Cyber Hygiene.

What is cyber hygiene?

Cyber hygiene means the routine, basic habits that keep devices, accounts and data in good security health. It works like personal hygiene: small steps, repeated often, that lower everyday risk. The term is a plain-language label, so exact wording varies between organizations.

What are the basic cyber hygiene practices?

CISA, the United States cyber agency, names four basic security practices for staying safe online.

• Recognize and report phishing. CISA says phishing often tries to get people to open a harmful attachment or share personal information.
• Use strong passwords and a password manager. CISA says these are easy ways to protect against someone logging into an account.
• Turn on multifactor authentication. CISA says it makes people much safer from someone accessing their accounts.
• Update software. CISA says flaws in software can give criminals access to files or accounts, so updates matter for the latest protection.

The UK National Cyber Security Centre (NCSC) gives similar advice for small organizations. Its guide covers backups, protecting devices and accounts, and spotting scams.

Why does cyber hygiene matter?

The NCSC says that adopting the security measures in its 10 Steps guidance reduces the likelihood of cyber attacks occurring and minimizes the impact when incidents do occur. The NCSC also says cyber security is everyone’s business, so these habits are not only for the security team.

A simple illustration

This is a generic illustration, not a real case. A team member receives a message asking them to open an attachment. Because the team has the habit of recognizing and reporting phishing, they report the message instead of opening it. Their accounts also use multifactor authentication, which adds a second check beyond the password.

How do organizations check their cyber hygiene?

CISA offers no-cost cyber hygiene services to eligible organizations. It says these services take a proactive approach to monitoring and mitigating attack vectors. They include vulnerability scanning, which CISA says continuously monitors and assesses internet-accessible network assets. They also include web application scanning, which CISA says evaluates publicly accessible web applications for security weaknesses.

How does cyber hygiene relate to nearby terms?

Several practices above have their own entries. See patch management for keeping software updated, multi-factor authentication for the extra login check, and password manager for storing strong passwords.

Is cyber hygiene the same as cyber security?

Not exactly. Cyber security is the wider field. Cyber hygiene is the set of basic, regular habits inside it. The NCSC’s 10 Steps guidance breaks protecting an organization into ten components.

Is cyber hygiene only for large organizations?

No. CISA’s four practices are written for everyday people. The NCSC publishes a guide aimed at small organizations, and its 10 Steps guidance mainly serves medium to large organizations.