![\"cybersecurity](\"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/gestion-de-crise-cybersecurite.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n\n- Neglecting security updates<\/a><\/li>\n\n\n\n
- Insufficient employee training<\/a><\/li>\n\n\n\n
- Weak or poorly managed passwords<\/a><\/li>\n\n\n\n
- Lack of an incident response plan<\/a><\/li>\n\n\n\n
- Unsecured mobile devices<\/a><\/li>\n\n\n\n
- Irregular data backups<\/a><\/li>\n\n\n\n
- Unsecured network access<\/a><\/li>\n\n\n\n
- Use of unauthorized software<\/a><\/li>\n\n\n\n
- Insufficient protection against phishing<\/a><\/li>\n\n\n\n
- Ineffective access rights management<\/a><\/li>\n\n\n\n
- Lack of encryption for sensitive data<\/a><\/li>\n\n\n\n
- Lack of network monitoring<\/a><\/li>\n\n\n\n
- Misconfiguration of cloud services<\/a><\/li>\n<\/ol>\n\n\n\n
Neglecting security updates<\/h2>\n\n\n\n
How many companies ignore security updates? Why? Sometimes due to lack of time, sometimes due to a poor understanding of the risks. Yet each update fixes vulnerabilities that can be exploited by cybercriminals<\/strong>.<\/p>\n\n\n\nHow to solve this issue? Automate updates and educate your teams! A good patch management policy should be clear, comprehensive, and include asset inventory. Always test patches before deployment and back up your systems. It’s a requirement, not an option<\/strong>.<\/p>\n\n\n\nInsufficient employee training<\/h2>\n\n\n\n\n- According to IBM, human error is involved in 95%<\/strong> of cybersecurity incidents. (Source: IBM Cyber Security Index<\/a>)<\/em><\/li>\n\n\n\n
- The 2025 Verizon report indicates that around 88%<\/strong> of incidents related to “Basic Web Application Attacks” involve compromised credentials. (Source: Verizon DBIR 2025<\/a>)<\/em><\/a><\/li>\n\n\n\n
- Each company surveyed by the Ponemon Institute for the 2020 edition of its \u201cCost of Insider Threats Global Report\u201d experienced at least one insider incident in the past 12 months. (Source: Ponemon Institute \u2013 2020 Cost of Insider Threats Report)<\/li>\n\n\n\n
- According to Cybersecurity Insiders, 74%<\/strong> of companies consider insider threats a growing risk. (Source: 2023 Cybersecurity Insiders<\/a>)<\/em><\/li>\n\n\n\n
- Although less quantified, incidents involving removable media such as USB drives are regularly reported by IT security managers.<\/li>\n\n\n\n
- A study by CybSafe reveals that over 90%<\/strong> of breaches reported to the ICO are due to human error. (Source: CybSafe 2020<\/a>)<\/em><\/li>\n\n\n\n
- According to Zurich.ch (updated 2025), one in three Swiss SMEs<\/strong> has already fallen victim to a cyberattack. (Source: zurich.ch<\/a>)<\/em><\/li>\n<\/ul>\n\n\n\n
<\/p>\n\n\n\n![\"updates](\"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/mise-a-jours-faille-securite.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Weak or poorly managed passwords<\/h2>\n\n\n\n
Simple or reused passwords expose your systems to major risks. A password like “123456” can be cracked in 37 seconds (source: SafetyDetectives<\/a><\/em>), and 80% of data breaches stem from this. (source: Jumcloud<\/a>) Cybercriminals exploit this negligence to access your critical data. A single compromised password can jeopardize your entire information system.<\/p>\n\n\n\n\n- Require at least 12 characters<\/strong> including uppercase, lowercase, numbers, and special characters<\/li>\n\n\n\n
- Ban password reuse<\/strong> across services to avoid contagion<\/li>\n\n\n\n
- Enable two-factor authentication<\/strong> (2FA) to enhance security<\/li>\n\n\n\n
- Use a password manager<\/strong> like Bitwarden or 1Password<\/li>\n\n\n\n
- Train your employees<\/strong> to create memorable but complex passphrases<\/li>\n<\/ul>\n\n\n\n
Lack of an incident response plan<\/h2>\n\n\n\n
Swiss companies without an incident response plan remain particularly vulnerable to cyberattacks.<\/strong> More and more Swiss businesses are facing cyber threats. In the past three years, 4% of SMEs have suffered a serious cyberattack. (Source: kmu.admin.ch<\/a>)<\/em> And 40% of them have no continuity or crisis management plan<\/strong>. (Source: focus.swiss<\/a>)<\/em> Without a clear strategy, response times increase, systems remain down longer, and the company\u2019s reputation can suffer greatly. Moreover, compliance with legal obligations \u2014 notably the new 2025 reporting requirement to the OFCS<\/strong> \u2014 may be compromised.<\/p>\n\n\n\nAn effective plan is based on four key steps: preparation, detection, containment, and recovery<\/strong>. It is essential to define roles, test procedures regularly through tabletop exercises and real scenarios, and keep the plan updated. Continuous employee training<\/strong> and monitoring security indicators<\/strong> strengthen resilience against incidents. The goal: limit the impact, protect data, and ensure quick business recovery<\/strong>.<\/p>\n\n\n\nUnsecured mobile devices<\/h2>\n\n\n\n
