Password Management for Business

Key facts

• Password management covers four things: generating strong unique credentials, storing them securely, sharing them between staff in a controlled way, and removing access when a person or a role changes.
• Credential reuse is the core problem. When one service is breached anywhere on the internet, every other account using that same password is exposed, regardless of how good your own security is.
• A business password manager differs from a personal or browser-based one in the areas that matter to an employer: structured sharing, per-vault permissions, reporting on reuse and breach exposure, an audit trail, and central removal of access.
• Offboarding is where most businesses are exposed. Without a password manager, revoking a departing staff member’s access means remembering every system they had a login for.
• Password management does not replace multi-factor authentication. One defeats reuse and guessing, the other defeats a password that has been stolen outright. You need both.
• 4iT deploys 1Password as our standard platform, and we support businesses already running a different password manager rather than insisting on a migration.

Why does password management matter more than most security spending?

Because of where attacks against small businesses really begin. The picture people carry around is a targeted attacker studying their company, but the common reality is automated and indiscriminate: a large set of email addresses and passwords from some unrelated breach gets tried against everything from Microsoft 365 to banking portals, and wherever someone reused a password, it opens. No exploit, no malware, no sophistication. Just a credential that was already valid somewhere else.

That is a solvable problem, and solving it costs less than almost anything else on a security roadmap. Once credentials are generated and stored rather than remembered, unique passwords stop being advice people ignore and become the default. It is worth being clear about the sequencing: a business with reused passwords and no offboarding process, spending on advanced threat detection, has bought a smoke alarm for a house with the front door open.

What does good password management look like in practice?

It has four parts and they are not equally hard. Generation and storage are close to automatic once a password manager is in place. Sharing is where the design work goes, because credentials need to reach the people who need them without everyone having access to everything. Removal is where discipline is required, because it depends on someone doing it when a person leaves.

In a well-set-up business, credentials sit in vaults organised by function rather than by person, so the finance team reaches the banking and accounting logins, and operations reaches the systems they run. Permissions distinguish between people who may use a credential and people who may change or share it. Nobody, including the business owner, needs to hold a list of every password. An administrator can see that there are reused or breached passwords in a given vault and get them fixed, without being able to read the passwords themselves. That separation of oversight from access is the part most homegrown approaches get wrong.

What is wrong with a spreadsheet or the browser?

A shared spreadsheet fails on every dimension at once. Anyone with access can copy the whole thing, there is no record of who looked at what, removing one person’s access to one credential is impossible without changing it for everyone, and the file itself is usually protected by a password that is also in the spreadsheet. It is the single most common arrangement we find when we start with a new client, and it is the first thing we change.

The browser’s built-in manager is better, and for personal use it is a reasonable choice. As a business system it falls short in specific ways: credentials are tied to an individual’s browser profile, so they leave when the person leaves and are hard to recover if that account is lost; there is no structured sharing between staff; there is no reporting on reuse or breach exposure; and there is no audit trail. It solves convenience and leaves governance untouched, which is fine for one person and not fine for a business with staff turnover.

How does 4iT deploy and manage it?

We start with discovery, because credentials are always in more places than anyone expects: browsers, spreadsheets, notes apps, email, and people’s memory. Then we design the vault structure around how the business is organised, rather than importing the existing mess into a better tool. Permissions, administrator roles and sharing rules are set deliberately. Where you have an identity platform, we connect single sign on and automated provisioning so accounts follow the directory instead of being maintained by hand. The applications and browser extensions are deployed across the fleet so nobody has to install anything.

Adoption decides whether it works, so staff are taken through it properly rather than sent a link. After that it is ongoing: breach and reuse reports get acted on, vaults get tidied as teams change, joiners and leavers are handled as they happen, and the audit trail is available when an insurer or auditor asks for it. Password management is one layer, and it sits alongside multi-factor authentication, identity and access management, dark web monitoring and security awareness training.