Most attacks start with weak or reused passwords. Five habits that greatly reduce the risk, for personal and company accounts alike.
Most attacks on a company don't start with a sophisticated technical exploit. They start somewhere much simpler: a password that was guessed, leaked from another site, or reused across several accounts. The good news is that reducing this risk doesn't require an expensive investment. The five habits below are the most effective first step for both your personal and your company accounts.
1. Use long passwords
The single most important factor that makes a password hard to crack is its length. Aim for at least 12 characters; longer is better. For a password that is both long and memorable, use a passphrase: a few unrelated words put together. Such a password is stronger than a short one full of symbols, and much easier to remember.
Avoid: your name, date of birth, company name, licence plate, favourite team and well-known patterns like "Password123!". These are the first guesses attackers try.
Forcing people to change a strong password on a fixed schedule often pushes them towards predictable changes like "Password1", "Password2". The better approach: change the password immediately when you suspect a leak.
2. Use a different password for every account
Attackers automatically try email and password pairs stolen from one site on many others. If you use the same password for your email, your accounting software and an online shop, a leak at the weakest site opens all of them.
Your email password in particular must be unique. The "forgot my password" link of most other accounts lands in your inbox; whoever takes over your email can reset the rest.
3. Leave passwords to a password manager
Giving dozens of accounts long, unique passwords is not something anyone can keep in their head. A password manager does it for you: it generates strong passwords, stores them in an encrypted vault and fills them in when needed. You only need to remember one strong master password.
- Keep the master password long and never use it anywhere else.
- Turn on two-step verification for the password manager itself.
- For companies, team editions let you share passwords for shared accounts based on permissions, instead of passing them around by email or sticky note.
4. Turn on two-step verification
Two-step verification asks for a second proof besides the password: a code from an authenticator app on your phone, a code sent to you, or a security key. Even if your password is stolen, the account can't be opened without this second step.
In general, security keys and authenticator apps are stronger than codes sent by SMS. Still, an SMS code is far better than nothing.
Start with these accounts:
- Email accounts
- Bank and payment accounts
- Accounting, ERP and business applications
- Domain, server and cloud management panels
- The company's social media accounts
5. Never share your password
No serious organisation, including your bank and your IT service provider, will ask for your password by email, message or phone. Messages that rush you, such as "your account will be closed, verify now", are the best-known sign of phishing. Instead of clicking the link, type the site's address yourself.
The same rule applies inside the company. Shared accounts where several people work under the same username cause problems for security and for the question "who changed this record?". Every employee should have their own user and only the permissions their job requires. In our business management software, too, every user signs in with their own account, and you decide who can see and approve what.
A short checklist for your company
- All employees use unique passwords of at least 12 characters.
- Two-step verification is on for email, banking and business applications.
- Passwords for shared accounts are kept in a password manager and shared by permission.
- Accounts of employees who leave are closed the same day.
- The team recognises phishing messages and knows whom to report suspicious activity to.
None of these steps is complicated, but applied together they make an attacker's job much harder.