Resources

Article

7 essential tips for maintaining good cyber hygiene

Article

7 essential tips for maintaining good cyber hygiene

Article

7 essential tips for maintaining good cyber hygiene

Security

Article

7 essential tips for maintaining good cyber hygiene

Security

As cybersecurity attacks, data breaches, and hacking methods continue to evolve and advance, businesses need to raise their expectations of all employees and adapt their defence efforts. Here are seven valuable insights to remain resilient against cybercrime.

1. Two-factor authentication (2FA) is crucial to secure logins

2FA, also known as multi-factor authentication (MFA), is a simple way to secure logins by requiring a second piece of information in addition to your password. Authentication comes in three different factors:

  • Knowledge factor: Something you know, such as a password.
  • Possession factor: Something you have, such as a phone with an authenticator app.
  • Inherent factor: Something that’s a part of you, such as your fingerprint.

So why is 2FA so important? Even if your password were to leak, a malicious hacker won’t be able to access your accounts that have enabled 2FA unless they know the second factor – which they usually don’t. 

Get started with 2FA today by installing an authenticator app on your phone, and make sure you enable it for all services that allow it.

→ Read more about 2FA and how to strengthen your passwords

2. Failing to update your devices’ software puts you at great risk

Are you guilty of avoiding updating your iPhone to the latest iOS version? If so, that’s a really bad habit you need to get rid of. Postponing or neglecting software updates leaves your device more vulnerable to cyber threats, as these updates usually patch up existing security vulnerabilities. So, by sticking with outdated software, you’re essentially leaving the door open for cybercriminals to walk into the system and easily exploit weaknesses.

The European Union Agency for Cybersecurity (ENISA) strongly advises keeping all software up-to-date, at all times, to ensure maximum protection. Software updates don’t just bring new features but are also critical for your own digital safety. 

Make sure you have enabled automatic updates wherever possible, such as on iPhones, so you don’t have to worry about manually checking for updates. Your device will do it for you, ensuring it’s always protected with the latest security fixes. And remember: an update a day keeps the hackers away.

3. 50% of security breaches happen due to human error

Even with strong antivirus protection, your security might not be as solid as you think. In fact, half of all security breaches are caused either wholly or partially by human error. Imagine this scenario: you receive an email from a friend you haven’t heard from in two years. The message reads: "Please click http://shorturl.sdgxz.com, it was so funny!” What should you do?

The correct answer is to never open an attachment or click a link unless you are 100% sure of the sender’s identity. In this case, you can’t be sure of whether this abrupt reconnection is legitimate, so you should call your friend to verify the email’s legitimacy. What you’re likely dealing with is a phishing attack. 

In phishing attacks, cybercriminals use social engineering tactics to manipulate you into clicking on malicious links or opening harmful attachments. These attacks rely on tricking you into acting without thinking, which is why it’s important to always remain cautious.

→ Learn more about phishing

4. Businesses are more concerned about employees than hackers

Surprisingly, according to YouGov, businesses tend to worry more about the potential risks posed by their own employees than by external hackers. So much so that 48% of businesses reported worrying more about employees breaching data protection guidelines than attacks by cybercriminals.

This is a valid concern as employee actions – whether intentional or accidental – can lead to data breaches, system vulnerabilities, and severe financial and reputational damage. One in five companies doesn’t provide regular cybersecurity training to its staff, leaving employees unaware and ill-equipped to recognise threats like phishing or ransomware attacks. Without proper training, people are more likely to unknowingly contribute to the very vulnerabilities that hackers exploit – even though they might think they’re being careful.

A whopping 42% of medium and large businesses have been affected by cybersecurity breaches, with 1 in 18 reporting that the breaches were major, resulting in significant consequences and irreversible damage. This highlights the urgent need for companies to not only focus on external threats but to also invest in employee training to safeguard the organisation from the inside. Internal cybersecurity efforts to raise awareness is essential for reducing human error and embedding cybersecurity into the company culture.

→ Explore the Visma Security Program

5. Malware infections and data breaches usually originate from phishing attacks

According to ENISA’s 2018 Threat Landscape Report, social engineering tactics – particularly phishing – are responsible for a staggering 90% of malware infections and 72% of data breaches in the software industry. As one of the most prevalent and damaging cyber threats, phishing attacks often serve as the entry point for more serious breaches like malware infections and data leaks. They exploit human trust and gullibility, making them difficult to defend against. 

Phishing typically involves deceitful emails, phone calls, or messages designed to trick us into sharing sensitive information or clicking on malicious links. A common example is an email that appears to be from a trusted source, such as your company’s IT department, asking you to click on a link to reset your password. However, these emails often lead to fraudulent websites designed to steal personal or business data. And social engineering extends beyond emails. 

With remote work on the rise, these tactics are becoming even more effective as employees may feel a pressure to respond quickly, without verifying the source of the request. Other examples of phishing tactics include:

  • Spear phishing: A more targeted form of phishing where cybercriminals personalise a direct message, often using information they’ve gathered about the victim to appear more credible. For example, an attacker might impersonate an acquaintance and ask for personal data.
  • Vishing (voice phishing): Attackers using phone calls to manipulate us into revealing confidential information by impersonating others. For example, a phone call that seems to come from your company’s support desk but is actually made by an imposter trying to gain access to your company’s network.
  • Smishing (SMS phishing): Malicious links that are sent via text message, often appearing to be from well-known service providers or social platforms, to trick recipients into revealing their login information.

The damage caused by phishing attacks goes beyond just stolen data; it can lead to irreversible damage such as significant financial losses, a tarnished reputation, and a breach of customer trust.

6. Low security awareness puts businesses at great risk, but very few think they’re likely to fall victim to cyberattacks

How do we become targets on the internet? Keep in mind that financial data, such as credit card details, is not the only target. Sensitive business data, intellectual property, and even operational infrastructure can be at risk from cyber threats. They are designed to exploit human error and weak security practices – and, unfortunately, businesses tend to underestimate these risks. 

As an example, 63% of Norwegian companies acknowledge that low security awareness makes them vulnerable to hybrid threats, but only 28% report believing they’re likely to be targeted. This gap in perception can leave organisations unprepared for attacks that rely on deception. A false sense of security is just as dangerous as no security at all – which is why regular awareness training and proactive defence strategies are so essential.

7. You leave more footprints online than you think – act responsibly!

One day you’re surfing the web and you decide to install a Chrome extension. It makes everything so much easier! But then, the next day, you realise that your browser history – every website you visited – is now for sale online.

The takeaway? Only install extensions from trusted sources. Even with multiple layers of security on your work computer, you are responsible for upholding that security. Stay vigilant and report potential threats – anything that seems suspicious – to your organisation’s IT or security team.

Related content