Device Security: Updates, Encryption and Backups

Three habits protect most of what's on your devices: install updates promptly, encrypt the storage, and keep backups you've actually tested. Updates close the holes attackers use; encryption keeps data private when a device is lost or stolen; backups make sure nothing is gone for good, whether the cause is ransomware, a spilled coffee or a dead drive. This lesson covers all three and ends with a backup plan for a Nashville photographer, calculated step by step.

1. Keep everything updated
2. Use built-in protection
3. Encrypt and lock
4. Back up with 3-2-1
5. Test your restore

Updates: closing holes before attackers use them

Every operating system, browser and app has bugs, and some are security flaws. When a vendor fixes one, the update itself tells attackers where to look, and they quickly start scanning for devices that haven't installed it. In Verizon's 2026 DBIR, exploiting vulnerabilities was the most common way attackers got into breached organizations, and the median time to fix vulnerabilities grew to 43 days. Every day an update waits is a day the door stays open.

• Turn on automatic updates for the operating system, browser and apps. Restart when asked: many updates only take effect after a restart.
• Don't forget firmware: routers, printers, cameras and the BIOS/UEFI of your computer.
• Watch for end of support. When a vendor stops supporting a product, new flaws are never fixed. Microsoft ended standard support for Windows 10 on October 14, 2025; phones also have limited update periods, which vary by manufacturer and model.
• Prioritize what attackers are using. CISA's Known Exploited Vulnerabilities (KEV) catalog lists flaws being exploited in the wild. Businesses use it to decide which patches can't wait.
• Remove what you don't use. Old apps and browser extensions are unpatched attack surface.

Built-in protection you already have

Modern devices come with solid security features. Most people just need to confirm they're turned on:

Three more settings make a big difference:

• Screen lock: a PIN of at least six digits or a passcode, with auto-lock after a few minutes. Biometrics (fingerprint or face) make this painless.
• A standard user account for daily work: use an administrator account only to install software. Much malware can do far less damage without admin rights.
• Remote wipe ready: confirm "Find My" is on before you need it, and know how to erase a lost device.

Businesses usually add endpoint detection and response (EDR), which watches for suspicious behavior (like a program encrypting hundreds of files per minute) and lets IT isolate a device remotely, plus device management (MDM) to enforce encryption, updates and screen locks on every company laptop and phone.

Encryption: the difference between "lost laptop" and "data breach"

Full-disk encryption scrambles everything on the drive. Without your password or PIN, the data is unreadable, even if someone removes the drive and connects it to another computer. That's confidentiality from the CIA triad, applied to the most common real-world incident: a device left in a car, a taxi or an airport.

For businesses, encryption also has legal weight. Under HIPAA, breach notification rules apply to unsecured protected health information, and HHS guidance treats properly encrypted data as secured. The FTC's Safeguards Rule likewise defines a reportable event as unauthorized acquisition of unencrypted customer information. A stolen encrypted laptop is still a loss to report internally, but it's far less likely to become a notification event.

Backups: the 3-2-1 rule

A backup is a separate copy of your data that you can restore if the original is lost, damaged or encrypted by ransomware. The classic rule is easy to remember:

For ransomware, add one more requirement from CISA's #StopRansomware Guide: keep backups offline (disconnected) or immutable (unchangeable for a set period), encrypted, and test them regularly. Attackers specifically look for connected backups to destroy them before encrypting everything else.

Sync is not backup

Cloud sync folders are wonderful for working across devices, but they copy every change, including deletions and ransomware encryption, to all your devices within seconds. Sync becomes closer to a backup only if the service keeps version history long enough for you to roll back. Check how many days of versions your plan keeps, and don't rely on sync as your only copy.

Two numbers that define a backup plan

• RPO (recovery point objective): how much work you can afford to lose. A nightly backup at 11 p.m. means a failure at 4 p.m. the next day loses up to 17 hours of work.
• RTO (recovery time objective): how fast you need to be working again. Restoring 2 TB from the cloud can take days; from a local drive, hours.

Case: sizing a backup plan for a Nashville photographer

Lena, a fictional wedding photographer in Nashville, has 2.4 TB of client photos on her laptop and an external drive that she plugs in "now and then." Her shoots add about 60 GB a month. She wants a proper 3-2-1 setup.

Step 1: size the storage. In one year she'll have 2.4 + (0.06 × 12) = 3.12 TB; in two years, 3.84 TB. Two 5 TB external drives cover at least two years of growth.

Step 2: estimate the first cloud upload. Upload speed, not download speed, decides how long the initial copy takes:

Time (seconds) = data in bits ÷ upload speed in bits per second
2.4 TB = 2.4 × 10^12 bytes × 8 = 1.92 × 10^13 bits
At 20 Mbps: 1.92 × 10^13 ÷ (20 × 10^6) = 960,000 seconds ≈ 11.1 days

With her 20 Mbps upload, the first full cloud backup takes about 11 days, so she starts it right away and prioritizes current client folders. After that, only new and changed files upload, which is quick.

Step 3: set the routine.

1. ContinuousCloud backup with versioningOff-site copy with at least 30 days of file versions.
2. Every MondayDrive A: plug in, back up, unplugDisconnected the rest of the week, so ransomware can't reach it.
3. First of the monthSwap drive A with drive BDrive B lives at her sister's house: a second off-site copy.
4. Every quarterTest a restoreRestore one full wedding folder to a spare location and open the files.

Result: three or more copies, two types of storage, two of them off-site, one always offline. An RPO of at most a few hours (cloud) and an RTO of an afternoon (local drive).

Common mistakes

Summary

• Automatic updates close the holes attackers exploit most; replace anything past end of support.
• Use the protection you already have: built-in antivirus, firewall, screen lock and Find My.
• Full-disk encryption turns a stolen laptop into a hardware loss instead of a data breach; keep the recovery key safe.
• Follow 3-2-1 with at least one offline or immutable copy; sync alone is not a backup.
• Size your plan with real numbers (storage growth, upload time, RPO and RTO) and test restores every quarter.

Next lesson: Privacy and Personal Data Protection. You'll learn how your personal data is collected and shared, what U.S. privacy laws cover, and how to freeze your credit and reduce your digital footprint.