This blog post was updated on October 9, 2024
It was originally published on August 1, 2019
Most cybersecurity breaches stem from avoidable mistakes and bad habits. These habits, while often unintentional, usually begin as shortcuts, workarounds, or steps that bypass standard security protocols. Over time, they become ingrained in daily operations, especially when they make work easier or seem to sidestep "red tape." What’s alarming is that businesses can fall into these bad cybersecurity habits just as easily as individuals.
Often, companies continue these poor practices without realizing the risks they’re taking. Many businesses are unaware of the threats these bad habits expose them to. The frightening reality is that even after falling victim to a cyberattack, they may not understand that their own habits were the root cause.
To help you spot these vulnerabilities, we've compiled a list of common cybersecurity mistakes. We hope that by recognizing these bad habits, you can take steps to avoid them and better protect your business.
Cybersecurity Practices You Need To Avoid
Here’s the list of cybersecurity bad habits you must avoid:
1. Poor Password Management
Weak or easy-to-guess passwords are a top vulnerability exploited by cybercriminals. Long, complex passwords are more secure but are often hard to remember, leading many users to reuse the same password across multiple accounts. In fact, studies show that 59% of people use the same or similar passwords for multiple services.
Additionally, many users write down their passwords somewhere others can easily find them or share them with colleagues or family members to avoid forgetting them. These poor password management habits make it easy for attackers to hijack your account and commit fraud.
It’s not just individual users who are at fault. System administrators often leave network access protected by weak default passwords such as "123456" or "password." These passwords remain unchanged, making it effortless for attackers to compromise your systems and steal sensitive data.
2. Not Using 2FA (two-factor authentication)
There’s no excuse for not using two-factor authentication (2FA). In today’s digital age, it’s easy to set up and doesn’t require complicated tools. 2FA combines a memorized password with a one-time password (OTP), adding a second layer of security. This multi-layered approach makes it significantly harder for hackers to gain access to your accounts.
We recommend using a password manager, such as 1Password, alongside an authentication tool like Google Authenticator. This combination will reduce the burden of memorizing passwords for all your business and personal accounts while ensuring your information remains secure.
3. Not Setting Up Disaster Recovery Plan
Many companies focus on preventive cybersecurity measures but neglect to prepare for what happens in the event of a breach. While preventative measures reduce risk, no system is 100% immune to cybersecurity threats. Even with the best protections, you still need a disaster recovery plan.
A staggering 60% of companies that lose their data will close within six months of the disaster. Data loss can cause irreparable harm, damaging both your operations and your customers’ trust. Even if you recover your data, clients may never feel comfortable sharing their information with you again. Given this risk, a comprehensive backup and recovery plan is essential to keep your business running smoothly in the face of a cyberattack, system failure, or natural disaster.
4. Treating Cybersecurity As A One Time Project
One of the most common and dangerous mistakes businesses make is treating cybersecurity as a “set it and forget it” project. Cybersecurity is not a one-time effort. Many companies put security policies in place, install a few tools, and then fail to revisit them as threats evolve.
Cybercriminals are constantly adapting and developing new tactics to exploit vulnerabilities. To stay protected, you must regularly update and reassess your IT security policies, tools, and procedures to ensure they remain effective against new and emerging threats. Routine penetration testing and phishing drills are essential for identifying weaknesses and addressing them before they can be exploited.
5. Failing to Keep Employees’ Knowledge Up to Date
As cyber threats evolve, your employees’ knowledge must also keep pace. A well-informed team is your first line of defense against cyberattacks. Unfortunately, many companies rely on a one-time IT security presentation during onboarding, which is never enough.
Human error remains one of the biggest challenges to cybersecurity. With employees juggling multiple tasks, it’s easy for someone to lose focus and click on a seemingly harmless link that turns out to be malicious. Regular cybersecurity training on password hygiene, phishing scams, and company IT policies is crucial.
For example, spear-phishing attacks often rely on employees unknowingly sharing sensitive information via email. By educating staff on how to recognize these schemes and reinforcing company policies that prohibit sharing sensitive data through email, you reduce the likelihood of falling victim to such attacks.
6. Overconfidence- Thinking it can’t happen to me
Overconfidence is perhaps the biggest security risk. Once businesses believe they have implemented all the necessary IT security controls, they may become complacent. If no incidents occur over time, it’s easy to fall into a false sense of security, assuming that cyberattacks won’t happen to you.
Small businesses, in particular, often think they’re too insignificant to be targeted. However, 43% of cyberattacks target small businesses, yet only 14% of them rate their cybersecurity as highly effective. This combination of overconfidence and lack of preparedness leaves them vulnerable to malware, ransomware, and data breaches.
The best way to combat overconfidence is by regularly reviewing and updating your cybersecurity measures. Stay informed about the latest threats and trends in cybersecurity, and ensure your team is prepared to respond to new challenges.
Conclusion
No matter how vigilant you are, the possibility of a cyberattack slipping through the cracks always exists. The key is education and awareness. A well-informed workforce is one of your strongest defenses against cybercriminals. Employees should be trained not only on external threats but also on internal security protocols.
These are some of the most common cybersecurity bad habits we see in businesses. If you need help addressing these issues or improving your cybersecurity posture, don’t hesitate to reach out to us today.
At Jones IT, we take IT security very seriously. We regularly publish blogs on cybersecurity sharing useful information, tips, and general education. In this blog post, we shared with you some of the most common cybersecurity bad habits that we regularly come across. We would be happy to help you kick these habits as well as improve your cybersecurity measures. Click the button below to reach out to us today.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.