A strong password is only the front door.
Protecting an account takes more than a clever password. It means proving who you are, limiting what each person can reach, and spotting when someone is trying to get in uninvited.
The short version
- Passwords can be stolen. Back them with MFA.
- Give people only the access they need, for only as long as they need it.
- Biometrics are convenient, but they can’t be changed if exposed.
- If an approval prompt isn’t yours, deny it and report it.
Are strong passwords enough?
Long, unique passwords and passphrases still matter. But passwords have one unavoidable weakness: they can be stolen.
Cybercriminals can get hold of passwords through phishing, data breaches, malware or fake login pages. Even a complex password can’t protect an account if someone is tricked into typing it into a fraudulent website.
That’s why good account security works in layers. The password is one layer. Multi-factor authentication (MFA) is another: an extra check, such as an authenticator app, a security key or a biometric scan, that an attacker can’t easily copy.
A strong password helps protect against
- Automated password-guessing attacks
- Criminals trying common or predictable passwords
- One breached account exposing your other accounts
But it can’t stop
- A phishing site capturing the password
- Malware recording what you type
- A reused password turning up in a data breach
- Someone approving a fraudulent login request
Use a unique passphrase for every account, keep it in an approved password manager, and switch on MFA wherever it’s offered.
Limit access, reduce risk.
Everyone needs access to files, systems and applications to do their job. Nobody needs access to everything.
Overprivileged access happens when someone holds more permissions than their current role requires. It builds up quietly: access granted “just in case”, temporary permissions nobody removes, or a change of role where the old access stays.
Each extra permission is one more thing that can go wrong if the account is compromised, misused or simply mistaken. Here’s how it adds up.
A larger target for attackers
If an overprivileged account is compromised, the attacker may reach sensitive data or systems that the employee rarely uses.
Bigger consequences for mistakes
An accidental deletion, a wrong file-sharing setting or a misdirected message does more harm when the user has broad permissions.
Increased insider risk
Excessive access gives careless and malicious insiders more opportunity to view, copy, change or remove information.
Harder access management
Outdated permissions make it difficult to know who can reach sensitive resources, and whether they still should.
Only the access needed for current responsibilities, and only for as long as it’s needed.
Review permissions whenever someone changes roles, finishes a temporary project or leaves the organisation.
Security at your fingertips.
Biometrics use physical or behavioural traits to help confirm that you are really you.
Fingerprint readers and facial recognition are already common on phones, laptops and workplace systems. Some technologies can also assess a person’s voice, eyes or even the way they type.
Biometrics make signing in faster because there’s no extra code to remember or enter. They can also reduce our reliance on passwords that may be guessed, reused or stolen.
A fingerprint or face scan gives quick access.
Attackers can’t get a biometric by guessing a password.
A biometric can unlock a device-based passkey without sending the biometric itself.
Biometrics can be one part of multi-factor authentication.
Attackers may also try photographs, recordings, deepfakes or other tricks to imitate biometric traits. Secure systems use protections such as “liveness detection” to confirm a real person is present, but no employee should assume biometrics make an account untouchable.
Use biometrics wisely
- Use biometrics only on trusted, organisation-approved devices and services.
- Keep devices and biometric software up to date.
- Combine biometrics with other safeguards when required.
- Report unexpected authentication prompts or repeated failed scans.
- Never approve access just because a biometric prompt appears.
MFA fatigue attacks.
Repeated approval prompts can be the last step of an account takeover attempt. Here’s how one plays out.
The prompts start
Brian is finishing work when several login approval notifications appear on his phone. He denies the first few, assuming someone typed the wrong details.
“IT” calls
A caller claiming to be from his company’s IT department says a system fault is causing the notifications. To “fix” his account, he just needs to approve the next one.
The caller is the attacker
A cybercriminal already had Brian’s password and was signing in repeatedly. The notifications weren’t an error. They were the final barrier protecting his account.
Did you spot the red flags?
How to protect yourself
Never approve an unexpected MFA request. Deny it and report it through your organisation’s approved process.
Verify IT requests independently. Contact your IT team on a trusted phone number or internal channel, not contact details given by the caller.
Your two-minute security check.
Tick what you’ve already done this month.
Protecting Digital Access
Why secure authentication is about more than passwords.
Turn the page to start.
Protecting access from four angles.
- Are strong passwords enough?
- Limit access, reduce risk
- Security at your fingertips
- Scam of the month: MFA fatigue
Passwords matter. They aren’t enough alone.
Phishing, data breaches, malware and fake login pages can expose even a complex password.
Layers work better: a unique passphrase, a password manager, and MFA wherever it’s offered.
Limit access, reduce risk.
Overprivileged access builds up when people keep permissions they no longer need: “just in case” access, forgotten temporary rights, old role access.
More access means a bigger target, costlier mistakes, more insider risk and harder management.
Security at your fingertips.
Fingerprint and face recognition are quick, resist password theft, and can unlock device-based passkeys.
But they can be imitated with photos, recordings or deepfakes, and they can’t be changed if exposed.
MFA fatigue attacks.
Brian gets repeated login approvals. Then “IT” calls and asks him to approve the next one to fix it.
The caller is the attacker, who already has Brian’s password. The prompts were the final barrier.
Three things to remember.
- Passwords plus MFA, always
- Least access, reviewed often
- Deny what you didn’t start
Stay safe out there.
Spotted something suspicious? Report it through your organisation’s approved process.