I have two-step authorization turned on for everything that offers it - iCloud, Email services, Dropbox, Evernote, Microsoft (Office365), IFTTT, Facebook and a few others.
I use complex alphanumeric passwords and with assistance from a password manager app and Safari password suggestion.
My iOS devices have FMiP turned on, "send last location upon critical battery" turned on, and are set to wipe the device after 10 unsuccessful password attempts.
My MacBook Air has FileVault turned on and Open Firmware Password is turned on to prevent unauthorized target disk mode. My only Windows (Win 10) device has Bit Locker turned on.
I use a trusted VPN service when I need to use unknown or suspect wifi hotspots (airports, hotels, etc).
While only as secure as the offerings can be, I'm as careful as possible to make sure it's very difficult to get in to my stuff without me knowing about it or that the device is rendered useless should it disappear.