Security Guides

#security basics #devices #theft protection #public Wi-Fi

Securing a laptop you carry around — protecting against theft, loss, and shoulder-surfing

Assume your laptop will be lost or stolen. Disk encryption, a strong login with auto-lock and remote wipe keep the contents safe, plus public Wi-Fi advice.

Published 2026-06-11 Updated 2026-10-06 9 min read

On this page

If you take a laptop outside, the starting point is one idea: prepare as if you'll lose it or it'll be stolen. No attack steps here, just the measures that keep a loss from becoming a breach.

If you lost this PC right now, what leaks?

It's not "just a laptop." It holds the passwords and keys that get you into other services and servers.

Saved PW

Passwords saved in the browser/apps

SSH keys

Private keys that open your servers

Work files

Customer data, contracts, source

Logged in

Open sessions and email

Without encryption, all of it is read just by pulling the drive. So the starting point is making the data ciphertext.

✗ No encryption

The drive is pulled and everything is read = data breach

◎ Encrypted

Contents are ciphertext = you only lost the hardware

Same 'loss,' completely different outcome depending on encryption.

The three basic measures (in priority order)

Turn on disk encryption (top priority)

BitLocker on Windows, FileVault on Mac. Protects data when powered off / the drive is pulled. Keep the recovery key outside the PC (→ what is BitLocker). Without this, the contents can be read whatever else you do.

Strong login + a short auto-lock

Log in with fingerprint/PIN/passkey and auto-lock after a few idle minutes. Lock instantly when you step away (Win+L on Windows). Encryption guards the "powered-off" state; a lock guards it in use.

Set up remote lock and locate

Turn on Windows 'Find my device' so that, on loss or theft, you can see where it is and lock it from another device (remote erase isn't offered for personal devices). Mac 'Find My' can lock it and also erase it remotely.

MFA on important accounts

Even if someone gets past the PC login, phishing-resistant MFA on your email and main services stops the damage (→ multi-factor authentication guide).

Public Wi-Fi and shoulder-surfing — the realistic take

This is where misconceptions cluster. Set priorities calmly.

Often overrated

"Public Wi-Fi = your traffic gets sniffed" — less so with HTTPS everywhere
"A VPN makes it safe" — privacy benefits, but not a cure-all

What actually helps

Insist on HTTPS (don't ignore the lock icon / cert warnings)
A privacy filter against over-the-shoulder peeking
Beware rogue APs (don't auto-join unknown SSIDs)
Always lock when you step away (the few-second gap is the real risk)

This site's view: encryption and lock before a VPN

"Public Wi-Fi" tends to bring "VPN" to mind, but on this site we think the priority is backwards. Almost all traffic is HTTPS-encrypted now, so the real harm from sniffing is down. Meanwhile, the risk of the laptop itself being lost, stolen, or peeked at applies everywhere. So start with disk encryption and a short auto-lock.

A VPN is an extra measure you add when the goal is clear (privacy on an untrusted link, geo-restrictions), not a substitute for protecting the device itself. Getting the order right gives the most protection for the least effort.

Settings to check before you leave (Windows 11 / Mac)

Task	Windows 11	Mac
Disk encryption	Settings → Privacy & security → Device encryption ("Manage BitLocker" on Pro)	System Settings → Privacy & Security → FileVault
Recovery key outside the PC	Confirm it's saved to your Microsoft account	Choose "Allow my iCloud account to unlock my disk," or write the recovery key on paper and store it separately
Auto-lock	Shorten the screen-off time in Settings → System → Power & battery. In Sign-in options, require sign-in again after you've been away	In System Settings → Lock Screen, require a password immediately after the display turns off
Remote action on loss	Turn on Settings → Privacy & security → Find my device (and location)	System Settings → your name → iCloud, turn on "Find My Mac"

If you're unsure which encryption you have, see BitLocker vs Device encryption; for finding the recovery key, see when BitLocker asks for a recovery key.

By situation: how far to go

Situation	What to do
Stepping away from a cafe table for a few minutes	Take the laptop. If you must leave it, at least lock the screen (Win+L / Control+Command+Q on Mac)
Working on a train or at the airport	Use a privacy filter. Save work that shows passwords or customer data for later
Leaving it in a hotel room	Shut down or hibernate instead of sleep. Carry an important laptop with you
Airport security screening	Once it's on the belt, keep it in sight until you pick it up. Watch for mix-ups
Joining public Wi-Fi	Prefer tethering (→ public Wi-Fi risks)

Carrying a laptop in sleep mode weakens encryption

Disk encryption is fully effective when the power is off. During sleep, the encryption key stays in memory and the drive stays unlocked, so only the screen lock is protecting it. Microsoft recommends that, if you need to defend against advanced attacks, you shut down or hibernate before the device leaves your control and combine that with a startup PIN (TPM + PIN).

