As we begin the new year, many of us take the opportunity to reflect on our resolutions, whether they pertain to personal finances, career goals, or health. While individuals can often take charge of their personal health independently, businesses, especially in the realm of cybersecurity, require a more collaborative approach.
In 2025, the security landscape will present numerous challenges, and it is crucial for organisations to recognise the need for teamwork and proactive strategies to ensure the health and resilience of their digital assets.
In the UAE, a Cyber Security Council survey, published in March 2024, uncovered more than 155,000 vulnerable assets in the country and found that 40 per cent of critical vulnerabilities had gone unaddressed for longer than five years. If the nation is to attain the resilience to stave off campaigns by increasingly sophisticated threat actors, every enterprise will need to practice rigorous cyber hygiene.
Cyber hygiene can be defined as a comprehensive set of best practices designed to prevent organizations from becoming vulnerable to cyber threats. This responsibility extends across all levels of the organisation, from end users to technical teams, including DevOps, IT, and security personnel. Everyone must adopt a daily routine of cybersecurity practices to collectively enhance the organisation’s security posture.
Much like personal hygiene, which requires regular attention to maintain health, cyber hygiene necessitates ongoing vigilance to safeguard against potential threats. Failure to maintain proper cyber hygiene can lead to compromised sensitive data, operational disruptions, and significant financial losses.
Practice makes perfect
Let’s start with five basic cyber-hygiene practices. First, software updates cannot be treated as optional, but as the UAE Cyber Security Council found, many updates are ignored, even though they are released to protect against known vulnerabilities. Attackers are always looking for these vulnerable assets.
Second, enforce password-strength principles.
Ensure users choose complex, unique strings of diverse characters (uppercase letters, numbers, and special symbols), and avoid birthdays, pet names, and other memory-friendly words that are easy to guess. Ensure each password is unique to an account. Third, implement multi-factor authentication because as strong as a password may be, it is just one layer of security and is vulnerable to theft.
Fourth, think about how data is backed up. Whether you opt for external hardware or a cloud storage solution, test your choice and make sure you perform restoration drills.
Lastly, fifth, stay vigilant. Make sure every user knows that nefarious parties are perfectly capable of sending emails, text messages, and other communications that appear genuine. Be sure they know that every link clicked, and every network joined, is a potential threat.
If security leaders have trouble getting buy-in from decision-makers, the business case for these practices is simple and strong.
Good cyber hygiene brings business continuity in the event of an incident and earns trust from customers, partners, investors, and regulators. In this way, basic cyber hygiene minimises risk by mitigating the impact of any potential breach.
Tools for tasks
Investment in the right tools can help address a range of problems. While many are targeted at specific industries, others have broader relevance. Continuously updated antivirus software still has a place in the organisation.
Multi-scanning — the technique of having multiple AV agents scanning resources — helps increase detection rates of malware, even zero-day threats. These solutions go beyond file hygiene to guard against fraudulent or malicious websites. They provide protection against ransomware. And their privacy features can even prevent tracking by advertisers.
The list of hygiene tools goes on. Virtual private networks (VPNs) encrypt data and mask IP addresses, leading to private, secure connections. Password managers allow the creation and storage of passwords and even allow strong (complex and unique) passwords to be shared via text or email, meaning they never have to be written down.
Software and hardware firewalls allow organisations to restrict outside access to home and business computers and a range of other connected devices. This protects data and accounts from compromise by blocking malicious traffic, but users still must be urged not to install unvetted software or click on unknown links.
Going further
These tools come together with best practices to protect organizations from the modern cyberthreat landscape, which is becoming more dangerous with every passing month. But basic digital hygiene is only the beginning. There are more advanced practices that allow individuals and enterprises to go further with their cyber hygiene.
You can start by conducting regular audits of your digital footprint. Review all the permissions granted to apps and websites. Many websites store payment data, for example. When we minimize permissions by only maintaining those that are necessary, we can greatly reduce our exposure to cyber-incidents or the unwanted collection of your data.
Make sure you have the visibility to monitor your environment for anything that looks suspicious. Leave no stone unturned. If you see something that appears out of place, then investigate. This could be a new device on your network or an unrecognised charge on your credit card. Be wary of these flags and investigate them early. If you do not, a minor incident could quickly become a major problem.
Carry out periodic diagnostics on your systems and clean up as appropriate. Ensure each of your devices runs optimally in terms of both performance and security, for both hardware and OS.
If needed, seek out the vendor’s guide on the correct configuration. Do not hesitate to run virtual machines in isolated environments for the testing of new software or to see what threats an untrusted website holds.
Using a secure, contained ecosystem means any malware will be trapped inside the virtual environment, and will be unable to have any impact on the live network. This approach adds another layer of security on top of those provided by security tools.
Ongoing vigilance is key
Cyber hygiene is a journey, not a destination. It is a process that calls for organisations’ ongoing commitment. It requires vigilance and consistency. The basic practices and some standard tools can certainly strengthen the digital immune system.
The writer is a regional sales director – UAE, South Gulf, Levant & Pakistan, OPSWAT.
