Cyber Hygiene Best Practices

Cyber Hygiene is a set of best practices users should follow to improve the safety and security of their devices.

For detailed information on minimum security standards for Servers, Endpoint, and Multi-Function Devices based on UH Institutional Data Category type (Public, Restricted, Sensitive, and Regulated), please visit the following page: https://www.hawaii.edu/infosec/minimum-standards/

When working with Regulated Data, please refer to the applicable Standard, Act, or Policy (e.g., CMMC, PCI DSS, HIPAA, FERPA, NIST SP800-171, etc.) for specific details on any additional controls needed.

Best Practice Description References
1 Anti-Malware Software and Host Based Firewalls

Install Anti-Malware software and ensure its signatures are regularly updated. Anti-Malware software is a key protective measure to detect, quarantine, and remove various types of malware.

Trellix (formerly McAfee) antivirus software is licensed by the University of Hawaiʻi (UH), Information Technology Services (ITS) site license for use by active UH faculty, staff, and students: https://www.hawaii.edu/askus/1254

In addition to Anti-Malware software, most modern operating systems have built-in Host-Based Firewalls. These firewalls run directly on your device, offering an extra layer of defense against network-based cyberattacks. Ensure your firewall is always active and properly configured to enhance your overall security.
2 Regularly Update Software Regular software updates are among the most effective steps to strengthen your cybersecurity. This includes updates for operating systems, firmware, patches, and security fixes. Most software now automatically checks for updates, so ensure this feature is enabled to keep your systems protected.
  • CISA.gov Security Tip Understanding Patches and Software Updates: https://www.cisa.gov/news-events/news/understanding-patches-and-software-updates
  • ITS MSS 7.3 – Perform Automated Operating System Patch Management (CIS Control 7.3)
  • ITS MSS 7.4 – Perform Automated Application Patch Management (CIS Control 7.4)
  • ITS MSS 9.1 – Ensure Use of Only Fully Supported Browsers and Email Clients (CIS Control 9.1)
3 Multi-Factor Authentication

Multi-Factor Authentication (MFA) is required for all UH users when accessing UH resources. MFA adds an extra layer of security beyond just a username and password, requiring a second factor—like your smartphone—to log in. This significantly reduces the risk of unauthorized access, as attackers would need both your password and the second factor to succeed.

ITS supports the use of MFA. Please visit the following sites for further information on MFA and how to set it up:
  • UH Login: http://www.hawaii.edu/its/uhlogin/
  • Getting setup for Multi-Factor Authentication (MFA): https://www.hawaii.edu/askus/1758
  • ITS MSS 6.3 – Require MFA for Externally-Exposed Applications (CIS Control 6.3)
  • ITS MSS 6.4 – Require MFA for Remote Network Access (CIS Control 6.4)
  • ITS MSS 6.5 – Require MFA for Administrative Access (CIS Control 6.5)
4 Set Strong Passwords

If your password has been compromised or exposed in a data breach, NEVER reuse it on any other account. Reusing compromised passwords significantly increases the risk of further security breaches.

Strong passwords are key to protecting unauthorized access. Best practices include:

With the use of Multi-Factor Authentication:

  • Passwords must be 8-32 characters long; and
  • Passwords contain one uppercase character, one lowercase character, one number, and one special character.

Without Multi-Factor Authentication:

  • Passwords must be 14-32 characters long;
  • Passwords contain one uppercase character, one lowercase character, one number, and one special character;
  • Passwords should expire every 365 days or less. For passwords compromised or exposed, you must change this password immediately;
  • Password history of at least the last 10; and
  • Devices unable to meet these best practices (e.g. Multi-Function Devices, Network Devices, Legacy Systems, etc.) should have password settings at the maximum complexity allowed by the system.

Additional best practices include:

  • Change all default passwords. These pre-configured passwords usually have administrator level privileges and are readily known on the internet.
  • Do not use the same password with multiple accounts.

Password Managers:

  • Password managers can help you generate, store, and manage long, complex passwords for each of your accounts.
  • The only way to access your password vault is by using one strong master password, which greatly reduces the amount of information you need to remember and protect.
  • The following article discusses the use of password managers: https://www.hawaii.edu/infosec/resources-tips/password-manager/
5 Use Encryption

Data is stored across various devices, including desktops, laptops, and removable storage media like USB drives, external hard drives, and CDs/DVDs. Sensitive information requires extra care. Encryption is a critical method for safeguarding this data, ensuring that the information remains secure even if accessed by unauthorized individuals.

The following article discusses the encryption options available: https://www.hawaii.edu/infosec/resources-tips/encryption/

When sending files, consider using the UH File Drop service: https://www.hawaii.edu/filedrop/
6 Back Up Your Data Regularly back up your data to removable media or a cloud-based service like Google Drive. Ensure that your backups are encrypted to protect your information. Regular backups are essential to recover your data in case of corruption, loss, theft, or other failures.
  • CISA.gov Home Network Security Tips: https://www.cisa.gov/news-events/news/home-network-security
  • ITS MSS 11.2 – Perform Automated Backups (CIS Control 11.2)
  • ITS MSS 11.3 – Protect Recovery Data (CIS Control 11.3)
  • ITS MSS 11.4 – Establish and Maintain an Isolated Instance of Recovery Data (CIS Control 11.4)
7 Lock your Devices Always lock your device when stepping away, requiring a password to regain access and preventing unauthorized access. Configure your device to automatically lock after 10 minutes or less of inactivity. When you’re finished working for the day, consider shutting down your workstation or, at a minimum, log out.
8 Limit the use of Administrative Accounts

Administrative accounts have elevated privileges, allowing actions that standard user accounts cannot perform, such as installing software, disabling anti-malware programs, managing user accounts, and controlling services.

