Device and Network Security

Device and Network Security

Adapted from GitLab's device standards and "Isolating your work laptop from other devices in your home".

Your laptop and phone hold your NFE sessions, synced files and often saved passwords. An infected device leaks everything on it. Infostealer malware is a likely way our 2026 mail passwords leaked.

Laptops and desktops

• Keep it updated: turn on automatic OS and browser updates and restart when asked.
• Full-disk encryption on: FileVault (macOS), BitLocker or Device Encryption (Windows), LUKS (Linux).
• Screen lock after 5 minutes or less, with a password, PIN or biometrics.
• Malware protection: Windows Defender is fine on Windows. Run a scan after anything suspicious.
• Install software only from official sources. No cracked software, "free" game cheats or unknown browser extensions. These are the main way infostealers spread.
• Separate user accounts if family members share the computer. Ideally, keep a separate work device.
• Don't save the NFE password in the browser. Use a password manager.

Phones

• Screen lock and automatic updates on.
• Install apps from the official app store only.
• Use an app password for mail and Nextcloud apps, never your main password.
• If the phone is lost, revoke its app passwords and sessions straight away (Nextcloud → Devices & sessions) and report it.

Networks

• Home network: change the router's default admin password, use WPA2/WPA3, and keep the router firmware updated. Put smart-home and IoT devices on a guest network if possible, separate from your work laptop.
• Public Wi-Fi: NFE services use HTTPS, so normal use is fine. Avoid admin work (servers, field devices) on public Wi-Fi unless you're on a VPN or tunnel (Tailscale/WireGuard).
• Never expose field devices (Raspberry Pi, inverter or meter interfaces, Modbus) directly to the internet. Use a VPN or tunnel.

USB drives

Encrypt drives that carry NFE data. Don't plug in drives you found or were given unexpectedly.