I like the way this guy thinks.

I've basically followed this concept for years.

PLEASE - don't tell me the article is from 2008. The basic efforts for
home computer security are dang near the same these days as back when
the article was first published. Yeah, there's plenty of new malware
threats, but the way the sickos try to get you pretty much have stayed
the same.
--------------
Following two simple rules will make your home computer much safer.

Roger Grimes lays out the facts on computer security for home and
business computing.

After I give my talk, people often ask me what to do to prevent
malware from invading their computer. Their question usually begins by
asking me what anti-virus program I recommend, as if there is a single
program everyone should use that would defeat all malware.
Unfortunately, it doesn't exist. I do recommend that users buy and use
a well-known anti-virus program that has a good track record of being
highly accurate. I'm not a big fan of new, unpopular, or free
programs. Not because these latter programs aren't good, but I like to
see a long-term track record of success before I recommend a security
product. Plus, you never know when the new ones might just be malware
programs in disguise.

But the reality is that I've rarely run anti-virus programs in my 22
years of PC computing, and I've never been exploited (except when
intentionally playing around with malicious code during testing). My
"secret" isn't a product. It's a philosophy based upon the facts.

The No. 1 way end-users are infected these days is by installing anti-
virus software that is, instead, malware. Several studies have shown
that a majority of your risk comes from being socially engineered into
installing malicious programs. Nearly all the rest of the risk comes
from an unpatched operating system or programs, which then allow
silently installed "drive-by" downloads.

A very small percentage of attacks comes from zero-day attacks.
Although the following table isn't scientific, I believe client-side
risk is somewhat represented like this:

User socially engineered into running malware: 95%

Unpatched software allows silent install: 4%

Zero day hole: 1%

Rest of article here:
https://www.csoonline.com/article/2633196/the-only-two-things-you-need-to-know-about-home-computer-security.html