October is Cybersecurity Awareness Month, and we’re spending it on the basics that actually stop attacks on Chicago small businesses. This week: the front door.
Most break-ins at small offices don’t involve a hacker cracking code. Someone gets a staff member’s email password, through a fake login page, a reused password from an old breach, or a lucky guess, and simply logs in. From there they can read invoices, email your customers as you, and reset passwords for your bank and payroll accounts.
The good news: one free setting stops most of these attacks cold. It’s called multi-factor authentication, or MFA.
What MFA is, in plain English
MFA means a password alone isn’t enough to get in. After typing the password, you also confirm it’s really you, usually with a tap on an app on your phone or a short code.
Think of it like your office building: a key gets you through the front door, but you still need the alarm code. A thief with a stolen key still trips the alarm.
The most common options, from strongest to weakest:
- Security key or passkey (a small USB key or your phone’s built-in passkey): hardest to fake, great for owners and anyone handling money.
- Authenticator app (Microsoft Authenticator, Google Authenticator): the best everyday choice for most staff.
- Text message code: better than nothing, but weaker, because phone numbers can be hijacked. Use it only when nothing else works.
Which accounts to protect first
You don’t have to do everything this week. Start at the top of this list and work down:
- Business email (Microsoft 365 or Google Workspace). Email is the master key, because every other password reset goes through it.
- Banking and payroll. Anywhere money moves.
- Admin accounts. Your domain registrar, website login, and any “global admin” account in Microsoft 365 or Google.
- Accounting software like QuickBooks or Zoho Books.
- Remote access tools and your Wi-Fi or firewall admin page.
- Social media pages. A hijacked Facebook or Instagram page can scam your own customers.
If you only do one thing after reading this, turn on MFA for every email account in your business, including the owner’s.
Passwords: three simple rules
MFA is the alarm, but the key still matters. Keep it simple:
- One account, one password. Reusing a password means one leaked website opens every door. This is the most common problem we find in small offices.
- Longer beats complicated. A phrase like “blue-taxi-on-Clark-Street” is easier to remember and harder to crack than “P@ssw0rd1!”.
- Use a password manager. Tools like Bitwarden, 1Password, or the manager built into Microsoft Edge or Google Chrome remember everything for you. Business versions let you share logins with staff safely and remove access the day someone leaves.
And please: no more passwords on sticky notes under the keyboard, or in a spreadsheet called “Passwords.”
“But…” — what we hear from business owners
“We’re too small to be a target.” Attackers don’t pick businesses by size. They send millions of automated login attempts and fake emails, and small offices are often the easiest ones to get into.
“My staff will hate it.” Most apps let you mark a computer as trusted, so people approve a login once every few weeks, not every hour. Setup takes about five minutes per person.
“It costs too much.” MFA is included free in Microsoft 365 and Google Workspace. Most banks and payroll services offer it at no charge too.
“What if someone loses their phone?” That’s a solvable problem. Set up backup methods and recovery codes during setup, and have one admin who can reset access. This is part of what we set up for clients.
Get a free 15-minute MFA check
Not sure which of your accounts are protected? We’ll look at your Microsoft 365 or Google Workspace setup and tell you, in plain English, which accounts are missing MFA and what to fix first. No cost, no obligation.
Book your free MFA check — or call 2nd Chance PC Techs at 773-800-7544.
Coming up in this series:
- Next week: Microsoft gave home PCs another year on Windows 10. Your business PCs didn’t get the same deal.
- After that: Spot the Phish: 7 red flags your staff should catch in 5 seconds.
2nd Chance PC Techs is a Chicago-based managed IT provider helping small businesses and nonprofits stay secure, with 17 years of hands-on IT experience behind every recommendation.