Start with a few habits, not a perfect system
Most people who lose accounts or files to attackers were not targeted personally. Their devices were running out-of-date software, their passwords were reused, or they clicked something that looked routine. That is encouraging, because the common problems have common fixes. Security is not about being unbreakable. It is about being a harder, less rewarding target than the next person, and about being able to recover when something does go wrong.
The habits below apply to phones, tablets and computers alike. Settings screens change from one version to the next, so this guide describes what to look for rather than exact menus. Nothing here guarantees safety, but together these steps reduce the most common risks considerably.
Keep software updated
Updates fix security flaws that attackers already know about. Once a flaw is public, criminals often build tools that look for devices that have not been patched, so delay carries real risk. This applies to the operating system, web browsers, and apps.
- Turn on automatic updates wherever the device offers them.
- Restart when asked. Some updates do not take effect until you do.
- Remove apps and programs you no longer use, since each one is something else that needs patching.
- Be aware that very old devices eventually stop receiving updates from the maker. If yours has, plan to replace it, especially for banking or work.
The reasons behind this are covered in more depth in the discussion of phone software updates, and the same logic applies to laptops and desktops.
Back up what you cannot replace
Devices get lost, broken, stolen and infected. A backup is the thing that turns a disaster into an annoyance. Photos, documents and records of past transactions are usually what people miss most.
A widely used guideline is the 3-2-1 backup rule: keep three copies of important files, on two different types of storage, with one copy kept somewhere else. In practice that might mean the original on your computer, a copy on an external drive, and a copy in an online storage service. Which mix suits you depends on how much you store and how much you trust each option, and the tradeoffs in cloud versus local backup are worth a read.
Two cautions apply. A drive that stays plugged in can be damaged along with your computer by malicious software, so keep at least one copy disconnected. And a backup you have never opened is a guess, not a plan. Occasionally restore a file to confirm it works. Our guide to data backup basics goes through the process in more detail.
Use security software sensibly
Modern phones and computers include built-in protection, such as malware scanning, firewalls and app vetting, and for many people keeping these features switched on is a solid starting point. Whether you also need antivirus software depends on your device and habits. If you add a security product, choose one from a well-known maker, download it only from the official site or app store, and do not run several at once, since they can conflict.
Be wary of pop-ups claiming your device is infected. Fake virus alerts are a common trick to push people into installing something harmful or paying for a useless service. A genuine warning comes from software you installed on purpose, not from a web page.
Downloads matter too. Stick to official app stores and the maker’s own website, and avoid cracked or pirated programs, which are a frequent way for malware to arrive.
Lock your devices
A screen lock is the first barrier if a device is lost or stolen. Use a PIN, password, fingerprint or face unlock, and set the device to lock itself after a short time. Short, obvious codes such as repeated digits are easy to guess, so pick something longer and less predictable if the device allows it. Turn on any built-in “find my device” feature so you can locate, lock or erase a lost phone. For a quick tour of the main options, see the notes on smartphone security.
Choose safer networks
Your home router is the front door to every connected device you own. Change its default admin password, use a modern encryption setting, and install firmware updates when they are offered. These points are explained under home Wi-Fi security.
Away from home, treat public networks with caution. The open hotspot risks are real but often misunderstood: most websites now encrypt traffic, yet anyone can set up a network with a familiar-looking name. If you can, use your phone’s mobile connection for banking or other sensitive tasks, and avoid typing important passwords on shared computers.
Protect accounts with strong sign-in
Your devices are only as safe as the accounts on them. Give every account its own password; password reuse means one leak can unlock many accounts. A password manager makes unique passwords practical, and our explanation of password managers covers who benefits. Where passkeys are offered, they can replace passwords with something much harder to steal.
Then turn on two-step sign-in for email first, because email is usually how other accounts get reset, and then for banking, social media and shopping accounts. An authenticator app or a security key is generally stronger than a text message code, though any second step is better than none. If you are unsure of the differences, look at the comparison of verification code options.
Slow down for suspicious messages
Many attacks start with a message, not a technical exploit. Phishing messages try to create urgency, whether a locked account, a missed delivery or an unexpected bill. Before clicking, pause and ask whether you expected the message. Go to the organization’s website by typing its address or using its app, rather than using the link you were sent. Treat unexpected attachments with the same suspicion.
A simple routine
Rather than trying to do everything at once, work through this order:
- Turn on automatic updates.
- Set screen locks.
- Set up one backup, then add a second.
- Install a password manager and fix your email password first.
- Turn on two-step sign-in for email and financial accounts.
- Review your home router settings.
Revisit the list every few months. If something does go wrong, such as a hacked account or a suspected infection, act quickly: disconnect the affected device, change passwords from a clean device, and contact the service involved. Local police or a national fraud-reporting service can advise on reporting a crime.