Topic 1: Passwords, Multi-Factor Authentication & Account Access

Passwords, logins, and permission levels determine who holds the keys to your business data. Securing account access requires straightforward guardrails that keep unauthorized users out while allowing your team to work securely.
NOTE: Some sites that you need to log into may have an maximum allowable password length as well as a minimum length - and they don't always tell you this. Ask them.

Items Ranked by Priority

The 12 items below are ordered from highest critical risk to routine access administration.

1. Weak or Predictable Passwords

Why It’s a Threat: Bad guys do not sit at a keyboard guessing passwords one by one. They use programs that try hundreds to thousands of common words, business names, dates, and patterns [your pet's name?] and report back with their successes.

Real-World Example: You pick a password based on your town name and the current year. Hacking tools run through a dictionary list of local town names combined with common numbers, cracking your login before lunch.

Solution: Use passphrases instead of short passwords. Pick four or five random words strung together (like BluePencilCoffeeRiverJump). Passphrases are easier for you to remember, but mathematically brutal for cracking programs to guess. If using passphrases for other accounts, make sure that your passphrase does not exceed the maximum password length. Check the account holder.(See also Item 2, regarding reuse of passwords.)

2. Reusing Passwords Across Multiple Accounts

Why It’s a Threat: If you use the exact same password across personal and work accounts, leakers on unrelated hobby or news sites compromise all your logins at once.

Real-World Example: A local sports news forum gets hacked and leaks your password. Programs try that leaked combination against major accounting platforms and unlock your business portal.

Solution: Treat every single business login like a custom key. Every account must have its own unique password or passphrase.

3. Not Using Multi-Factor Authentication (MFA)

Why It’s a Threat: A password alone is no longer enough. If a thief steals or guesses your password, nothing stands between them and your business data.

Real-World Example: A thief steals your browser password for business email. When attempting to log in, the system demands a 6-digit code sent to an app on your personal phone, locking them out cold.

Solution: Turn on Multi-Factor Authentication (MFA/2FA) on every business account - starting immediately with email, online banking, and accounting tools.

4. Relying on SMS Text Messages for MFA Codes

Why It’s a Threat: Text messages travel over open phone networks that can be intercepted or hijacked via SIM swapping.

Real-World Example: A scammer impersonates you with mobile customer service and swaps your cell number to a new device to intercept bank password resets.

Solution: Use an Authenticator App whenever possible or set up Port-Out Protection and an account security PIN with your cellular carrier.

5. Prompt Fatigue and Blindly Approving MFA Notifications

Why It’s a Threat: Bad guys spam your phone with dozens of login prompts late at night gambling that you will hit "Approve" just to stop the noise.

Real-World Example: An attacker tries logging in at 2:00 AM, and you wake up groggy, hit "Approve" assuming it is a system glitch, and grant them entry.

Solution: Treat every login prompt like a stranger at your door; deny unexpected requests immediately and change your account password right away.

6. Writing Passwords on Paper Notes Left at the Desk

Why It’s a Threat: Physical notes turn physical office access into digital access for visitors, cleaners, or contractors.

Real-World Example: An after-hours cleaning crew spots a sticky note listing banking logins, photos it, and sells your credentials online.

Solution: Keep physical notes locked inside a fireproof safe rather than open on desks.

7. Storing Passwords in Unencrypted Spreadsheets or Documents

Why It’s a Threat: Standard documents do not scramble contents; malware scripts actively scan desktop folders for files containing words like "passwords".

Real-World Example: An employee opens a bad file, and a script finds Business_Passwords.docx on the desktop, uploading it offsite in three seconds.

Solution: Use a password manager. Plan B - Store password and account information only in a known encrypted spreadsheet.

8. Sharing Administrator Accounts with Staff or Vendors

Why It’s a Threat: Handing out owner admin logins destroys accountability and exposes admin rights if the employee or vendor is breached.

Real-World Example: An outside web designer gets admin credentials, and later, their personal laptop gets infected by malware. Later, attackers gain control your entire business portal.

Solution: Issue dedicated sub-accounts with limited permissions to contractors and staff.

9. Failing to Revoke Access When Staff or Contractors Leave

Why It’s a Threat: Departing workers with lingering access can be the source for significant intentional file deletions or insider data breaches.

Real-World Example: A former employee joins a competitor and uses their still-active cloud access to download client lists and pricing templates.

Solution: Use an offboarding checklist to immediately disable accounts when workers leave. Generally, it is advisable to disable rather than delete an ex-employee account.

10. Over-Privileged Staff Accounts (Excessive Permissions)

Why It’s a Threat: Giving daily staff full administrative control means malware they encounter inherits high-level rights to alter system settings.

Real-World Example: An invoicing clerk with full admin access opens a bad email attachment, allowing malware to modify vendor payout details across the entire system.

Solution: Apply the Principle of Least Privilege, giving staff limited standard accounts plus only the access needed for their daily work.

11. Leaving Vendor and Third-Party Portals Unmonitored

Why It’s a Threat: Outside vendors with remote access can serve as an open bridge into your internal network if they are compromised.

Real-World Example: An HVAC vendor's office network gets hacked, and attackers use their maintenance connection to enter your local computers.

Solution: Require vendors to use MFA and turn off unused remote maintenance portals when projects finish.

12. Missing or Ignored Failed-Login Lockout Limits

Why It’s a Threat: Without lockout limits, automated scripts can attempt thousands of password guesses per minute, indefinitely.

Real-World Example: A program runs all night trying passphrases against your login portal and cracks the account at 4:00 AM.

Solution: Enable account lockout limits that trigger delays or temporary locks after 3 to 5 failed attempts.