Most small businesses that get breached don't get breached by a sophisticated hacker exploiting a zero-day vulnerability. They get breached because an employee reused a weak password across multiple accounts, or because a former employee's login credentials were never deactivated, or because anyone with a company email address had access to systems they didn't actually need. These aren't exotic threats requiring expensive security tools to defend against — they're basic hygiene problems, and fixing them is inexpensive compared to almost anything else a small business can do to reduce its cybersecurity risk.
Why password reuse is the single biggest risk
When an employee uses the same password across a work account and a personal account, a breach at any one of the dozens of other companies that personal account touches can expose the work password too. Attackers run these leaked password lists against business login pages constantly, in what's called credential stuffing — an automated, low-effort attack that works precisely because password reuse is so common. A single reused password on an email account or a financial system can be the entire difference between a non-event and a serious breach. This risk exists regardless of how strong the password itself is; strength doesn't help if the same password was exposed somewhere else entirely.
What a password manager actually solves
A password manager generates and stores a unique, complex password for every account, so employees never need to remember more than one master password to access all the rest. This eliminates password reuse as a practical matter, since there's no longer any reason to reuse a password when the manager handles generation and storage automatically. Business-tier password managers also let an administrator see which employees are using weak or reused passwords (without seeing the passwords themselves), enforce password policies, and revoke access to shared credentials the moment someone leaves, all from a central console. The cost is typically a few dollars per user per month, which is a small fraction of what a single credential-based breach costs in recovery time, notification obligations, and reputational damage.
Multi-factor authentication as the second layer
Multi-factor authentication requires a second form of verification beyond the password — a code from an authenticator app, a push notification, or a hardware key — before granting access. Even if a password is compromised, MFA stops the vast majority of automated credential-stuffing attempts, because the attacker doesn't have the second factor. Prioritize enabling MFA on the accounts that would cause the most damage if compromised: email (since email access often allows password resets on everything else), financial and banking platforms, cloud storage, and any system holding customer data. Most major business software platforms support MFA at no additional cost; the barrier to adoption is usually just that nobody enabled it, not that it wasn't available.
The principle of least privilege
Not every employee needs access to every system. Least privilege means giving each person access only to the specific accounts, folders, and tools their role actually requires, rather than defaulting to broad access because it's easier to set up once. A part-time customer service employee doesn't need access to the accounting system; a bookkeeper doesn't need admin rights on the company's website. This isn't about distrust — it's about limiting the damage any single compromised account can do. If an attacker gains access to one employee's credentials, least privilege determines whether that attacker reaches one folder or the entire business.
Offboarding: the step almost everyone skips
When an employee leaves, their access to every system they touched needs to be revoked, not just their building key or company laptop. This includes email, shared drives, project management tools, financial software, social media accounts, and any personal devices that had company email or apps installed. A written offboarding checklist that names every system a departing employee had access to, checked off one by one, closes a gap that otherwise depends entirely on someone remembering to do it under the time pressure of a departure. Former employees rarely have malicious intent, but an account that should have been closed and wasn't is an unnecessary open door, and it's one of the more common ways small businesses get breached long after an employee is gone.
Shared logins: a habit worth breaking
Many small businesses share a single login for a social media account, a subscription service, or a piece of software across multiple employees, partly for convenience and partly to avoid paying for additional seats. This makes it nearly impossible to know who actually took a given action on the account, and it means revoking one person's access requires changing the password for everyone, which rarely happens promptly in practice. Where the software supports individual logins, even at a modest additional cost per seat, moving away from shared logins improves both accountability and the speed at which access can be cut off cleanly.
Basic phishing awareness training
Technical controls only go so far if an employee is convinced to hand over credentials directly through a convincing phishing email. Brief, periodic training — recognizing suspicious sender addresses, hovering over links before clicking, being skeptical of urgent requests to change payment or login information — measurably reduces how often employees fall for these attempts. This doesn't need to be an elaborate program; a short session when someone is onboarded, plus periodic reminders when new phishing tactics emerge, covers most of the practical benefit at very little cost.
Building a simple access review habit
Set a recurring reminder, quarterly is reasonable for most small businesses, to review who has access to what. Cross-check the current employee roster against active accounts on every major system, confirm that access levels still match current roles, and close out anything that no longer has a clear business justification. This single habit catches the accumulated drift that happens naturally as a business grows — access granted for a project that ended, a contractor who was never offboarded, an admin permission given temporarily and never revoked — before it becomes the vulnerability that gets exploited.
Comments
Post a Comment