Passwords and second factor: the first thing to fix in a business
Every incident we have seen in a small business started with a credential. What to do this week, which second factor to choose and how access is managed when somebody leaves.
· Security
Before investing in any other security measure, there is one that returns more than all the rest put together and costs practically nothing: fixing how credentials are managed.
The reason is simple. The incidents a small business suffers almost never start with an exotic vulnerability: they start with a reused password that turned up in somebody else's breach.
Why the reused password is the problem
Somebody on your team signed up six years ago to some forum with their work email address and a password. That forum was breached. That email-and-password pair has been circulating ever since.
Attacks do not guess passwords: they try the ones they already have, automatically, against thousands of services. If that same password opens the company email, that is it. And from the email everything else follows, because the email is where the passwords for the other services get reset.
That is where the bank-account switch fraud comes from, the one we describe in how a transfer is stolen from a business.
What to do, in order
1. Second factor on the email, today
If you are only going to do one thing on this list, make it this one. With a second factor active, a leaked password is not enough to get in.
And not all second factors are worth the same:
- SMS: better than nothing, but the weakest. SIM-swap fraud exists.
- Code app: a good option, free and sufficient for most people.
- Physical key or passkey: the most robust, and the only one that holds up well against phishing, because it cannot be «typed» into a fake site.
2. A password manager for the team
This is the piece that makes everything else possible. With a manager, every service has a different, long password nobody needs to remember.
What it also solves, and this is the most underrated part: passwords stop living on sticky notes, in a shared spreadsheet or in a chat. And it lets you share an access without revealing the password, and withdraw it afterwards.
3. Check which of your addresses appear in breaches
There are free, public services that tell you whether an address appears in known breaches. Check it with your company accounts. It is public information the attackers already have; the odd thing is that the victim is the last to look at it.
4. Review who has access to what
Make the list of company services and, for each one, who gets in. What always turns up:
- Former employees with live access.
- Old suppliers still inside.
- Shared accounts with the password everybody knows.
- People with administrator permissions they do not need.
5. A leavers procedure
When somebody leaves the company, a written list of what gets revoked and in what order, executed the same day. Without that list something is always left open — and it usually gets discovered months later.
What is no longer recommended
Two inherited practices worth abandoning:
Forcing a password change every ninety days. Current reference guidance advises against periodic expiry with no cause: it produces worse, predictable passwords, with a number on the end going up by one each time. The change is forced when there is an indication of compromise.
Baroque composition rules. Requiring an uppercase letter, a digit and a symbol produces short passwords that are hard to remember. Length matters far more than complexity: a long phrase is better and easier to remember than eight characters with symbols.
This week's plan
- Monday: second factor on the whole team's email.
- Tuesday: password manager signed up for and accounts created.
- Wednesday: change the passwords of the critical services, starting with banking and email.
- Thursday: review accesses and withdraw the ones that are surplus.
- Friday: write the joiners-and-leavers access procedure, and keep it somewhere findable.
Five days, almost no cost, and it removes the way in for most incidents.
If this sounds like you
Rolling it out with the team — including the uncomfortable part, which is getting people to actually use it — is security and compliance. The rest of the reasonable minimum is in the minimum you need to have, and the other half is in backups.
And if you handle customer data, this is not just prudence: security measures are an obligation, and their absence makes any incident worse. It is in the record of processing activities.
We are Mindset & Code: automation, data and development for small businesses. You can see what we do and what it costs.
Sources: INCIBE, credential-management and two-factor guidance for small businesses; NIST SP 800-63B, digital identity guidelines, which advise against periodic password expiry and composition rules. General guidance.