Ask most business owners how their systems are protected and “we all have strong passwords” is a common answer. It’s a good starting point, but on its own it’s no longer enough. Attackers don’t need to guess a password when they can buy one: huge numbers of email addresses and passwords from previous, unrelated data breaches are traded and tested against other services automatically. If one of your employees has ever reused a password anywhere else that’s since been breached, that password may already be sitting in a criminal’s list, whether or not it looks “strong.”
This is Week Two of our Cyber Security Awareness Month series, and the theme carries straight through from last week: don’t make it easy for them. Here’s what that actually looks like in practice.
Start with a password manager, not memory
Asking people to remember a unique, complex password for every single system they use isn’t realistic, which is exactly why password reuse happens. A password manager solves this properly: it generates and stores a unique password for every account, so a breach of one service doesn’t put every other account at risk. It’s a small change with a disproportionately large impact on your organisation’s overall risk.
Multi-factor authentication should be the default, not the exception
Multi-factor authentication (MFA) means proving who you are with something beyond a password alone, typically a code from an authenticator app, a push notification to approve on your phone, or a physical security key. Even if a password is stolen or guessed, MFA stops it being enough on its own to get in.
Where we still see gaps in businesses we work with is admin accounts and older or “less important” systems being left without MFA, simply because they’re not the ones used day to day. Attackers know this too, and often target exactly these accounts first.
Not all MFA is equal
It’s worth knowing that some forms of MFA are more resistant to modern attacks than others. SMS codes are better than nothing, but they can be intercepted or manipulated. Authenticator app codes and push approvals are stronger. The most robust option, increasingly recommended and becoming more widely supported, is phishing-resistant MFA using passkeys or security keys, which can’t be tricked into approving a login on a fake site the way a code or a tapped approval sometimes can.
Identity is bigger than any one login
For businesses using Microsoft 365, tools like Microsoft Entra ID go further than basic MFA, allowing conditional access rules such as blocking sign-ins from unexpected locations or devices, and giving IT a single, central view of who has access to what across the organisation. This matters as much for offboarding, making sure access is fully removed when someone leaves, as it does for day-to-day security.
Three practical steps to keep in check
1. Check MFA is switched on everywhere, particularly admin, finance, and email accounts, not just the systems staff log into most often.
2. Introduce a password manager if you don’t already use one, and retire any shared or reused passwords you’re aware of.
3. Review who still has access to systems they no longer need, especially former employees or old supplier accounts.
How Information Solutions can help
We help businesses roll out MFA properly across their systems, set up Microsoft Entra ID for tighter identity and access control, and review existing access for gaps that are easy to miss. If you’re not confident everything is covered, a short conversation with our team is a good place to start.