Smartphones and tablets used in the workplace are ideal entry points for cybercriminals<\/strong>. Identity theft via SMS, public Wi-Fi networks, or malicious apps can expose your data. A lost device without a password means full access to professional communications. Smishing (SMS phishing) is becoming increasingly common.<\/p>\n\n\n\nTo secure these devices, adopt an MDM solution such as Microsoft Intune. It enforces encryption, applies security policies (access code), and remotely wipes data if the device is lost. Enable file encryption for sensitive documents using BitLocker or FileVault. Raise awareness among your teams about the risks of public connections and suspicious attachments.<\/p>\n\n\n\n
<\/p>\n\n\n\n![\"mobile](\"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/le-mobile-comme-faille-de-securite.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Irregular data backups<\/h2>\n\n\n\n
Irregular backups expose your data to major risks. Ransomware even targets outdated backups. A 3-2-1 strategy<\/strong> (3 copies, 2 media types, 1 offline) is essential.<\/p>\n\n\n\nImplement a 3-2-1 strategy with frequent backups adapted to your business type (e-commerce vs. consultancy). Regularly test them through simulated restores. Prioritize encryption and immutable storage. The goal: recover your data intact<\/strong>, even after a major incident.<\/p>\n\n\n\nUnsecured network access<\/h2>\n\n\n\n
Remote connections open a backdoor for cybercriminals<\/strong>. In 2023, companies saw a surge in cyberattacks following the rise of remote work. Poorly secured Wi-Fi networks, weak passwords, and personal devices unmanaged by the company multiply vulnerabilities. A simple coffee shop with public Wi-Fi could cost your business dearly.<\/p>\n\n\n\nThere is a solution. Use a corporate VPN<\/strong> to encrypt data between device and server. Enable MFA (multi-factor authentication), which blocks 99% of intrusions. Microsoft Security provides tools to configure these protections. To learn more about secure network access, Microsoft solutions<\/a> offer a complete approach. Combine them with strong passwords and regular updates to secure your remote access.<\/p>\n\n\n\nUse of unauthorized software<\/h2>\n\n\n\n
Shadow IT refers to the phenomenon where employees use tools without IT approval. Why? Sometimes authorized software is slow or limited. Your staff wants to stay productive, but they unintentionally create security gaps. Dropbox, Google Drive, mobile apps\u2026 all pose risks to your data<\/strong>.<\/p>\n\n\n\nControl this issue with a clear policy on tool usage. Monitor with tools like Datto RMM or Nagios. Educate your teams about the risks. Offer useful alternatives to the unauthorized tools they rely on. It\u2019s a balancing act<\/strong> between security and productivity.<\/p>\n\n\n\nInsufficient protection against phishing<\/h2>\n\n\n\n
Has phishing evolved or remained a static threat? Attacks have changed, moving from generic emails to more targeted techniques like spear-phishing and BEC. Cybercriminals exploit social engineering<\/strong> and generative AI for highly effective campaigns. Remote work increases exposure, with employees more vulnerable outside the office. Companies must adapt their defenses.<\/p>\n\n\n\nWhat concrete solutions can strengthen your defenses? SMEs can deploy multi-factor authentication (MFA) to secure connections. Tools like Barracuda or Cofense use AI to detect phishing attempts. Raise team awareness through regular simulations. The DMARC protocol authenticates email senders, and simulated phishing tests assess employee vigilance. A proactive approach<\/strong> reduces the risk of compromise.<\/p>\n\n\n\n<\/p>\n\n\n\n![\"phishing](\"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/phishing.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Ineffective access rights management<\/h2>\n\n\n\n
Why does poor privilege assignment put your data at risk? Excessive access to HR services<\/strong> can expose sensitive information. Companies must control access systems to prevent data leaks.<\/p>\n\n\n\n\n- Apply the principle of least privilege<\/strong>: grant only the necessary access for each role<\/li>\n\n\n\n
