Security Best Practices

Security Best Practices Fundamentals, Password Security, Account Protection, and Encryption Basics

Introduction to Security Best Practices

Technology alone cannot secure a computer system. Even the most advanced hardware and software can become vulnerable if users do not follow proper security practices.

Security best practices are recommended procedures that reduce the likelihood of security incidents and help protect:

Following security best practices helps prevent unauthorized access, malware infections, data loss, and identity theft.

Defense in Depth

Defense in Depth is a security strategy that uses multiple layers of protection rather than relying on a single security control.

Examples of layered security include:

If one layer fails, additional layers continue to protect the system.

User Responsibility

Every user shares responsibility for maintaining security.

Users should:

Human error is one of the most common causes of security incidents.

Password Security

Passwords remain one of the primary methods used to protect accounts.

Weak passwords are among the easiest targets for attackers.

Strong password practices greatly reduce the risk of unauthorized access.

Characteristics of Strong Passwords

A strong password should be:

Avoid using:

Attackers often try these first.

Password Complexity

Many organizations require password complexity rules.

A strong password typically contains a combination of:

Example:

Tr@vel2026!Lake

Long passphrases are often easier to remember and harder to crack than short, complex passwords.

Passphrases

A passphrase is a longer sequence of words or characters used as a password.

Examples:

Advantages include:

Password Reuse

One of the most dangerous password habits is using the same password for multiple accounts.

If attackers obtain a password from one website, they often attempt to use it on:

This attack is known as credential stuffing.

Always use a different password for every important account.

Password Expiration

Some organizations require users to change passwords at regular intervals, such as every 90 days.

Reasons include:

Even if password expiration is not required, users should immediately change passwords if they suspect compromise.

Password History

Many organizations prevent users from reusing recently used passwords.

A password history policy stores previous passwords and prevents them from being selected again immediately.

Benefits include:

For example, a company may prohibit reuse of the previous 10 passwords.

Password Reset

Users occasionally forget passwords or become locked out of their accounts.

Organizations typically provide secure password reset methods such as:

Password reset procedures should verify the user’s identity before allowing access.

Account Lockout

Many systems temporarily lock accounts after multiple failed login attempts.

Benefits include:

After the lockout period expires, users may attempt to log in again or complete a password reset.

Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) requires users to verify their identity using two or more authentication factors.

Common authentication factors include:

Something You Know

Something You Have

Something You Are

Even if a password is stolen, MFA greatly reduces the chance of unauthorized access.

Password Managers

A password manager securely stores usernames and passwords in an encrypted vault.

Advantages include:

Users only need to remember one strong master password.

Protecting User Accounts

Users should also:

Good account management helps prevent unauthorized access.

Introduction to Encryption

Encryption protects information by converting readable data into an unreadable format.

Without encryption, anyone intercepting data could potentially read it.

Encryption protects:

Encryption is one of the most effective methods of protecting sensitive information.

Plaintext

Plaintext is readable, unencrypted information.

Anyone who intercepts plaintext can read its contents immediately.

Example:

Password = Summer2026

Plaintext provides no confidentiality.

Ciphertext

Ciphertext is encrypted information that appears unreadable without the proper decryption key.

Example:

A93#Xm!Q7$82L

Only authorized users possessing the correct key can restore the original information.

Encryption Keys

An encryption key is a value used to encrypt and decrypt information.

The strength of encryption depends largely on:

Keeping encryption keys secure is just as important as encrypting the data itself.

Symmetric Encryption

Symmetric encryption uses one key for both encryption and decryption.

Advantages:

Disadvantages:

Asymmetric Encryption

Asymmetric encryption uses two different keys:

The public key encrypts data, while the private key decrypts it.

This method is widely used for secure Internet communications and digital certificates.

Public Key Infrastructure (PKI)

Public Key Infrastructure (PKI) is a framework that manages digital certificates and public/private key pairs.

PKI enables secure communication over untrusted networks such as the Internet.

Certificate Authorities (CAs) verify identities before issuing digital certificates.

Benefits of Encryption

Encryption provides:

Encryption protects both data at rest and data in transit.

