IT Security Habits That Will Get You on the Naughty List

If Santa had a cybersecurity team, he’d keep a separate naughty list just for IT security practices. And in today’s high-stakes landscape, some organizations are practically writing their names in bold red letters. With data breaches, ransomware attacks, and insider threats constantly evolving, the difference between good and bad IT security isn’t just about what you do—it’s about what you don’t do or do wrong. Here’s a look at the most egregious security habits that’ll land you on the naughty list.

Ignoring MFA Misconfigurations

Multi-factor authentication (MFA) is a darling of IT security—until it’s not. Simply enabling MFA isn’t enough. Weak MFA setups, like using SMS-based codes vulnerable to SIM swapping or failing to deploy phishing-resistant protocols, are invitations for attackers. Worse, many organizations don’t enforce MFA across critical accounts, leaving gaps in the armor.

MFA fatigue attacks, where attackers bombard users with repeated push notifications until they approve one, are on the rise. Without proper monitoring, this trend can bypass even well-configured MFA systems.

Fix: Implement phishing-resistant MFA and actively monitor for unusual authentication attempts.

Overtrusting Third-Party Vendors

You’ve locked down your perimeter, but what about your vendors? In today’s interconnected IT ecosystems, your weakest vendor is your weakest link. Breaches like MOVEit demonstrated how attackers targeted vulnerable vendor systems to access customer networks.

The rise of supply chain attacks allows attackers to compromise trusted partners and leapfrog into your environment.

Fix: Demand SOC 2 or ISO certifications from vendors, conduct regular security audits, and limit third-party access to only what’s necessary.

DIY Zero Trust That’s Barely Zero Anything

Zero Trust isn’t a set-it-and-forget-it project, and it’s certainly not something you cobble together with off-the-shelf tools and hope for the best. Many companies implement surface-level measures like conditional access policies while skipping the heavy lifting of microsegmentation, continuous monitoring, and least-privilege enforcement.

Attackers are exploiting gaps in poorly implemented Zero Trust architectures to move laterally undetected.

Fix: Build a comprehensive Zero Trust strategy that spans identity, devices, applications, and data. Conduct regular penetration testing to validate its effectiveness.

Neglecting SaaS Shadow IT

With the explosion of SaaS apps, employees are introducing unauthorized software faster than IT teams can blacklist them. Shadow IT creates an unmanaged and unmonitored risk vector that attackers can exploit, especially when these apps store sensitive data or bypass corporate security policies.

A staggering 80% of employees admit to using unapproved SaaS apps, many of which lack proper security controls.

Fix: Deploy cloud access security broker (CASB) tools to gain visibility into shadow IT and enforce security policies across unsanctioned apps.

Overlooking Endpoint Detection for Macs

In many organizations, Macs are treated like the golden child that doesn’t need rules. That’s a dangerous assumption. With more professionals—and attackers—targeting macOS, endpoints without detection and response capabilities are sitting ducks.

macOS malware is on the rise, with sophisticated strains targeting endpoints used by developers and executives.

Fix: Extend endpoint detection and response (EDR) tools to macOS, enforce regular patching, and educate users on emerging threats.

Underestimating Insider Threats in the Cloud

Today’s insider threats aren’t just rogue employees—they’re careless users, contractors, or misconfigured permissions in cloud environments. Cloud misconfigurations can lead to massive data leaks, often by accident but sometimes with malicious intent.

Overprivileged access in platforms like AWS, Azure, or Google Cloud has led to numerous incidents of accidental data exposure or intentional sabotage.

Fix: Use identity and access management (IAM) policies, enforce strict role-based access control (RBAC), and conduct regular access reviews to catch privilege creep.

Relying on Password Expirations Instead of Passwordless Solutions

If you think forcing users to reset passwords every 90 days is protecting your organization, think again. This outdated practice often results in weaker passwords and frustrated users, creating more risks than it mitigates.

Attackers leverage password reuse and credential stuffing against legacy authentication systems.

Fix: Transition to passwordless authentication systems like biometrics or hardware tokens. At the very least, implement strong password policies with unique, randomized credentials.

Not Auditing Your Active Directory

Active Directory (AD) has been around for decades—and attackers have had just as long to study it. Without proper auditing, AD can become a treasure trove of exploitable misconfigurations, from weak Kerberos policies to stale accounts.

Golden Ticket attacks and Kerberoasting remain favorite techniques for breaching AD environments.

Fix: Regularly audit your AD configurations using tools like BloodHound, clean up stale accounts, and apply security baselines.

Delaying Patching for “Non-Critical” Systems

If 2024 taught us anything, it’s that attackers are relentless in exploiting overlooked vulnerabilities. Recent examples like the XZ Utils backdoor—a stealthy threat embedded in a widely used Linux library—and the Microsoft SharePoint remote code execution vulnerability (CVE-2024-38094) highlight how so-called “non-critical” systems can become entry points for devastating attacks.

Organizations often focus patching efforts on high-priority systems while neglecting internal tools, development environments, or IoT devices. This leaves the backdoor wide open for attackers, who are quick to exploit these vulnerabilities as stepping stones to escalate access or launch ransomware campaigns.

Fix: Automate patch management across all environments and prioritize updates based on risk exposure, not just perceived system importance. Comprehensive risk assessments must consider all potential entry points, even those that seem less critical, to mitigate these evolving threats effectively.

Underinvesting in Incident Response Testing

Having an incident response (IR) plan isn’t enough—it needs to be tested rigorously. Many organizations dust off their IR plans only after a breach occurs, only to discover glaring gaps or impractical steps.

The average breach lifecycle (the time to identify and contain a breach) is 277 days. Poorly tested IR plans can significantly extend this timeline.

Fix: Conduct regular tabletop exercises and red team/blue team simulations to refine your IR capabilities and response time.

Focusing on Compliance Over Actual Security

Compliance checkboxes don’t equal a secure environment. Many companies pour resources into meeting the bare minimum for standards like PCI DSS or SOC 2 without addressing broader security risks that fall outside compliance requirements.

Compliant systems have still fallen victim to breaches due to gaps in real-world defenses.

Fix: Treat compliance as a baseline and invest in advanced defenses like behavioral analytics, threat hunting, and continuous monitoring.

Wrapping Up

The cybersecurity landscape is brutal, but staying ahead requires more than good intentions. It demands vigilance, the willingness to adapt, and a commitment to fixing bad habits before attackers exploit them. As you review your IT security practices, ask yourself: Are you defending your organization—or just checking boxes.