'Best practices' and password changes remain key for avoiding cyber threats