lax cyber security practices