Oh, and one other way to control risk, which we tend to forget in a world of always-on cloud services: you can turn it off when you aren't using it.

It's blunt, but it really works. Software that isn't running can't be attacked.