Enable the firewall (System Preferences > Security and Privacy > Firewall). Also click on the Advanced settings, and enable "stealth mode". This will help a bit with protecting you on public WiFi networks by not acknowledging ping packets and similar.
Don't enable any Sharing options (System Preferences > Sharing) unless you're positive you need them. Things like Remote Login and File Sharing are especially dangerous if your passwords are insecure.
Be wary in general of things you see. If there's a page (fake) that states you have hundreds of viruses that need to be removed, don't believe it. Think before you act basically. Easier said than done, but it's really the best summary of best practices.
So many people also forget about the fact that your bank or other important institutions will NEVER ask for personal information via email or for you to "update settings". When in doubt, go directly to the relevant institution's site.