Passwords, MFA and Password Managers: Fixing Your Weakest Link

Ask how most break-ins start and the answer is often a stolen or reused password. Employees reuse the same password across sites, write them on sticky notes, or enter them on a convincing fake login page. The fix is not to ask people to be perfect; it is to make a single stolen password much less useful.

Turn on multi-factor authentication

MFA asks for a second proof, such as an authenticator app prompt, in addition to the password. Start with email and Microsoft 365, remote access and any admin accounts. Authenticator apps or hardware keys are stronger than text messages where you have the choice.

Use a password manager

A business password manager generates long unique passwords, fills them in only on the correct site, and lets you share credentials without pasting them into chat. It also makes offboarding simple.

Write a short, realistic policy

• Unique password for every account.
• MFA required wherever it is offered.
• No sharing passwords by email or text.
• Report suspicious login prompts right away.

Train for the fake login page

Phishing messages try to get people to type a password on a look-alike site. Short, regular training with realistic examples helps staff pause before they click.

Let someone own it

Enforcement, reporting and onboarding checks are part of managed security, so they do not depend on one person remembering.

Related reading

• managed cybersecurity for Portland businesses
• Managed IT in Portland
• Cybersecurity for small businesses (2026)

Talk to a local team

PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.