Cyber Hygiene at Work & Home

October 16, 2025

Practical Habits That Protect Your People, Your Data, and Your Peace of Mind

Since the Covid Pandemic in 2020, it’s been proven time and again that the boundary between work and home is thin. Your “office” might be a kitchen table. Your “help desk” might be your teenager asking for the Wi-Fi password. And while we like to think that security is something handled by IT or left to our antivirus, the truth is simpler. It’s your daily habits: at work and at home. They can decide whether attackers get a foothold.

Below is a field-tested guide to cyber hygiene that treats all aspects of your life with the reality that they are all connected. Use it to harden the places you click, type, scan, and share, no matter where you are.

Step 1: Start with the “Big Four” (everywhere you log in)

Multi-Factor Authentication (MFA)

Turn on MFA for every important account. It adds a second proof (app prompt, code, or security key) so a stolen password alone won’t grant access.

Strong, Unique Passwords (via a Password Manager)

Use a password manager to generate and store long, unique passwords for each site. This prevents one breach from unlocking multiple accounts.

Relentless Updates (OS, Apps, Browsers, Firmware)

Keep everything current—laptops, phones, browsers, and even routers/IoT. Updates patch known flaws attackers actively exploit.

Phishing Awareness & Reporting

Slow down on links and attachments. Verify unusual requests on a separate channel and report suspicious emails/messages to IT.

Go one level deeper: choose phishing-resistant MFA

Not all MFA is equal. SMS codes and push prompts can be bypassed (push fatigue, SIM swaps). Where available, use FIDO2/WebAuthn security keys or passkeys for phishing-resistant authentication (CISA).

Passkeys = fewer headaches, more security

Passkeys use public-key cryptography, so there’s nothing reusable for criminals to steal or phish—and they’re now supported across major platforms. If a site offers passkeys, turn them on (FIDO Alliance).

Step 2: Treat your home like a branch office

Attackers don’t care if they land on a CFO’s laptop or a teenager’s tablet, both act as launchpads to your data.

Segment your Wi-Fi

Create separate networks for primary devices, guests, and IoT (cameras, TVs, smart speakers). This limits blast radius if one thing gets infected. At minimum: Primary, Guest, and IoT SSIDs (U.S. Department of War).

Harden the router

Change default passwords, disable WPS, enable WPA3/WPA2, update firmware, and hide/rename default SSIDs that leak your router model (CISA).

Update edge devices

Firewalls, routers, VPN gateways, and internet-facing boxes need regular patching—treat them like crown jewels, not appliances (CISA).

Family reality check

Kids and elders are prime targets because they’re helpful and curious. Set up non-admin accounts, turn on automatic updates, and require approval for new installs. Teach a simple rule: no scanning random QR codes. EVER! QR-based phishing (“quishing”) is rising—from stickers on parking meters to QR codes sent in the mail.

Step 3: Close the “human gaps” at work

Technology can’t save us from workflows that reward speed over safety.

Slow down where it counts

Clicking a link, approving an MFA prompt, or running an attachment is a risk decision. If something feels rushed or emotional, pause and verify on a separate channel.

Defend against MFA fatigue

Never approve a push you didn’t initiate; report repeated prompts to IT. Ask your org to move critical apps to phishing-resistant MFA (CISA).

Kill shadow IT kindly

People use unsanctioned tools to get work done. Offer safe, approved alternatives—and make them easier than the workaround.

Separate identities and browsers

Use different browser profiles (or separate browsers) for corporate vs. personal accounts to avoid cross-contamination of cookies, extensions, and autofill.

Step 4: Five Pillars of Cyber Hygiene (with “Work” and “Home” plays)

Think of these as your daily vitamins—boring, effective, non-negotiable.

Identity

Work: Require MFA everywhere; prefer FIDO2 keys or platform passkeys for high-risk roles. Review admin privileges quarterly (CISA).

Home: Use a password manager for everyone in the house. Turn on passkeys where offered. Store account recovery codes securely (not in your email) (CISA).

Devices

Work: Enforce OS/browser/driver updates. Block unsigned macros; restrict USB media.

Home: Auto-update everything. On kids’ devices, require approval for new apps and in-app installs. Back up photos/docs to a service or external drive (3-2-1 rule).

Network

Work: Patch edge devices; audit remote access and VPN portals; disable unused services (CISA).

Home: Separate SSIDs: Primary | Guest | IoT. Change router defaults; update firmware; prefer WPA3 (U.S. Department of War).

Applications

Work: Maintain an allow-list of approved software and browser extensions. Monitor OAuth app grants to corporate accounts.

Home: Delete apps you don’t use. In browsers, keep extensions minimal and reputable; disable third-party cookies; use separate profiles for kids.

People

Work: Run short, contextual training (60–90 seconds) tied to real incidents: “Why this phish worked,” “How that MFA prompt slipped through,” etc.

Home: Have a five-minute family drill: “If a pop-up says we’re infected, what do we do?” (Answer: close the browser, don’t call numbers, tell an adult.)

Step 5: A 15-Minute Monthly Tune-Up

Set a recurring reminder synced to all your devices will help and knock these out

Update all devices (phones, laptops, tablets, routers, smart TVs).

Review your password manager for weak/reused passwords; rotate any shared family passwords. (CISA)

Check bank and email alerts (sign-ins, transfers, forwarding rules).

Audit browser extensions and remove anything you don’t use.

Test backups by restoring a file (don’t wait for an emergency).

Step 6: If you slip (because we all do)

At work: Unplug from the network if malware is suspected; call IT; do not try to “clean it” yourself; preserve evidence (timestamps, screenshots).

At home: Power down the affected device; change important account passwords from a different device; call your bank if credentials were exposed; reset router and update firmware; reinstall OS if necessary.

If you scanned a suspicious QR code or clicked a fake login: reset any password, you entered and revoke OAuth sessions for the affected app. Watch for new MFA prompts you didn’t initiate.

The Takeaway

Cyber hygiene isn’t a fancy toolkit; it’s a set of small, repeatable habits your whole circle can manage. Enable MFA that resists phishing. Use passkeys when available. Update relentlessly. Segment the home network. Slow down on links, attachments, QR codes, and MFA prompts. These are the same moves that security teams recommend, because they meaningfully cut risk at work and at home (IT Services).

Do this now, and when Clean Out Your Computer Day rolls around next February, you’ll be cruising through a short, satisfying tune-up instead of tackling a backlog.

Finally, the next time a child asks for your phone at dinner or a relative forwards a “too-good-to-be-true” link, remember: YOU may be the gateway (for better or worse).

Make the safer choice first.