Don't forget to install software security updates which can help protect you against many types of the more commonly used malware.
Avoiding malicious websites and unsolicited emails
Many people are wising up to the importance of avoiding suspect websites. However often unsolicited emails will try and trick/convince/entice you into browsing to them. Don't open unsolicited emails, don't read them and don't click on any links inside them. If an email appears to be from your bank (for example) and is stating that action is required from you (typical of phishing emails) and you are concerned, open your web browser and navigate to your bank's website – do not click on links in the email.
Privacy settings
Review your privacy settings on the social media websites you have accounts on, ensure you're only sharing information with trusted groups. Also retrospectively correct anything which may have been shared publicly previously. Profiling a target is much harder when their social networking profiles have locked down privacy settings. What you post online is available for the whole world to see. Think to yourself if it is a good idea to publish before you click and think of your privacy as something valuable that shouldn't be given away.
More than just passwords
Some of the more common services (for example Gmail, LinkedIn) support SMS-based 2-factor authentication (2FA), meaning that to log in from a new device you have to type a secret code that gets sent to you via SMS, this means the bad guys would need more than just your password to login to your account.
Improve the security settings on your email client(s)
Configure your email client to not automatically download images or other resources from the web, or even to just use plain text emails. Some email clients already do this by default but some do not so it is best to check.
Related story
Tech Sovereignty: A Quest for Nepal
