Why it matters
If you manage staff in your business, at some point they’ll need access to your network. You’ll need to put measures in place to keep their access secure. Strong passwords are a good place to start.
If you want to make sure your staff create strong, unique passwords for their accounts, you need to give them the tools to do so. This could mean updating your password policy.
How to protect your business
Here's what to do to protect your business.
Educate your staff about creating good passwords
The first thing you need to do is make sure your staff understand what a good password is, and why it’s important. As a rule, passwords should:
- be unique – used for one account only, not reused across many accounts
- be long and strong – a passphrase made up of 4 or more words is stronger than a password made up of letters, number and symbols (and it's easier to remember)
- not be based on personal information – for example, don’t use your pet’s name as your password, as personal information like that is often easy to find online
- be kept safe – encourage your staff to use a password manager to store their passwords in.
We’ve put some guidance together on creating good passwords that you can share with your staff.
Strong and unique instead of changing regularly
Asking staff to change their password regularly is counterproductive to good password security. People choose weaker passwords when they know they have to change them often. For example, they might simply change their password from Password1 to Password 2. Instead, ask them to create one long, strong and unique password for their account.
If your system currently prompts staff to change their password on a regular basis, change the setting. Staff should only have to change their password if you suspect their account, or the business network, might be compromised in some way.
Ask for longer passphrases
A passphrase of four or more words is stronger than a mix of characters, symbols and numbers, and it’s easier to remember. For example, i like eating breakfast.
Some password systems set rules asking staff to include a mix of symbols, letters and numbers. The problem with these rules is that people tend to use predictable methods to meet these requirements. It often means they will tag a ? or ! to the end of their password so that it includes a symbol. This creates passwords that are hard to remember. Instead, ask your staff to use longer passwords or passphrases.
Encourage staff to use two-factor authentication (2FA)
Using 2FA adds an extra layer of security to accounts. It is more secure than asking security questions to authenticate users in a system. This is because security questions often relate to personal information that is freely available online and easy for attackers to find, particularly on social media.
Using 2FA instead means that anyone who logs in to your system will need to provide something else to verify that they are who they say they are – for example, a one-time code sent to their phone.
Protect your business with two-factor authentication
Set up protection against vulnerable passwords
Simple passwords such as Password! or Welcome1 are easy for attackers to guess. Attackers often use databases of common passwords when they’re trying to gain access to accounts.
If you manage your own network, set up your system so it won’t accept common passwords. You can configure your system to only accept long, strong passwords instead.
If you manage your network on a cloud service, you might not be able to set the rules around password use. However, you can encourage staff to use good passwords and teach them why it's important. Circulate a list of common passwords that staff should avoid using.
Some staff may worry about remembering their passwords, so encourage them to use a password manager. A password manager is an app that stores and protects your passwords. The only login they’ll need to remember is for the password manager itself.
