Using your laptop and phone safely

Module 5: Devices, software and network · Reading time: 10 minutes

Learning objective: After this lesson, you'll be able to secure laptops and phones against loss, theft and malware, and you'll know what to do in the first hour if a device goes missing.
Key concepts: screen lock, disk encryption, recovery key, find and wipe device, built-in security, standard user, administrator account, app permissions, remote management (MDM)

The device is the keyring

A business owner's laptop or phone holds more than just files. It also holds logged-in sessions for email, accounting and banking, saved passwords, the authenticator app for two-factor authentication, customer data in the downloads folder, and photos of passports someone "just" sent over. A lost or stolen device is therefore almost always more than a cost item. It can give access to your entire business, and it can be a data breach (lesson 8.2).

There are two types of risk, with different measures:

Screen lock: the first door

Without a lock, anyone who picks up your device can carry on right where you left off. So set up:

• a PIN or password on every device, with biometrics (fingerprint or face) as a convenient extra. A PIN of six digits or more is much stronger than four; a swipe pattern can often be read from the smudges on the screen;
• automatic locking after a few minutes of inactivity;
• the habit of locking it yourself when you walk away. On Windows that's the Windows key + L, on a Mac it's Control + Command + Q;
• limiting notifications on the lock screen. A login code sent by text message or part of a confidential email doesn't need to be visible to anyone who sees your phone lying on the table.

Disk encryption: what a thief can't read

A screen lock stops a passer-by, but not a thief with time on their hands. They can remove the disk from a laptop and read it in another computer. Disk encryption protects against that scenario: all data on the storage is encrypted with a key that's only released when you log in. Without that key, the disk is just a collection of unreadable characters.

Encryption comes with a recovery key: a long code that lets you access the data if your password stops working or after a major change to the device. Store that key somewhere you can still reach even if the laptop itself is gone, for example in your password manager or in your organisation's account. A recovery key on a note in the laptop bag is about as useful as the house key under the doormat.

Why this matters for GDPR: if you lose an encrypted device whose key is kept safe, the risk of the data being misused is small. With an unencrypted laptop holding customer data, that's a different story. You'll learn how to assess that in lesson 8.2.

Lost it? The first hour

Set this up now, so it works when you need it:

1. Turn on remote find and wipe. Apple, Google and Microsoft each have a feature to show a device on a map, make it ring, lock it and wipe it. It only works if it's been switched on in advance.
2. Know how you sign in to do that, and make sure you can do so even without the missing device. If your two-factor authentication is set up only on that phone, you'll need your recovery codes (lesson 2.3).

If the device is missing:

1. Lock it remotely and display a message with a phone number.
2. Revoke sessions on your most important services: email, cloud storage, accounting. In Nextcloud, for example, you can revoke access per device or instruct the device to wipe that service's data.
3. Change passwords for accounts that were open on the device, from another, clean device.
4. Wipe the device remotely if you don't find it quickly.
5. Assess and document whether it held personal data, and report the theft to the police.

Malware: built-in security and minimal rights

A modern laptop or phone already has plenty of built-in security: Windows has Microsoft Defender, macOS has its own checks on programs, and Apple's and Google's app stores vet apps before they're offered. A separate antivirus package can add extra features, but the most important thing is that the built-in security is switched on and kept up to date.

Two habits make a big difference:

• Work day to day as a standard user, not as an administrator. Malware you accidentally launch gets the same rights as you have. As a standard user, it can do far less: no installing software, no changing system settings, no turning off security. If you ever need administrator rights, the system will ask for the administrator password. That moment of pausing to think is exactly the point.
• Only install from the official app store or the maker's own site. On Android that means: leave "install from unknown sources" switched off. In tech support scams or fake bank alerts, scammers love to send a link to an "app" that in reality takes over your screen.

App permissions: what's an app allowed to do?

Every app asks for permissions: camera, microphone, location, contacts, files. A torch app that wants access to your contacts has no good reason for that. Once a quarter, go through the permissions in your phone's settings:

• only grant location "while using the app", not always;
• revoke access to contacts and files for apps that don't need it. Your contacts are other people's personal data;
• remove apps you no longer use;
• pay extra attention to apps that ask for accessibility permissions or screen sharing. With these, an app can see and click everything you see.

More devices? Remote management

If you work with a few people or more, "everyone sorts it out themselves" becomes hard to keep track of. With remote management (Mobile Device Management, MDM) you set centrally that every device is encrypted, has a lock, receives updates and can be wiped remotely. There are solutions built into the major business office suites, as standalone services, and as open source. For employees' own phones (bring your own device), you can often manage only the business part, so you can't access anyone's private photos.

Even without MDM, you can agree on rules and review them together once a year. The checklist in the exercise helps with that.

In practice: what it looks like

In Nextcloud, as offered by WebOké, you'll find a list called Devices & sessions under Settings, Security. There you can see every browser, app and app password that has access. Using the three dots, you can revoke the access of a single device, or have the device wipe its Nextcloud data the next time it connects. With other cloud services this is often called "devices", "sessions" or "security overview" and works in a similar way.

Summary

• A device is a keyring: sessions, passwords and the 2FA app all live on it.
• Lock automatically, use a strong PIN, and limit notifications on the lock screen.
• Turn on disk encryption and store the recovery key somewhere other than with the device.
• Turn on remote find and wipe in advance; if lost: lock, revoke sessions, change passwords, wipe, assess.
• Work as a standard user, only install from official sources, and review app permissions regularly.

Quiz

Exercise

Exercise D5.2: Checking your laptop and phone. Check your own laptop and phone for the lock, disk encryption, recovery key, remote find and wipe, your account type and app permissions. Tick off the checklist and write down what you would do if your phone were stolen tomorrow.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers it works in a similar way.

• Nextcloud manual 3.6: Viewing, revoking, or remotely wiping devices and sessions
• Nextcloud manual 3.10: Lost your phone or lost 2FA: here's how to get back in
• WebOké manual 3.6: Viewing and logging out active sessions
• NCSC, mobile devices (Dutch source): https://www.ncsc.nl/mobiele-apparatuur
• Microsoft, device encryption in Windows: https://support.microsoft.com/nl-nl/windows/apparaatversleuteling-in-windows-cf7e2b6f-3e70-4882-9532-18633605b7df
• Apple, passcodes and data protection: https://support.apple.com/guide/security/passcodes-and-passwords-sec20230a10d/web