3. Your Devices

3.1 Software and App Safety

Core Concepts: Minimize Your Exposure, Protect Your Data

Malware often disguises itself as legitimate software. A free game, a helpful utility, even a security tool can hide viruses, spyware, or ransomware. The software you install is one of the largest parts of your attack surface. Knowing what's safe to install, and what to avoid, is critical.

3.1.1 Understanding Software Risks

Every piece of software you install increases your attack surface; the number of ways someone could compromise your system. Even legitimate software can have security vulnerabilities that attackers exploit.

Common ways malicious software spreads:

Think before you install. Every piece of software is a potential security risk. Ask yourself:

When in doubt, don't install it.

3.1.2 The Basics

Never Use Pirated Software

This cannot be emphasized enough: Pirated or "cracked" software is one of the most common ways to get infected with malware.

Why pirated software is dangerous:

Alternatives to piracy:

Use Official App Stores Only

App stores vet software before allowing it in their store. While not perfect, this dramatically reduces your risk.

Mobile devices:

Desktop computers:

Avoid:

Other potentially useful software sites (use these with caution):

Verify Download Sources

When downloading directly from a website instead of an app store, make sure you’re downloading from the official publisher

Steps to verify:

Example: You want VLC media player. Search "VLC official download" and go to videolan.org (the real site), not vlc-player-download.com (fake).

Watch for Bundled Software

Some legitimate software tries to install additional programs during installation, toolbars, antivirus trials, browser plug-ins.

How to avoid unwanted software:

Understand App Permissions

Permissions tell you what an app can access on your device. Always check permissions before installing.

Ask yourself: Does this make sense?

Permissions to be extra careful about:

If permissions don't make sense for what the app does, don't install it.

3.1.3 Better Protection

Review App Permissions Regularly

Apps can request additional permissions after installation. Review these periodically:

On iPhone:

On Android:

On Windows:

On Mac:

Do this review quarterly.

Uninstall Unused Apps and Software

Software you don't use is a security risk for no benefit. Every unused app is a potential vulnerability.

Monthly cleanup routine:

How to properly uninstall:

Don't just delete the icon or folder: Use the proper uninstall process to remove all components.

Keep Software Updated

Software updates fix security vulnerabilities. Delaying updates leaves you exposed to known exploits.

Enable automatic updates for:

For software without auto-update: Check for updates monthly. Most programs have a "Check for updates" option in their menu.

Be Careful with Browser Extensions

Browser extensions have access to everything you do in your browser, every website you visit, everything you type, all your passwords.

Extension safety rules:

Red flags for extensions:

3.1.4. Extra Credit

Use a Sandbox for Unknown Software

A sandbox is an isolated environment where you can run software without it affecting your main system. If the software is malicious, it's contained.

Sandbox options:

This is advanced but very effective for testing questionable software safely.

3.2 Mobile Device Hardening

Core Concepts: Protect Your Data, Minimize Your Exposure

Your phone carries more personal data than your computer ever did, photos, messages, contacts, emails, banking apps, location history, health data, and more. It goes everywhere with you, making it vulnerable to loss, theft, and unauthorized access. It's also constantly connected to the internet, making it a target for remote attacks.

Mobile operating systems (iOS and Android) are designed with security in mind and include excellent built-in protections. The challenge is ensuring these features are enabled and properly configured.

3.2.1 Understanding Mobile Security

Mobile devices face unique security challenges:

This section covers both iPhone (iOS) and Android. Follow the instructions for your device, or both if you use multiple phones or tablets.

Mobile Security Habits

Beyond settings, develop these habits:

Your phone is your most personal computer. It knows where you go, who you talk to, what you buy, what you search for, and holds keys to your digital life. Protecting it isn't paranoia, it's common sense.

Mobile platforms are pretty secure by default. You just need to enable the right settings, review permissions regularly, and develop good habits. Start with The Basics, add Better Protection over time, and remember, the most important security feature is the lock screen. Use it every time.

3.2.2 The Basics

Set a Strong Passcode and Enable Biometrics

Your lock screen is your first line of defense.

iPhone:

Android:

Biometrics are convenient for daily use, but the passcode is more secure against certain attacks (can't be compelled in court, can't be used while you're unconscious). See Understanding Biometrics in the Authentication topic.

