Keeping a Family's Devices Secure Without Becoming the Administrator

Being the person in a household who understands computers means being asked to fix everything. The way out is not more control — it is setting things up so they stay secure without maintenance, and having a few conversations that do more than any setting.

Set it up so it maintains itself

Automatic updates on, everywhere. Operating systems, applications, browsers and router firmware. This is the single highest-return thing and it requires no ongoing involvement.

Built-in protection enabled, not a paid product that expires and nags. See security software.

Automatic backups, configured once, running to an external drive and a cloud service. Test a restore occasionally.

A password manager for everyone, with family sharing for the accounts that genuinely need sharing. This removes the reuse problem permanently rather than requiring vigilance.

Two-factor on email, for every family member, because email resets everything else. See two-factor authentication.

A guest network for visitors and smart home devices, which are the least maintained things in most houses. See your home network.

Separate user accounts on shared machines, with only one having administrator rights.

Set that up once and most of the ongoing work disappears.

The conversations that matter more than the settings

Technical controls stop technical problems. Almost every successful attack on a household is social.

Nobody legitimate telephones about a virus. Say it, and say it again occasionally. This one sentence prevents the most common scam against older relatives.

Urgency is the signal. Anything demanding immediate action — an account closing, a payment failed, a parcel held, a relative in trouble — should be checked through a different channel.

Never sign in through a link. Open the site yourself.

Gift cards are never a payment method for anything, ever.

Ring the person you already know, on the number you already have. Particularly for a message claiming to be a family member with a new phone. See scams that target home users.

Agree a family word — something a caller could be asked that a stranger would not know. Old-fashioned and effective against voice impersonation.

Make it safe to ask

The most important thing in this article.

People who fear being told off do not report problems. They hide the suspicious email, they do not mention what they clicked, and the compromise runs for weeks instead of hours.

Say explicitly that anyone can ask about anything without judgement, and mean it when they do.

Respond well the first time. That response determines whether there is a second.

Make asking easier than deciding. "Send me a screenshot and I'll look" costs you two minutes and prevents a great deal.

For children

Different from security, and it overlaps.

Parental controls work in layers — router, device, account, application — and each covers different things and misses different things. See parental controls.

They are also worked around, increasingly with age. Treat them as a floor rather than a solution.

The conversation does more. What to do about a message from a stranger, what not to share, and — critically — that they can tell you about something without losing access to everything. A child who believes reporting a problem means losing their device will not report it.

Adjust as they grow. Controls appropriate at eight are counterproductive at fifteen and generate deception rather than safety.

For older relatives

Be careful with the framing. Advice delivered as though someone is incapable produces resistance and hidden problems.

Set up what maintains itself, as above.

Two things are worth more than everything else: two-factor on their email, and knowing that nobody legitimate rings about a virus.

Write down the important information — account recovery details, the password manager access — and keep it somewhere they and one trusted person can find. See protecting your digital legacy.

Agree a rule for anything involving money: ring you first, always, before acting. Not because they cannot judge it, but because a second opinion defeats urgency, which is what every scam relies on.

And check in occasionally without being asked. Problems are frequently not reported.

What not to do

Do not install monitoring software on adults. It damages trust and it does not address social attacks.

Do not take over their accounts. Set things up with them, not for them, or they cannot manage anything when you are unavailable.

Do not create a single point of failure. If everything depends on you, a household is stranded when you are away — and permanently, eventually.

Do not rely on lecturing. People remember two or three rules. Choose the three that matter.

The three rules worth teaching

If a household remembers nothing else.

Nobody legitimate rings about a virus on your computer.

Never sign in through a link in a message — open the site yourself.

Anything urgent about money: stop, and ring someone you know first.

Those three prevent most of what actually happens to households.

The short version

Automatic updates, built-in protection, backups, a password manager and two-factor on email — set up once, maintains itself.

Almost every successful household attack is social, not technical, which is why the conversations matter more than the settings.

Make it safe to ask. Fear of being told off is what turns an hour's problem into a month's.

Teach three rules, not twenty.

And set things up with people rather than for them, or the household is stranded whenever you are unavailable.

For practical baseline security guidance for home users, see CISA Secure Our World.