- Perform regular access reviews<\/strong>: disable inactive or outdated accounts<\/li>\n\n\n\n
- Automate access management<\/strong> with tools like Microsoft Entra ID<\/li>\n\n\n\n
- Enable multi-factor authentication<\/strong> (MFA) for sensitive accounts<\/li>\n\n\n\n
- Monitor suspicious logins<\/strong> using real-time alert systems<\/li>\n<\/ul>\n\n\n\n
Hackers often exploit privileged credentials to infiltrate systems. Tools like Microsoft Entra ID<\/a> help minimize the risk. Strict access rights management<\/strong> significantly reduces critical vulnerabilities. Administrator training remains a cornerstone of any effective cybersecurity strategy.<\/p>\n\n\n\nLack of encryption for sensitive data<\/h2>\n\n\n\n
Unencrypted data is a goldmine for cybercriminals. Over 80% of security breaches involve poorly managed passwords. Customer information, accounting files, or patents must be encrypted. Without it, a simple stolen laptop could expose all your data. Your company\u2019s reputation and partnerships will suffer.<\/p>\n\n\n\n
To secure your data, several methods are available. BitLocker (Windows) or FileVault (macOS)<\/strong> encrypt hard drives. For SMEs, symmetric encryption (AES-256) is fast, while asymmetric (RSA) secures exchanges. Encrypt your local and in-transit files with tools like VeraCrypt. Train your teams on these best practices.<\/p>\n\n\n\n<\/p>\n\n\n\n![\"cybersecurity](\"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/erreurs-cybersecurite.png\")
<\/figure>\n\n\n\n<\/p>\n\n\n\n
Lack of network monitoring<\/h2>\n\n\n\n
Without active monitoring, anomalies such as a spike in DNS requests or suspicious ICMP traffic can go completely unnoticed. Yet, 1 in 3 Swiss SMEs experienced an attack between 2020 and 2023<\/strong>, and 73%<\/strong> of them reported significant financial losses. (Source: digitalswitzerland.com<\/em>) Poor network visibility can lead to delayed detection, with potentially high costs. On the other hand, real-time monitoring reduces response time by 40%<\/strong>, speeding up attack identification and mitigation. (Source: MoldStud<\/a>)<\/em><\/p>\n\n\n\nTools like Auvik or NinjaOne continuously monitor your infrastructure. They send alerts for unknown connections or traffic spikes. Microsoft Security Copilot<\/a> analyzes logs and detects threats before they spread. Set alert thresholds for off-hours access or repeated login attempts. Continuous monitoring helps quickly identify anomalies and limit consequences.<\/p>\n\n\n\nMisconfiguration of cloud services<\/h2>\n\n\n\n
Poor configuration in the cloud exposes your systems to major risks. According to Gartner, 80% of data breaches<\/strong> (source: Cloud Security Alliance<\/a>)<\/em> are caused by such errors: public S3 buckets, overly permissive access, or unsecured ports. These flaws, often due to lack of oversight, turn the cloud into a playground for cybercriminals.<\/p>\n\n\n\nTo secure your cloud services, apply the principle of shared responsibility. The provider manages the infrastructure, but you protect the data<\/strong>, access, and applications. Enable encryption, monitor IAM permissions, and conduct regular audits.<\/p>\n\n\n\nCommon cybersecurity mistakes like weak passwords, ignored updates, or lack of training put your data and business at risk. Act now: strengthen your systems, raise staff awareness, and adopt proactive strategies. Simple but rigorous vigilance can prevent severe cyberattacks and secure your digital future.<\/p>\n\n\n\n
FAQ<\/h2>\n\n\n\n
What are the 3 pillars of cybersecurity?
<\/strong>The three pillars are: cyber protection (preventing attacks), cyber defense (detecting and responding), and cyber resilience (quickly recovering after an incident). Together, they form a comprehensive strategy.<\/p>\n\n\n\nWhat are the top 5 cybersecurity threats?
<\/strong>Malware, ransomware, hackers, social engineering, and human error top the list. These threats target both technology and human behavior, making vigilance and training essential.<\/p>\n\n\n\nWhat type of cyberattack is most common?
<\/strong>Phishing remains the number one attack. These are deceptive emails mimicking trusted sources to steal data or install malware. It’s simple but highly effective.<\/p>\n\n\n\nWhat are the 5 Ps of cybersecurity?
<\/strong>People, Priorities, Prepare, Persist, Parallel pathways. These principles guide crisis management: engage the right people, prioritize actions, plan backups, stay determined, and be well prepared.<\/p>\n\n\n\nWhat cyber threats should we watch for in 2025?
