Many security incidents begin with a compromised account: a reused password, a convincing phishing email or an administrator login without additional protection. Strengthening accounts is one of the most effective security improvements an organisation can make.
Better passwords
Current guidance favours length over complexity. Encourage:
- long passphrases rather than short, complicated passwords;
- a different password for every service;
- a reputable password manager to generate and store passwords;
- changing a password when there is reason to believe it has been exposed, rather than forcing frequent arbitrary changes.
Multi-factor authentication
Multi-factor authentication (MFA) requires something in addition to a password, such as a code from an authenticator app or a security key. Even if a password is stolen, MFA blocks most account takeovers.
Prioritise MFA for:
- email accounts, since they can reset other passwords;
- administrator and finance accounts;
- remote access and cloud services;
- domain, hosting and DNS accounts.
Authenticator apps and security keys are generally stronger than codes sent by SMS, although SMS is still better than no second factor.
Recognise phishing
Phishing messages often create urgency, imitate familiar brands or colleagues and ask you to sign in or open an attachment. Encourage staff to check the sender and the link destination, to verify unexpected payment requests through a separate channel and to report suspicious messages without fear of blame.
Avoid shared accounts
Shared logins make it impossible to know who did what and are hard to secure when people leave. Give each person their own account. Where a shared account is unavoidable, store its credentials in a password manager with controlled access and change them when staff change.
Protect administrator access
Administrators should use separate accounts for administrative tasks, with MFA, and use them only when necessary.
Plan for leavers
When someone leaves, disable their accounts promptly, transfer ownership of their files and change any shared credentials they knew.
Make it easy
Security that is difficult will be bypassed. Provide tools such as password managers, short practical guidance and support, so the secure way is also the easy way.
