Keeping devices safe: updates, backups, permissions and theft protection

Your phone is the remote control for your whole digital life. A few settings, switched on today, mean that an old flaw, a stolen handset or a ransomware attack becomes an inconvenience rather than a disaster.

Watch the 1-minute overview

Watch the full video guide for this module

Updates: the quiet superpower

• The NCSC says applying security updates promptly helps protect your devices and accounts from cyber criminals, and that updates include protection from malware.
• Turn on automatic updates in your device's settings where available, so you do not have to remember (NCSC).
• Updates can take time and need a reliable connection, so the NCSC suggests doing them at home on Wi-Fi with the device plugged in.
• Manufacturers eventually stop updating older devices. You do not need the newest model, but the NCSC recommends avoiding phones that no longer receive security support.
• Remember apps and browsers too, not just the operating system.

Backups that survive ransomware

• The NCSC's rule of thumb: back up anything that you value, such as photos, coursework and documents.
• Cloud storage can back up automatically, so it happens even when you forget (NCSC).
• For large files you can use an external drive or USB stick, but password-protect it and set a reminder (NCSC).
• Ransomware and other malware can spread to attached drives, so the NCSC advises disconnecting removable media when it is not in use.
• For irreplaceable things, keep one copy in the cloud and one on removable media, and check now and then that the backup really contains your files (NCSC).

App permissions: give apps only what they need

• The UAE Cyber Security Council advises reviewing permissions before installing apps, checking them regularly, and limiting location, camera and microphone access to when it is truly needed. It also advises avoiding contact-list access unless essential (Gulf News, 2025).
• On Android, go to Settings, then Apps, choose an app, then Permissions. For location, camera and microphone you can choose 'Allow only while using the app', 'Ask every time' or 'Don't allow' (Google).
• Android's Permission manager (Settings, Security and privacy, Privacy) shows every app with a given permission, such as location, in one list (Google).
• Turn on 'Pause app activity if unused' so apps you forget about lose their permissions (Google).
• On iPhone, Safety Check can review and reset the privacy permissions you have given apps (Apple).

iPhone: Stolen Device Protection

• Stolen Device Protection adds extra security when your iPhone is away from familiar places such as home (Apple).
• Away from those places, actions such as using saved passwords or passkeys, or erasing the phone, need Face ID or Touch ID, with no passcode fallback. This matters because thieves sometimes watch people type their passcode before stealing the phone.
• Changing your Apple Account password or your passcode needs a one-hour Security Delay followed by a second Face ID or Touch ID check (Apple).
• To turn it on: Settings, then Face ID and Passcode, enter your passcode, then Stolen Device Protection. It needs iOS 17.3 or later, 2-step verification on your Apple Account and Find My switched on (Apple).
• Apple stresses it must be turned on before the device is lost or stolen.

Android: theft protection

• Theft Detection Lock uses the phone's sensors to spot a snatch-and-run and automatically locks the screen (Google).
• Offline Device Lock locks the screen if the phone is taken offline for a short time, which thieves sometimes do to stop it being tracked (Google).
• Remote Lock lets you lock a lost phone from android.com/lock using your verified phone number (Google).
• Identity Check asks for your fingerprint or face for sensitive changes when you are away from trusted places (Google).
• To turn these on: Settings, then Google, then All services, then Theft protection. Some features need newer Android versions and are not available on every model (Google).

If a device goes missing

• Follow the step-by-step plan in lesson tc-05 (Find My or Find Hub, mark as lost, report to police, block the SIM).
• Then change your email and banking passwords from another device.
• Remove any passkeys stored on the lost device from your accounts (Google).
• Check your accounts' device lists and sign out the missing device (lesson cy-07 shows how).