Poor Security Practices

Poor security practices create internal threats through how staff use passwords, updates and logins. They are often accidental rather than deliberate, but they can still let an unauthorised person reach systems and data.

Passwords

A weak password is short or easy to guess, such as a pet's name or 123456, so someone can keep trying likely choices until one works. A shared password is used by several people for one login: if one person reveals it, everyone's access is exposed, and changes cannot be traced to an individual. An unprotected password is written on a note or saved where others can see it. For example, a shared login for a sports club's booking system means a volunteer who learns the password can sign in as the club secretary and change bookings.

Updates and open sessions

Security software and operating systems need updates because updates often fix known weaknesses. If staff ignore them, those weaknesses stay open and can be exploited to gain unauthorised access. Logging out matters because an open session lets the next person act as that user, which can include changing security settings.

Organisations reduce these risks with clear policies, strong password rules, automatic updates, screen locks and training.