Best practices for securing your home network from ransomware

Ransomware can reach a home through a vulnerable router, an overlooked NAS, an infected laptop, or a compromised online account. A useful security plan contains that spread: it limits access, shortens the time devices remain exposed, and preserves a clean path back to important files.

Many Australian homes now rely on an NBN service through Telstra, Optus, Aussie Broadband, or another provider, often combining a fibre or hybrid connection with Wi-Fi and numerous connected devices. The security habits that matter are therefore practical: know what is online, separate it appropriately, and test recovery before an incident.

Map every device and connection point

Begin with a handwritten inventory of the router, laptops, phones, televisions, cameras, printers, game consoles, and storage systems connected to the network. Record each device’s purpose, owner, operating system, and whether it needs access to other devices. Unknown equipment is a common entry point, especially forgotten smart home products.

Give the internet router a unique administrator password, enable WPA2 or WPA3 encryption, and use a strong Wi-Fi passphrase. Automatic updates should remain enabled, while unused features such as UPnP and remote administration can be disabled. These changes are safer when applied through the ISP’s current documentation rather than an outdated guide.

Before buying additional equipment, compare the features and limitations of network security products. Pay particular attention to VLAN support, firewall controls, logging, and update policies rather than treating the product name as evidence of protection.

Isolate ordinary devices from sensitive systems

Separate internet-of-things equipment, guest devices, and work computers into different network zones. A managed switch with VLAN support is useful for knowledgeable users, while an ordinary unmanaged switch cannot provide that isolation. Guest Wi-Fi with client isolation offers a basic level of separation for visitors.

This arrangement is particularly helpful in crowded Sydney, Melbourne, and Brisbane households where several people, appliances, and work-from-home systems share one connection. A compromised camera or television should have little opportunity to reach a laptop containing customer records, family photographs, or NAS administration tools.

Place a Synology NAS and other sensitive systems on a trusted network segment. Restrict administrative access to specific devices and accounts, and never expose NAS management interfaces directly to the internet. Remote access should use a properly configured VPN or a carefully reviewed secure relay service.

Keep firmware and accounts current

Patch the router, NAS, smartphones, laptops, cameras, and smart home hubs. Many Australian households use a mixed collection of devices, so firmware updates need to be checked manually even when major computers update themselves. Replace products that no longer receive security fixes and remove unused default accounts.

Turn on automatic updates where practical and schedule a short monthly review for neglected equipment. The Australian Cyber Security Centre recommends reducing the time that known vulnerabilities remain exposed, a principle that applies equally to consumer routers and small business systems. Update documentation from the manufacturer’s Australian support page, especially after changing ISPs or broadband equipment.

Require multifactor authentication for email, cloud storage, NAS administration, banking, and any remote-access service. Use an authenticator app or passkey rather than SMS where available. For a home business using business video services, individual accounts, separate editing folders, and revocable contractor access prevent shared credentials from becoming an easy route into the network.

Preserve clean recovery copies

A NAS is valuable for storing data, but a NAS connected to the same network as an infected computer may also be compromised. Maintain versioned or immutable backups, plus at least one offline copy kept disconnected from routine operation. Test that files can actually be opened and restored rather than assuming the backup job succeeded.

For family photographs, accounting records, and business documents, follow the 3-2-1 principle: three copies, on two types of storage, with one copy separated. Encrypt portable drives and record where they are stored. Synology snapshot and backup tools can improve recovery, but they should complement offline protection rather than replace it.

The Privacy Act 1988 and Notifiable Data Breaches scheme mainly apply to organisations, including qualifying home businesses that handle personal information. Such businesses should preserve evidence, document the incident, and follow applicable notification duties. Keeping offline copies also prevents a family business from discovering during an emergency that its critical records were encrypted or deleted.

Watch traffic and recognise warning signs

Enable the router’s security logging and review connected-device lists regularly. Guidance on monitoring network traffic can help identify unexplained outbound connections, sudden DNS changes, disabled security tools, or devices appearing at unusual hours. Logs are most useful when the household knows which normal activities to expect.

Treat sustained unexplained traffic, repeated account lockouts, unexpected router changes, and disabled antivirus or update services as warning signs. Isolate the affected device from the internet without deleting its data, because volatile information may help determine how the intrusion occurred. Check administrator accounts and restore altered settings from a trusted device.

Australian households should report serious incidents to ReportCyber, contact the relevant financial institution if banking is involved, and notify their ISP or technology supplier. Keep the equipment powered and isolated until a qualified responder advises otherwise, preserving logs and avoiding actions that erase useful evidence.

Make recovery routine and decisive

Rehearse recovery before an attack occurs. Keep a written record showing how to reconnect devices, apply patches, change exposed passwords, and restore data from the offline copy. Confirm that priority files such as identity documents, tax records, household records, and business backups are readable on a clean device.

After an incident, rebuild rather than trust a compromised system. Replace passwords and authentication keys, revoke active sessions, update every vulnerable device, and restore data gradually while monitoring for renewed activity. If a NAS was affected, validate its backup catalogue and upgrade its software before reconnecting sensitive files.

The standard to remember is simple: effective protection limits lateral movement, preserves trustworthy recovery copies, and treats recovery preparation as part of everyday network security.