I recently came across a blog post pointing out a PDF from Sophos that covers the different aspects of computer security.

I am no security expert, but I do know that the rule of thumb is to not try to be 100% invulnerable, but only to try to be less vulnerable than the next potential victim.

Yeah, this sounds crude, but it’s very practical. I remember a story that a friend told me about the thought process of a car thief. They typically play the odds - they go after the lowest hanging fruit. If you do something to show that your car will not be an easy steal - such as using The Club on your steering wheel - then you significantly decreased the likelihood of it being stolen.

Supposedly, if a thief really wants your car, they can use liquid nitrogen to make your steering wheel brittle and will break a piece off the steering wheel to remove the Club. Replacing the steering wheel is trivial compared to the value of the car. And supposedly, liquid nitrogen is quite easy to get if you are in the racket of stealing cars. However, a thief will 99% of the time go after a car without the Club than a car that uses it, so it certainly is a valuable deterrent. No car is 100% theft-proof though; if your car is exotic enough to stand out of the crowd, the Club may not be enough of a deterrent and you should consider only parking where an attendant is always there.

Same thing with computer security - if you have a website, there’s no way to be 100% hacker-proof, but do things that prevent it from being a low-hanging fruit, such as updating your software when a security update is released or not using a easy-to-hack password for your admin account (in fact, why not change the default admin username while you’re at it?).