Cyber hygiene for executives: seven decisions you make once

Seven decisions

• Two-factor authentication on email and messengers — via an app or a hardware key, not an SMS code.
• Different passwords for work and personal services, kept in a password manager rather than in phone notes.
• A separate address for financial and legal services, never used in correspondence or on websites.
• A second-channel rule: any request to move money or change payment details is confirmed by voice on a known number.
• A backup of your working data that you have restored and checked at least once.
• A review of access rights after departures and role changes — by calendar, not from memory.
• Knowing who to call in the first hours of an incident, before it happens.

Why the second-channel rule beats antivirus

The most common financial loss scenario requires no hacking at all: an email or message in the executive's name asking for an urgent payment to new details. Its credibility comes from urgency, hierarchy and details taken from open sources.

Technology does little against that scenario; confirmation on a second channel works. The rule has to be announced in advance and applied to the executive as well: a member of staff must have the explicit right to call the director back and check.

Personal and work

Separating personal and work digital environments is not a formality. A compromised personal social media account becomes a corporate incident precisely when it gives access to work correspondence or password resets.

What this does not replace

Personal cyber hygiene does not replace managing information risk in the company: policies, access segregation, supplier management and incident readiness. It closes the part that depends on you personally.

Sources

• Bureau RM practice in information security and cyber risk. General information only; not a technical recommendation for a specific infrastructure.

All articles · Editorial policy