{"id":22268,"date":"2021-08-06T14:00:52","date_gmt":"2021-08-06T13:00:52","guid":{"rendered":"https:\/\/www.n-able.com\/?p=22268"},"modified":"2021-08-18T14:45:27","modified_gmt":"2021-08-18T13:45:27","slug":"25-cybersecurity-bad-practices","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices","title":{"rendered":"25 cybersecurity bad practices: more than just bad habits"},"content":{"rendered":"

The CISA (Cybersecurity & Infrastructure Security Agency) recently started an initiative to create a catalogue of exceptionally risky cybersecurity bad practices<\/span><\/a>. While this will be a welcome and very useful tool once it is complete, only two practices are currently listed. Since cybersecurity and business decisions can be time-sensitive, we wanted to expand on the CISA\u2019s list. Our Head Sales and Marketing Nerd, Stefanie Hammond<\/span><\/a><\/span>,<\/span> is also covering the number one, cybersecurity-related business bad practice that managed services providers should be aware of\u2014click here to read it<\/a>. <\/span><\/p>\n

We encourage you to read through all the cybersecurity and business bad practices regardless of what your role and responsibilities are within your organization. Most of them do not arise out of ill intentions but rather out of bad habits, or a lack of guidance and planning. It would be a worthwhile use of your organization\u2019s time to make sure none of these bad practices are at play in your MSP business or your clients\u2019 environments.<\/span><\/p>\n

Cybersecurity bad practices<\/span><\/h2>\n

According to the CISA, the number one bad practice is the use of unsupported or end-of-life software\u2014and they consider it to be \u201cespecially egregious in internet-accessible technologies.\u201d Attempting to support and protect EOL hardware and software can be a challenge in some situations and impossible in others. Sometimes you\u2019re left crossing your fingers and hoping that nothing breaks. This isn\u2019t sustainable long-term, and it makes it difficult to deliver on a promise to offer your clients the best protection possible. <\/span><\/p>\n

Use of known\/fixed\/default passwords or credentials is number two on the CISA\u2019s list. We all know it\u2019s important to change the default password on managed switches or other appliances, but are you verifying it? Make sure you have an audit process in place to ensure default credentials are not being left in place. <\/span><\/p>\n

Now we\u2019re on to our own recommendations of some common, bad cybersecurity practices that should be avoided:<\/span><\/p>\n

    \n
  1. Use of Windows 7 without ESU<\/span><\/a> or air-gaping<\/span><\/li>\n
  2. No disaster recovery or incident response plan<\/span><\/li>\n
  3. Not practicing disaster recovery or not utilizing incident response plans <\/span><\/li>\n
  4. In workgroup environments, giving users file share access with admin credentials<\/span><\/li>\n
  5. Not performing permissions audits quarterly, or more frequently <\/span><\/li>\n
  6. Not monitoring for suspicious log-in activity<\/span><\/li>\n
  7. Leaving SMBv1 enabled<\/span><\/li>\n
  8. Not using a password manager to facilitate auditing, reduce password reuse, and enforce password strength<\/span><\/li>\n
  9. Not forcing session timeouts <\/span><\/li>\n
  10. Giving client business owners full admin access<\/span><\/li>\n
  11. Not segmenting unmanaged BYOD to their own network or VLAN<\/span><\/li>\n
  12. Not segmenting IoT devices to their own network or VLAN<\/span><\/li>\n
  13. Not implementing physical access controls for server rooms\/telco closets<\/span><\/li>\n
  14. No documented security framework <\/span><\/li>\n
  15. Not documenting and planning remediation for discovered vulnerabilities\u00a0<\/span><\/li>\n
  16. Not monitoring for and automatically disabling accounts that haven\u2019t been used in more than 90 days<\/span><\/li>\n
  17. Not implementing a principle of least-privilege approach to permissions<\/span><\/li>\n
  18. Leaving Windows\u2019 built-in administrator account enabled<\/span><\/li>\n
  19. Using Windows Automatic Updates to handle patching instead of a dedicated solution, which creates a lack of visibility across an environment of current patch status<\/span><\/li>\n
  20. Assuming a traditional AV is enough to protect endpoints <\/span><\/li>\n
  21. Not using an email security and filtering solution<\/span><\/li>\n
  22. Not having external security audits of your internal processes<\/span><\/li>\n
  23. Not performing quarterly or yearly penetration testing<\/span><\/li>\n
  24. Leaving RDP ports open to the internet, because \u201chey, it\u2019s free\u201d <\/span><\/li>\n
  25. Not disabling RDP in environments that do not need it<\/span><\/li>\n<\/ol>\n

    The list of cybersecurity bad practices could go on, but we\u2019re going to switch gears and encourage you to read more about the number one, business bad practice concerning cybersecurity that MSPs should avoid<\/a>. If you would like to have a more in-depth conversation about any of the cybersecurity bad practices listed, please reach out via the contact information below. <\/span><\/p>\n

    Lewis Pope is the Head Security Nerd at N‑able. You can follow him on<\/i><\/span><\/p>\n

