Updates close the holes attackers use to break in. Backups mean that if something still goes wrong, from a broken laptop to ransomware, you lose nothing that matters. Together they are the cheapest protection you will ever set up.
About 12 minutes to readAn hour to set upBeginner
1Turn on automatic updates
Most updates are security fixes. Once a fix is released, attackers study it to learn what was broken, then target everyone who has not installed it yet. The days after an update are when unpatched devices are most at risk, so let updates install automatically.
Windows
Settings → Windows UpdateLeave updates on and restart when asked. Turn on “Get the latest updates as soon as they're available”.
Mac
System Settings → General → Software Update → Automatic updatesTurn on all options, including security responses and system files.
iPhone and iPad
Settings → General → Software Update → Automatic UpdatesTurn on download and install, including security responses.
Android
Settings → System (or Software update)Install system updates, and also check Settings → Security for Google Play system updates. Menus vary by manufacturer.
Apps and browsers
App Store, Google Play and Microsoft Store auto-updateChrome, Edge, Firefox and Safari update themselves, but only finish when restarted. If your browser shows an update or restart button, use it.
Don't forget
Routers, smart TVs, cameras, printers and other connected gadgets need updates too. Module 4 covers your router; for other devices, turn on automatic updates in their app if offered.
2Replace devices that no longer get updates
Every device eventually stops receiving security fixes. After that, new weaknesses are never repaired, and the device becomes steadily easier to attack.
Windows 10: mainstream support ended in October 2025. Home users can still get security updates until 12 October 2027 by enrolling in Microsoft's Extended Security Updates: free if you turn on Windows Backup, or with Microsoft Rewards points or a one-off $30 payment. Look for the enrolment link in Settings → Windows Update. Plan to move to Windows 11 or a new computer before then.
Phones and tablets: check how long your manufacturer promises updates. Many recent phones from Apple, Google and Samsung get them for several years; budget and older models often far less.
Anything that says it is out of support, or has not had an update in over a year, should be replaced, or at least kept away from banking, email and work.
3Back up with the 3-2-1 rule
Ask yourself: if this device were lost, stolen or broken right now, what would I never get back? Usually photos, documents and messages. The 3-2-1 rule keeps them safe:
3 copies of anything important
2 different kinds of storage
1 copy kept away from home or offline
For most people that means the original on your device, an automatic cloud backup, and an external drive that is plugged in only while backing up.
iPhone
iCloud Backup and iCloud PhotosSettings → [your name] → iCloud. Check the backup actually completes; free storage is small.
Android
Google One backup and Google PhotosSettings → Google → Backup. Turn on backup for photos and videos in Google Photos.
Windows
Windows Backup, OneDrive and File HistoryWindows Backup and OneDrive copy folders to the cloud; File History copies versions of files to an external drive.
Mac
Time Machine and iCloud DriveTime Machine keeps hourly versions on an external drive; iCloud Drive keeps your Desktop and Documents in the cloud.
Do this
Turn on the cloud backup for each phone and computer.
Buy an external drive and run a full backup to it at least monthly, then unplug it and store it somewhere safe.
Test a restore: open a few files from the backup to make sure it actually works. An untested backup is a hope, not a plan.
Sync is not backup
Services that sync, such as a shared folder, copy your mistakes too: delete or encrypt a file on one device and it changes everywhere. Make sure your cloud service keeps version history or deleted files, and keep that offline copy.
4Be ready for ransomware
Ransomware is malicious software that locks your files and demands payment to unlock them. It targets homes and small businesses as well as large companies, and it can also encrypt any drive or synced folder the infected computer can reach.
An offline backup, such as the unplugged drive above, is what lets you recover without paying.
Updates, built-in antivirus and care with downloads and email attachments prevent most infections.
If it happens
Disconnect the affected device from Wi-Fi and the network, and unplug any backup drives, so it cannot spread.
Do not pay. The FBI advises against paying: there is no guarantee you will get your files back, and it funds further attacks.
Report it to the FBI at ic3.gov. For a business, call your IT provider and insurer straight away.
Get the device professionally cleaned or reset to factory settings, then restore your files from a backup made before the infection.
Change your passwords from a clean device, starting with email and banking.
5Built-in protections to switch on
Modern devices come with good protection built in. Make sure it is on, rather than paying for extras you may not need.
Antivirus: Microsoft Defender on Windows and the built-in protection on Mac are on by default. Leave them on, and do not install two antivirus products at once.
Encryption: turn on Device Encryption or BitLocker (Windows) and FileVault (Mac), so a stolen laptop's files cannot be read. Phones are encrypted when you set a passcode.
Everyday account: on computers, use a standard user account day to day and keep the administrator account for installing software. Malware then has less power.
Install from official sources: use app stores and developers' own websites. Avoid “cracked” software and search ads for downloads.
Remove what you don't use: old apps, browser extensions and plug-ins are all things that need updating and can be exploited.
Check your understanding
Why is it risky to delay an update for weeks?
Attackers study the fix. Once a security update is public, the weakness it fixes becomes widely known, so unpatched devices are easy targets.
Ransomware has locked your files. Which backup will save you?
An offline or versioned backup. Ransomware can encrypt anything the infected computer can reach, including synced folders and connected drives.
When do you know a backup really works?
When you have restored from it. Backups fail silently more often than you would think. Test one now and then.
Your checklist
Your ticks are saved only in this browser. Nothing is sent anywhere.
This module is general educational information, not professional advice, and following it cannot guarantee your devices or data will not be compromised or lost. Menus and support dates change and vary by device; follow each manufacturer's current instructions. Products are named as examples only; Rondel Group is not affiliated with them.