Ask a small business where its passwords live and you’ll often get an uncomfortable laugh. A spreadsheet on the shared drive. A notebook in the top drawer. One password, changed slightly, used for everything. The owner’s memory.
Managed IT for small and medium-sized businesses is part of what I oversee at DirecTech Connect, and if I could ask every small team to adopt one tool this year, a password manager would be near the top of the list. Here is why, and how to start without turning it into a big project.
What a password manager does. It is an app that stores passwords in an encrypted vault. Each person unlocks it with one strong master password plus a second step, like a code on their phone. From there it can create long, random passwords for every account, fill them in automatically and share them safely with the people who need them.
Why it matters for a small team. Reused passwords are one of the most common ways small businesses get broken into. When a website an employee signed up for is breached, attackers try that same email and password everywhere else. A password manager makes it practical to use a different password for every account, because nobody has to remember them.
It solves the shared-login problem. Every small business has accounts that several people use: the supplier portal, the social media pages, the domain registrar, the bank. Instead of passing those around by text or keeping them in a spreadsheet, put them in a shared folder in the password manager. People can use them, and you control who has access.
It makes departures cleaner. When someone leaves, you remove them from the password manager and they lose access to the shared vault at once. Then change the passwords on the shared accounts they used. Without a central list, you are guessing which accounts they knew.
Here is how I would start.
1. Choose a business plan, not a personal one. Look for a version built for teams, with shared folders, an admin console and a way to recover access if someone forgets their master password. Business plans also let you remove a person’s access in one step.
2. Start with the owner and the shared accounts. Set it up for yourself first, then move the logins everyone shares. That gives the rest of the team an immediate reason to use it, because it becomes the only place to find what they need.
3. Organize shared folders by role. Create folders like “Office,” “Marketing” and “Accounting,” and share each one only with the people who need it. The bookkeeper doesn’t need the social media login, and the marketing help doesn’t need the bank.
4. Protect the vault with multi-factor authentication. The password manager holds everything, so it deserves more than a password. Require MFA for every user. If MFA is new to your team, my piece on phishing and MFA basics explains it in plain terms.
5. Give everyone fifteen minutes of training. Show them how to install the browser extension and the phone app, save a new login and use the password generator. Most people are won over the first time it fills in a password for them.
6. Retire the old lists. Once everything has moved, delete the spreadsheet and shred the notebook. A password manager doesn’t help if the old list is still sitting on the shared drive.
7. Plan for the master passwords. Master passwords should be long phrases that are easy to remember and hard to guess. Decide ahead of time how the business gets back into critical accounts if the owner is unavailable, and write that plan down somewhere secure.
A password manager won’t stop every threat. It works best alongside multi-factor authentication on your important accounts and a habit of questioning unexpected emails. But for the cost and effort involved, few changes do more to protect a small team.
Start with the shared accounts this week, and bring everyone else in from there.
Danielle Lemons is Vice President of Operations at DirecTech Connect, a Nashville provider of business phone systems, managed IT services, websites and digital marketing. More about Danielle.
Read more of Danielle’s writing, or see her profile at DirecTech Connect.
