Small Business Cyber‑Hygiene Series: Part 3: Protect Access: Passwords, MFA, and Accounts
Introduction
Most cyberattacks don’t start with advanced hacking techniques. They start with everyday weaknesses: stolen passwords, reused logins, or accounts with too much access. Whether you’re running a small business or managing your own digital life, protecting access is one of the simplest and most effective ways to reduce risk.
This article walks through the essential habits that keep attackers out and ensure only the right people have the right access at the right time.
Why Access Protection Matters
Attackers don’t need to break in if they can simply log in. Weak passwords, reused credentials, and forgotten accounts are among the most common entry points for cybercriminals.
Strong access protection:
- Reduces account‑takeover risk
- Prevents unauthorized access
- Limits the blast radius if an account is compromised
- Supports compliance with frameworks like NIST CSF, CIS Controls, and FTC Safeguards
This is foundational cyber hygiene — and it’s achievable without an IT department.
What Good Access Protection Looks Like
A small business with strong access controls typically has:
- Long, unique passwords or passphrases
- MFA enabled on all critical accounts
- No unused or forgotten accounts
- Limited administrative privileges
- A simple, repeatable access‑review process
These practices are low‑cost, high‑impact, and sustainable.
How to Protect Access (Step‑by‑Step)
1 Strengthen Passwords Without Making Life Hard
Modern password guidance focuses on length and uniqueness, not complexity.
Use long passwords or passphrases
- Aim for 14+ characters
- Example: SunsetCoffeeTruck2024!
Avoid reusing passwords
If one site is breached, attackers try the same password everywhere.
Use a password manager
Password managers help you:
- Generate strong passwords
- Store them securely
- Reduce employee frustration
They’re inexpensive and easy to roll out.
2 Turn On Multi‑Factor Authentication (MFA) Everywhere
MFA is one of the most effective security controls available. Even if a password is stolen, MFA blocks most unauthorized access attempts.
Where to enable MFA
- Email (Microsoft 365, Google Workspace)
- Banking and financial accounts
- Remote access tools
- Any system with sensitive data
Best MFA options (ranked)
- Authenticator apps (Microsoft Authenticator, Duo, Google Authenticator)
- Hardware keys (YubiKey, Feitian)
- SMS codes (acceptable, but less secure)
For SMBs, authenticator apps offer the best balance of security and convenience.
3 Clean Up and Lock Down Accounts
Attackers love old, shared, or overly‑permissive accounts.
Remove accounts you no longer need
Disable accounts immediately when employees leave or vendors no longer require access.
Limit admin access
Only grant administrative privileges to people who truly need them — and only temporarily when possible.
Avoid shared accounts
If you must use them:
- Protect with MFA
- Restrict who can access them
- Monitor them closely
Review access regularly
A quarterly review is enough for most small businesses.
4 Protect Your Email — It’s the Front Door
Email is the gateway to password resets, financial approvals, and internal communication.
Minimum protections
- MFA enabled
- Strong password
- Alerts for unusual sign‑ins
- Disable legacy authentication (Microsoft 365)
Bonus protections
- Separate admin accounts
- Block direct sign‑in for shared mailboxes
- Require MFA for sensitive mailboxes
Access Protection Checklist
Monthly
- Review admin accounts
- Check for unusual sign‑ins
- Update password manager entries
Quarterly
- Remove unused accounts
- Review access permissions
- Confirm MFA is still enabled everywhere
Annually
- Refresh password manager master passwords
- Revisit your access policy as your business grows
Key Takeaway
Protecting access is one of the simplest and most effective ways to strengthen your cyber hygiene. Strong passwords, MFA, and clean account management dramatically reduce the risk of unauthorized access — and they’re easy to maintain with the right habits.
Ready to Strengthen Your Access Security?
You don’t need a full IT department to protect your business. Small, consistent habits make a big difference — and SQ Risk can help you put them in place.
Small Business Cyber‑Hygiene Series
Start Here:
- Introduction: Why Cyber‑Hygiene Matters
- Know What You Have (Identify)
- Protect Access: Passwords, MFA, and Accounts (You are here)
Next Articles:
4. Secure Your Devices — Updates, Antivirus, and Hardening
5. Back Up What Matters — The 3‑2‑1 Rule
6. Defend Your Inbox — Phishing & Email Security
7. Monitor for Trouble — Detection Basics
8. Respond Effectively — What To Do When Something Goes Wrong
9. Recover Quickly — Getting Back to Normal
10. Build a Security‑First Culture
11. Bonus: Safe Use of AI for Small Businesses
12. Cyber‑Hygiene Checklist: A One‑Page Summary