A Strong Password Is Only Part of Protecting Your Business Accounts

A strong password is still worth having. It makes an account harder to guess and helps keep one compromised login from exposing other accounts, especially when every account has its own unique passphrase.

But a password can also be stolen. Someone might enter it on a convincing fake login page, or it could be captured through malware or exposed in a data breach. Once that happens, the password’s complexity offers little protection. That’s why protecting business accounts takes more than one step: verify the person signing in, limit what the account can reach, and pay attention when a login request doesn’t make sense.

Add another check at sign-in

Start with a unique passphrase for each account, stored in an approved password manager. Then use multi-factor authentication, or MFA, wherever it’s available.

MFA asks for another form of verification after the password, such as an authenticator app, a security key, or a biometric check. If a password is stolen, that extra step can keep the person holding it from simply signing in.

That protection depends on how people respond to prompts. An approval request you did not initiate is a warning, not a routine notification to clear from your phone.

Check what each account can access

Sign-in security is only one part of the picture. The permissions attached to an account determine how much someone can do after getting in.

Employees need access to the files, applications, and systems involved in their work. Problems arise when permissions are granted “just in case,” kept after a temporary project ends, or carried over when someone changes roles. Those old permissions can accumulate without anyone noticing.

If an account with broad access is compromised, an attacker may be able to reach information the employee rarely uses. Broad access can also make an ordinary mistake, such as an incorrect sharing setting or accidental deletion, more consequential. And when permissions are outdated, it becomes harder to tell who can reach sensitive resources.

A practical rule is to give people the access their current responsibilities require, for as long as they require it. Review permissions when roles change, temporary work ends, or someone leaves the organization.

Where biometrics fit

Fingerprint and facial recognition can make sign-in quicker. Other biometric systems may use characteristics such as a person’s voice, eyes, or typing behavior. Biometrics can be part of MFA, and they can help unlock a device-based passkey without transmitting the biometric itself.

Convenience does not make biometrics foolproof. A password can be changed after exposure; a fingerprint or face cannot be replaced in the same way. Biometric information therefore needs secure handling. Attempts to imitate someone using a photograph, recording, or deepfake are another reason to keep other safeguards in place.

Use biometrics on trusted, organization-approved devices and services. Keep devices and biometric software updated, and report unexpected prompts or repeated failed scans. A biometric prompt deserves the same attention as any other sign-in request: make sure it matches something you are actually trying to do.

When an approval request becomes the attack

The newsletter describes a scenario in which an employee receives several login approval notifications he did not request. After he denies them, someone calls claiming to be from IT. The caller says a system issue is causing the alerts and asks him to approve the next one to “fix” his account.

In the scenario, the caller is the attacker. They already have the employee’s password and are trying to persuade him to provide the final approval needed to sign in. The repeated notifications create pressure; the supposed IT call gives that pressure an explanation.

If you receive an MFA request while you are not signing in, deny it and report it through your organization’s approved process. If someone contacts you about the request, verify who they are through a trusted phone number or internal channel, rather than the contact details they provide.

Put the pieces together

Good account protection is a set of habits and controls working together: unique passphrases, MFA, permissions that match current work, and people who know when to stop and question a prompt. Each addresses a different point where access can go wrong.

For a business, a useful place to begin is with two questions: Who can access each sensitive system today? And what happens when someone receives a login request they weren’t expecting? If the answers are unclear, those are the processes to review first.