Best Practices

Key Terms

Exam Tips

Data Encryption, Secure Communications, VPNs, Wireless Security, and Safe Internet Practices

Protecting Data

Data is one of an organization’s most valuable assets. Whether information is stored on a device or transmitted across a network, it should be protected from unauthorized access.

Encryption plays a major role in protecting data throughout its lifecycle.

Data exists in two primary states:

Understanding the difference is important for selecting the appropriate security controls.

Data at Rest

Data at rest refers to information that is stored on a device and is not actively moving across a network.

Examples include:

Although the data is not moving, it is still vulnerable if the storage device is lost, stolen, or accessed without authorization.

Why Encrypt Data at Rest?

Encrypting stored data helps protect sensitive information if a device is:

Even if someone removes a hard drive from a stolen computer, encrypted data remains unreadable without the correct decryption key.

File-Level Encryption

File-level encryption protects individual files or folders.

Characteristics include:

Examples of files commonly encrypted include:

Disk-Level (Full-Disk) Encryption

Disk-level encryption, also called full-disk encryption, encrypts the entire storage device.

Everything on the drive is protected, including:

Advantages include:

Full-disk encryption is commonly used on laptops because they are easily lost or stolen.

Benefits of Encryption

Encryption provides several important security benefits:

Encryption is one of the most effective methods of protecting sensitive information.

Data in Transit

Data in transit refers to information actively traveling across a network.

Examples include:

Without encryption, intercepted network traffic may expose confidential information.

Why Encrypt Data in Transit?

Attackers may intercept network communications using techniques such as:

Encryption prevents attackers from reading intercepted communications.

Secure Web Browsing

When visiting websites, users often exchange sensitive information such as:

Secure web protocols help protect this communication.

HTTP

HTTP (Hypertext Transfer Protocol) transmits web pages without encryption.

Characteristics include:

Sensitive information should never be transmitted over plain HTTP.

HTTPS

HTTPS (Hypertext Transfer Protocol Secure) encrypts communication between a web browser and a web server.

Benefits include:

Modern websites should always use HTTPS when handling sensitive information.

SSL and TLS

Historically, secure web traffic used Secure Sockets Layer (SSL).

Modern systems primarily use Transport Layer Security (TLS), which replaced SSL and provides stronger security.

TLS protects:

Although people often say “SSL certificate,” most secure websites today actually use TLS.

Digital Certificates

A digital certificate verifies the identity of a website, server, or organization.

Certificates contain information such as:

Web browsers verify certificates before establishing encrypted HTTPS connections.

Certificate Authority (CA)

A Certificate Authority (CA) is a trusted organization that issues digital certificates after verifying an organization’s identity.

Examples of responsibilities include:

Browsers trust certificates issued by recognized Certificate Authorities.

Secure Email

Email often contains confidential business and personal information.

Users should:

Organizations frequently implement email filtering and encryption to improve security.

Virtual Private Network (VPN)

A Virtual Private Network (VPN) creates an encrypted tunnel between a user’s device and another network.

VPNs are commonly used for:

Benefits include:

Wireless Security

Wireless networks must also be protected against unauthorized access.

Common wireless threats include:

Strong wireless security helps reduce these risks.

WPA2

Wi-Fi Protected Access 2 (WPA2) introduced much stronger encryption than earlier wireless security protocols.

Features include:

Although still common, WPA2 is gradually being replaced by WPA3.

WPA3

Wi-Fi Protected Access 3 (WPA3) is the latest wireless security standard.

Advantages include:

WPA3 is the recommended security protocol for modern wireless networks.

Public Wi-Fi Risks

Public wireless networks found in places such as:

may expose users to security risks.

Attackers may create fake hotspots that appear legitimate.

Users should avoid transmitting sensitive information over unsecured public Wi-Fi unless using a VPN.

Safe Internet Browsing

Users should browse the Internet responsibly.

Good practices include:

Safe Downloads

Before downloading software:

Malicious downloads remain one of the most common malware delivery methods.

Safe File Sharing

When sharing files:

Organizations often implement secure file-sharing platforms to protect confidential information.

Best Practices

Key Terms

Exam Tips

Software Updates, Malware Protection, Firewalls, Device Security, Physical Security, and Backup Best Practices

Keeping Systems Updated

One of the simplest and most effective ways to improve security is to keep operating systems, applications, and firmware up to date.