<\/strong>Attacks are becoming more sophisticated: AI used by cybercriminals, targeted ransomware, hacking-as-a-service (CaaS), supply chain attacks, and vulnerabilities in connected devices.<\/p>\n\n\n\nSources:<\/h2>\n\n\n\n\n- IBM Cyber Security Index<\/a><\/li>\n\n\n\n
- Verizon DBIR 2025<\/a><\/li>\n\n\n\n
- Ponemon Institute \u2013 2020<\/li>\n\n\n\n
- Cybersecurity Insiders 2023<\/a><\/li>\n\n\n\n
- CybSafe 2020<\/a><\/li>\n\n\n\n
- Zurich Switzerland<\/a><\/li>\n\n\n\n
- SafetyDetectives<\/a><\/li>\n\n\n\n
- JumpCloud<\/a><\/li>\n\n\n\n
- Swiss SME Portal \u2013 SECO<\/a><\/li>\n\n\n\n
- Focus.swiss<\/a><\/li>\n\n\n\n
- digitalswitzerland<\/li>\n\n\n\n
- MoldStud<\/a><\/li>\n\n\n\n
- Cloud Security Alliance<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"
Many companies still make common cybersecurity mistakes. Whether it’s human negligence, outdated software, or the lack of an action plan, these weaknesses increase the risk of intrusion or data leakage. This article reviews the main vulnerabilities observed and offers practical recommendations to address them, including in a professional context. Summary Neglecting security updates How many […]<\/p>\n","protected":false},"author":112,"featured_media":140381,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[2915],"tags":[],"class_list":["post-140383","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ms-office"],"acf":[],"yoast_head":"\n
Common Cybersecurity Mistakes to Avoid - ITTA<\/title>\n<meta name=\"description\" content=\"Avoid common cybersecurity mistakes and protect your data from threats even in a business environment.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Damien Crocq\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/\"},\"author\":{\"name\":\"Damien Crocq\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#\\\/schema\\\/person\\\/ca875e6c61a8f6f224901d4b48e1494f\"},\"headline\":\"Common Cybersecurity Mistakes to Avoid\",\"datePublished\":\"2025-07-29T12:20:02+00:00\",\"dateModified\":\"2026-04-07T23:20:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/\"},\"wordCount\":1691,\"publisher\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/les-erreurs-en-cybersecurite.png\",\"articleSection\":[\"MS Office\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/\",\"url\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/\",\"name\":\"Common Cybersecurity Mistakes to Avoid - ITTA\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/les-erreurs-en-cybersecurite.png\",\"datePublished\":\"2025-07-29T12:20:02+00:00\",\"dateModified\":\"2026-04-07T23:20:00+00:00\",\"description\":\"Avoid common cybersecurity mistakes and protect your data from threats even in a business environment.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/les-erreurs-en-cybersecurite.png\",\"contentUrl\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2025\\\/07\\\/les-erreurs-en-cybersecurite.png\",\"width\":1200,\"height\":600,\"caption\":\"Les Erreurs En Cybersecurite\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/blog\\\/cybersecurity-mistakes-to-avoid\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.itta.net\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Common Cybersecurity Mistakes to Avoid\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.itta.net\\\/en\\\/\",\"name\":\"ITTA\",\"description\":\"Formations & Certifications en Suisse Romande\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.itta.net\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":[\"Organization\",\"EducationalOrganization\"],\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#organization\",\"name\":\"ITTA\",\"alternateName\":\"IT TRAINING ACADEMY SA\",\"url\":\"https:\\\/\\\/www.itta.net\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/Logo-transparent.png\",\"contentUrl\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2023\\\/02\\\/Logo-transparent.png\",\"width\":1500,\"height\":623,\"caption\":\"ITTA\"},\"image\":{\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/people\\\/ITTA\\\/100063747262936\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/1001738\",\"https:\\\/\\\/www.instagram.com\\\/itta_suisse\\\/\"],\"contactPoint\":{\"@type\":\"ContactPoint\",\"telephone\":\"+41 58 307 73 00\",\"contactType\":\"customer service\",\"availableLanguage\":[\"French\",\"English\"],\"areaServed\":[{\"@type\":\"Country\",\"name\":\"Switzerland\"},{\"@type\":\"Country\",\"name\":\"France\"}]},\"location\":[{\"@type\":\"Place\",\"name\":\"ITTA Geneve\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Route des Jeunes 35\",\"addressLocality\":\"Carouge\",\"postalCode\":\"1227\",\"addressRegion\":\"GE\",\"addressCountry\":\"CH\"},\"geo\":{\"@type\":\"GeoCoordinates\",\"latitude\":46.18274,\"longitude\":6.12922}},{\"@type\":\"Place\",\"name\":\"ITTA