Enable Find My Device

If you lose your phone, you need to be able to locate it, lock it remotely, and erase it if necessary.

iPhone (Find My):

Android (Find My Device):

Enable Automatic Updates

Mobile OS updates fix security vulnerabilities. Enable automatic updates so you're always protected.

iPhone:

Android:

Review App Permissions

Apps request access to your camera, microphone, location, contacts, and more. Review what you've granted and revoke unnecessary permissions.

iPhone:

Android:

Do this review quarterly; apps update and request new permissions over time.

Disable Lock Screen Notifications for Sensitive Apps

Notifications on your lock screen can reveal sensitive information to anyone who glances at your phone.

iPhone:

Android:

Enable Automatic Backup

If you lose your phone, you need your data backed up. Enable automatic cloud backup.

iPhone (iCloud Backup):

Android (Google Backup):

3.2.3 Better Protection

Enable Remote Wipe Capability

If your phone is stolen and you can't recover it, you should be able to erase all data remotely.

iPhone:

Note: After erasing, you can't track it anymore

Android:

Note: After erasing, you can't track it anymore

Use Encrypted Backups

Cloud backups can be encrypted so even the backup provider can't access your data.

iPhone (Advanced Data Protection):

Android:

Disable USB Accessories When Locked

USB accessories can be used to attack locked phones. Disable them when locked.

iPhone:

Android:

Use One-Time Passwords for Apps

For email and other accounts accessed through apps, use app passwords instead of your main password.

Review Location Services Settings

Location tracking is convenient but invasive. Review what's tracking you and when.

iPhone:

Android:

Turn Off Unused Wireless Features

Bluetooth, WiFi, and NFC create additional attack surfaces when not in use.

Use Control Center/Quick Settings for easy toggling.

Review Privacy & Tracking Settings

Apps and advertisers track your activity across apps and websites. Limit this tracking.

iPhone:

Android:

3.2.4 Extra Credit

Use Separate Work/Personal Profiles (Android)

Android allows multiple user profiles or work profiles to keep personal and work data separated. This may already be a requirements and set up automatically depending on where you work and how you access work data on your phone. Contact your local IT center with any questions.

Use Secure Folder / Private Space Features

Some phones offer encrypted, hidden spaces for sensitive apps and files.

Samsung Secure Folder:

Google Private Space (Android 15+):

iPhone:

Enable Advanced Privacy Features

iPhone (iOS 15+):

Android:

Set Up a SIM PIN

A SIM PIN prevents someone from using your SIM card in another phone (protects against SIM-swap attacks).

iPhone:

Android:

Warning: If you enter the wrong SIM PIN 3 times, you'll need a PUK code from your carrier to unlock it. Keep your carrier's customer service number handy.

Use Lockdown Mode (iPhone) for High-Risk Situations

Lockdown Mode is an extreme security mode for people facing serious targeted threats (journalists, activists, executives).

3.3 Operating System Hardening

Core Concepts: Minimize Your Exposure, Protect Your Data

Your operating system is the foundation of your computer's security. Everything else, your applications, your files, your passwords, sits on top of it. A properly configured OS blocks most attacks before they can start. A poorly configured one leaves the door wide open.

Modern operating systems have excellent security features built in. The challenge is that many of these features aren't enabled by default, or the default settings prioritize convenience over security. This section shows you how to configure your OS for better protection without making it unusable.

3.3.1. Understanding OS Security

Operating system hardening means configuring your system to be more resistant to attacks. This involves:

We'll cover Windows, macOS, and Linux. Skip to the section for your operating system, or read them all if you use multiple systems.

Maintaining Your Hardened System

OS hardening isn't a one-time task. Maintain your security:

Remember: Security is about balance. If a setting makes your computer too difficult to use, you'll disable it or work around it, defeating the purpose. Find the right balance between security and usability for your needs.

3.3.2. The Basics

Enable Automatic Updates

This is the single most important thing you can do. Unpatched vulnerabilities are responsible for roughly half of all data breaches. Software vendors release updates to fix security holes; if you don't install them, you're leaving known vulnerabilities exposed.

Windows:

Mac:

Linux:

Use an Antivirus

Modern operating systems come with built-in antivirus that's quite good. Make sure it's enabled and updating. 

Part of a defense in depth strategy.

