Four online security measures protect most business accounts. Use strong and distinct passwords with a password manager. Enable multifactor authentication on every account with that option. Recognize and report phishing messages and install software updates promptly. Give administrator accounts extra protection and the least access they need.
Your staff sign in to email, banking and cloud tools every day. Attackers know that one stolen password can open all of them.
This guide lists the online security measures that official sources recommend and adds the extra steps that administrator accounts need.
What are the Four Core Online Security Measures?
CISA lists four core behaviors in its Secure Our World campaign. See Secure Our World.
| Measure | What CISA States |
|---|---|
| Strong passwords | Strong and distinct passwords with a password manager reduce the chance that others log in to your accounts |
| Multifactor authentication | Uses more than a password to open an app or account |
| Phishing awareness | Phishing tries to make you open a harmful attachment or share personal information |
| Software updates | Flaws in software can give criminals access so install updates promptly |
How do You Create Strong Passwords for Business Accounts?
- Use a different password for every account. Then a leaked password opens only one door.
- Store passwords in a password manager. CISA names the manager as part of the strong password step.
- Share no passwords by email or chat. Give staff their own accounts instead.
Why does Multifactor Authentication Matter?
CISA explains that multifactor authentication means using more than a password. You can be asked for a text code or a fingerprint, which makes it much harder for someone to enter your account.
Microsoft recommends multifactor authentication for all administrator accounts and states that an account with it is 99.9 percent less likely to be compromised. See Microsoft Entra role best practices.
How do You Recognize Phishing?
- Check the sender address before you open an attachment.
- Do not share personal information because a message asks for it.
- Report suspicious messages to your security contact.
- Delete the message after you report it.
Why do Software Updates Matter?
CISA states that programmers release fixes for flaws that give criminals access to files or accounts. Install updates for operating systems, browsers and business apps as soon as they appear.
How do You Protect Administrator Accounts?
Microsoft recommends least privilege. Grant administrators exactly the permission they need for a specific scope and time.
- Limit Global Administrators. Microsoft recommends fewer than five people in that role.
- Limit privileged role assignments. Microsoft recommends fewer than ten.
- Create emergency access accounts. Microsoft recommends two cloud only accounts for break glass cases.
For the larger picture see the main cyber security challenges for business. For cloud controls see data protection controls for business cloud data.
Frequently Asked Questions
What are the Most Important Online Security Measures?
CISA names four. They are strong passwords with a password manager, multifactor authentication, phishing awareness and software updates.
What is Multifactor Authentication?
CISA defines it as using more than a password to access an app or account.
Does Multifactor Authentication Reduce Risk?
Microsoft states that an account with it is 99.9 percent less likely to be compromised.
How Many Global Administrators should You Have?
Microsoft recommends fewer than five.
Why Update Software Quickly?
CISA states that flaws in software can give criminals access, and updates carry the fixes.
Key Takeaways
- CISA names four core measures that protect business accounts.
- Password managers store strong and distinct passwords.
- Multifactor authentication adds a second proof of identity.
- Updates carry fixes for flaws that criminals use.
- Administrator accounts need least privilege and multifactor authentication.
Sources and References
This guide follows CISA and Microsoft documentation.
- Secure Our World (CISA) www.cisa.gov
- Best Practices for Microsoft Entra Roles (Microsoft Learn) learn.microsoft.com