What are the main security practices every IT professional should follow?

Identity — where most attacks now begin:

• Multi-factor authentication everywhere, especially on remote access, email, and administrative accounts. This single control blocks the large majority of credential attacks.
• Least privilege. Users are not local administrators; administrators use a separate account for privileged work and a normal one for email and browsing.
• Prompt deprovisioning when people leave, ideally automated from HR.

Systems:

• Patch on a defined cycle, prioritising internet-facing systems and actively exploited vulnerabilities.
• Change all default credentials and disable unused services and accounts.
• Disable legacy protocols — SMBv1, TLS 1.0, and Telnet.
• Encrypt disks on laptops and mobile devices.

Network: segment so a compromise in one area does not reach everything; never expose RDP or SMB to the internet; and use a VPN or zero trust access for remote work.

Detection and recovery: centralised logging that an attacker cannot delete, endpoint detection, and tested backups that are immutable or offline.

People: phishing awareness training measured on reporting rate rather than click rate, and a culture where reporting a mistake is safe.

Note: Say that security is now part of every IT role rather than a separate team's problem. The most common breaches exploit basic gaps — an unpatched server, a missing MFA, a default password — not sophisticated attacks.