Well one tip is to keep most/all funds in SP. Even if they get your active key, they can take the steem and SBD, but they have to power down the SP. You should be able to recovery control using your owner key before they can get the SP out. NEVER USE YOUR OWNER KEY. Also 99.9 % of the time you should be using only your posting key.