A business should manage passwords with a written policy, a password manager, multi-factor authentication and regular staff training. Weak, shared or stolen passwords are one of the easiest ways into a company. Fast Response IT explains below how passwords are compromised and what to do about it.
Why are passwords still a risk?
A password is a secret that grants access. If it is weak, shared or captured by an attacker, that access is open to anyone holding it. Passwords remain the main way people sign in to most business systems, so managing them well reduces risk across the board.
How do cybercriminals get passwords?
There are four common routes.
Malware
Malware designed to steal data can record what a user types and send usernames and passwords to an attacker. A single infected device can expose many accounts.
Data breaches
When a website or service is breached, stolen email and password pairs are often traded or tested against other sites. If staff reuse a password, a breach at an unrelated service can become a breach of your business accounts.
Phishing
Phishing is a common method of stealing credentials. Fake messages and login pages trick people into typing their details. Administrators and other privileged users are especially valuable targets, which makes targeted phishing a particular risk for them.
Accidental exposure
Staff share passwords, write them down or reuse them. Accounts also stay open after someone leaves. These are ordinary habits, not bad intentions, and they are fixable with policy and tools.
What should a password policy include?
A password policy turns good intentions into consistent practice. At minimum, cover:
- How passwords should be created, with a preference for length over complexity.
- Where passwords may be stored and how.
- When a password must be changed, such as after a suspected compromise.
- Rules on sharing, and how to share access safely when a team needs it.
- What to do when a device is lost or an account looks compromised.
Share the policy with everyone, explain the reasons behind it and, where possible, enforce it through your systems rather than relying on memory.
Should you use a password manager?
A password manager is one of the most effective steps you can take. You remember one master password, and the manager generates, stores, fills and updates the rest. The vault is encrypted using that master password.
This reduces password fatigue, which is the main reason people reuse and share passwords. Cloud-based managers are usually easier to deploy and manage across a team. Look for one that works across your operating systems, supports shared business credentials and lets an administrator manage access.
How does multi-factor authentication help?
Multi-factor authentication asks for a second proof of identity, such as a code or approval on a phone, as well as the password. A stolen password alone then is not enough to get in.
It is not perfect. Attackers have methods to get around it, for example by tricking users into approving a prompt. Treat it as one important layer, together with strong unique passwords and training, not a replacement for them.
How do you train staff to spot phishing?
Show people what phishing looks like and make reporting easy and blame-free. Awareness training works best when it is regular and uses realistic examples relevant to each role. Simulated phishing exercises can help you see where more training is needed and how it is improving.
Our guide to cyber attacks small businesses should know about covers the wider threats these habits help to prevent.
What about people who leave?
Make account removal part of your leaver process. Disable accounts, revoke shared credentials, remove access to cloud services and retrieve devices. Review periodically for accounts that nobody owns any more.
What is a sensible set of next steps?
- Write a short password policy and share it.
- Roll out a password manager to everyone.
- Turn on multi-factor authentication for email, cloud services and remote access.
- Run short awareness sessions twice a year and after any incident.
- Add a leaver checklist.
Passwords will be part of business life for some time, so it is worth managing them well. Fast Response IT supports this as part of our cyber security services.
What makes a strong password?
Length matters more than clever substitutions. A long passphrase made of several unrelated words is stronger and easier to remember than a short string of symbols. Each account should have its own unique password, so one breach cannot open the others.
Avoid obvious choices such as names, dates and common words, and never reuse a business password on a personal site. If you use a password manager, let it generate long random passwords for you and keep memorable passphrases for the few you must type, such as the manager's master password and your device login.
Where should shared logins be kept?
Some systems still need a shared login. Keep these in the password manager's shared area, not in spreadsheets, notes or messages, and limit access to those who need it. Change the password when someone with access leaves, and record who uses each shared account.
What should you do next?
Ask yourself two questions: could you list every shared login your business uses, and could you remove a former employee's access in an hour. If either answer is no, start with the cyber risk check below.
Questions we get asked
Should my business use a password manager?
Yes, in most cases. A password manager creates and stores strong, unique passwords so staff only need to remember one master password. It reduces reuse and sharing. Choose one that works across your devices, supports business sharing and can be managed centrally.
Is multi-factor authentication enough on its own?
No. It adds an important layer, but some attacks can bypass it, for example by tricking a user into approving a prompt. Use it together with strong unique passwords, staff awareness and prompt removal of access for people who leave.
How often should staff change passwords?
Current guidance generally favours long, unique passwords that change when there is a reason, such as a suspected compromise, rather than frequent forced changes. Your policy should state what applies in your business. Fast Response IT can help you set one that fits your systems.
What should we do when a staff member leaves?
Disable their accounts promptly, remove access to shared passwords and cloud services, and review which devices they hold. A checklist for leavers prevents old accounts remaining open, which is a common and avoidable risk. Do this on the day they leave, not weeks later, and record that it was done.