Data breaches are inevitable – here's how to protect yourself anyway

Authors
Distinguished Research Professor of Computer Science; Director of Research, Center for Cybersecurity and Data Intelligence, University of Dayton
Disclosure statement
The authors do not work for, consult, own shares in or receive funding from any company or organization that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.
As cybersecurityresearchers, we offer good news to brighten this bleak picture. There are some simple ways to protect your personal data that can still be effective, though they involve changing how you think about your own information security.
The main thing is to assume that you are a target. Though most individual people aren’t specifically being watched, software that mines massive troves of data – enhanced by artificial intelligence – can target vast numbers of people almost as easily as any one person. Think defensively about how you can protect yourself from an almost inevitable attack, rather than assuming you’ll avoid harm.
What’s most important now?
That said, it’s unproductive and frustrating to think you must pay attention to every possible avenue of attack. Simplify your approach by focusing on what information you most want to protect.
In terms of online data, the most important information to protect is your login credentials for key accounts – like banking, government services, email and social media. You can’t do much about how well websites and companies safeguard your information, but you can make it harder for hackers to get into your account, or at least more than one of them.
How? The first step is to use a different username and password on each crucial site or service. This can be complicated by sites’ limits on username options – or their dependence on email addresses. Similarly, many sites have requirements on passwords that limit their length or the number or type of characters that they can include. But do your best.
Use long passwords
There has been a lot of research about what makes a strong password – which has often led to many people using complex passwords like “7hi5!sMyP@s4w0rd.” But more recent research suggests that what matters much more is that passwords are long. That’s what makes them more resistant to an attempt to guess them by trying many different options. Longer passwords don’t have to be harder to remember: They could be easily recalled phrases like “MyFirstCarWasAToyotaCorolla” or “InHighSchoolIWon9Cross-CountryRaces.”
It can be daunting to think about remembering all these different usernames and passwords. Password management software can help – though choose carefully as more than one of them have beenbreached. It can be even safer – despite conventional wisdom and decades of security advice – to write them down, so long as you trust everyone who has access to your home.
With these straightforward steps – and the new mindset of thinking like a target who wants to avoid getting hit – you’ll be far less worried when news breaks of the next breach of some company’s enormous data files. Bad guys may get one of your usernames, and maybe even one of your passwords – so you’ll have to change those. But they won’t have all your credentials for all your online accounts. And if you use multi-factor authentication, the bad guys might not even be able to get into the account whose credentials they just stole.
Focus on what’s most important to protect, and use simple – but effective – methods to protect yourself and your information.