6.3Best practices & pitfalls
The essentials in 30 seconds
- Golden rule: when in doubt, slow down and verify through another channel — caution pays, never rushing.
- Do: unique passwords in a manager, two-factor authentication, updates, locking, offline backup, fast reporting.
- Never do: reuse a password, click from a received link, approve an urgent transfer without checking, plug in a found stick.
Karim thread — three habits that pay off
After one year, Karim takes stock: what mattered most was not a tool, but three habits — verifying every urgent request through a separate channel, locking his session when stepping away, and reporting the slightest doubt quickly without waiting for certainty. And his biggest narrowly avoided trap: enabling the macros of a received document during a rush week.
Pick a single habit to anchor into your routine, then move to the next one.
The do / don't of a cyber-vigilant employee
The difference between a protected workstation and an open door comes down to a few habits. Here are the ones that come up most.
✓ Do
- One long and unique password per account, in a manager.
- Two-factor authentication on all critical accounts (mailbox first).
- Automatic updates everywhere; active antivirus.
- Verify through a separate channel every urgent or unusual request.
- Lock your session when stepping away.
- Back up with an offline copy, and test the restore.
- Systematic VPN on uncontrolled networks.
- Report any doubt or incident quickly — without waiting for certainty.
✗ Never do
- Reusing the same password on several sites.
- Logging in to an account from a link received by e-mail.
- Enabling the macros of a received document.
- Approving an urgent and confidential transfer without checking.
- Paying a ransom or switching off an infected workstation.
- Forwarding work files to your personal mailbox.
- Plugging in a found USB stick.
- Hiding a mistake (e-mail to the wrong recipient) instead of reporting it.
Ready-to-say script — checking your day before leaving (30 s)
“Session locked when stepping away? Urgent requests verified through another channel? Updates and antivirus active? Doubt reported to IT without waiting? If any no, I fix it before leaving.”
Copy-paste template — monthly self-check (8 questions)
THIS MONTH (yes / to improve):
1. Passwords: unique, long, in a manager?
2. Two-factor authentication on critical accounts?
3. Updates and antivirus active everywhere?
4. Urgent requests verified through a separate channel?
5. Session locked systematically?
6. Offline backup in place and restore tested?
7. VPN on uncontrolled networks?
8. Doubts and incidents reported quickly to IT?
MY PRIORITY NEXT MONTH (only one): ...Small business / tight budget
One single habit per quarter is enough: fast reporting first, the rest after.
Algeria SME
Adapt routines to peaks and travel: one weekly slot for updates and backup kept every week beats an annual campaign.
Remote / hybrid
The no. 1 discipline at a distance: systematic VPN and locking at every break, even at home.
Cross-cultural
Check local practices rather than assume: an unusual channel or urgency should raise an alert everywhere.
48h challenge — apply tomorrow
Fill in the monthly self-check above and pick a single priority to anchor (e.g. two-factor authentication on the mailbox).
- I know the reflexes to adopt and the pitfalls to avoid.
- I have filled in the self-check and picked a priority.
- I have done the 48h challenge or scheduled its date.
Before leaving, Karim reviews his day. Which reflex best protects his workstation?
Golden rule: when in doubt, slow down and verify through another channel — cybersecurity rewards caution, never rushing.