Computers, Local Data and Backups

Lesson 2 closed the front door: who can sign in. This lesson covers the machines behind it. Laptops get stolen. Old servers go unpatched for years. A USB stick with the payroll file goes through the wash in someone's jeans. And one afternoon a ransom note appears on the screen. For all of these, the same short list of habits helps.

Know what you have: the inventory

You cannot update, encrypt or retire a machine you forgot you owned. An inventory is a spreadsheet, nothing fancier, with one row per device.

Include the things people forget: the NAS box in the closet, the old desktop that runs the label printer, the tablet at the counter, the security camera recorder, personal phones that read work email, and the router. Update the list when a device arrives or leaves, and review it once a year.

Updates and patching

A patch is an update that fixes a security hole. Attackers read the same bulletins as everyone else, then race to use the hole before you install the fix. Verizon's 2026 Data Breach Investigations Report found that 31% of breaches began with exploited software vulnerabilities, which overtook stolen passwords as the top way in (Verizon DBIR). CISA's ransomware guide says to patch promptly, with priority for anything facing the internet and anything known to be actively exploited (CISA).

What to do, in order of payoff:

• Turn on automatic updates for the operating system (Windows Update, macOS Software Update), the web browser and Office or your office suite. Set the restart for after hours.
• Update the router, the NAS, the printer and the camera recorder. These have their own firmware (software built into the device) and rarely update themselves. Put a date on the calendar every quarter.
• Retire anything past end of support. Microsoft ended support for Windows 10 on October 14, 2025: no more technical support, software updates or security updates for ordinary installations. Eligible machines can upgrade to Windows 11 at no charge. A consumer extended security update program runs through October 12, 2027, and business customers have separate extended update terms that Microsoft documents on its business pages (Microsoft). If a machine cannot run Windows 11 and holds business data, budget to replace it.
• Use standard accounts for daily work, not administrator accounts. Malware that lands in a standard account can do less.
• Do not expose remote-access services such as Remote Desktop (RDP) directly to the internet. CISA lists this as a ransomware prevention step.

Endpoint protection

Endpoint protection is software that watches a computer or phone for malware. On Windows, Microsoft Defender Antivirus is built in and turned on by default through the Windows Security app. For a small office, the built-in tool plus automatic updates covers the basics. Paid tools add a central dashboard where you can see every computer at once, remote isolation of an infected machine, and monitoring by a service provider. Those extras are worth it when you have more than a handful of computers or when your insurer asks. CISA's guide recommends centrally managed antivirus with automatic updates, and endpoint detection and response (EDR, a more watchful kind of endpoint tool) on all assets where you can.

Whatever you use, check two things monthly: that it is running on every machine, and that nobody has turned it off to make something work.

Encrypt the disk, lock the screen

If a laptop is stolen from a truck, the question is whether the thief can read the customer list. Full-disk encryption scrambles the whole drive, so without the sign-in or the recovery key the data is gibberish. It is built in.

• Windows. BitLocker is the full-disk tool in Windows Pro, Enterprise and Education editions. Microsoft also says "device encryption" is available on all Windows versions when the hardware meets requirements, and that Windows 11 version 24H2 removed some earlier prerequisites so more devices qualify. You can check in System Information whether a device meets the requirements. Device encryption does not cover USB drives. Where the recovery key goes matters: on a device linked to a business Microsoft Entra account it is saved there; otherwise it goes to the Microsoft account that turned it on. A device with only a local account may be encrypted yet have no saved recovery key. Check where yours is (Microsoft BitLocker overview).
• Mac. Apple says Macs with Apple silicon or the T2 security chip already encrypt data, and turning on FileVault in System Settings under Privacy and Security adds protection that requires your login password. You choose how to recover: with the iCloud account or a printed recovery key. Lose both the password and the recovery key and the data is gone for good (Apple).

Save the recovery keys in the password manager's secure notes or with the administrator. A key stored only on the stolen laptop does nobody any good.

Screen locks matter for the opposite reason. They protect against the person who walks up to an open machine: a visitor, a cleaner, a coworker with bad intentions. Set computers to lock after a few minutes idle and require the sign-in to wake them. Teach one shortcut: Windows key plus L on Windows, Control, Command and Q on a Mac. Locking becomes a habit.

