Attackers usually don’t need to “hack” a system; they just need to log in. Passwords leaked from other websites, simple and guessable passwords, and phishing emails that lead users to fake login pages are the most common ways in. The good news: two simple measures, the right password policy and multi-factor authentication, neutralize most of these attacks.
What Does a Good Password Look Like Today?
Current recommendations, including NIST guidelines, differ from the old rules:
- Length matters more than complexity: a long passphrase (for example, several unrelated words together) is more secure than a short password full of symbols, and easier to remember.
- Forced periodic changes are not needed: when users are forced to change their password every month, they usually just change the last digit. Change a password only when there is a chance it has been exposed.
- Common and leaked passwords should be blocked: passwords such as the company name plus the year, or 123456, should not be allowed.
- A separate password for every system: your work email password should never be the same as the one you use on personal websites.
Password Managers
Expecting employees to remember dozens of long, different passwords is not realistic. A business password manager solves this: passwords are stored encrypted, team passwords (such as the login for a service panel) are shared without sending them over messaging apps, and when an employee leaves, their access is revoked.
What Is Multi-Factor Authentication (MFA)?
With multi-factor authentication, a second factor is required in addition to the password, usually a six-digit code from an authenticator app on a phone or a hardware key. Even if the password leaks, an attacker cannot log in without the user’s phone or key.
Methods, from most to least secure:
- Hardware security key or Passkey: resistant even to fake login pages.
- Authenticator app (TOTP): a six-digit code that changes every 30 seconds.
- SMS: better than nothing, but more vulnerable to certain attacks.
Where Should You Enable MFA First?
Prioritize systems that are reachable from the internet or grant broad access:
- Business email and webmail portals
- VPN and remote access
- System administrator accounts, the firewall panel and the backup console
- Cloud services, hosting and domain panels
- Financial and banking software
Administrator Accounts: Separate and Limited
IT administrators should use a regular account for everyday tasks such as email and web browsing, and use their admin account only for administrative work. Keep the number of accounts with Domain Admin rights to a minimum and make the local administrator password unique on every computer; Windows LAPS, built into recent versions of Windows, automates this.
Short Staff Training
Most password theft starts with a phishing email. A short ten-minute training session is enough for employees to know that they should:
- Never send a password or verification code to anyone, even “support.”
- Check the page address before entering a password.
- Reject and report any unexpected login approval request on their phone.
Checklist
- An appropriate minimum password length and a ban on common passwords
- A business password manager
- Multi-factor authentication for email, VPN and admin accounts
- Separate admin accounts and unique local administrator passwords
- Regular staff training on phishing emails
ITPlus724 engineers can implement a password policy in your domain and set up multi-factor authentication for your company’s sensitive services.