# Device and Network Security

# Device and Network Security

*Adapted from GitLab's device standards and "Isolating your work laptop from other devices in your home".*

Your laptop and phone hold your NFE sessions, synced files and often saved passwords. An infected device leaks everything on it. **Infostealer malware is a likely way our 2026 mail passwords leaked.**

## Laptops and desktops

- **Keep it updated:** turn on automatic OS and browser updates and restart when asked.
- **Full-disk encryption on:** FileVault (macOS), BitLocker or Device Encryption (Windows), LUKS (Linux).
- **Screen lock** after 5 minutes or less, with a password, PIN or biometrics.
- **Malware protection:** Windows Defender is fine on Windows. Run a scan after anything suspicious.
- **Install software only from official sources.** No cracked software, "free" game cheats or unknown browser extensions. These are the main way infostealers spread.
- **Separate user accounts** if family members share the computer. Ideally, keep a separate work device.
- **Don't save the NFE password in the browser.** Use a password manager.

## Phones

- Screen lock and automatic updates on.
- Install apps from the official app store only.
- Use an **app password** for mail and Nextcloud apps, never your main password.
- If the phone is lost, revoke its app passwords and sessions straight away (Nextcloud → Devices & sessions) and report it.

## Networks

- **Home network:** change the router's default admin password, use WPA2/WPA3, and keep the router firmware updated. Put smart-home and IoT devices on a guest network if possible, separate from your work laptop.
- **Public Wi-Fi:** NFE services use HTTPS, so normal use is fine. Avoid admin work (servers, field devices) on public Wi-Fi unless you're on a VPN or tunnel (Tailscale/WireGuard).
- **Never expose field devices** (Raspberry Pi, inverter or meter interfaces, Modbus) directly to the internet. Use a VPN or tunnel.

## USB drives

Encrypt drives that carry NFE data. Don't plug in drives you found or were given unexpectedly.