If a standard (non-privileged) account is compromised, the potential damage is usually limited. The best practice is to use a non-privileged account for everyday activities like browsing the internet and checking email. When you need to perform administrative tasks, log in with an administrative account and log out immediately after completing the task.
  • ITS MSS 4.7 – Manage Default Accounts on University Assets and Software (CIS Control 4.7)
  • ITS MSS 5.2 – Restrict Administrator Privileges to Dedicated Administrator Accounts (CIS Control 5.4)
9 Recognize Phishing

Phishing is one of the most common and straightforward methods attackers use to compromise your device and steal sensitive information. Follow these best practices to reduce your risk:

  • Never open links or attachments in emails that seem suspicious or are from unknown sources.
  • Hover over links to verify they lead to legitimate sites before clicking.
  • Be cautious of poorly worded emails with misspellings, as these are common signs of phishing attempts.

For more details, please visit the following:
10 Mobile Device Security

Mobile devices require strong cyber hygiene practices due to their portability and everyday use. In addition to general best practices:

  • Set a secure PIN or password.
  • Keep your device’s operating system up to date with the latest patches.
  • Only install apps from trusted sources like the Apple App Store or Google Play.
  • Limit the amount of sensitive information stored or transmitted on your device.
  • Consider using encryption, as mobile devices are at higher risk of being lost or stolen due to their size.
11 Internet of Things (IoT) Devices

CISA.gov refers to the Internet of Things (IoT) as any “object or device that sends and receives data automatically through the Internet. This rapidly expanding set of “things” includes tags (also known as labels or chips that automatically track objects), sensors, and devices that interact with people and share information machine to machine.”

Common IoT devices include Network Attached Storage (NAS), sensors like temperature readers, Universal Plug and Play (UPnP) devices, and IP-based devices such as routers, cameras, and printers.

Given the increasing prevalence of IoT devices in both work and home environments, this section will explore the associated risks, best practices, and how various Cyber Hygiene Best Practices (CHBP) can work together to reduce the risk exposure of these devices.

Risks

  • Data Exfiltration: Attackers often target IoT devices to steal sensitive data. This is especially concerning if you store UH Institutional Data at the Protected level (Restricted, Sensitive, Regulated) on these devices.
  • Botnet Involvement: A compromised IoT device can become part of a botnet, which can be used to launch further attacks.
  • Additional Malicious Activity: Compromised IoT devices are frequently used to target other computers or devices, leading to further malicious actions.

Best Practices

When considering IoT devices for work or home, lacking these basic security features significantly increases the risk of compromise:

  • Strong Passwords (CHBP #4): Always set strong, unique passwords for your IoT devices. Many devices come with default passwords that are widely known and easily exploitable.
  • Evaluate Security Settings: Enable security options that enhance protection, such as encryption (CHBP #5), activating the device firewall (CHBP #1), disabling unnecessary features, and requiring strong authentication (e.g., username and strong password) for access.
  • Keep the Device Updated (CHBP #2): Regularly update the device’s software and firmware from the manufacturer to patch vulnerabilities.
  • Connect Only When Necessary:
    • Assess whether the device truly needs to be connected to the internet. Once online, it becomes susceptible to scans for vulnerabilities, misconfigurations, and weak or default credentials.
    • If a connection is necessary, place the device behind a firewall.
    • Whenever possible, connect the device to the network only when needed to perform specific functions and disconnect it once those tasks are completed.
  • Create an Inventory: Maintain an inventory of all IoT devices to keep track of what is connected to your network.
  • Physical Security: If the device is accessible to the public, ensure that it, along with its ports and cables, is protected against tampering.
  • CISA.gov Security Tip Securing the Internet of Things: https://www.cisa.gov/news-events/news/securing-internet-things-iot
  • From Homes to the Office: Revisiting Network Security in the Age of the IoT: https://www.trendmicro.com/vinfo/au/security/news/internet-of-things/from-homes-to-the-office-revisiting-network-security-in-the-age-of-the-iot
  • ITS MSS 1.1 – Establish and Maintain Detailed University Asset Inventory (CIS Control 1.1)
  • ITS MSS 3.5 – Encrypt Institutional Data on End-User Devices (CIS Control 3.6)
  • ITS MSS 3.7 – Encrypt Institutional Data on Removable Media (CIS Control 3.9)
  • ITS MSS 3.8 – Encrypt Institutional Data in Transit (CIS Control 3.10)
  • ITS MSS 3.9 – Encrypt Institutional Data at Rest (CIS Control 3.11)
  • ITS MSS 4.1 – Establish and Maintain a Secure Configuration Process (CIS Control 4.1)
  • ITS MSS 4.4 – Implement and Manage a Firewall on Servers (CIS Control 4.4)
  • ITS MSS 4.5 – Implement and Manage a Firewall on End-User Devices (CIS Control 4.5)
  • ITS MSS 4.7 – Manage Default Accounts on University Assets and Software (CIS Control 4.7)
  • ITS MSS 4.8 – Uninstall or Disable Unnecessary Services on University Assets and Software (CIS Control 4.8)
  • ITS MSS 7.3 – Perform Automated Operating System Patch Management (CIS Control 7.3)
  • ITS MSS 7.4 – Perform Automated Application Patch Management (CIS Control 7.4)