Software vendors regularly release updates to:

Attackers frequently target computers running outdated software because known vulnerabilities are easier to exploit.

Software Updates

A software update is any modification made to improve an existing application or operating system.

Updates may include:

Users should install updates as soon as practical to reduce security risks.

Patch Management

A patch is a software update specifically designed to fix a problem or vulnerability.

Patch management is the process of:

Organizations often automate patch management to ensure consistency across many devices.

Automatic Updates

Many operating systems support automatic updates, allowing security patches to be installed without user intervention.

Advantages include:

Critical security updates should be installed promptly.

Firmware Updates

Firmware is software stored inside hardware devices that controls their basic functions.

Examples include:

Manufacturers periodically release firmware updates to improve security and functionality.

Antivirus Software

Antivirus software detects, blocks, and removes malicious software from a computer.

Modern antivirus applications protect against many types of malware, including:

Antivirus software should always remain enabled and updated.

How Antivirus Software Works

Antivirus software commonly uses several detection methods.

Signature-Based Detection

Compares files against a database of known malware signatures.

Advantages:

Limitations:

Heuristic Detection

Heuristic analysis searches for suspicious characteristics or behavior that may indicate previously unknown malware.

Advantages:

Limitations:

Behavioral Detection

Behavior-based protection monitors software while it runs.

It looks for suspicious activities such as:

Behavioral analysis helps detect ransomware and other modern threats.

Anti-malware Software

Although antivirus traditionally focused on viruses, anti-malware software protects against a broader range of malicious software.

Modern security products often combine antivirus and anti-malware capabilities into one solution.

Real-Time Protection

Real-time protection continuously monitors system activity.

It automatically checks:

Real-time monitoring helps stop malware before it can infect the system.

Scheduled Scans

Organizations often configure antivirus software to perform automatic scans.

Common scan types include:

Quick Scan

Examines the most common malware locations.

Advantages:

Full Scan

Examines every accessible file on the device.

Advantages:

Disadvantages:

Quarantine

When suspicious software is detected, antivirus programs often move it into quarantine.

Quarantined files:

If a legitimate file is mistakenly quarantined, it may be restored.

Firewalls

A firewall monitors incoming and outgoing network traffic according to predefined security rules.

Its primary goal is to prevent unauthorized network access while allowing legitimate communication.

Firewalls are one of the most important layers of network defense.

Types of Firewalls

Host-Based Firewall

Installed on an individual computer.

Protects:

Each device manages its own firewall rules.

Network Firewall

Installed between networks.

Typically protects:

Network firewalls protect multiple devices simultaneously.

Firewall Functions

Firewalls can:

Firewalls reduce the attack surface of systems connected to networks.

Security Awareness

Technology alone cannot prevent every attack.

Employees should receive regular security awareness training covering:

Educated users are an important part of organizational security.

Device Security

All computing devices should be secured against unauthorized access.

Examples include:

Proper device security protects both hardware and stored information.

Locking Devices

Whenever users leave a device unattended, they should:

This prevents unauthorized access if someone approaches an unattended computer.

Mobile Device Security

Mobile devices store significant amounts of personal and business information.

Recommended protections include:

These features reduce the risk associated with lost or stolen devices.

Bring Your Own Device (BYOD)

Many organizations allow employees to use personal devices for work.

Advantages include:

Potential security risks include:

Organizations often implement Mobile Device Management (MDM) solutions to secure BYOD devices.

Physical Security

Physical security remains an essential part of cybersecurity.

Important controls include:

Protecting hardware also protects the information stored on it.

Secure Disposal of Devices

Before selling, donating, recycling, or disposing of storage devices, organizations should ensure sensitive information cannot be recovered.

Simply deleting files is not enough.

Secure Disposal Methods

Data Wiping

Overwrites existing data multiple times.

Suitable for devices that will be reused.

Degaussing

Uses a powerful magnetic field to erase magnetic storage media.

Most effective for traditional hard disk drives (HDDs).

Physical Destruction

Physically destroys storage devices through methods such as:

Often used when highly sensitive information was stored on the device.

Backup Best Practices

Regular backups remain one of the best defenses against:

Backups should be:

A backup that cannot be restored provides little value.

