What you are actually protecting
Before deciding what to do, it helps to be clear about what is worth protecting. In most homes and small businesses it comes down to a handful of things, and nearly all of them hang off one account: your email.
The master key. Anyone who controls your email can reset the password on almost everything else you own. This gets protected first, always.
Online banking, card details, payment apps, invoices and payroll. The fastest route to a real, immediate loss.
Photos, tax records, documents, customer records. These are not stolen so much as held hostage by ransomware, or simply lost with a dead drive.
Date of birth, address, Social Security number, answers to security questions. Used to open accounts in your name.
For a business, a breach of customer information is the kind of damage that outlasts the cleanup bill by years.
The implementation plan
This is the order I work through with clients. Earlier steps shut down the most common attacks, so if you only get partway through, you are still far better off than you were.
-
Install updates — everywhere, automatically
Most successful attacks use a hole that was patched months ago on computers that never installed the fix. Turn on automatic updates for Windows or macOS, your web browser, your phone and your security software.
Do not forget the things that do not look like computers: your router, printers, security cameras and anything "smart". Those rarely update themselves, and an out-of-date router is a wide-open door into your network.
-
Use strong, unique passwords
Reusing one password across sites means a breach at any one of them hands over all the others. Attackers automate exactly that.
Make each password long and different. A passphrase of a few unrelated words is both stronger and easier to remember than a short jumble of symbols. Use a reputable password manager so you only have to remember one good master password, and change any password you know you have reused — starting with email and banking.
-
Turn on two-factor authentication (2FA)
This is the single highest-value change you can make. With 2FA on, a stolen password alone is not enough to get into your account.
Enable it on email first, then banking, then anything that stores payment details or customer information. An authenticator app or a physical security key is stronger than text-message codes, though a text code is still far better than nothing. And remember: a code sent to you is never to be read out to anyone, for any reason.
-
Back up your files — and test the backup
Backups are what turn a ransomware attack or a failed hard drive from a disaster into an inconvenience. Follow the simple rule: three copies of anything important, on two different kinds of media, with one copy off-site (cloud backup or a drive kept somewhere else).
Keep at least one backup disconnected when it is not in use, because ransomware happily encrypts the external drive that is plugged in. Then actually restore a file from it. A backup nobody has ever tested is only a hope.
-
Secure the network and use a VPN away from home
Change the router's default admin password, update its firmware, turn off remote management if you do not need it, and use current Wi-Fi encryption with a strong passphrase. Put guests, cameras and smart devices on a separate guest network so a problem on one cannot reach your main computers.
On public Wi-Fi — hotels, coffee shops, waiting rooms — use a reputable VPN so your traffic is encrypted between you and the internet. There is more detail in my firewall assessment and implementation plan.
-
Run real protection, and limit what runs as administrator
Keep an up-to-date antivirus or security suite with real-time and web protection switched on — see how I test antivirus software for what to look for. Leave the firewall on.
Then use a standard (non-administrator) account for everyday work. If malware runs while you are an administrator, it can do far more damage. Remove software you do not use, and only install programs from the maker's own site or an official store.
-
Learn to spot phishing — and teach everyone who uses the computer
Email and text messages are how most attacks arrive. The tell-tale signs: urgency, a threat or a prize, an unexpected attachment, a link whose address does not match the company, a request to change payment details, or a sender address that is slightly off.
Hover over links before clicking. Never open an attachment you were not expecting. If a message claims to be from your bank, your supplier or a family member, verify it by calling a number you already had. My article on spotting imposters covers this in detail.
-
Protect the devices themselves
Turn on full-disk encryption (BitLocker on Windows, FileVault on a Mac) so a stolen laptop does not hand over your files. Use a screen lock on every device. Wipe old computers, drives and phones properly before passing them on — deleting files is not the same as erasing a drive.
-
Know what you will do if it happens anyway
Decide in advance: disconnect the machine from the network, change key passwords from a different clean device, call your bank if money or card details were involved, restore from backup rather than paying a ransom, and have the computer checked properly before trusting it again. Write down who you will call. Panic is where the expensive mistakes get made.
If you only do three things: turn on two-factor authentication for your email, get a working backup of your files, and install your updates. Those three alone stop the overwhelming majority of what I see go wrong.
Extra steps for a small business
Give each person access only to what their job needs, and remove accounts the day someone leaves. Shared logins make it impossible to know who did what.
Invoice and wire-transfer fraud works by emailing new bank details. Always confirm a change by calling a number you already had on file.
Point-of-sale systems, cameras and guest Wi-Fi should not share a network with the computers holding customer records.
A short conversation about current phishing tricks does more than a long policy nobody reads. Make it safe to report a mistake quickly.
Know every computer, phone, router and online service you use. You cannot protect or update equipment you have forgotten about.
Hardware and operating systems past end of support stop receiving security fixes. Plan replacements before they become the weak link.
Warning signs worth acting on today
Your quick checklist
- Automatic updates on, including the router
- A unique password for every account
- Two-factor authentication on email and banking
- Backups running, with one copy off-site
- A restore tested at least once
- Router admin password changed from the default
- Guest and smart devices on their own network
- Antivirus and firewall active and current
- Everyday work on a standard, non-admin account
- Disk encryption and screen locks enabled
Need a hand putting this in place?
Most of this takes one sitting with someone who has done it before. Backup help and ongoing support are included in the Mark’s Computer Repair Yearly Service Plan, and security cleanup, network setup and full diagnostics are covered by the Single Repair service. We will explain each change in plain language before we make it.
Want your setup locked down properly?
Call Mark’s Computer Repair — remote help is available 24/7.
Protecting several computers, cameras or point-of-sale systems at a business? Contact David to talk it through.
← Back to all tech tips