What is Cyber Hygiene?
Personal hygiene is a way of taking care of our body, performing cleaning tasks routinely and proactively, to reduce the possibility of acquiring diseases.
Cyber hygiene is a cybersecurity practice that works similarly to personal security. And it consists of a set of routine tasks that serve to prevent or mitigate the most common errors or oversights, which are the root cause of security incidents.
Regular execution of these recommendations allows individuals to train and form judgment to make intelligent decisions when facing attacks.
Why is Cyber Hygiene important?
A 2020 Stanford University study by Professor Jeff Hancock titled “Psychology of Human Errors” revealed that nine out of ten security breaches were caused by employee error or carelessness.
When employees understand basic security practices, and their role in protecting information, the number of errors or oversights decreases.
Cyber hygiene helps people understand that information protection is not only the responsibility of an IT or Cybersecurity area, but that it is the responsibility of all individuals in an organization. This enables a better response from the organization in case of incidents.
Cyber Hygiene best practices for users
In general, the most common recommendations that users should follow are:
- Safe and secure passwords:
- Use a password vault or management tool, (Keepass, or some commercial option). With this you will be able to maintain a large set of strong passwords without relying on your memory
- Use a strong master password as a phrase to access
the vault.
- Back up the file with the password vault.
- Use 2-step authentication (or second factor authentication), it's especially important in financial applications.
- Use a different password for each SITE or service you use, do not reuse passwords between different services.
- Use passwords with a minimum length of 12 characters (Consider using phrases, they are easier to remember)
- Don't use obvious passwords or easy-to-guess personal information, don't use significant dates like births or anniversaries, or use numbers or letters in sequence.
- If the system or site asks you to set up security or challenge questions, such as “What is the name of the city where I was born?”, “What is my mother's maiden name”, etc. Do not give obvious answers that can be easily guessed, and keep the answers in the password management vault.
- Do not share passwords, if you have to do it do not do it in clear text. Submit account information and password by 2 different means.
- anti-malware
- Use antimalware on all computers (desktops or laptops) and mobile devices (phones, tablets, etc).
- All operating systems are susceptible to attacks, do not believe the publicity or rumors that there are computers or systems that are not affected by malware.
- Keep anti-malware up to date
- Perform full scans periodically
- E-mail and messaging systems: The use of email accounts to identify and retrieve services on the Internet is widely used. The attack on email accounts is one of the most common.
- Keep separate email accounts for business or work use and personal use.
- Use a strong password and never reuse the email account password on any other service.
- Always enable 2-step authentication (or multi-factor authentication)
- Don't click on email links.
- Be careful with attachments. If you are going to download an attachment, check it with an antivirus before opening it.
- Do not trust and pay special attention to emails that ask you to carry out transactions or bank card information, or ask for passwords.
- Report and delete unsolicited mail (spam).
- Do not share passwords in clear text in emails or messaging systems.
- Privacy of information on social networks
- Do not post personal information (addresses, bank accounts, private photos, phone numbers).
- Do not post business or work information on personal accounts
- Do not use games or quizzes that ask for sensitive personal information.
- Software updates
- Only download apps from official sites.
- Update applications, operating systems, apps, browsers, and firmware.
- Where possible configure automatic updates.
- Delete apps you no longer use.
- web browsing
- Review the permissions you grant to the apps you use
- Endpoints y Móviles
- Protect the device with a password.
- Encrypt the device or the entire hard drive, etc.
- Before selling a computer, make sure to erase all the information contained in it, consider the use of specialized software for secure erasure.
- 8. Removable Devices
- Use encrypted removable media
- Erase information from removable media before disposal
- Destroy removable media, before disposal, if it is not possible to erase the information on it.
- Public Wifi and travels
- Do not use sensitive information if you are connected to public computers, Internet cafes, computers in libraries, hotel lobbies, etc.
- Do not use public networks to transmit sensitive information, carry out financial or electronic commerce transactions, consider using your cell phone network.
- Use VPNs if you will be connecting to work from a public network
- Consider the use of disposable cell phones when traveling to over-monitored or unsafe destinations. And keep your cloud service accounts offline.
- Backups
- Take regular backups.
- Once the information is backed up, disconnect from the backup site, or keep the backup device offline. This prevents backups from being compromised in the event of a ransomware attack.
- Use encrypted devices to back up to removable media. Encrypt the backup if you do it in the cloud.
- Verify that the backups work. Perform information restoration tests.
Simple cyber hygiene steps that when carried out will prevent your information from being compromised.