Every laptop, phone, and tablet that touches your business is a potential entry point for attackers—or a potential loss if it's stolen. This guide covers the core hardening steps every device needs: updates, screen locks, encryption, physical security, USB risks, and backups, with quick setup steps for each major platform.
OS Updates: Your First Line of Defense
Why Updates Matter Most
Keep Everything Updated
- Enable automatic updates for your operating system, browser, and critical applications
- Don't postpone security updates repeatedly—known vulnerabilities get exploited quickly once patches are public
- Restart devices regularly so pending updates actually install
- Retire devices that no longer receive security updates from the manufacturer
Screen Locks & Authentication
Lock It Down
- Set auto-lock to activate after 5 minutes or less on computers, immediately on mobile devices
- Use a PIN, password, or biometric (fingerprint/face) lock—never leave a device with no lock screen
- Use at least a 6-digit PIN on mobile; avoid simple patterns like "1234" or "0000"
- Enable "Find My Device" / remote wipe features on every device
Encryption
Encryption protects your data if a device is lost or stolen—without it, anyone with physical access can pull data directly off the drive.
Turn On Full-Disk Encryption
Enable Full-Disk Encryption
- Windows: BitLocker (Pro/Enterprise editions) or Device Encryption (Home edition, if supported)
- Mac: FileVault
- iOS/Android: Encryption is on by default when a passcode is set—make sure a passcode is actually configured
- Store recovery keys securely (password manager or with IT), not on a sticky note
Physical Security
Protect the Device Itself
- Never leave devices unattended in public places, even briefly
- Don't leave laptops visible in a parked car
- Use cable locks for desktop workstations in shared or open offices
- Label devices with contact info (not company name, which can invite social engineering) for return if lost
- Report a lost or stolen device to IT immediately so it can be remotely wiped or locked
USB & External Device Risks
Treat Unknown Devices as Hostile
- Never plug in a USB drive you found or received unexpectedly—it may be "baiting" malware
- Avoid public USB charging stations; use your own charger and outlet, or a "USB data blocker"
- Disable AutoRun/AutoPlay for removable media on company computers
- Only use company-approved external drives for sensitive data, and encrypt them
- Scan any external device with antivirus software before opening files
Backup Strategy
The 3-2-1 Backup Rule
- 3 copies of important data
- 2 different storage types (e.g., cloud + external drive)
- 1 copy stored offsite or offline (protects against ransomware reaching connected backups)
- Test restoring from backup periodically—an untested backup is not a reliable backup
- Enable automatic backup for mobile devices (iCloud, Google Backup) for personal device recovery
Platform-Specific Quick Setup Steps
Windows
- Settings → Update & Security → turn on automatic updates
- Settings → Accounts → Sign-in options → require a PIN/password
- Settings → Privacy & Security → Device encryption → turn on BitLocker
- Settings → Privacy & Security → Windows Security → confirm Defender is active
- Enable "Find My Device" under Update & Security
Mac
- System Settings → General → Software Update → enable automatic updates
- System Settings → Lock Screen → require password immediately after sleep
- System Settings → Privacy & Security → turn on FileVault
- System Settings → Privacy & Security → confirm firewall is on
- Enable "Find My Mac" via Apple ID settings
iOS (iPhone/iPad)
- Settings → General → Software Update → enable automatic updates
- Settings → Face ID/Touch ID & Passcode → set a passcode (6+ digits)
- Settings → [Your Name] → Find My → enable Find My iPhone
- Settings → Privacy & Security → review app permissions
- Enable automatic iCloud backup
Android
- Settings → System → System update → check for updates regularly
- Settings → Security → Screen lock → set PIN/pattern/biometric
- Settings → Security → confirm device encryption is enabled
- Settings → Security → Find My Device → turn on
- Settings → System → Backup → enable Google backup
Before/After Security Checklist
Before Hardening (At Risk)
- No screen lock, or a short PIN like "0000"
- Updates postponed for weeks or months
- No encryption enabled
- No remote wipe capability configured
- Backups nonexistent or untested
- USB drives from unknown sources plugged in freely
After Hardening (Protected)
- Auto-lock enabled with PIN/biometric
- Automatic updates turned on and applied
- Full-disk encryption active
- Find My Device/remote wipe configured and tested
- 3-2-1 backup strategy in place and verified
- Unknown USB devices never connected without IT review