cyber hygiene

What is cyber hygiene?

Cyber hygiene (or cybersecurity hygiene) is a cybersecurity practice that maintains the basic health and security of hardware and software. Cyber hygiene is a joint precautionary measure performed by an organization’s security practitioner, computer system administrator and users to help protect from attacks. The basic practice aids in maintaining and protecting already properly functioning devices, ensuring they are protected from threats such as malware.

Cyber hygiene aims to keep any sensitive data organized and secure it from theft or attacks. The concept works similarly to personal hygiene, where an individual maintains their health by taking precautionary measures that would help ensure their health. If an individual neglects their health, they might catch a cold. If an organization neglects cyber hygiene, then it could lead to a virus and data breach.

In order to know what is on an organization’s network and how it’s associated with risk, an organization needs to develop a cyber resilience plan that can evaluate their cyber hygiene.

Why is cyber hygiene important?

Creating a routine around cyber hygiene helps ensure a system’s health by enabling practices that continually help prevent cybercriminals from causing security breaches, installing malware or stealing personal information. Having proper cyber hygiene also ensures better incident response if a successful attack occurs.

Organizations that rely on only cybersecurity professionals to protect their network and devices ignore the role an individual employee or the end user can have in ensuring security. If employees and end users understand basic cyber hygiene practices, they can play a larger role in protecting and maintaining their devices and networks.

Cyber hygiene best practices

To have good cyber hygiene, an organization must have a set of practices and workflows to follow regarding cybersecurity. Some best practices to follow regarding cyber hygiene include:

• Create a cyber hygiene policy. Creating a common set of practices to maintain cyber hygiene will make it easier to maintain hardware and software.
• Document all equipment, hardware and software. Create a list of hardware, software and web applications used. Manage any newer installs, so they are kept track of and updated when needed.
• Inspect the list to find unused or outdated software and hardware that could have vulnerabilities. Uninstall outdated and unused hardware and software.
• Update all software or hardware that have updates available.
• Ensure antivirus and antimalware software is properly installed and configured.
• Ensure proper password management.
• Limit those who have administrative access to the network.
• Make sure routers and firewalls are properly set up and configured.
• Use two-factor authentication (2FA) or multifactor authentication (MFA).
• Physically segment computer networks.
• Have an on-call list of workers who can respond to security events.
• Keep up to date on cyber hygiene best practices.

Tips to maintain effective cyber hygiene

Ensure secure authentication and access. When employees work from various locations, they must secure access to their duties while excluding outsider access from others. This process involves working with existing authentication services to increase control. Multifactor authentication and digital certificates are great places to start and strengthen network security.

Build an extensive governance policy. A comprehensive governance policy should incorporate endpoint protection and prevent cybercriminals from accessing a system. Governance policies should evolve whenever issues arise. This can include, for example, using existing connectivity through a VPN connection and setting up policy-based cloud controls — a process that creates segmentation and network isolation. This is an important aspect of proper cyber hygiene.

Enhance logging. Know who has accessed what and why. IT departments should know how closely they track activities. This is critical to be able to retrace any steps if a breach occurs. One way to fix this is to maintain a detailed log of every action with logging tools. When using logging tools, watch for authentication, authorization, events, access points, network flow, security detections and any other data points so employees can evaluate them appropriately. Another aspect of logging is to set alerts for these items.

Verify endpoint protections. Use and improve standard endpoint controls. This is especially important for Windows-based systems. Test the backup recovery of files and data to help ensure successful recovery in the event of a crisis.

Other tips for maintaining good cyber hygiene are:

• Determine a baseline to evaluate business risks.
• Keep an inventory of the organization’s hardware and software.
• Encourage good password management with complex passwords.
• Regularly back up data.
• Identify any vulnerable applications.
• Establish an incident response plan.
• Implement controls to protect and recover data.
• Conduct threat and vulnerability monitoring.
• Make sure any security software used is trustworthy and kept updated.
• Make cyber hygiene practices a common part of a worker’s routine.

Benefits of cyber hygiene

The two biggest benefits to cyber hygiene are in both security and maintenance. Some general benefits include:

• Security — The security cyber hygiene adds can help prevent hackers from installing malware and viruses from accessing an organization’s data.
• Maintenance — Starting a cyber hygiene routine allows users and cybersecurity experts to find outdated software, outdated administrative privileges or fragmented Well-maintained systems are less likely to become vulnerable to threats.
• Routine cyber hygiene procedures — Having procedures in place helps in enabling hardware and software to run efficiently while being less vulnerable. Applying a routine to maintenance and security practices helps make the maintenance and security practices more secure.

Other benefits are:

• Better protected customer data.
• Increased chances of identifying unauthorized software in a system or device.
• Increased chances of finding previously unmanaged assets.
• Running checks for compliance audits more easily.

Challenges of cyber hygiene

Common challenges with cyber hygiene are:

• Loss of data — if mismanaged, data that is not backed up can be lost or misplaced.
• Lack of vendor risk management — An organization’s data can still be at risk if a third-party vendor is holding it.
• Outdated security software — can become vulnerable if left alone. Security patches should always be applied to avoid software breaches.

Poorly managed cybersecurity practices — Poor network security or lacking configuration management can lead to security breaches.