Lausanne\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Rue des Cotes-de-Montbenon 16\",\"addressLocality\":\"Lausanne\",\"postalCode\":\"1003\",\"addressRegion\":\"VD\",\"addressCountry\":\"CH\"},\"geo\":{\"@type\":\"GeoCoordinates\",\"latitude\":46.52111,\"longitude\":6.62734}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/en\\\/#\\\/schema\\\/person\\\/ca875e6c61a8f6f224901d4b48e1494f\",\"name\":\"Damien Crocq\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/damien-bio-1-100x100.jpg\",\"url\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/damien-bio-1-100x100.jpg\",\"contentUrl\":\"https:\\\/\\\/www.itta.net\\\/wp-content\\\/uploads\\\/2024\\\/04\\\/damien-bio-1-100x100.jpg\",\"caption\":\"Damien Crocq\"},\"description\":\"Damien est un professionnel dynamique, passionn\u00e9 par le marketing digital et le r\u00e9f\u00e9rencement naturel. Dipl\u00f4m\u00e9 d'un master en Web Marketing, il a acquis une solide exp\u00e9rience en e-commerce et a enseign\u00e9 sur des th\u00e9matiques de marketing digital. Aujourd'hui, il occupe le poste de sp\u00e9cialiste en marketing digital chez ITTA. Toujours curieux et innovant, Damien reste avant tout un passionn\u00e9 des technologies \u00e9mergentes, de l'informatique, de l'IA et du r\u00e9f\u00e9rencement naturel.\",\"sameAs\":[\"https:\\\/\\\/www.itta.net\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/damien-crocq\\\/?originalSubdomain=fr\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Common Cybersecurity Mistakes to Avoid - ITTA","description":"Avoid common cybersecurity mistakes and protect your data from threats even in a business environment.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/","twitter_misc":{"Written by":"Damien Crocq","Estimated reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#article","isPartOf":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/"},"author":{"name":"Damien Crocq","@id":"https:\/\/www.itta.net\/en\/#\/schema\/person\/ca875e6c61a8f6f224901d4b48e1494f"},"headline":"Common Cybersecurity Mistakes to Avoid","datePublished":"2025-07-29T12:20:02+00:00","dateModified":"2026-04-07T23:20:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/"},"wordCount":1691,"publisher":{"@id":"https:\/\/www.itta.net\/en\/#organization"},"image":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#primaryimage"},"thumbnailUrl":"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/les-erreurs-en-cybersecurite.png","articleSection":["MS Office"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/","url":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/","name":"Common Cybersecurity Mistakes to Avoid - ITTA","isPartOf":{"@id":"https:\/\/www.itta.net\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#primaryimage"},"image":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#primaryimage"},"thumbnailUrl":"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/les-erreurs-en-cybersecurite.png","datePublished":"2025-07-29T12:20:02+00:00","dateModified":"2026-04-07T23:20:00+00:00","description":"Avoid common cybersecurity mistakes and protect your data from threats even in a business environment.","breadcrumb":{"@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#primaryimage","url":"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/les-erreurs-en-cybersecurite.png","contentUrl":"https:\/\/www.itta.net\/wp-content\/uploads\/2025\/07\/les-erreurs-en-cybersecurite.png","width":1200,"height":600,"caption":"Les Erreurs En Cybersecurite"},{"@type":"BreadcrumbList","@id":"https:\/\/www.itta.net\/en\/blog\/cybersecurity-mistakes-to-avoid\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.itta.net\/en\/"},{"@type":"ListItem","position":2,"name":"Common Cybersecurity Mistakes to Avoid"}]},{"@type":"WebSite","@id":"https:\/\/www.itta.net\/en\/#website","url":"https:\/\/www.itta.net\/en\/","name":"ITTA","description":"Formations & Certifications en Suisse Romande","publisher":{"@id":"https:\/\/www.itta.net\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.itta.net\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":["Organization","EducationalOrganization"],"@id":"https:\/\/www.itta.net\/en\/#organization","name":"ITTA","alternateName":"IT TRAINING ACADEMY SA","url":"https:\/\/www.itta.net\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.itta.net\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.itta.net\/wp-content\/uploads\/2023\/02\/Logo-transparent.png","contentUrl":"https:\/\/www.itta.net\/wp-content\/uploads\/2023\/02\/Logo-transparent.png","width":1500,"height":623,"caption":"ITTA"},"image":{"@id":"https:\/\/www.itta.net\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/people\/ITTA\/100063747262936\/","https:\/\/www.linkedin.com\/company\/1001738","https:\/\/www.instagram.com\/itta_suisse\/"],"contactPoint":{"@type":"ContactPoint","telephone":"+41 