Windows Defender:

There is some debate as to whether these are necessary for Mac and Linux. While Unix-based and Linux operating systems are generally more secure (Mac is Unix-based), they are not immune to viruses. There is also a rise in development of malware for Linux-based operating systems as their use becomes more common. Also, there is more to malware than just viruses, and most modern antivirus solutions are able to detect and block access to websites known to be infected, monitor system processes for evidence of ransomware, and detect malicious web traffic. Make a risk-based decision for yourself: Is the risk of dealing with leaked personal information and ransomware worth the tiny amount of system resources protection requires? Personally, I recommend Sophos as part of a defense-in-depth strategy.

Mac XProtect:

Linux:

Enable Built-In Firewall

A firewall blocks unauthorized network connections to and from your computer. Every modern OS has one built in, make sure it's on.

Windows:

Mac:

Linux:

Enable Full-Disk Encryption

Encryption scrambles your entire drive so no one can access your files without your password. If your laptop is stolen, your data is protected. This is especially important for laptops and any computer with sensitive information.

Important: Back up your data before enabling encryption. While rare, problems during encryption can result in data loss.

Windows (BitLocker - Windows Pro or higher):

Note: Windows Home edition doesn't include BitLocker. Consider upgrading to Pro or using VeraCrypt (free, open-source alternative).

Mac (FileVault):

Linux (LUKS):

Create Separate Accounts for Each Person

Never share user accounts. Each person should have their own account to provide security and privacy for everyone.

On computers:

Windows:

Mac:

Lock Your Screen When Not In Use

Your screen should lock when you step away. This prevents someone from accessing your computer if you forget to lock it manually. On Windows use windows key + L; on Mac use command + control + Q; on Linux, use windows key + L (dependent on keyboard).

You should also set your screen to automatically lock in case you step away and forget.

Windows:

Mac:

Linux (Ubuntu):

Disable AutoPlay/AutoRun

When you connect a USB drive or CD, your computer can automatically run files. This is dangerous as malware often spreads via USB drives. Turn off AutoPlay.

Windows:

Mac:

Linux:

3.3.3. Better Protection

Review and Minimize Privacy Settings

Modern operating systems collect data about how you use your computer. Some of this is for diagnostics, some for targeted advertising. Review these settings and turn off what you don't need.

Windows:

Mac:

Linux:

Configure User Account Control (Windows)

User Account Control (UAC) prompts you when programs try to make system changes. Make sure it is configured it to always notify you.

Disable Unnecessary Services (Windows)

Windows runs many background services. Some are necessary, others aren't. Disabling unused services reduces attack surface.

Safe services to disable for most users:

How to disable:

Warning: Only disable services you understand. When in doubt, leave it alone.

Disable Legacy Network Protocols (Windows)

Windows keeps old networking features for compatibility. You probably don't need them, and they're security risks.

Review Startup Programs

Programs that start automatically when you boot slow down your computer and can be security risks. Review and disable unnecessary startup items.

Windows:

Mac:

Linux:

3.3.4 Extra Credit

Create a Guest Account

If friends or family need to use your computer, create a guest account with limited access. This protects your files and prevents accidental system changes.

Windows:

Mac:

Enable Secure Boot (Windows/Linux)

Secure Boot prevents unauthorized operating systems and bootloaders from starting. It protects against bootkits and rootkits that load before Windows.

Note: Some Linux distributions and dual-boot setups may have compatibility issues with Secure Boot. Verify that your distribution and hardware are compatible with secure boot before enabling.

Encrypt External Drives

If you store sensitive data on external drives or USB sticks, encrypt them too.

Windows (BitLocker To Go):

Mac:

Linux:

Disable SMBv1 Protocol (Windows)

SMBv1 is an old file sharing protocol with known security vulnerabilities (like WannaCry ransomware). Disable it unless you need to connect to very old network devices.

3.4 Physical Security

Core Concepts: Minimize Your Exposure, Protect Your Data

All the passwords, encryption, and firewalls in the world won't help if someone can simply walk away with your laptop or peek over your shoulder to see your password. Physical security is often overlooked because we focus on digital threats, but physical access defeats almost all security measures.

If someone steals your laptop, they have unlimited time to try to break your encryption or find vulnerabilities. If they watch you type your password once, they don't need to hack anything. Physical security is where digital security starts.

3.4.1. Understanding Physical Security

Physical security covers protecting your devices and data from:

The good news is most physical security measures are simple, inexpensive, and about habits more than technology. You don't need expensive equipment, you need to lock your screen every time, keep devices with you, and stay aware of your surroundings.

3.4.2. The Basics

Lock Your Screen Every Time

This is the single most important physical security habit. Lock your screen whenever you step away from your device, even for a moment. Also, never leave devices unattended in public. It only takes a second for someone to pick it up.

