Password & Access Hygiene: The Fundamentals That Still Matter Most

← Back to Insights

It’s tempting to assume that as attacks get more sophisticated, the fixes need to get more sophisticated too. In practice, a large share of real-world breaches still trace back to something basic: a weak password, a reused credential, or an account that had more access than it needed.

Why credentials are still the weak link

Passwords are easy to phish, easy to reuse across systems, and easy to guess when they’re predictable. Once an attacker has valid credentials, they don’t need to exploit a vulnerability at all — they can simply log in. That makes access hygiene one of the highest-leverage areas of security to get right.

Practices that actually reduce risk

• Multi-factor authentication everywhere it’s supported. A stolen password alone should never be enough to get in.
• Unique credentials per system. Password reuse means one breach elsewhere becomes a breach here too.
• Least-privilege access. People and service accounts should only have the access they actually need for their role — not more, and not “just in case.”
• Regular access reviews. Permissions should be revisited when someone changes roles, and removed promptly when someone leaves.
• No shared or generic accounts. Shared logins make it impossible to know who actually did what.

Where organizations usually fall short

Not in having no policy — most do. It’s in enforcement drifting over time: MFA rolled out for some systems but not others, access granted for a project that was never revoked afterward, and accounts belonging to people who left the organization months ago still sitting active.

A practical starting point

Start with an honest access review: who has access to what, whether that access is still needed, and whether MFA is actually enforced everywhere it should be — not just where it was easiest to turn on.