and delete this history regularly.

Amazon Alexa:

Google Home:

Apple HomePod:

4.3.4. Extra Credit

Use Local Control Instead of Cloud

Devices that work locally don't require internet and can't be compromised through manufacturer's cloud.

Local control options:

Benefits:

Tradeoff: More complex to set up and requires ongoing maintenance. Only recommended for technically comfortable users.

Use VLANs for Advanced Network Segmentation

VLANs provide the strongest isolation between IoT devices and your trusted devices.

VLAN segmentation example:

Firewall rules:

Requirements:

See the Home WiFi section for more on VLANs, of TheDen Home Network Guide.

4.4 Virtual Private Networks (VPNs)

Core Concepts: Protect Yourself, Protect Your Data

VPNs are one of the most misunderstood security tools. They're marketed as making you "invisible online" which isn't true, but they do have legitimate, specific uses that can protect your privacy and security.

This section cuts through the marketing hype to explain what VPNs actually do, when you need one, when you don't, and how to choose and use one effectively.

4.4.1. Understanding VPNs

What is a VPN?

A Virtual Private Network creates an encrypted tunnel between your device and a VPN server. All your internet traffic goes through this tunnel before reaching its destination. A VPN protects your network traffic from local snooping on public WiFi, but it does not make you anonymous or protect you from phishing or malware.

Think of regular internet traffic like sending a postcard. Anyone handling it can read the message and see where it’s going. A VPN puts your postcards in sealed envelopes and sends them to a trusted friend (the VPN server) who opens them and sends them to their final destination. The recipient sees the message as coming from your friend, not you.

What VPNs DO:

What VPNs DON'T DO:

The trade-off: VPNs add an extra step to your internet connection, which usually means slower speeds. You're trading some speed for privacy and security in specific situations.

When You Should Use a VPN

On Public or Untrusted WiFi

This is the real reason for using a VPN. Use a VPN when connected to any open (unencrypted) WiFi network. An open WiFi network is any network you do not have to enter a network key to connect to.

Note that captive portal sign-in is not the same thing. If you have ever connected to a network, then had to open a browser and sign in to get internet access, you were probably on an open network with a captive portal. A captive portal is a web page that appears when you connect to some WiFi networks (like at hotels or airports) requiring you to agree to terms or enter a password before accessing the internet. These do not offer any protection!

When you connect to an open WiFi network, all other people on the network can potentially see what you are doing. This means a malicious person could also tamper with the data coming from or going to your device. A VPN encrypts all your traffic so they cannot.

For Privacy from Your ISP

Your internet service provider can see all the websites you visit. A VPN hides this.

Why you might want this:

Keep in mind: You're shifting trust from your ISP to your VPN provider. Choose your VPN provider carefully.

When You DON'T Need a VPN

To "Stay Anonymous Online"

VPNs don't make you anonymous, this is marketing hype. You are still tracked based on the accounts you log into, browser and device fingerprinting, tracking cookies, and payment information.

If you want more anonymity (for journalism, activism, etc.), you need specialized tools like Tor, not just a VPN.

4.4.2. The Basics

Choose a Reputable VPN Provider

This is the most important decision. A bad VPN provider is worse than no VPN as they can see and log everything you do. Avoid free tiers, as they make money by selling ads to you or your data to someone else. In fact, avoid any VPN that offers a free tier.

What to look for:

My recommendation is Mullvad https://mullvad.net/en.

4.4.3. Better Protection

Install On Your Phone Too

(Tested with Mullvad, should be a similar process for others)

Android Setup:

iOS Setup:

4.4.4. Extra Credit

Run Your Own VPN Server

Advanced users can set up their own VPN server.

Options:

Benefits:

Drawbacks:

Best for encrypting your traffic on a public WiFi or accessing your home network remotely, not for privacy from ISP or geographical restrictions.

4.5 Travel Guide

Core Concepts: All Four

Travel introduces unique risks. Prepare before you go and stay vigilant while away.

4.5.1. Before You Leave

4.5.2. During Travel

4.5.3. At Border Crossings

Plan for Border Crossings

International border agents can legally search devices in many countries.

Standard precautions:

High-security approach: