Tom wants to make sure his wireless router is secure. Leo says the only thing Tom really needs to do is turn on WPA2 encryption. It's in the router setup, which can usually be accessed at 192.168.1.1. He should turn on WPA2 and give it a password that isn't obvious. Once that's turned on, all the traffic is encrypted.
If he wants to take the next step, he could use a VPN or virtual private network. This is essentially an encrypted tunnel through the internet that will prevent anyone else from seeing his traffic online. At some point, though, the traffic has to go public again. A VPN will protect him at "the first mile." He could set up a VPN server with his router and then surf through his own network, or he can use a commercial VPN service.
Another option is to use the Tiny Hardware Firewall, which is a portable hardware VPN that he can take anywhere and protect himself.