10 critical security habits you should be doing (but aren't)