File servers, NAS boxes, USB drives and printers

The shared file box

A server or NAS box in the closet is often the single most important device and the least looked after. The usual faults are the default admin password, no firmware updates in years, shared folders open to everyone, and a backup that sits on the same box. Fixes: change the admin password and give admin to a named person, update the firmware, set folder permissions by group (accounting sees accounting), turn off remote access from the internet unless you truly need it and then protect it with two-step sign-in, and turn on the box's own snapshots (point-in-time copies) if it has them. If the box is old and nobody can say how it is set up, schedule an outside IT provider to review it. This is a good place to spend money.

USB drives and removable media

USB sticks and external disks are handy and easy to lose. For business data: use only drives the business bought, encrypt them (BitLocker To Go on Windows, or the encrypted format option on a Mac), keep a record of who has which drive, and never plug in a found drive. Attackers have dropped infected sticks outside offices for decades because it works. A stick that holds the only copy of something is a coin toss, and no kind of backup.

Printers and copiers

Modern printers and copiers are small computers. Many store scanned documents on an internal disk, many have web admin pages that ship with a default password, and many send scans straight to email or network folders. Change the default admin password, update the firmware, keep them off the guest network, disable features you do not use, and clear stored jobs. When a leased copier goes back, ask the lessor in writing how they erase its drive.

Retiring old equipment

Deleting files does not erase them. Before any computer, phone, copier, server or drive leaves the business, sold, recycled, donated or returned, the data must be wiped on purpose.

1. Move what you need to the new device first and confirm it works.
2. Sign out of accounts and remove the device from the password manager, Microsoft 365 or Google Workspace and any "find my device" list.
3. For a drive that is encrypted, a factory reset or reinstall destroys the key and leaves only scrambled data, which is a sound approach for modern machines. For others, use the operating system's reset option with the "remove everything" or "clean the drive" choice, or a secure-erase tool the maker provides.
4. For a drive that holds sensitive data and is dead or too old to wipe reliably, physically destroy it or use a recycler that gives a written certificate of destruction.
5. Record the date, serial number and method in the inventory.

Lesson 9 covers disposal rules for paper and records.

Backups: the layer that wins on bad days

A backup is a separate copy of data that you can restore after loss, damage or theft. It is the single protection that works against a whole list of disasters: ransomware, a dropped laptop, a fire, a flood, an employee who deletes the wrong folder, a software update that corrupts a file, and a hacker who wipes your cloud account.

The 3-2-1 rule

This is the common starting rule, and it is easy to remember.

• 3 copies of your data: the working copy plus two backups.
• 2 kinds of storage: for example the computer's disk plus an external drive or a cloud service, so one type of failure doesn't take out both.
• 1 copy offsite: not in the same building, so fire, theft or flood can't take everything.

Ransomware changed the rule enough that a fourth point is now standard advice: at least one copy must be offline or immutable. Offline means disconnected, like an external drive that sits in a drawer except during the backup. Immutable means the backup service locks it against deletion or change for a set time, so even a hacker with an administrator password cannot erase it. CISA's guide says to keep offline, encrypted backups and test their availability and integrity regularly, and also lists object lock, delete protection and versioning on cloud storage (CISA). It also advises caution with immutable storage, so ask your provider exactly how it works and who can override it.

Figure: the 3-2-1 backup picture, with the ransomware-era addition that one copy sits where an attacker's tools cannot reach it.

What to back up

• Files on computers and the file server or NAS.
• Cloud data: Microsoft 365 or Google Workspace mail, files and calendars. Providers keep these running but do not promise to restore everything you delete. Lesson 4 covers this.
• Accounting data and any database, plus the settings of your router and key systems.
• Exports of your list of accounts and licenses, and the recovery keys from this lesson and lesson 2.

Test the restore, and time it

Backups fail silently. The job reports "complete" while skipping a folder, a drive fills up, a password expires, or the backup software itself needs a license you let lapse. The only proof is a restore. Every quarter, pick five files at random and restore them to a different folder, and once a year restore a whole machine to a spare computer or virtual machine. Write down how long it took, because speed is part of the plan.

Ransomware: prevent, spot, respond

Ransomware is malware that encrypts your files and demands payment to restore them. Many gangs now also steal a copy first and threaten to publish it, which is why backups alone do not cover the whole problem. In 2025 the FBI's IC3 received 3,611 ransomware complaints with adjusted losses of $32,320,105, and many victims do not report (IC3 2025). Verizon found ransomware in 48% of the breaches it studied, across organizations of all sizes (Verizon).

