The Passwords Your Business Is Using Right Now

How it actually goes wrong

Not a hacker targeting your business. Something far more mundane.

A company you used once is breached and its user list ends up circulating. Your address and password are in it. Automated systems then try that combination against hundreds of other services. If you used the same password for your email, that account is now accessible, and email is the master key because almost every other account can be reset through it.

You are not singled out. The attempt is automated and indiscriminate, which is precisely why small businesses are affected as often as large ones.

The accounts that actually matter

Not everything needs equal attention. A small number of accounts control everything else.

Five accounts. Securing those properly is most of the available benefit, and it is a realistic afternoon of work rather than an ongoing programme.

What makes a password strong

Length, more than complexity. A long passphrase of unrelated words is both harder to break and easier to type than a short string of substituted characters.

The old advice about mixing symbols and numbers produced passwords that were hard for people and not especially hard for computers. Current guidance favours length, and it favours never reusing one, which matters more than the composition of any individual password.

The genuinely important rule is that the five accounts above each have a different password from each other and from everything else. Reuse is the failure that turns one breach into all of them.

Where to keep them

A password manager, which is the one tool in this area worth adopting. It generates long unique passwords, stores them encrypted, fills them in, and means you only remember one.

The common objections are worth answering plainly. Putting everything in one place feels risky, and the alternative is reuse, which is demonstrably worse. If you forget the master password most services offer a recovery mechanism you set up in advance. And they work across phones and desktops, which is where the practical benefit shows.

The alternative that people actually use, a written list, is not absurd for a very small business provided it is kept somewhere physically secure rather than under the keyboard. It fails when staff change and when you need a password while on a job site.

The step that matters more than passwords

Two-factor authentication, which asks for a code from your phone in addition to the password.

This is the single most effective change available, because it means a stolen password on its own is not enough. Even if your password appears in a breach, the account holds.

Switch it on for email first, then the registrar, then hosting. Where offered a choice, an authenticator application is more secure than codes by text message, though text-based is far better than none. And save the backup codes somewhere separate from your phone, because losing the phone without them is a genuinely difficult situation to recover from.

Shared accounts and staff

Most small businesses share one login for everything, which is understandable and creates two problems. Nobody can tell who did what, and when someone leaves, the only remedy is changing a password everyone uses.

Where a service supports multiple users, use them. Most business platforms do, at no extra cost. It takes a few minutes per person and it means removing access when someone leaves is one action rather than a scramble.

Keep a short list of which accounts each person can reach. Reviewing it when someone joins or leaves takes five minutes and it is the step that gets skipped in the fortnight after a departure, which is exactly when it matters.

The afternoon worth spending

• Set up a password manager and add the five accounts that matter.
• Change each to a long unique password, starting with email.
• Switch on two-factor authentication on email, registrar, and hosting.
• Save the backup codes somewhere separate.
• Write down who has access to what, on one page.
• Check the recovery address on each account is one you still control.

That last one catches people. Recovery addresses pointing at a former employee or a mailbox nobody reads turn a routine reset into a serious problem, and it is the kind of thing nobody discovers until the day it matters.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.