Windows 11 Security Best Practices

Summary

This guide helps you troubleshoot and resolve: Windows 11 Security Best Practices. Follow the steps below to fix the issue.

Common Causes

Key Security Principles

• Proactive protection: Implement measures before an attack occurs.
• Layered security: Use multiple security controls.
• Regular maintenance: Keep software updated and scan regularly.
• User awareness: Understand common threats and safe behaviours.

Step-by-Step Security Practices

1. Keep Windows and Software Updated

Updates often include critical security patches.

• Windows Update: Open Settings > Windows Update. Click “Check for updates” and install all available updates. For detailed guidance see How to update Windows.
• Application updates: Ensure all applications (web browsers, office suites, etc.) are kept up‑to‑date. Enable automatic updates where possible.
• Secure Boot and TPM: Verify that Secure Boot is enabled in the BIOS/UEFI and that TPM 2.0 is active. These are prerequisites for many Windows 11 security features.

2. Use Strong Passwords and Multi‑Factor Authentication (MFA)

Strong credentials are your first line of defence.

• Strong passwords: Use long, complex passwords (12+ characters, mix of upper‑ and lower‑case letters, numbers and symbols). Avoid reusing passwords across accounts.
• Password manager: Utilise a reputable password manager to generate and store unique passwords.
• MFA/2FA: Enable Multi‑Factor Authentication for your Microsoft account and any critical services.
• Windows Hello: Configure Windows Hello (PIN, facial recognition, fingerprint) for convenient and secure sign‑in. Go to Settings > Accounts > Sign‑in options.

3. Utilise Windows Security Features

Windows 11 includes a comprehensive suite of built‑in security tools.

• Microsoft Defender Antivirus: Ensure it is active and up‑to‑date. Perform regular quick or full scans. Navigate to Windows Security > Virus & threat protection and select “Virus & threat protection settings” → “Manage settings” to confirm real‑time protection is on.
• Microsoft Defender Firewall: Keep the firewall enabled and configure network profiles appropriately. Find it under Windows Security > Firewall & network protection.
• SmartScreen: Protects against phishing sites and malicious downloads. Settings are located at Windows Security > App & browser control > Reputation‑based protection settings. Ensure “Check apps and files” and “SmartScreen for Microsoft Edge” are turned on.
• Controlled folder access: Helps defend against ransomware. Enable it via Windows Security > Virus & threat protection > Ransomware protection and add folders you wish to protect.
• BitLocker (Pro/Enterprise) or Device Encryption (Home): Encrypt the system drive to protect data if the device is lost or stolen. For Windows 11 Pro or Enterprise, search “Manage BitLocker” from the Start menu. For Windows 11 Home, enable Device Encryption via Settings > Privacy & security > Device encryption. Note that Device Encryption availability on Home edition depends on hardware requirements. For guidance on encrypting external media see How to encrypt USB drive.
• Core Isolation and Memory Integrity: These features use hardware virtualisation to protect system processes from exploits. Enable them via Windows Security > Device security > Core isolation details and toggle “Memory integrity” to On.
• Windows Sandbox (Enterprise/Education): Use this lightweight virtual environment to run untrusted files safely. Enable it in Windows Features and launch from the Start menu.

4. Be Wary of Phishing and Scams

• Email vigilance: Treat suspicious emails with caution, especially those requesting personal information, credentials, or containing unexpected attachments/links. Verify the sender’s identity.
• Link safety: Hover over links to view the actual URL before clicking. If unsure, avoid the link.
• Software downloads: Only download software from official sources such as the Microsoft Store or the vendor’s website.
• Australian resources: Report scams and stay informed about current threats via Scamwatch. Small businesses should also align with the Australian Cyber Security Centre (ACSC) Essential Eight mitigation strategies.

5. Regular Data Backups

Back up your data to protect against loss from malware, hardware failure or accidental deletion.

• Cloud backup: Use OneDrive or another cloud service to store important files.
• External drive backup: Use File History (Settings > System > Storage > Advanced storage settings > Backup options) or third‑party backup software. For detailed steps on backing up to an external drive, see How to backup photos to external drive.

6. Practice the Principle of Least Privilege

• Standard user accounts: Use a standard account for everyday tasks and switch to an administrator account only when required for system changes or software installations.
• Administrator accounts: Limit the number of accounts with administrative rights.

7. Secure Your Network

• Strong Wi‑Fi password: Use WPA2 or WPA3 encryption with a unique, complex password. For guidance on connecting securely, see How to connect to Wi‑Fi.
• Router security: Change the default router administrator credentials and keep the firmware up‑to‑date. If you need to restart the router or modem, follow How to restart router/modem.
• Guest network: Enable a guest Wi‑Fi network for visitors to isolate them from your main network.

8. Lost Encryption Keys

Without the BitLocker recovery key, data on an encrypted drive may be unrecoverable. Store the key securely, for example in your Microsoft account or a password manager.

Australian Context and Compliance

Australian small businesses should consider their obligations under the Australian Privacy Act when handling personal information. Implementing the ACSC Essential Eight provides a strong baseline for cyber security defence. If you suspect a security breach, require advanced security configurations, or are unable to resolve a persistent malware issue, Open a Ticket with your IT support team.

Still Having Issues?