One of the things we hear most often from small business owners is some version of this: “My business is too small. Nobody is going to bother attacking us.”
It is an easy belief to hold, and it is an easy one to dispel. Nobody is sitting at a keyboard picking your company out of a list. It is not a live person attacking your business. It is a bunch of scripts, and increasingly AI, scanning the entire internet looking for any vulnerability anywhere, business or otherwise. When one of those scripts finds a weakness, it tries to exploit it. Only after it gets in does anyone look at who you actually are. At that point they monetize you. They look at your business, or your personal computer, and decide how much effort and work they are willing to put in to see how much they can get out of you, either in ransom or extortion of some kind.
You were never targeted. You were simply found.
The harder conversation: why credential theft matters
That first one is easy to explain. The much harder one is explaining how credential theft actually hurts a customer. The question we get constantly is, “Why do we need multi-factor authentication for our computers, or for our Microsoft 365?” The answer is less intuitive than people expect, because the way stolen credentials get used is not obvious from the outside. So let me walk through it.
Problem number one: people reuse passwords
Employees reuse passwords. If you are my age, and I am fifty-three, that is simply how it was done. You had a couple of passwords you cycled through, and maybe you changed a few numbers. It was usually something memorable, like your kid’s name and a number, or your kid’s name and a special character and a number, whatever the requirements happened to be. Then when forced password changes became common fifteen or twenty years ago, you changed the number. If your kid’s name was Steve, your password was Steve, pound sign, one hundred. Then it expired, so it became Steve, pound sign, one hundred and one.
Because people do not remember things well, they write them down and store them insecurely. That is the first problem. The second problem is that even when they do memorize a password, they want to use that same one everywhere, precisely because they have memorized it. So every account they own becomes a variation of the same string. Your bank might be one hundred, and then eventually one hundred and one. With a few guesses, someone could get into any account you have.
Then a website you used gets breached
All of that seems harmless on the surface, right up until that email address and password get reused on a site that is later compromised. Amazon, LinkedIn, Yahoo, or any of the cloud services where you used your work email address and your usual password.
When that happens, the threat actor gets your email address and your password. And I say threat actor deliberately, not attacker. They are not an attacker yet. They are simply gathering the data they need to become one once they gain access.
From your email address, tracing back to your company is trivial. Your email address contains your company’s domain. They type that domain into a browser, land on your website, and now they know who you are. A little forensic work tells them what your company does and whether you look valuable.
Then the scripts go to work
Next they run scripts against a hundred different websites commonly used by businesses. QuickBooks Online, using your login and password. Microsoft 365, using your login and password. And not just the one password. A hundred variations of it, spread out over a period of time.
If your current password is Steve, pound sign, one hundred and one, and the breach handed them a stale one that was Steve, pound sign, ninety-nine, they will try one hundred and one hundred and one. They will try a hundred different numbers. They know, just like I know, that you are going to increment that number, or decrement it, or nudge it. That is not hard to crack.
So once they have your email address and a password, and they have tried every common portal and every variation, they are very likely to get in as your employee somewhere. It might be the employee’s Facebook page. It might be your QuickBooks Online. It might be the employee’s email. It might be another hosted application entirely. With software-as-a-service and cloud-based apps becoming so predominant, we are seeing compromised accounts used against every common cloud application an employee might touch. Usually, they get into one or more of them.
So how do you defend against it?
1. Multi-factor authentication on anything mission-critical
First and foremost, you should have multi-factor authentication on any account that is mission critical to your business. Microsoft 365. Local computers, which helps even if someone gains physical access. VPN connections into your corporate network that use only a username and password. Terminal servers, remote desktop session hosts, and anything similar.
Multi-factor authentication fends off a great deal. Except when they run a saturation attack at two o’clock in the morning, and this happens more often than people realize. The threat actor tries to log into your Microsoft 365, and the prompt lands on your employee’s phone. They deny it. They deny it again. And again. And again. And eventually your employee, who frankly is not as vested in this as the owner or manager reading this, thinks, I have got to sleep tonight. Clearly this is a glitch. And they tap accept.
Just like that, they handed over access to their email. And the logs will show your employee, on their own mobile device, approving it.
2. Phishing testing and security awareness training
Which rolls straight into the next requirement. You have to provide phishing testing and training that teaches your employees how to recognise these threats, and what to do to stop the annoyance in a way that does not involve handing an attacker the keys. Because in that moment you do not know, you do not care, and you are tired. That is exactly when they get you. They wait until you are tired or not paying attention.
3. An enterprise password management system
The next one we are very big proponents of is an enterprise password management system. In my opinion, every single company should roll one out to every employee, paired with a policy stating that all corporate passwords must be stored in the password manager and must meet the company’s password standards.
A proper enterprise system lets you set password complexity and expiration. It should check your email addresses and passwords against the dark web to see if they have been published anywhere, and notify you, your employees, or both when something surfaces, so you know to change it. That alone makes your organisation meaningfully more secure.
Does it create extra effort for your employees? Kind of. And I say kind of because modern password managers include browser plugins that make it quick to enter, create, restore, and manage passwords. They let you share passwords between employees with access logging. They let you grant temporary access to a third-party vendor that expires automatically, managed by an employee directly. The list of capabilities goes on. A good one also has a mobile app for recalling passwords on the go.
One serious caveat. If your password manager itself is ever compromised, that creates enormous problems for your organisation. So make sure whatever system you choose holds the right certifications and has never been breached. I would never trust a password manager from a company that has been compromised in the past. Time and again, companies that get compromised once get compromised again. It is very common for organisations not to truly get with the program after an attack.
4. A written policy, and actual verification
Now you have your password manager rolled out to every employee. You need a policy to go with it, stating that employees must keep all passwords secured in the corporate password management system.
Then, periodically, test it. Go to an employee and say: You access these four mission-critical websites on behalf of our company. I want you to pull the password up out of the manager and use it to log in, so I can verify you are using the system we paid for to secure our data.
You will be shocked how few employees adopt the password manager, no matter how hard you work at it. But with training, clear expectations, and possibly a little disciplinary action, you can get your employees to start protecting your environment.
5. No password reuse. Ever.
The last piece is making sure your employees know they are not allowed to reuse passwords, ever, for any reason. That belongs in both the training and the written password management policy.
A word about pushback
I want to be honest about something. These changes often generate a lot of pushback inside an organization. Ultimately, your organization has to decide how secure it wants to be. If you decide this is a bridge too far, that is absolutely your right to choose.
But if your organization says it wants to be secure, these are some of the minimum things you should be doing. There is much more you can do beyond this. What makes this list worth starting with is that it is low cost. What it is not is low effort. It takes real management attention, and adoption can be genuinely difficult in some parts of a business. Keep that in mind going in.
We’re on IT!
At The ArcLight Group, we have spent eighteen years helping Tulsa-area businesses put exactly these protections in place, from multi-factor authentication and phishing training to enterprise password management and dark web monitoring. If you would like an honest conversation about where your organization actually stands, give us a call at (918) 270-6600 or visit arclightgroup.com.
Brian Largent
Father to five, husband to one, founder, CEO, and all around swell fella (or so I'm told)