    Twitter:\u00a0<\/i>@cybersec_nerd<\/i><\/span><\/a><\/span><\/p>\n

    LinkedIn:\u00a0<\/i>thesecuritypope<\/i><\/span><\/a><\/span><\/p>\n

    Twitch:\u00a0<\/i>cybersec_nerd<\/i><\/span><\/a><\/span><\/p>\n

     <\/p>\n

    \u00a9 2021 N‑able Solutions ULC and N‑able Technologies Ltd. All rights reserved.<\/p>\n

    The N‑able trademarks, service marks, and logos are the exclusive property of N‑able Solutions ULC and N‑able Technologies Ltd.\u00a0 All other trademarks are the property of their respective owners.<\/p>\n

    This document is provided for informational purposes only. Information and views expressed in this document may change and\/or may not be applicable to you.\u00a0 N‑able makes no warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information contained herein.<\/p>\n

    \u00a0<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

    With the CISA starting its catalogue of cybersecurity bad practices, Lewis Pope sets out his own, more expansive list.<\/p>\n","protected":false},"author":62,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-22268","post","type-post","status-publish","format-standard","hentry","topic-head-nerds","topic-security"],"acf":[],"yoast_head":"\n25 cybersecurity bad practices | N-able<\/title>\n<meta name=\"description\" content=\"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"25 cybersecurity bad practices | N-able\" \/>\n<meta property=\"og:description\" content=\"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/NableMSP\" \/>\n<meta property=\"article:published_time\" content=\"2021-08-06T13:00:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-08-18T13:45:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"356\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Lewis Pope\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lewis Pope\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\"},\"author\":{\"name\":\"Lewis Pope\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae\"},\"headline\":\"25 cybersecurity bad practices: more than just bad habits\",\"datePublished\":\"2021-08-06T14:00:52+01:00\",\"dateModified\":\"2021-08-18T13:45:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\"},\"wordCount\":739,\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"articleSection\":[\"Head Nerds\",\"Security\"],\"inLanguage\":\"pt-BR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\",\"url\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\",\"name\":\"25 cybersecurity bad practices | N-able\",\"isPartOf\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\"},\"datePublished\":\"2021-08-06T14:00:52+01:00\",\"dateModified\":\"2021-08-18T13:45:27+00:00\",\"description\":\"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Head Nerds\",\"item\":\"https:\/\/www.n-able.com\/pt-br\/blog\/category\/head-nerds-pt-br\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"25 cybersecurity bad practices: more than just bad habits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#website\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.n-able.com\/pt-br?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#organization\",\"name\":\"N-able\",\"url\":\"https:\/\/www.n-able.com\/pt-br\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/NableMSP\",\"https:\/\/x.com\/Nable\",\"https:\/\/www.linkedin.com\/company\/n-able\",\"https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae\",\"name\":\"Lewis Pope\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g\",\"caption\":\"Lewis Pope\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"25 cybersecurity bad practices | N-able","description":"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices","og_locale":"pt_BR","og_type":"article","og_title":"25 cybersecurity bad practices | N-able","og_description":"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.","og_url":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/NableMSP","article_published_time":"2021-08-06T13:00:52+00:00","article_modified_time":"2021-08-18T13:45:27+00:00","og_image":[{"width":720,"height":356,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg","type":"image\/jpeg"}],"author":"Lewis Pope","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/04\/blog-Lewis-Pope.jpg","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Escrito por":"Lewis Pope","Est. tempo de leitura":"4 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices"},"author":{"name":"Lewis Pope","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae"},"headline":"25 cybersecurity bad practices: more than just bad habits","datePublished":"2021-08-06T14:00:52+01:00","dateModified":"2021-08-18T13:45:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices"},"wordCount":739,"publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"articleSection":["Head Nerds","Security"],"inLanguage":"pt-BR"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices","url":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices","name":"25 cybersecurity bad practices | N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/pt-br#website"},"datePublished":"2021-08-06T14:00:52+01:00","dateModified":"2021-08-18T13:45:27+00:00","description":"Check out our own recommendation list of some common bad cybersecurity practices that should be avoided.","breadcrumb":{"@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.n-able.com\/pt-br\/blog\/25-cybersecurity-bad-practices#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Head Nerds","item":"https:\/\/www.n-able.com\/pt-br\/blog\/category\/head-nerds-pt-br"},{"@type":"ListItem","position":2,"name":"25 cybersecurity bad practices: more than just bad habits"}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/pt-br#website","url":"https:\/\/www.n-able.com\/pt-br","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/pt-br#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/pt-br?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/pt-br#organization","name":"N-able","url":"https:\/\/www.n-able.com\/pt-br","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/NableMSP","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"]},{"@type":"Person","@id":"https:\/\/www.n-able.com\/pt-br#\/schema\/person\/32c214c92846fdd7b16459b9236c12ae","name":"Lewis Pope","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f61d746b384dec3b7d702cd5a5e62b2d6a9722dd83df5ae50505361c3a3eadb1?s=96&d=mm&r=g","caption":"Lewis Pope"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/22268","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/comments?post=22268"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/posts\/22268\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/pt-br\/wp-json\/wp\/v2\/media?parent=22268"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}