58 307 73 00","contactType":"customer service","availableLanguage":["French","English"],"areaServed":[{"@type":"Country","name":"Switzerland"},{"@type":"Country","name":"France"}]},"location":[{"@type":"Place","name":"ITTA Geneve","address":{"@type":"PostalAddress","streetAddress":"Route des Jeunes 35","addressLocality":"Carouge","postalCode":"1227","addressRegion":"GE","addressCountry":"CH"},"geo":{"@type":"GeoCoordinates","latitude":46.18274,"longitude":6.12922}},{"@type":"Place","name":"ITTA Lausanne","address":{"@type":"PostalAddress","streetAddress":"Rue des Cotes-de-Montbenon 16","addressLocality":"Lausanne","postalCode":"1003","addressRegion":"VD","addressCountry":"CH"},"geo":{"@type":"GeoCoordinates","latitude":46.52111,"longitude":6.62734}}]},{"@type":"Person","@id":"https:\/\/www.itta.net\/en\/#\/schema\/person\/ca875e6c61a8f6f224901d4b48e1494f","name":"Damien Crocq","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.itta.net\/wp-content\/uploads\/2024\/04\/damien-bio-1-100x100.jpg","url":"https:\/\/www.itta.net\/wp-content\/uploads\/2024\/04\/damien-bio-1-100x100.jpg","contentUrl":"https:\/\/www.itta.net\/wp-content\/uploads\/2024\/04\/damien-bio-1-100x100.jpg","caption":"Damien Crocq"},"description":"Damien est un professionnel dynamique, passionn\u00e9 par le marketing digital et le r\u00e9f\u00e9rencement naturel. Dipl\u00f4m\u00e9 d'un master en Web Marketing, il a acquis une solide exp\u00e9rience en e-commerce et a enseign\u00e9 sur des th\u00e9matiques de marketing digital. Aujourd'hui, il occupe le poste de sp\u00e9cialiste en marketing digital chez ITTA. Toujours curieux et innovant, Damien reste avant tout un passionn\u00e9 des technologies \u00e9mergentes, de l'informatique, de l'IA et du r\u00e9f\u00e9rencement naturel.","sameAs":["https:\/\/www.itta.net","https:\/\/www.linkedin.com\/in\/damien-crocq\/?originalSubdomain=fr"]}]}},"_links":{"self":[{"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/posts\/140383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/users\/112"}],"replies":[{"embeddable":true,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/comments?post=140383"}],"version-history":[{"count":1,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/posts\/140383\/revisions"}],"predecessor-version":[{"id":238452,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/posts\/140383\/revisions\/238452"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/media\/140381"}],"wp:attachment":[{"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/media?parent=140383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/categories?post=140383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.itta.net\/en\/wp-json\/wp\/v2\/tags?post=140383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Neglecting security updates<\/h2>\n\n\n\n
How many companies ignore security updates? Why? Sometimes due to lack of time, sometimes due to a poor understanding of the risks. Yet each update fixes vulnerabilities that can be exploited by cybercriminals<\/strong>.<\/p>\n\n\n\n How to solve this issue? Automate updates and educate your teams! A good patch management policy should be clear, comprehensive, and include asset inventory. Always test patches before deployment and back up your systems. It’s a requirement, not an option<\/strong>.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Simple or reused passwords expose your systems to major risks. A password like “123456” can be cracked in 37 seconds (source: SafetyDetectives<\/a><\/em>), and 80% of data breaches stem from this. (source: Jumcloud<\/a>) Cybercriminals exploit this negligence to access your critical data. A single compromised password can jeopardize your entire information system.<\/p>\n\n\n\n Swiss companies without an incident response plan remain particularly vulnerable to cyberattacks.<\/strong> More and more Swiss businesses are facing cyber threats. In the past three years, 4% of SMEs have suffered a serious cyberattack. (Source: kmu.admin.ch<\/a>)<\/em> And 40% of them have no continuity or crisis management plan<\/strong>. (Source: focus.swiss<\/a>)<\/em> Without a clear strategy, response times increase, systems remain down longer, and the company\u2019s reputation can suffer greatly. Moreover, compliance with legal obligations \u2014 notably the new 2025 reporting requirement to the OFCS<\/strong> \u2014 may be compromised.