You don't need to shut down for a daily commute, but power it off when it will be out of your hands for a long time, such as in a hotel room or checked luggage.

Real example: a lost USB stick (Amagasaki City, Japan, 2022)

In June 2022, Amagasaki City in Hyogo, Japan, announced that a USB stick holding personal data on all of its residents had been lost after an employee of a sub-subcontractor of the city's contractor took it out of the office. The stick was found a few days later. In November that year, the city's investigation committee reported that, based on a digital forensic investigation, no leak of personal data was confirmed.

According to the city, the contract specification required the stick to be transported in a locked metal case, but that procedure wasn't followed. Translated to an individual or a small organization, there are three lessons:

Take out only the data you need
Encrypt the media you carry (BitLocker To Go on Windows)
Check that the rules you set are actually followed

Common mistakes and fixes

Keeping the recovery key in the same bag as the laptop

If the laptop is stolen, the recovery key goes with it. Keep it somewhere else, such as your Microsoft account or a printout at home.

Auto-lock set to 'never' or a long time

The screen lock is the only protection while the laptop is in use. Set it to a few minutes (5 or less as a guide), and lock it yourself when you step away.

Assuming remote erase will save you

Remote actions only reach the laptop once someone connects it to the internet. The Windows consumer feature only locates and locks. Disk encryption is what actually protects the contents.

Every password saved in the browser, with a short PIN for the PC login

If the PC lock is broken, all saved passwords are usable at once. Set up multi-factor authentication on important accounts and manage passwords in a password manager.

Physical measures

Guard against grab-and-go

Take it with you when you leave a cafe table. Don't leave it out even briefly. Use a cable lock if needed.

Privacy filter

On trains, in airports, and cafes where others can see the screen, a privacy filter helps.

Don't advertise it

Stickers that make it obvious the laptop is expensive make theft more likely. Keep it in your bag while moving.

Sources (official)

Checked against official vendor and government sources on 6 October 2026.

Microsoft Learn, "BitLocker countermeasures" (sleep vs hibernate, TPM + PIN) — learn.microsoft.com
Microsoft Support, "Find and lock a lost Windows device" (locate and lock, requirements) — support.microsoft.com
Apple Support, "Protect data on your Mac with FileVault" — support.apple.com
Amagasaki City, response to the investigation committee report on the lost USB stick (28 November 2022, Japanese) — city.amagasaki.hyogo.jp

FAQ

QWhat's the single most important measure?

Disk encryption (BitLocker on Windows, FileVault on Mac). Without it, a thief pulls the drive and reads everything. With it, the loss shrinks to 'you only lost the hardware.' Next, add a strong login (fingerprint/PIN) that auto-locks quickly, plus remote wipe/locate.

QIs a VPN required on public Wi-Fi?

Not really required. Most sites now use HTTPS, so traffic sniffing matters far less than it used to. The real public-Wi-Fi risks are rogue access points, shoulder-surfing, and someone using your machine while you step away. A VPN has privacy benefits but isn't a cure-all — disk encryption, auto-lock, and HTTPS matter more first.

QWhat if it gets stolen?

It depends on prior setup. (1) Lock it remotely (with Windows 'Find my device' turned on, you can see its location and lock it from account.microsoft.com/devices; Mac 'Find My' can lock or erase it); (2) change the passwords saved/autofilled on that PC, important ones first; (3) revoke and rotate any keys (e.g. SSH) you kept on the device. If it was encrypted and auto-locked, you also get the calm time to do all this.

QWhen carrying a laptop, is sleep or shut down better?

When it will be out of your hands for a while, such as left in a hotel room or in checked luggage, shut it down or hibernate it. During sleep the encryption key stays in memory and the drive stays unlocked. Microsoft also recommends that, if you need to defend against advanced attacks, you shut down or hibernate before the device leaves your control and combine that with a startup PIN (TPM + PIN). For stepping away from a cafe table for a few minutes, a screen lock (Win+L) is enough.

QCan Windows 'Find my device' erase a stolen PC remotely?

The consumer 'Find my device' lets you see the location and lock the PC. Remote erase isn't offered. It needs an administrator signed in with a Microsoft account and location turned on, and it only works while the PC is powered on and online. That's why disk encryption, which protects the data without any remote action, comes first. Mac 'Find My' does support remote erase.

QWhat should I watch for when carrying data on a USB stick?

First ask whether you really need to carry it, and take only what you need. If you do, encrypt it with BitLocker To Go (Windows Pro and up) or similar, and don't carry the password with the stick. A USB stick is small and even easier to lose than a laptop.