Why Every Tech Professional Needs Basic Cyber Hygiene (and How to Practise It)

Key takeaways

• Most breaches start with ordinary failures: reused passwords, missing updates, phishing and exposed credentials. Hygiene targets exactly those.
• Use a password manager, unique long passwords and multi-factor authentication. Prefer authenticator apps, passkeys or security keys over SMS codes.
• Tech staff are high-value targets because they hold admin access, keys and production data.
• Never commit secrets to Git. Use environment variables or a secrets manager, and rotate anything that leaks.
• In India, report cyber fraud on the national helpline 1930 or at cybercrime.gov.in, and organisations report incidents to CERT-In.

What is cyber hygiene?

Cyber hygiene means doing a few basic security things consistently, the way personal hygiene means washing your hands every day. It is not advanced. Strong passwords, updates, backups and careful clicking stop a large share of everyday attacks, and they cost very little.

The reason it matters is that attackers prefer easy routes. Breaking strong encryption is hard. Guessing a reused password, or sending a convincing email to someone who has admin rights, is far easier.

Why tech professionals need it more than most

If you are a developer, sysadmin, tester or student heading into IT, you hold access that ordinary users do not: servers, cloud consoles, source code, customer data, API keys. An attacker who gets your laptop or your GitHub token may reach all of that without ever attacking the company directly.

Clients and employers also judge you on it. Leaking a key in a public repository, or running an unpatched machine on a company VPN, is the kind of mistake that ends contracts.

The core habits, in order of value

1. Use a password manager and unique passwords

Reusing a password means that one breached website exposes every account that shares it. A password manager creates and stores a different long password for each account, so you remember only one strong master passphrase. NIST's digital identity guidance (SP 800-63B, in the NIST Special Publications series) recommends favouring length over odd symbol rules, checking passwords against known-breached lists, and not forcing regular changes without a reason. Change a password when you suspect it leaked, not on a calendar.

2. Turn on multi-factor authentication everywhere that matters

A second factor stops most password-only takeovers. Rank your options: security keys and passkeys are strongest and resist phishing; authenticator-app codes are good; SMS codes are better than nothing but can be intercepted by SIM swap or social engineering. Start with email, cloud consoles, GitHub or GitLab, banking and your password manager. Your email account can reset every other account, so protect it first.

3. Keep everything updated

Attackers scan the internet for known flaws within days of public disclosure. Updates close them. Turn on automatic updates for your operating system, browser and phone. For servers, keep a patching routine and track vulnerabilities for the software you run in the National Vulnerability Database.

4. Back up, and test the restore

Ransomware and disk failure both end in the same question: can you get your data back? Follow the 3-2-1 rule: three copies, on two kinds of storage, with one copy offline or off-site. A backup you have never restored is a hope, not a backup. Try restoring a file every few months.

5. Slow down on links, attachments and urgent requests

Phishing works by creating urgency: a courier fee, a KYC update, a "security alert" from your own company. Check the sender's real address, hover over links before you click, and verify unexpected requests through a second channel such as a phone call to a known number. Be extra careful with anything asking for credentials, payments or OTPs. Nobody legitimate needs your OTP.

6. Encrypt and lock your devices

Turn on full-disk encryption (BitLocker on Windows, FileVault on macOS, LUKS on Linux) and set a screen lock. If a laptop is lost or stolen, the data stays unreadable. Do the same for your phone.

7. Use the least privilege you need

Do daily work with a normal account and use admin rights only when required. In the cloud, give each person and service only the permissions the job needs. If an account is compromised, least privilege limits the damage.

Hygiene for people who write code and run servers

• Keep secrets out of Git. Passwords, API keys and private keys do not belong in source control, even in a private repository. Use environment variables or a secrets manager, add secret files to .gitignore, and turn on secret scanning in your Git host. If a key is committed, rotate it at once; deleting the commit is not enough because the old value stays in history and may already be copied.
• Use SSH keys, not passwords, protect them with a passphrase, and disable password login on servers.
• Use separate accounts for admin and daily work, and for personal and company cloud accounts.
• Check your dependencies. Pin versions and run a dependency scanner, because vulnerable libraries are a common way in.
• Treat user input as hostile. Validate it and encode output. Cross-site scripting (XSS), where an attacker's script runs in another user's browser, is the classic result of skipping this. Our guides on preventing XSS and code injection show how.
• Log and monitor. You cannot respond to what you cannot see. Keep authentication and admin logs somewhere an attacker on one server cannot erase.

The OWASP Top 10 lists the web application risks that these habits help prevent.

Public Wi-Fi, USB drives and home networks

• On public Wi-Fi, stick to HTTPS sites and use a VPN you trust for anything sensitive.
• Do not plug in unknown USB drives or charge from unknown public USB ports.
• At home, use WPA2 or WPA3, change the router's default admin password and keep its firmware current.

A simple routine you can keep

What to do if something goes wrong

1. Change the password for the affected account from a clean device, and sign out other sessions.
2. Revoke any API keys or tokens that might be exposed and rotate them.
3. Tell your security team or manager straight away. Early reports cost less than hidden ones.
4. If money was lost to online fraud in India, call the national cyber crime helpline 1930 quickly and file a complaint at cybercrime.gov.in. Speed improves the chance of freezing funds.
5. Organisations in India are expected to report certain cyber incidents to CERT-In, with a short reporting window set by its directions. Check the current requirements at CERT-In.

Common mistakes

• Treating hygiene as the security team's job. Everyone who has access is part of the defence.
• Using the same password with a small change, such as Name@2025 then Name@2026.
• Relying on SMS codes for high-value accounts when a better option exists.
• Skipping updates because "it works fine". The update is the fix for something that already works for attackers.
• Keeping the only backup on the same machine.

Next steps

Do the "once, today" row of the table above, it takes under an hour. If you want to turn this into a career, the cyber security course builds from these basics into network defence, and the CCT (Certified Cybersecurity Technician) programme is an entry-level route.

Related reading

• What is XSS (Cross-Site Scripting) and How to Prevent It in Web Applications