<\/p>\n\n\n\n An effective plan is based on four key steps: preparation, detection, containment, and recovery<\/strong>. It is essential to define roles, test procedures regularly through tabletop exercises and real scenarios, and keep the plan updated. Continuous employee training<\/strong> and monitoring security indicators<\/strong> strengthen resilience against incidents. The goal: limit the impact, protect data, and ensure quick business recovery<\/strong>.<\/p>\n\n\n\n Smartphones and tablets used in the workplace are ideal entry points for cybercriminals<\/strong>. Identity theft via SMS, public Wi-Fi networks, or malicious apps can expose your data. A lost device without a password means full access to professional communications. Smishing (SMS phishing) is becoming increasingly common.<\/p>\n\n\n\n To secure these devices, adopt an MDM solution such as Microsoft Intune. It enforces encryption, applies security policies (access code), and remotely wipes data if the device is lost. Enable file encryption for sensitive documents using BitLocker or FileVault. Raise awareness among your teams about the risks of public connections and suspicious attachments.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Irregular backups expose your data to major risks. Ransomware even targets outdated backups. A 3-2-1 strategy<\/strong> (3 copies, 2 media types, 1 offline) is essential.<\/p>\n\n\n\n Implement a 3-2-1 strategy with frequent backups adapted to your business type (e-commerce vs. consultancy). Regularly test them through simulated restores. Prioritize encryption and immutable storage. The goal: recover your data intact<\/strong>, even after a major incident.<\/p>\n\n\n\n Remote connections open a backdoor for cybercriminals<\/strong>. In 2023, companies saw a surge in cyberattacks following the rise of remote work. Poorly secured Wi-Fi networks, weak passwords, and personal devices unmanaged by the company multiply vulnerabilities. A simple coffee shop with public Wi-Fi could cost your business dearly.<\/p>\n\n\n\n There is a solution. Use a corporate VPN<\/strong> to encrypt data between device and server. Enable MFA (multi-factor authentication), which blocks 99% of intrusions. Microsoft Security provides tools to configure these protections. To learn more about secure network access, Microsoft solutions<\/a> offer a complete approach. Combine them with strong passwords and regular updates to secure your remote access.<\/p>\n\n\n\n Shadow IT refers to the phenomenon where employees use tools without IT approval. Why? Sometimes authorized software is slow or limited. Your staff wants to stay productive, but they unintentionally create security gaps. Dropbox, Google Drive, mobile apps\u2026 all pose risks to your data<\/strong>.<\/p>\n\n\n\n Control this issue with a clear policy on tool usage. Monitor with tools like Datto RMM or Nagios. Educate your teams about the risks. Offer useful alternatives to the unauthorized tools they rely on. It\u2019s a balancing act<\/strong> between security and productivity.<\/p>\n\n\n\n Has phishing evolved or remained a static threat? Attacks have changed, moving from generic emails to more targeted techniques like spear-phishing and BEC. Cybercriminals exploit social engineering<\/strong> and generative AI for highly effective campaigns. Remote work increases exposure, with employees more vulnerable outside the office. Companies must adapt their defenses.<\/p>\n\n\n\n What concrete solutions can strengthen your defenses? SMEs can deploy multi-factor authentication (MFA) to secure connections. Tools like Barracuda or Cofense use AI to detect phishing attempts. Raise team awareness through regular simulations. The DMARC protocol authenticates email senders, and simulated phishing tests assess employee vigilance. A proactive approach<\/strong> reduces the risk of compromise.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Why does poor privilege assignment put your data at risk? Excessive access to HR services<\/strong> can expose sensitive information. Companies must control access systems to prevent data leaks.<\/p>\n\n\n\n Hackers often exploit privileged credentials to infiltrate systems. Tools like Microsoft Entra ID<\/a> help minimize the risk. Strict access rights management<\/strong> significantly reduces critical vulnerabilities. Administrator training remains a cornerstone of any effective cybersecurity strategy.<\/p>\n\n\n\n Unencrypted data is a goldmine for cybercriminals. Over 80% of security breaches involve poorly managed passwords. Customer information, accounting files, or patents must be encrypted. Without it, a simple stolen laptop could expose all your data. Your company\u2019s reputation and partnerships will suffer.