IT Security Basics or Hygiene

Most breaches I’ve seen up close were not the result of some exotic zero-day or a nation-state actor with unlimited budget. They came from a patch that was postponed, an account without MFA, a backup nobody had actually tested. Hygiene work is boring, it never makes a good conference talk, and it rarely gets budget on its own. It is also the single biggest lever you have. Get the basics right and you remove most of the attack surface before anyone even needs a fancy tool to defend it.

Once someone said theses basics building blocks or practices of IT Security can be named as IT Security Hygiene. (credits to him).

Chasing the shiny stuff

A lot of organizations want to talk about red and blue teams, threat intelligence feeds, AI security, chaos engineering for security. These are all legitimate, useful things, once you actually have something solid to point them at. But I keep seeing budget and headcount go there first, while nobody can answer a simple question like “which of our admin accounts don’t have MFA” or “do we actually know if last week’s backup restores.” A red team exercise on an environment with no patch discipline and no asset inventory just finds the same basic gaps a checklist would have found for a fraction of the cost, dressed up as a sophisticated finding. The advanced stuff is not wrong to want, it’s just the wrong thing to want first. Basics are not fancy, but they are the floor everything else stands on.

The basics, by category

If it helps to make it concrete, here is what “the basics” actually breaks down into, and what being in control of each one really means in practice.

Inventory

You cannot secure what you don’t know you have. This means a current, accurate list of devices, servers, cloud resources, SaaS subscriptions, and every account with elevated access, not a spreadsheet from eighteen months ago. It means a process for adding new assets to that list the moment they’re provisioned, and removing or flagging anything nobody can explain the purpose of. Shadow IT and forgotten test systems live in the gap between “we think we know” and “we actually checked.”

Patch and vulnerability management

A defined cadence for applying security patches, not “whenever someone gets to it.” Regular vulnerability scans against your own inventory, so gaps get found by you before they get found by someone else. A real answer for systems that can no longer be patched, end-of-life software, unsupported firmware, because “we know about it and accepted the risk” is a very different position than “we didn’t know.”

Change management

Every change to production, infrastructure, configuration, access, goes through some form of review and gets logged, even a lightweight one. Not bureaucracy for its own sake, but so that when something breaks or looks suspicious, you can actually tell what changed, who changed it, and whether it was supposed to happen. Undocumented, untracked changes are exactly where both outages and intrusions hide.

Identity and access management

MFA on everything that can support it, no permanent exceptions quietly carried forward for years. Access granted based on what a role actually needs, not what’s convenient to hand out. A periodic review that actually revokes access nobody uses anymore, especially for people who changed roles or left. Most environments don’t have a permissions problem because of one bad decision, they have one because of hundreds of small, never-revisited ones.

Logging and monitoring

Logs centralized somewhere an attacker can’t quietly delete them from the moment they get a foothold. Enough retention to actually investigate something that gets noticed weeks later, not days. And, critically, someone whose job it is to actually look at what the logs are saying, alerts nobody reads are not meaningfully different from no logging at all.

Conclusion

None of this is exciting, and none of it will get you a headline. But security is much more often lost to a skipped basic than to a sophisticated attack. Buying more tools, or standing up more advanced capabilities, on top of shaky hygiene just adds noise to monitor and cost to justify, it does not fix the gaps that were already there. Get the six categories above solid first. The fancy stuff can wait, and it will be far more effective once it has fundamentals to build on.