Before anything else
A new computer has usually spent months in a box, so its software is months old. Connect it to your home network and run the system updater, restart, and run it again until it reports nothing left. It often takes three rounds. Do this before you install programs, sign in to your bank or move your files over.
Lock down the machine
- Set a strong login password, and have the screen lock after five minutes idle and require the password on waking.
- Turn on full-disk encryption, which is built into every major operating system and is sometimes off by default. Without it, anyone holding the laptop can read the drive by removing it, whatever your login password may be.
- Save the encryption recovery key in your password manager or on paper, and never only on the computer itself, because a forgotten password without that key means the data is gone.
- Confirm that the built-in firewall and the built-in malware protection are switched on. For most people they are sufficient.
- Turn on the find-my-device feature, so that a lost laptop can be located, locked or erased remotely.
- Use a standard account for daily work and keep a separate administrator account for installing software, if you want one more layer.
Clear out the preinstalled clutter
Many computers ship with trial antivirus software, shopping shortcuts and the manufacturer's own utilities. The antivirus trial will expire into a stream of alarming renewal pop-ups, and meanwhile it competes with the protection already built in. Uninstall it, along with anything else that you did not choose. During setup, decline the optional diagnostics, the advertising identifier and the personalized suggestions. None of them is required for the computer to work.
Install carefully
Download programs only from the official app store or the maker's own site, and type the address yourself. Paid search results for popular free programs regularly lead to lookalike pages that serve malware. Start with the browser, brought up to date, along with your password manager's extension and a reputable content blocker. Then start the backup on day one, with an external drive and an off-site copy. If the computer is secondhand, erase it and reinstall the operating system from scratch before you trust it with anything.
Tip Write down the serial number and keep the receipt with it. A police report, an insurance claim and a warranty repair all begin with that number, which is hard to read off a laptop you no longer have.
