Your first week at a new job is mostly noise. Paperwork, introductions, a laptop you have not customized yet, and about forty small questions you are saving up for whoever sits closest. Somewhere in the middle of that, you start making security decisions — usually without realizing you are making them.
Nobody expects a new hire to arrive with a security certification. But the habits you build in the first five days tend to stick, and they are far easier to build now than to retrofit after a near-miss. Here is what is worth getting right early, and what to do when something goes wrong.
Set Up Passwords Before You Do Anything Else
Your first instinct is probably to reuse the password you have used for years, because it is memorable and you are busy. Resist that. One reused password means a breach at some unrelated shopping site can become a breach at your employer, and you will be the one explaining how it happened.
Install the company password manager on day one and let it generate long, random credentials for every work account. If you prefer something you can actually type, use a passphrase of four or five unrelated words instead — harbor-cactus-lantern-ridge is both stronger and easier to remember than Summer2024!. What matters is length and uniqueness, not clever substitutions.
Two rules that never bend:
- Never share a credential, including with a colleague who is late for a deadline or a manager who is locked out. There is a process for that; use it.
- IT will not ask for your password. Legitimate support staff can reset your access without knowing it. Anyone requesting your password — by email, chat, or phone — is doing something they should not be.
Turn On MFA — and Read the Prompt Before You Approve
Multi-factor authentication is the single highest-value thing you can enable, and most companies now require it. Do not treat it as a formality. That approval prompt on your phone is the last line of defense between an attacker with your password and everything you can access.
The common attack is not sophisticated. Someone with a stolen password triggers repeated login attempts until your phone buzzes so often that you approve one just to make it stop. If a prompt arrives when you are not logging in, deny it and report it to your security team immediately — that password is compromised.
Set up more than one method while you are at it: an authenticator app plus backup codes stored somewhere offline, or a hardware key if your employer offers one. Losing your only MFA device on a travel day is a miserable way to spend an afternoon.
Device Hygiene: This Laptop Is Not Your Personal Computer
Small things on your work machine add up. A laptop that sleeps unlocked on a café table, a browser full of extensions you installed on a whim, an update postponed for three weeks — none of these are dramatic on their own. Together they are how a manageable incident becomes a serious one.
Spend fifteen minutes on these in week one:
- Set your screen to lock after five minutes and enable a lock shortcut. Windows: Windows key + L. Mac: Control + Command + Q. Use it every time you stand up.
- Confirm disk encryption is on — BitLocker on Windows, FileVault on Mac. It is usually enabled by default on managed machines, but check.
- Install updates when prompted. Reboots are annoying; a known unpatched flaw is worse.
- Do not install software outside your company's approved process, and be careful with browser extensions that request access to every site you visit.
- Keep work files off personal cloud drives, personal email, and USB sticks you found in a drawer.
Phishing Targets Your Judgment, Not Your Inbox Filters
Filters catch a lot, but the messages that reach you are the ones designed to look ordinary: an invoice from a supplier, a shared document notification, a note from your manager asking you to review something quickly. The tell is rarely a misspelling. It is the pressure.
Read the actual sending address, not the display name — a message can be labeled "IT Support" and come from anywhere. Hover over links before clicking, and remember that a page asking you to sign in again right after you signed in is worth a second look.
Three questions to ask about any request
- Does this make sense coming from this person, at this moment?
- Am I being pushed to act fast, keep it quiet, or skip a normal step?
- What happens if I verify it through a different channel — a phone call to a number I already have?
If the answer to the second question is yes, slow down and verify. A thirty-second phone call has never damaged anyone's reputation. Approving a fraudulent payment has.
Handle Data as If It Is Not Yours, Because It Is Not
Ask your manager or security contact how your company classifies data — public, internal, confidential, restricted — and where each kind is allowed to live. Then apply one habit: share deliberately.
Send links to specific people instead of attaching files to a wide distribution list. Check permissions before you share a folder, especially settings like "anyone with the link." Revoke access when a project ends. Do not paste customer records, credentials, or internal documents into unapproved web tools or personal storage accounts, no matter how convenient the tool is. Screenshotting sensitive information onto a personal phone is the same problem in a different shape.
Also keep your desk reasonable. Printed contracts left on the office printer, a whiteboard full of client names in a meeting room, a sticky note with a password under your keyboard — these are all small leaks that require no hacking at all.
If Something Goes Wrong, Report It Immediately
Everyone clicks something they should not, eventually. What separates a minor incident from a serious one is how quickly it gets reported. Call or message your security team right away, describe what happened honestly, and then stop touching the machine — do not reinstall anything, do not start deleting messages, and do not try to fix it alone. Preserving the evidence helps far more than tidying up.
Expect no punishment for reporting. Security teams genuinely prefer a five-minute conversation on day three over a forensic investigation in month six. Change the affected password from a different, trusted device, and follow whatever steps you are given.
Your first week is also a reasonable time to ask who to contact, how to reach them out of hours, and where to find your company's security policy. Knowing those three things before you need them is the whole point.
Photo: SnapwireSnaps / Pixabay
