Someone Has Your Password. Now What?

Imagine arriving at work tomorrow and discovering someone has your email password.

Not an old password. Your current password.

What could they access? What could they learn? And what other accounts could they reach from there?

During Cybersecurity Awareness Month, we spend a lot of time talking about creating strong passwords.

That’s important. But there’s a scarier question:

What happens when someone gets the password anyway?

The Password Works. The Person Using It Shouldn’t Be There.

A criminal doesn’t necessarily need to “hack” through layers of complicated cybersecurity defenses.

Sometimes they can simply log in.

Consider how much of your business can potentially be accessed through a username and password:

Email.

Banking.

Payroll.

Cloud storage.

Customer information.

Accounting.

Social media.

Your website.

That’s why multifactor authentication, commonly called MFA, has become such an important cybersecurity protection.

MFA requires another form of verification in addition to the password.

If someone obtains the password, that additional step can create another barrier between them and your business.

Check Your Cybersecurity Ghosts

If you thought ghosts weren’t real, think again.

There’s a problem hiding inside many businesses:

Old accounts and unnecessary access.

Employees leave. Vendors change. People change positions.

But their access doesn’t always leave with them.

Like ghosts from the past, old accounts and active credentials can remain long after the person who used them is gone. And unlike the ghosts we worry about in October, these can create a very real cybersecurity risk.

Ask yourself: Who has access to our important systems? Who has administrator privileges?

Do former employees still have active accounts? Are employees sharing passwords?

Does everyone with access actually need it?

These questions don’t require a cybersecurity department to begin answering.

They require someone to ask them.

Cybersecurity isn’t simply about keeping criminals out.

It’s about making sure the right people have the right access for the right reasons.

uRISQ helps SMBs approach cybersecurity and privacy as an ongoing process rather than something dependent on spreadsheets, emails or someone’s memory.

Here’s this week’s Click or Treat? challenge:

Identify the five accounts that would scare you most if someone else controlled them.

Check the passwords. Check MFA. Check who has access.

Then ask yourself:

If someone stole one of those passwords tonight, what would stop them tomorrow?