Mission 10
Password Security, MFA and Identity Protection
Your accounts are the keys to the business. Unique passwords kept in an approved password manager, multi-factor authentication on critical accounts, and giving people only the access they need make it much harder for one stolen password to become a crisis.
In this mission you will
- Explain why every account needs a unique password and how an approved password manager makes this practical.
- Describe how multi-factor authentication (MFA) protects accounts and how to respond to unexpected MFA prompts.
- Apply least privilege and avoid shared logins so access can be tracked and removed when roles change.
- Identify the critical business accounts that should be protected first.
Identity is the new front door
Most business systems now live online: email, accounting software, banking, GST and other government portals, cloud storage, the website and the domain name. Whoever holds the login holds the door key. Attackers rarely need to 'hack' anything clever. They get a password through phishing, guess a weak one, or reuse one that leaked from another website. This chapter is about making a stolen or guessed password far less useful.
Password basics that actually help
- Use a different password for every account. If one website leaks, the others stay safe.
- Length beats complexity. A long passphrase of several unrelated words is easier to remember and harder to guess than a short jumble.
- Avoid personal details such as names, birthdays, vehicle numbers or the company name plus the year.
- Do not write passwords on sticky notes, in notebooks on the desk, or in unprotected spreadsheets or chats.
- Never share your password or OTP with anyone, including people who say they are from IT, the bank or a government office.
Password managers make unique passwords realistic
Nobody can remember dozens of unique passwords. A password manager is an app that creates strong passwords, stores them in an encrypted vault and fills them in for you. You remember one strong master passphrase, protected with MFA. Use the password manager your business has approved, so that business passwords are not scattered across personal browsers and phones. A good manager can also help with shared business accounts that truly cannot be split, by sharing access to an entry in a controlled way rather than passing the password around on WhatsApp.
MFA: a second lock on the door
Multi-factor authentication asks for something extra beyond the password, such as a code from an authenticator app, an approval prompt on your phone, a security key or a passkey. Even if someone steals your password, they usually cannot get in without that second factor. Turn MFA on first for the accounts that matter most. Where supported, prefer authenticator apps, passkeys or security keys, which are generally harder to trick than SMS codes. MFA greatly reduces risk, but it is not magic. Attackers may still try to trick you into approving a prompt or sharing a code, or steal a signed-in session through a fake page.
Least privilege and no shared logins
- Least privilege means each person gets only the access needed for their job, and nothing more. The sales team does not need banking access.
- Admin rights are for administrative tasks only. Daily work should use a normal account.
- Each person should have their own login. Shared logins hide who did what and make it hard to remove one person’s access.
- When someone changes role or leaves, update or remove their access the same day, including email, cloud storage, banking and any shared accounts.
- Review who has access to critical systems every few months and remove what is no longer needed.
Practical business example
One password, five accounts at Patel Agro Traders
Patel Agro Traders is a fictional 15-person seed and fertiliser distributor in Anand. The owner Hitesh used one familiar password for his email, the accounting software, a supplier portal and an online shopping site. The office also shared a single email login among four staff. When the shopping site suffered a data leak, criminals tried the same email and password on other services. They got into Hitesh’s email and began reading supplier conversations. The accountant Nisha noticed a strange 'Re: payment details' email in the shared Sent folder and raised it the same day. With help from their IT partner, the business reset passwords, signed out unknown sessions, turned on MFA for email and accounting, and adopted an approved password manager. Each staff member got a personal login, and Hitesh now reviews access every quarter.
The lesson: Password reuse turned one leak into an email takeover. Unique passwords, MFA and individual logins would each have made it much harder. Nisha’s quick report limited the damage.
Key takeaways
- Use a unique password for every account, kept in the password manager your business has approved.
- Turn on MFA for critical accounts first: email, banking, accounting, cloud administration and the domain registrar.
- Deny and report any MFA prompt you did not start. Never share passwords or OTPs with anyone.
- Give each person their own login and only the access they need, and remove access promptly when roles change.
- MFA reduces risk a great deal but does not remove it. Stay alert to fake sign-in pages and 'support' calls.
Scenario lab · +25 XP
Prompts in the middle of lunch
You are an executive at Kaveri Logistics, a fictional 30-person transport company in Mysuru. You are eating lunch, nowhere near your laptop, when your phone shows a sign-in approval request for your work email. You dismiss it. Two more arrive in quick succession.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
What do you do with the prompts?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Check MFA on your critical accounts
Make a simple status list of the accounts that matter most. Record status only. Never write down passwords, OTPs, recovery codes or account numbers.
- 1.List your critical accounts by name only: business email, net banking, accounting software, cloud storage or admin, domain registrar and website hosting, and key government portals.
- 2.For each, note whether MFA is on, off or unknown, and the type if known (app, SMS, passkey or key).
- 3.Note who has access to each account and whether any login is shared.
- 4.Pick the highest-risk account with MFA off, and agree with the owner or IT partner a date to switch it on.
- 5.Plan to replace one shared login with individual accounts or a controlled password-manager share.
- 6.Put a reminder in the calendar to review this list in three months.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress