Password security: why your business needs a password vault

Why passwords are the weak spot

Most cyber incidents affecting small businesses don't start with clever hacking. They start with a stolen or guessed password — often one that was reused from a website that had a data breach years ago. Once someone has that password, they try it everywhere: your email, your bank, your accounting software.

For a business, the stakes are high. Access to your email can be used to send fake invoices to your customers or change a supplier's bank details. Access to payroll or accounting software exposes staff tax file numbers, bank accounts and your financial records.

Habits that put you at risk

We see these regularly when we start working with a new client:

• The same password (or a small variation) used across several accounts.
• Passwords kept in a spreadsheet, a notebook or the notes app on a phone.
• One shared login used by several staff, so nobody knows who did what.
• Former staff or contractors who still know current passwords.
• Passwords sent by email or text message.

What a password vault actually does

A password vault (or password manager) is an app that stores all your passwords in an encrypted vault, protected by one strong master password. It works on your computer and phone, and fills in logins for you — so you only ever need to remember one password.

Because you don't have to remember them, every account can have its own long, random password generated by the vault. If one website is breached, nothing else is affected.

• Generates strong, unique passwords for every account.
• Fills logins automatically, which also helps protect against fake look-alike websites.
• Lets you share specific logins with staff or your bookkeeper securely — without revealing the password in an email.
• Lets you remove someone's access instantly when they leave.
• Alerts you if a saved password appears in a known data breach.

Choosing a password vault for your business

Well-known options include 1Password, Bitwarden, Keeper and Dashlane, and most offer business plans for a few dollars per user per month. When comparing them, look for:

• A business or team plan with shared vaults and admin controls.
• Apps for every device your team uses.
• Support for multi-factor authentication on the vault itself.
• A clear recovery process if someone forgets their master password.

Don't forget multi-factor authentication

A password vault works best alongside multi-factor authentication (MFA) — a code from an app or a prompt on your phone as well as your password. Xero, QuickBooks Online, MYOB, most banks, myGov and the ATO's online services all support it. Turn it on for every account that offers it, starting with email, banking and your accounting software. The Australian Signals Directorate's cyber.gov.au site has free, plain-English guides for small businesses.

Getting started this week

• Pick a password vault and set up a business account.
• Create a long, memorable master password — a passphrase of four or more random words works well.
• Start with your most important logins: email, banking, accounting software and payroll.
• Change any reused passwords to new ones generated by the vault.
• Give each staff member their own login rather than sharing one.
• Turn on MFA everywhere it's available.

How we keep your data safe

As a Registered BAS Agent, we take access to your financial systems seriously. We use our own individual logins for your accounting software rather than shared passwords, and exchange documents through our secure client portal. If you'd like to tidy up who has access to your Xero, QuickBooks Online or MYOB file, our Cairns team is happy to help.