Updates: the boring superpower
Almost every mass malware outbreak in history exploited a hole that had already been fixed, on machines that hadn't installed the fix. Updating is the highest-value, lowest-effort security habit there is.
- Turn on automatic updates for your operating system, browser, and apps.
- Don't ignore the restart prompt for weeks. The fix isn't active until you reboot.
- Retire software and devices that no longer receive updates. An unpatched device is a permanent open window.
Lock it like you mean it
- Every device gets a lock screen. Use a 6+ digit PIN or biometrics on phones; a strong password on computers.
- Short auto-lock timers of a couple of minutes, not thirty. An unlocked, unattended machine is an open wallet.
- Lock when you walk away, even at home. (Windows: Win+L, Mac: Ctrl+Cmd+Q.) Make it a reflex.
Encryption: your safety net for theft
If a laptop is stolen without disk encryption, the thief can pull every file off it without ever knowing your password. With encryption, they get a very expensive paperweight.
- Windows: turn on BitLocker (or "Device encryption" on Home editions).
- Mac: turn on FileVault.
- Phones: modern iPhones and Androids encrypt automatically once a passcode is set, which is one more reason the lock screen matters.
Phones and tablets
- Install apps only from official stores, and even then, check reviews and permissions. A flashlight app doesn't need your contacts.
- Review app permissions occasionally and revoke what's unnecessary, especially location, microphone, and SMS.
- Set up "Find My" (iPhone) or "Find My Device" (Android) now, so you can locate, lock, or remotely erase a lost device.
- Beware charging kiosks and unknown cables in public places; a wall adapter you own is always safe.
If a device is lost or stolen
- Use Find My / Find My Device to locate and lock it, and display a contact number on the screen.
- If recovery looks unlikely, remotely erase it.
- Change the passwords for accounts that were signed in, starting with email, and sign out all sessions.
- Tell your employer's IT (or us) immediately if it was a work device. Speed limits the damage; nobody worth working for punishes fast reporting.
Selling or recycling a device? Sign out of your accounts, then do a full factory reset / secure erase. For computers with sensitive history, we're happy to wipe drives properly, or drill them if you'd rather be certain.