Passwords, MFA and digital hygiene in the company

Most cyberattacks on an SME do not start from a coding genius, but from a weak or reused password. You do not need a big bank’s budget to defend yourself: you need discipline on a few measures that, put together, cut the risk disproportionately to their cost. Digital hygiene is like health hygiene: trivial to say, decisive to do. Let’s look at what really matters and how to set it up without turning work into an ordeal.

Why passwords remain the weak point

The problem is not that passwords do not work, but how they are used. Three recurring mistakes explain much of the breaches:

• Reuse: the same password across multiple services. If one site is hacked, whoever stole the credentials tries them everywhere (this is so-called credential stuffing).
• Weakness: short passwords, with names, dates or dictionary words, that software guesses in seconds.
• Informal sharing: credentials passed via chat or e-mail, jotted on sheets, noted in the management system.

The practical consequence: a single data leak on an external service is enough for the attacker to get into the company mailbox, the management system or e-banking.

The minimum rules on passwords

Serious recommendations today no longer talk about “change your password every 30 days”. The current consensus is different and more effective:

1. Length before complexity: a long passphrase (several unrelated words) beats a short password full of symbols.
2. A different password for each service: never reuse it.
3. Change only on suspicion: frequent forced rotation makes things worse, because it pushes towards predictable variants.
4. No sharing in clear text: shared credentials managed only through dedicated tools.

Remembering dozens of different passwords by hand is impossible. This is where the key tool comes in.

The password manager

A password manager generates, stores and fills in strong, unique credentials, protected by a single strong master password. For an SME it changes the game: it eliminates reuse, allows access to a service to be shared without revealing the password, and lets you revoke the access of an employee who leaves the company in one click. It is the investment with the best cost-benefit ratio in all of corporate security.

MFA: the defence that matters most

If you can activate only one measure, activate multi-factor authentication (MFA). It adds a second element beyond the password: a temporary code from an app, a notification on the phone, a physical key. Even if someone steals the password, without the second factor they do not get in.

A few practical clarifications:

• Authentication apps or physical keys are more secure than SMS, which can be intercepted with SIM swapping. SMS is better than nothing, but if you can, choose the app.
• Activate MFA first of all on critical accounts: company mail, e-banking, management system, administrative access, cloud services.
• Mail is often the keystone: whoever controls it can reset the passwords of almost everything else.

The human link: phishing and common sense

Technology is not enough if a person hands over the keys. Phishing — messages that imitate suppliers, banks or colleagues to steal credentials or induce payments — remains the most widespread vector. Frauds of the “supplier IBAN change” or “urgent order from the boss” type strike companies of every size.

The habits that reduce the risk:

• Distrust urgency: pressure to act fast is the signature of a scam.
• Verify payments on a second channel: a change of bank details is confirmed by phone, not by e-mail.
• Check sender and links before clicking, without trusting the displayed name.

The other digital hygiene measures

Beyond passwords and MFA, a few practices complete the basic defence:

• Updates: up-to-date systems, browsers and applications close known holes. Postponing is a concrete risk.
• Backups: regular copies, tested and kept offline too. They are the real defence against ransomware.
• Least access: each person has only the permissions they need; the accounts of those who leave the company are disabled immediately.
• Device protection: encryption of laptops and phones, screen lock, up-to-date antivirus.

None of these is complicated. The difficulty is consistency, and that is where a written rule is needed.

How to set it up in the company

A one-page security policy, understood by everyone, is worth more than a technical document that no one reads. It must state clearly: how passwords are managed, where MFA is mandatory, how payments are verified, whom to contact in case of doubt. It is not an abstract IT topic: protecting access directly touches the protection of client and employee data required by the new Swiss law (nDPA).

SIH ONE is an AI-native fiduciary group: access security and data protection are part of how we handle clients’ information. We help you set up digital hygiene rules proportionate to your reality, without weighing down day-to-day work.

Do you want to secure your company’s access without complicating your life? Let’s talk about it.