The 3-2-1 Backup Rule

A widely accepted backup strategy is the 3-2-1 rule:

This approach improves resilience against hardware failures, ransomware, and disasters.

Security Maintenance

Security is an ongoing process.

Organizations should regularly:

Continuous maintenance helps reduce long-term security risks.

Best Practices

Key Terms

Exam Tips

Security Policies, Incident Response, Disaster Recovery, and Business Continuity

Organizational Security Policies

A security policy is a formal document that establishes rules, procedures, and expectations for protecting an organization’s information systems and data.

Security policies provide a consistent framework that employees, contractors, and third parties must follow.

Well-designed policies help organizations:

Every employee should understand and follow their organization’s security policies.

Common Types of Security Policies

Organizations often maintain several security-related policies.

Examples include:

Each policy addresses a different aspect of organizational security.

Acceptable Use Policy (AUP)

An Acceptable Use Policy (AUP) defines how employees may use organizational computers, networks, Internet access, software, and other technology resources.

An AUP typically specifies:

Permitted Activities

Prohibited Activities

Violations of the AUP may result in disciplinary action.

Password Policy

Organizations establish password policies to improve authentication security.

A password policy may require:

Following these policies helps reduce password-related attacks.

Security Awareness Training

Technology alone cannot prevent every cyberattack.

Employees should receive regular security awareness training covering topics such as:

Continuous training helps employees recognize and avoid evolving threats.

Security Awareness Best Practices

Employees should:

Security awareness is one of the most effective defenses against cyberattacks.

Incident Response

Despite strong security controls, security incidents can still occur.

Examples include:

Organizations should prepare for incidents before they happen.

Incident Response Lifecycle

Most organizations follow a structured incident response process.

1. Preparation

Preparation includes:

Proper preparation reduces the impact of future incidents.

2. Identification

During identification, organizations determine:

Early detection limits damage.

3. Containment

Containment prevents the incident from spreading.

Examples include:

Containment helps minimize additional damage.

4. Eradication

During eradication, organizations eliminate the root cause.

Activities may include:

The goal is to remove the threat completely.

5. Recovery

Recovery restores normal business operations.

Recovery activities include:

Systems should be tested carefully before returning to normal operation.

6. Lessons Learned

After recovery, organizations evaluate:

This continuous improvement strengthens future security.

Disaster Recovery (DR)

Disaster Recovery (DR) focuses on restoring IT systems and data after a major disruption.

Potential disasters include:

A Disaster Recovery Plan (DRP) outlines procedures for restoring operations quickly.

Disaster Recovery Objectives

Effective disaster recovery aims to:

Organizations regularly test disaster recovery procedures to ensure they work as expected.

Business Continuity (BC)

Business Continuity (BC) ensures that essential business operations continue during and after disruptive events.

Unlike disaster recovery, which focuses on restoring IT systems, business continuity focuses on maintaining overall business operations.

Examples include:

Business continuity planning reduces operational disruptions.

Disaster Recovery vs. Business Continuity
Disaster RecoveryBusiness Continuity
Focuses on restoring IT systemsFocuses on keeping the business operating
Primarily technology-orientedIncludes people, facilities, and processes
Restores data and infrastructureMaintains essential business functions
Activated after a disruptionPlanned before disruptions occur

For the exam, remember:

Data Backup Review

Backups remain one of the most important security controls.

Good backup practices include:

Backups are essential for recovering from ransomware and hardware failures.

Data Recovery

Recovery procedures should ensure:

Organizations should periodically perform restoration tests to verify backup reliability.

Security Audits

A security audit evaluates whether security controls are working effectively.

Audits may examine:

Regular audits help identify weaknesses before attackers exploit them.

Risk Assessment

A risk assessment identifies threats, vulnerabilities, and the likelihood of successful attacks.

The assessment helps organizations prioritize security improvements based on potential impact.

Typical steps include:

Risk assessments should be performed regularly.

Security Maintenance

Security is a continuous process rather than a one-time task.

Organizations should routinely:

Continuous maintenance keeps defenses effective against evolving threats.

Comprehensive Security Best Practices

Organizations should:

Security works best when multiple controls are used together.

Key Terms

Exam Tips

Password and Authentication

Encryption

System Protection

Network Security

Backup and Recovery

Security Awareness