Password managers and MFA: the two cyber security wins every business needs.

If I could get every small business in Perth to do just two things for their cyber security, it would be these: use a password manager, and turn on multi-factor authentication. Together, they stop a huge share of the account takeovers I see. They're cheap, and once set up, they're easy.

Why passwords alone aren't enough

Most people reuse passwords, or use small variations of the same one. When any website you've ever signed up to gets breached, those passwords end up on lists that criminals try against email, banking and business accounts. If your password works on one site, they'll try it everywhere.

Password managers: the easy fix

A password manager is an app that creates and remembers a strong, unique password for every account. You only remember one main password. It fills in the rest for you on your computer and phone.

• Every account gets a different, long password.
• You can securely share logins with staff without texting them.
• When someone leaves, you can remove their access in one place.

Reputable business password managers cost a few dollars per person per month. Choose one with business features like shared vaults and admin controls.

Multi-factor authentication: the second lock

Multi-factor authentication, or MFA, means that logging in needs something extra besides your password, usually a code or a prompt in an app on your phone. Even if someone steals your password, they can't get in without that second step.

Turn it on first for:

1. Your email, because it's the key to resetting everything else.
2. Banking and payment accounts.
3. Accounting software.
4. Your website and domain accounts.
5. Social media accounts.

Where you can, use an authenticator app rather than SMS codes. Text messages are better than nothing, but apps are harder to intercept.

Getting your team on board

• Set it up together in a short session, rather than sending an email and hoping.
• Explain why: one compromised staff email can be used to send fake invoices to your customers.
• Store recovery codes somewhere safe, so a lost phone doesn't lock anyone out.

One afternoon, big difference

For a small team, this is usually an afternoon's work. It won't make you bulletproof, but it closes the doors most attackers try first. For the full list, read cyber security basics every Perth small business needs, or the Australian Cyber Security Centre's guidance at cyber.gov.au.

If you'd like a hand setting this up for your team, my cyber security service covers exactly this. Get in touch.