Accounts And Passwords: Guides For Work Account Security
Passwords, second factors and the accounts nobody remembers to close.
In short: accounts and passwords come down to three things: long unique passwords, a password manager so unique is possible, and multi factor authentication. Accounts and passwords are where most business compromises begin.
Each guide here is written for staff who sign in to work accounts every day but do not work in IT. Terms are explained as they come up, no step asks for admin rights you lack, and nothing assumes you already know the fix.
Sign-in screens change more often than guides do. If a password or MFA step looks different from what is written here, call 678-374-4352 and we will sort out the account and correct the page.
Guides In Accounts And Passwords
The Short Version Of Everything In This Section
Accounts and passwords guidance has changed a lot, and most of what people were taught a decade ago is now either useless or actively harmful.
Length beats complexity. A long passphrase of unrelated words is far stronger than eight characters of punctuation, and far easier to type. Forced ninety day rotation makes things worse, not better, because people respond with predictable small changes.
Uniqueness matters more than strength. A brilliant password used on five sites is weaker than a mediocre one used on a single site, because attackers take credentials from one breach and try them everywhere automatically.
And multi factor authentication is what makes a stolen password worthless. If you only do one thing from this section, turn it on everywhere it is offered.
The rest of these guides are the practical detail behind those four sentences.
The Guides In This Section
Choose a strong password explains why length beats symbols and how to build a passphrase you will actually remember.
Use a password manager covers getting started without a painful weekend, sharing credentials at work properly, and what happens if you forget the master password.
Multi factor authentication covers what it is, which methods are stronger, and why you should never approve a prompt you did not trigger.
Lost MFA phone is the one to read before you lose it, and the one to open when you have.
IT checklist when someone leaves covers the account side of an employee departure.
Why Accounts Are The Target Rather Than Computers
It is worth understanding why this section exists, because it changes how seriously people take it.
Attackers do not generally break into networks any more. They sign in. A working set of credentials for your email is quieter, cheaper and more useful than any technical intrusion, and it looks like normal activity until the moment it does not.
From a mailbox, an attacker can read how your business approves payments, learn who your suppliers are, set a forwarding rule you will never notice, and send convincing messages to your clients from your real address.
None of that requires malware and none of it triggers an antivirus alert. Which is why accounts and passwords, an unglamorous subject, is the one that most often decides whether a business has a bad year.
Multi factor authentication is the single control that breaks this chain, and it is usually free.
What Good Looks Like Across A Team
For a business rather than an individual, four things make the difference.
A password manager rolled out to everyone, with shared vaults for the logins more than one person needs. That removes credentials from email threads and answers the question of who currently knows the supplier portal password.
Multi factor authentication enforced rather than optional. Optional means the people most likely to be targeted are the ones most likely to skip it.
A leaver process that runs on the day rather than the week after, covering shared logins and personal devices as well as the obvious accounts.
And a culture where reporting a suspected password problem is routine rather than embarrassing. The technical controls only buy time. Somebody telling you quickly is what lets you use it.
If you want any of these set up across your team, tell us and we will do it. Call 678-374-4352.
Related Sections And Further Reading
If something has already gone wrong, go to Security and phishing and call rather than read. For email specific questions see Email and Microsoft 365. For how to reach us see Getting help.
The full index is on the Knowledge Base home page.
If you want a policy on accounts and passwords written for your business rather than borrowed from a template, that is something we do as part of the compliance work. It is short, it is readable, and it matters more than most of the documents that usually get written.
For the reasoning behind these rules, such as length mattering more than complexity and the end of forced rotation, read the federal standard NIST SP 800-63B.
An Accounts And Passwords Checklist
The whole section in ten lines, in the order worth doing them.
- Make passwords long rather than complicated.
- Never reuse one anywhere. Uniqueness beats strength.
- Use a password manager so uniqueness is actually possible.
- Protect the manager with one long passphrase and multi factor authentication.
- Set up recovery for the manager on day one.
- Turn on multi factor authentication everywhere it is offered.
- Register a second MFA method before you lose the first.
- Store recovery codes outside the phone they protect.
- Move shared logins into a shared vault, out of email threads.
- Typed a password into a page reached from an email link? Reset it at once.
Accounts and passwords is unglamorous and it is where most business compromises actually begin.
Accounts And Passwords In Your Industry
The account that matters most is different in each sector.
Law firms. The fee earner mailbox. It maps every client and every matter, and a compromise there is a confidentiality event. Accounts and passwords discipline at a firm is a professional obligation.
Distribution and logistics. The accounts mailbox and the supplier portals. Compromise here leads to payment fraud rather than data loss, usually weeks later, long after anyone connects it to a reused password.
Manufacturing. Plant systems built for closed networks that have since been connected online. Here accounts and passwords plus multi factor authentication are often the only control standing in the way.
If you want a password manager and enforced MFA across the team, that is a short piece of work. Call 678-374-4352.
Rolling This Out Across A Team
Individual advice about accounts and passwords only goes so far. What changes outcomes is doing it once, properly, for everybody.
Start with a password manager for the whole team rather than for the people who volunteer. Voluntary adoption produces exactly the split you do not want, where the least confident users, who are the most likely to reuse passwords, are the ones who opt out.
Enforce multi factor authentication rather than offering it. Optional MFA means the accounts most worth protecting are the ones least likely to have it, because busy senior people are the ones who skip the setup prompt.
Set up shared vaults for the credentials more than one person needs, by function rather than one large shared folder. That single change removes passwords from email threads permanently and answers the question of who currently has access to what.
Then agree a leaver process that includes accounts and passwords rather than just hardware, and run it on the day.
That is four decisions. Together they close most of the gap between a business that gets compromised and one that does not.
What We See Go Wrong Most Often
A few patterns come up repeatedly, and none of them involve sophisticated attacks.
One password across many systems, discovered when an unrelated site is breached and the same credential unlocks the work mailbox. This remains the single most common route into a small business.
Shared logins that nobody owns. Shipping accounts, vendor portals and company social media pages are typical. Everybody knows the password, nobody knows who else does, and it has not changed since somebody left in 2022.
Multi factor authentication set up on one device with no backup method, which becomes an urgent problem the day that phone is lost or replaced.
Recovery codes screenshotted into the photo library of the phone they protect, which fails in exactly the scenario they exist for.
And accounts belonging to people who left, still active, because the departure was handled by HR and nobody told IT.
Every one of those is preventable with an afternoon of work, and every one of them is cheaper to fix than to survive.
Questions Worth Asking About Your Own Accounts
Five questions that are uncomfortable to answer honestly and useful to answer anyway.
Do you know how many people can currently sign in to your business email? Not how many should, how many can.
Is multi factor authentication on every account that touches money or client data, including the ones set up years ago and never revisited?
If a key person lost their phone this afternoon, could they get back into their accounts today, or would they be locked out until somebody found a workaround?
When somebody left most recently, was their access removed on the day, and can you show that it was?
And is there a password written down anywhere in your business that more than three people know?
If any of those answers is uncomfortable, that is normal and it is fixable. Accounts and passwords hygiene is not about being perfect, it is about closing the specific gaps that attackers actually use. Call 678-374-4352 and we will work through it with you.
Questions About Work Account Security
Anyone at a client business. They assume no IT background.
Call 678-374-4352. Login pages change, and we would rather update the steps.
Yes. Ask and we will send a printable password and MFA sheet for new hires.
Call 678-374-4352. Option 1 handles account security emergencies 24/7.