Prevention, in the order small businesses can do it

1. Backups that include an offline or immutable copy, tested.
2. Two-step sign-in everywhere, especially email and any remote access (lesson 2).
3. Patches on everything, with internet-facing devices first.
4. No Remote Desktop open to the internet; use a protected VPN or a managed remote support tool with two-step sign-in.
5. Standard user accounts for daily work and separate admin accounts.
6. Email filtering and a habit of reporting odd messages (lesson 5 and lesson 8).
7. Endpoint protection running on every device.
8. Limit who can reach the file server and what they can change.

If it lands

Lesson 10 is the full incident playbook. The first minutes matter, so memorize these:

• Disconnect the affected computer from the network: unplug the cable, switch off Wi-Fi. CISA says to isolate affected systems and to power down only if you cannot disconnect them. Powering off can also lose evidence that sits in memory.
• Do not use email on the affected network to coordinate. CISA suggests out-of-band communication, such as phone calls, so attackers do not learn they've been spotted.
• Call the owner, the outside IT provider and your insurer's breach hotline if you have cyber coverage.
• Photograph the screen. Do not delete the ransom note.
• Do not wipe or rebuild yet. Evidence and a decryption possibility may exist. CISA advises asking federal law enforcement about possible decryptors.
• Report to the FBI at ic3.gov and CISA at cisa.gov/report.

Whether to pay is a business decision with real downsides, covered in lesson 10. CISA's guide does not tell you to pay or not to pay. It tells you to report and to ask about decryptors.

Who does what

Questions and answers

How often should I back up?

As often as you can stand to lose work. For files people change daily, back up every night at least, and many cloud services copy continuously. For slow-moving data like old archives, weekly or monthly is enough.

Is a cloud backup alone enough?

It protects against losing everything but is slow to restore a lot of data, as the Tamarack example shows. A local copy speeds recovery. A good setup has both.

Do I need an offline copy if my cloud backup is immutable?

Immutable storage is a strong substitute when you trust how it is configured and who can override it. If you are unsure, an offline drive is cheap insurance. Ask your provider in writing how the lock works.

What is the cheapest decent setup for a three-person office?

Automatic updates, built-in encryption and Microsoft Defender or the Mac equivalent, two external drives rotated weekly with one kept off-site, plus a cloud backup service. Roughly a few hundred dollars a year at planning prices. Confirm current prices.

Should I keep my old Windows 10 computer?

Not on a network with business data unless it is covered by a paid extended update program. Consider replacing it, or running it offline for a single job.

Can I recover files after I have been hit by ransomware without paying?

Often yes, from clean backups. Sometimes a free decryptor exists for specific ransomware families. Ask the FBI or CISA when you report. Do not wipe machines before you know what you need.

Is it safe to use my personal laptop for work?

It is riskier, because the business does not control its updates, encryption or what else is installed. If you must, apply the same rules and keep work data in the company's cloud, not on the laptop. Lesson 7 covers personal devices.

How long do I keep backups?

Keep several generations: for example daily for 30 days, monthly for a year. Ransomware can sit unnoticed for days, so the newest backup may already be bad. Retention for legal and tax records is a separate question that lesson 9 touches on.

Hard questions

"We're small. Isn't a backup drive in a desk drawer good enough?"

It beats nothing, and a drawer is a fine offline location. The weak points are a fire or theft that takes the drawer too, and a drive that nobody has tested. Add a second copy off-site and test the restore.

"Encryption means we'll lose data forever if someone forgets a password."

Only if you skip the recovery key. Store it with the administrator and in the password manager. Apple's own help warns that losing both the password and the key means permanent loss, which is why you plan for it first.

"Updates break things. We've had a program stop working after an update."

It happens, and it is a reason to test, not to stop. Update the operating system and browser automatically, test line-of-business software on one machine first, and keep the old installer. Unpatched holes cost more than the occasional bad update.

"Why not pay a small ransom and be done with it?"

Payment does not guarantee working decryption, may not delete stolen data, and may mark you as a payer. Lesson 10 lays out what federal agencies say and the questions to ask before any payment. The better position is never to need to decide, which is what the tested offline backup buys.

"A managed IT provider costs more than we can afford."

A full contract may. But a one-time review of your server, backups and updates, then a quarterly check, can cost a fraction of that. Think of it as paying for a mechanic to look at the truck once a year.