Quick lock shortcuts:

Be Aware of Your Surroundings

Shoulder surfing is when someone watches your screen or keyboard to see what you're typing. They could observe passwords, PINs, sensitive emails, etc. They do not have to be directly over your shoulder either, across the room with a cellphone camera is enough. To that point, even security cameras could inadvertently capture sensitive information.

How to protect yourself:

Use Device Tracking Features

Enable Find My Device features on all your devices (covered in Mobile Device Hardening and OS Hardening sections).

What this enables:

Test it now: Make sure you can actually locate your devices before you need to.

Be Cautious with Public Charging Stations

Public USB charging stations (airports, hotels, conference centers) can be compromised with "juice jacking" attacks that install malware or steal data.

How to protect yourself:

Mark Your Devices

Visibly marking your devices makes them less attractive to thieves (harder to resell) and easier to identify if recovered. Just don’t use anything which could make it a bigger taget, such as your name or a company logo.

Marking options:

What to mark:

Document: Keep a record of serial numbers and device identifiers. Take photos. Store this in your password manager or secure cloud storage.

3.4.3. Better Protection

Secure Webcam and Microphone

Your webcam and microphone can be accessed by malware or accidentally left on during video calls.

Simple protection:

Use a Cable Lock for Laptops

Cable locks (Kensington locks) physically secure your laptop to a desk or other fixed object.

When to use:

What to buy:

Note: Cable locks are deterrents, not absolute security. Determined thieves can cut cables or remove the lock slot, but they do reduce opportunistic theft.

Use Privacy Screens

Privacy screens are physical filters that narrow the usable field of view of your monitor. Some laptops have this feature integrated. HP has a featured called the Sure View integrated privacy screen which can be turned on and off using a keyboard shortcut. If your laptop does not have a built-in privacy screen, consider purchasing one if you frequently access sensitive data in public.

When to use:

What to buy:

Tradeoff: Privacy screens reduce screen brightness and can make it harder to see in certain lighting. Worth it for sensitive work.

3.5 Data Lifecycle and Disposal

Core Concept: Protect Your Data

Data doesn't just disappear when you delete it. When you click "delete" or throw a device in the trash, your personal information often remains completely recoverable. This section covers how to properly manage data throughout its entire lifecycle, from creation to destruction.

Whether you're selling an old phone, donating a computer, recycling a hard drive, or just trying to clean up years of accumulated digital clutter, you need to know how to truly delete data so it can't come back to haunt you.

3.5.1 Understanding Data Lifecycle and Deletion

Delete doesn’t mean “gone.” When you delete a file, your computer doesn't actually erase it, it just marks that space as "available for reuse." The data sits there, completely intact, until something else overwrites it. This might take days, months, or never happen at all.

Where your data lives:

Real-world consequences of improper disposal:

3.5.2. The Basics

Factory Reset Before Selling or Donating Devices

Never sell, donate, or recycle a device without factory resetting it.

Before factory reset:

How to factory reset:

iPhone/iPad:

Android:

Windows:

Mac:

Delete Old Online Accounts

Old accounts you no longer use still contain your personal data.

Some accounts to review include:

Before deleting account:

If you’re not sure how to delete an account (service provider instructions are not always clear) you can look up the site here: https://justdeleteme.xyz/ 

Delete Cloud Data You Don't Need

Data in the cloud doesn't necessarily automatically delete when you delete it locally. Review your cloud data storage occasionally and remove any sensitive information to limit its exposure. Don’t forget to empty the trash, as cloud services often retain deleted items for 30+ days.

3.5.3. Better Protection

Use Secure Deletion Tools

When disposing of a computer, if you have used it to store sensitive files, normal deletion isn't enough. Secure deletion tools overwrite the data multiple times.

DoD 5220.22-M standard: Overwrites data 7 times (for HDDs). Once considered necessary, now overkill; 1-3 passes is sufficient for HDDs. For SSDs, multiple overwrites are ineffective due to wear-leveling; use manufacturer's Secure Erase utility or ensure the drive was encrypted from the beginning.

Check Printers and Copiers

Many printers and copiers have internal storage that keeps copies of things you printed or scanned.

Before disposing:

3.5.4. Extra Credit

Plan for Digital Legacy

What happens to your data when you die? Plan for it.

Digital legacy planning:

Services: