Your Password Policy is Weak

Why 'Password123' is putting your business at risk, and how to implement MFA properly.

We have all done it. Used the same password for LinkedIn as we do for our work email. It's human nature to want convenience. The problem is, hackers know this.

If LinkedIn gets hacked (which it has in the past) and leaks your password, 'bots' will instantly try that same email/password combination on Office 365, Amazon, banking sites, and CRM systems. This is called Credential Stuffing. This is why Cyber Essentials mandates strong passwords.

The New Rules of Identity

Forget the old advice of changing your password every 90 days. It doesn't work. Here is what modern security looks like:

1. Use a Password Manager You cannot remember 50 unique, complex passwords. We recommend Keeper Security or similar enterprise-grade password managers. You only need to remember ONE strong master password. The software generates and autofills 20-character random nonsense for everything else.

2. Use Passphrases If you can't use a manager for a specific account, stop using "Summer2025!". Use a Passphrase made of three random words, e.g., `Horse-Battery-Staple`. It is harder for a computer to guess but easier for a human to remember.

3. Go Passwordless The future is here. With Passkeys, you can sign in using your face (Windows Hello) or fingerprint (TouchID) instead of typing a password at all. It is faster and phishing-resistant because there is no password to steal!

4. Enable MFA (The Right Way) Multi-Factor Authentication (MFA) is non-negotiable. It is a key feature of Business Premium. However, avoid SMS text messages if possible - hackers can swap your SIM card to intercept codes. Always use an Authenticator App (like Microsoft Authenticator) which requires you to tap 'Approve' on your phone.

If you haven't turned on MFA for your Microsoft 365 email yet, stop reading this and do it now. It is the single most effective action you can take to secure your business today.