Access to your systems and data is your organisation’s first line of defence. If it is not properly arranged, it hardly matters how many other measures you take. One weak account can throw the door wide open. In the second edition of The Digital Compass we describe seven measures that together form the foundation.
Why logins are the first target
Criminals almost always choose the easiest way in. That is rarely a complex vulnerability, and usually a weak account with a bad password, a forgotten login or a click on a phishing link. Many incidents stem from human error, not clever hacks. A good login policy catches those errors.
1. Passphrases instead of complex codes
Many people think a password is secure when it is full of strange characters. But P4ssw0rd-I$-Str0ng is much harder to remember than THIS-is-1-strong-OPTION, while the latter is at least as secure thanks to its length. So choose passphrases: longer combinations of words.
The old advice to “come up with a difficult password and change it regularly” no longer works. It actually leads to unsafe behaviour: Welcome2023! becomes Welcome2024!. Criminals know that. They have millions of stolen passwords and automatically test them on other services. One reused password can give access to your business data.
2. Manage passwords centrally
Loose passwords almost always lead to unsafe behaviour: reuse, notes in spreadsheets, screenshots on phones or passwords stored in the browser. A password manager gives everyone one secure place, without having to remember passwords. Professional managers generate strong passphrases, check for leaked passwords and offer shared vaults for teams. Choose one that works on every device in your organisation, or it will not be used.
3. Two-step verification (MFA)
MFA is one of the most effective measures. If a password leaks, the extra step still keeps criminals out. Choose modern forms, such as an authenticator app or a physical hardware key. Text messages are vulnerable to interception and SIM swaps. MFA is not a guarantee of complete security, but it makes misuse many times harder. Also read why MFA is important, but knowledge is even more important.
4. Passkeys and passwordless sign-in
Passkeys are the future of secure sign-in. You log in with your fingerprint, your face or a device you carry. The big advantage: passkeys are phishing-resistant. On a fake website your passkey simply does not work. More in Passkeys: secure login without the hassle.
Not every organisation is ready for passkeys, and that is fine. A good intermediate step is signing in with a push notification in Microsoft Authenticator, without a password. How to set that up, you can read in Set up Microsoft Authenticator.
5. Conditional Access
Not every login attempt is the same. Someone logging in from the office on a managed device is a different risk from someone trying to get in from a hotel room abroad. With Conditional Access you set rules that take location, device and risk signals into account. That way you enforce extra checks where needed, and employees have to sign in again less often in trusted places.
6. Insight into accounts
Many organisations have forgotten accounts that have not been used for months or even years. Those are silent entry points for criminals. Regularly check which accounts are active, clean up what can go, and revoke access immediately when someone leaves.
7. Single sign-on (SSO)
With single sign-on, employees use one central identity for all their systems. Fewer passwords means fewer weak spots. And when someone leaves, you disable one account and all access is revoked at once.
What to look for in a password manager
- Shared vaults for teams, for shared accounts such as social media or supplier portals. Then passwords no longer travel by email or chat.
- Autofill without storing passwords in the browser. Browsers are not built to be a secure vault.
- Audit logs for administrators, so you can see how the manager is used and where the risks are.
- Access recovery. If someone is unavailable or leaves, you must be able to take over access in a controlled way.
Brandaris is a 1Password partner. Read what you may not know about 1Password.
Start with the basics
You do not need to introduce everything at once. Start with passphrases, a password manager and MFA, and build step by step. The easier you make secure choices for employees, the better they are followed.
More in The Digital Compass
This article is based on the second edition of The Digital Compass (in Dutch). It also covers authorisation, smart licence choices, email security and backups.
