GUIDINEE.COM › IT & Systems › Level 6 › 6.3

6.3 · Best practices & pitfalls

Level 6 · In practice

6.3Best practices & pitfalls

Goal: adopt the right reflexes and avoid the most frequent mistakes.
Estimated time: 10 min · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

  • Protect: least privilege everywhere, MFA on every account (especially administrators), 3-2-1 backups including a disconnected, tested copy.
  • Maintain: regular updates, documentation while doing, methodical diagnosis from simple to complex.
  • Deliver: test before applying en masse (GPOs, scripts) and treat underlying problems, not just incidents.

Sofiane’s thread — the rule taped to the wall

After a quarter in support, Sofiane taped his rule to the wall in Algiers: protect first, prove afterwards. What mattered most wasn’t one more tool, but a few habits — least privilege, MFA everywhere, tested backups — and his biggest pitfall narrowly avoided: a backup never restored that he believed was a given.

Pick a single habit to anchor in your ritual, then move to the next.

The do’s and don’ts of the job

The difference between a fragile IT setup and a solid one often comes down to a handful of habits. Protect, maintain, document: those are what hold the daily work together, not the latest trendy feature.

Least privilege first

Working in an administrator account day to day is handing half the work to ransomware. Standard accounts and rights by groups limit the damage in case of a mistake or an attack.

Prove rather than assume

A backup never tested is worth nothing; a static IP set inside the DHCP range creates conflicts. You test before trusting, and you document while doing.

✓ Do

  • Least privilege everywhere: standard accounts, rights by groups, separate administration.
  • MFA on every account, starting with administrators.
  • 3-2-1 backups + a disconnected copy, and TESTED restores.
  • Regular updates: they close known vulnerabilities.
  • Document WHILE doing, and diagnose methodically from simple to complex.

✗ Avoid

  • Working in an administrator account day to day.
  • Sharing “open to everyone” to go fast.
  • A backup never tested (= no backup).
  • Postponing updates indefinitely.
  • Assigning a static IP inside the DHCP range (conflicts).
Common misinterpretation: “ticking every box every day.” No. These are habits to install one by one: pick one (for example, least privilege everywhere), anchor it in your ritual, then move to the next.
Text version of the diagram (SEO / screen readers / translation): 1) Accounts — least privilege everywhere and MFA on every account (administrators first). 2) Protection — 3-2-1 backups including a disconnected, tested copy; regular updates. 3) Method — diagnose from simple to complex, one change at a time, test before applying en masse. 4) Substance — document while doing and treat the problems, not just the incidents. Lesson: a solid IT setup comes from a few constant habits, not stacked tools.

Script ready to say — verify before trusting (30 s)

“Accounts on least privilege? MFA everywhere? Backup restored at least once? Updates current? Docs written? If any no, I fix it before sleeping soundly.”

To reread before considering an infrastructure healthy.

Script ready to say — explaining your reflexes (30 s)

“I protect first: least privilege, MFA, tested backups, updates; then I diagnose from simple to complex, one change at a time, and I document while doing.”

One sentence to sum up a healthy practice.

Copy-paste template — 3-2-1 rule

3 copies of the data
2 different media (one local)
1 DISCONNECTED offline copy
-- Golden rule: restore at least once to verify

Copy-paste template — bad move to fix

-- BEFORE: static IP set inside the DHCP range
ip: 192.168.1.50 (DHCP range .50-.150)  --> CONFLICTS
-- AFTER: DHCP reservation for the device
-- or a static IP OUTSIDE the dynamic range

Very small business / small budget

One habit per quarter is enough: least privilege + tested backup first, the rest afterwards.

Algiers SME

Adapt the rituals to local realities: a single Internet link, outages, grouped updates, a known point of contact.

Remote / hybrid

Discipline no. 1 at a distance: written procedure, test and update dates noted, even for small interventions.

Intercultural

Check local practices rather than assuming: a habit obvious to one person must be explained to every newcomer.

Caution: Generic reminder: golden rule — protect first, prove afterwards; never work as administrator day to day, enforce MFA on sensitive accounts, and treat a backup as a given only after restoring it.

48h challenge — apply it tomorrow

Audit your infrastructure: zero day-to-day admin, zero untested backup, zero static IP inside the DHCP range. Fix the first gap you find.

Section exit checklist
  • I know the reflexes to adopt and the pitfalls to avoid.
  • I checked my critical points (least privilege, MFA, tested backup).
  • I did the 48h challenge or scheduled its date.
Self-assessment 1-5: consistency of good reflexes?pitfalls avoided?
← Previous : Recurring problems (playbook) (V3)Next : Toolbox (V3) →
Check your understanding

Before considering his IT setup healthy, which reflex protects Sofiane best?

💡

Golden rule: least privilege, MFA everywhere and tested backup — the rest (tools, features) only reveals this base.