Better-than-nothing security practices