<\/p>\n\n\n\n To secure your data, several methods are available. BitLocker (Windows) or FileVault (macOS)<\/strong> encrypt hard drives. For SMEs, symmetric encryption (AES-256) is fast, while asymmetric (RSA) secures exchanges. Encrypt your local and in-transit files with tools like VeraCrypt. Train your teams on these best practices.<\/p>\n\n\n\n <\/p>\n\n\n\n <\/p>\n\n\n\n Without active monitoring, anomalies such as a spike in DNS requests or suspicious ICMP traffic can go completely unnoticed. Yet, 1 in 3 Swiss SMEs experienced an attack between 2020 and 2023<\/strong>, and 73%<\/strong> of them reported significant financial losses. (Source: digitalswitzerland.com<\/em>) Poor network visibility can lead to delayed detection, with potentially high costs. On the other hand, real-time monitoring reduces response time by 40%<\/strong>, speeding up attack identification and mitigation. (Source: MoldStud<\/a>)<\/em><\/p>\n\n\n\n Tools like Auvik or NinjaOne continuously monitor your infrastructure. They send alerts for unknown connections or traffic spikes. Microsoft Security Copilot<\/a> analyzes logs and detects threats before they spread. Set alert thresholds for off-hours access or repeated login attempts. Continuous monitoring helps quickly identify anomalies and limit consequences.<\/p>\n\n\n\n Poor configuration in the cloud exposes your systems to major risks. According to Gartner, 80% of data breaches<\/strong> (source: Cloud Security Alliance<\/a>)<\/em> are caused by such errors: public S3 buckets, overly permissive access, or unsecured ports. These flaws, often due to lack of oversight, turn the cloud into a playground for cybercriminals.<\/p>\n\n\n\n To secure your cloud services, apply the principle of shared responsibility. The provider manages the infrastructure, but you protect the data<\/strong>, access, and applications. Enable encryption, monitor IAM permissions, and conduct regular audits.<\/p>\n\n\n\n Common cybersecurity mistakes like weak passwords, ignored updates, or lack of training put your data and business at risk. Act now: strengthen your systems, raise staff awareness, and adopt proactive strategies. Simple but rigorous vigilance can prevent severe cyberattacks and secure your digital future.<\/p>\n\n\n\n What are the 3 pillars of cybersecurity? What are the top 5 cybersecurity threats? What type of cyberattack is most common? What are the 5 Ps of cybersecurity? What cyber threats should we watch for in 2025? Many companies still make common cybersecurity mistakes. Whether it’s human negligence, outdated software, or the lack of an action plan, these weaknesses increase the risk of intrusion or data leakage. This article reviews the main vulnerabilities observed and offers practical recommendations to address them, including in a professional context. Summary Neglecting security updates How many […]<\/p>\n","protected":false},"author":112,"featured_media":140381,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[2915],"tags":[],"class_list":["post-140383","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ms-office"],"acf":[],"yoast_head":"\nInsufficient employee training<\/h2>\n\n\n\n
\n
<\/figure>\n\n\n\nWeak or poorly managed passwords<\/h2>\n\n\n\n
\n
Lack of an incident response plan<\/h2>\n\n\n\n
Unsecured mobile devices<\/h2>\n\n\n\n
<\/figure>\n\n\n\nIrregular data backups<\/h2>\n\n\n\n
Unsecured network access<\/h2>\n\n\n\n
Use of unauthorized software<\/h2>\n\n\n\n
Insufficient protection against phishing<\/h2>\n\n\n\n
<\/figure>\n\n\n\nIneffective access rights management<\/h2>\n\n\n\n
\n
Lack of encryption for sensitive data<\/h2>\n\n\n\n
<\/figure>\n\n\n\nLack of network monitoring<\/h2>\n\n\n\n
Misconfiguration of cloud services<\/h2>\n\n\n\n
FAQ<\/h2>\n\n\n\n
<\/strong>The three pillars are: cyber protection (preventing attacks), cyber defense (detecting and responding), and cyber resilience (quickly recovering after an incident). Together, they form a comprehensive strategy.<\/p>\n\n\n\n
<\/strong>Malware, ransomware, hackers, social engineering, and human error top the list. These threats target both technology and human behavior, making vigilance and training essential.<\/p>\n\n\n\n
<\/strong>Phishing remains the number one attack. These are deceptive emails mimicking trusted sources to steal data or install malware. It’s simple but highly effective.<\/p>\n\n\n\n
<\/strong>People, Priorities, Prepare, Persist, Parallel pathways. These principles guide crisis management: engage the right people, prioritize actions, plan backups, stay determined, and be well prepared.<\/p>\n\n\n\n
<\/strong>Attacks are becoming more sophisticated: AI used by cybercriminals, targeted ransomware, hacking-as-a-service (CaaS), supply chain attacks, and vulnerabilities in connected devices.<\/p>\n\n\n\nSources:<\/h2>\n\n\n\n
\n