Passwords, two-factor authentication and passkeys at work

01The door attackers use most is a password

In films, cyberattacks are black screens full of code and someone who "hacks" a system in a few seconds. In the reality of a shop, a professional office or a small business, the most common attack is far less spectacular: someone walks in with the keys. A guessed password, a password stolen from another site, a password handed over without noticing to a fake page.

A scene that happens again and again. A shop owner has used the same password for years for email, for the business software and for the site where he orders stock. One day that supplier site suffers a breach and the list of users goes up for sale. Nobody warns the owner. A few weeks later someone gets into his inbox, reads the invoices and writes to customers with a changed IBAN. Nobody "hacked" anything: the key was the same for every door.

The four most common techniques

• Phishing. An email, a text or a message that imitates the bank, the courier, the supplier or the email provider, and leads to a page identical to the real one where you type your password. I also cover it in the chapter on professional business email, because the defense starts with your mail.
• Credential stuffing: whoever has stolen the list of emails and passwords from one site tries them automatically on hundreds of other services. It works because so many people reuse the same password.
• Password spraying: instead of trying a thousand passwords on one account, the attacker tries one very common password, such as the company name followed by the year, on every account in the organization.
• Guessed passwords: birth dates, children's names, the name of the shop, "Summer2026!". A program tries them in a few seconds, starting from what can be found on social media.

To find out whether one of your email addresses has appeared in a known breach, there is a free public service, Have I Been Pwned: you enter the address and see which stolen lists it appears in. If the answer is yes, the password used on that site must be considered public, and changed everywhere it was the same.

02Passwords: the rules have changed

For years we were taught that a secure password needs an uppercase letter, a number and a symbol, and must be changed every three months. The result is plain to see: short, predictable passwords, written on a sticky note and "changed" by adding a number at the end. "Mark2025!" becomes "Mark2026!".

The guidelines of NIST, the US institute that writes the digital identity standards used as a reference all over the world, say very different things in the final version published in 2025:

• length is what counts: at least 15 characters when the password is the only way in, at least 8 when it comes with a second factor; services should accept at least 64;
• no mandatory composition rules: you must not force people to mix uppercase letters, numbers and symbols;
• no forced periodic changes: a password is changed when there is a sign it has been compromised, not by the calendar;
• every new password must be checked against a list of common, predictable or already breached passwords, and rejected if it is on it;
• services must allow password managers and autofill, and should allow pasting the password.

How to build a good password, when you need to remember it

The passwords you need to remember by heart should be very few: the one for your computer, the one for your password manager, the one for your main email inbox. For these, a phrase of several randomly chosen words works well, words with no link to each other or to you: four or five words are already more than twenty characters. All the other passwords don't need remembering: the manager generates and keeps them.

03The password manager: one vault, one key

A different, long password for every service is impossible to remember. That is why password managers exist: programs that keep all your credentials in an encrypted vault, which opens with a single master password, ideally backed by a second factor.

Why it is safer, not less safe

The most common objection is: "what if someone steals the vault?". The vault is encrypted with a key derived from the master password, and good managers are built so that not even the service provider can read its contents. In exchange you get three concrete advantages:

• unique passwords for every service: a breach somewhere else no longer opens anything of yours;
• long passwords generated at random, impossible to guess;
• an extra defense against phishing: the manager offers the password only on the address it belongs to. If the manager suggests nothing on a page that looks like your bank, that is a warning sign.

In a business: the shared vault

Many managers have a version for teams: shared credentials, such as the courier account or the website control panel, sit in folders shared only with the people who need them. When a collaborator leaves, you remove their access to the folder instead of having to remember every password they knew. It is far better than the "passwords.xlsx" spreadsheet on the desktop, which is still the most common solution in small businesses.

04Two factors: why a password alone is not enough

Two-factor authentication (2FA, or more generally MFA, multi-factor) asks for two proofs of identity of different kinds. The possible proofs come in three types:

• something you know: a password, a PIN;
• something you have: your phone, a USB security key, a card;
• something you are: your fingerprint, your face.

The principle is simple: whoever steals the password from a phishing page or a breached list does not also have your phone in their pocket. But not all second factors hold up equally well.

It is no coincidence that the ransomware guide from the US agencies asks for phishing-resistant multi-factor authentication on all services, starting with email, remote access and the accounts that administer critical systems. Why access is the first defense against data extortion is something I explain in the chapter on business backup and ransomware.

05The passkey: signing in without a password, and without being fooled

Passkeys are the sign-in method that the major makers of operating systems and browsers are rolling out in place of passwords, based on the standards of the FIDO Alliance. They are already used by many email services, banks, online stores and work platforms, and they unlock with the device's fingerprint, face or PIN.

Behind the simplicity there is an elegant cryptographic mechanism, worth understanding because it explains where the security comes from.

1. Registration. When you create a passkey for a site, your device generates a key pair: a private key, which stays on the device, and a public key, which is handed to the site.
2. Sign-in. The site sends a "challenge", a random number that is different every time. After you have unlocked it with fingerprint, face or PIN, the device signs it with the private key and sends it back.
3. Verification. The site checks the signature with the public key. If it matches, it's you.

This gives three properties a password will never have:

• there is nothing to steal on the site: if the site suffers a breach, the attacker finds only public keys, useless without the private ones;
• there is nothing to reuse: every site has its own key pair;
• there is nothing to be tricked out of you: the browser and the operating system tie each passkey to the site it was created for. On a fake address, even one identical to the eye, the passkey simply doesn't offer itself.

Synced or device-bound

There are two families of passkeys. Synced passkeys travel between your devices through the password manager or the operating system account, in an encrypted form the sync service cannot read: if you lose your phone, you find them on the new one. Device-bound passkeys, such as USB security keys, never leave the physical object: they are the choice for the most sensitive access, such as administering a server or a domain, but they require a second backup key kept in a safe place.

06The access map of your business

Tools are of little use without the big picture. Try an exercise: take a sheet of paper and write down every service your business works with online. Bank, email, PEC (Italian certified email), business software, website, domain, server, social media, suppliers, booking platforms. Then, next to each one, who has access, with which email, and whether there is a second factor. It is almost always a surprising sheet.

The plan, in five moves

The principle of least privilege

Every account should be able to do only what its user needs. Whoever takes bookings has no need to change prices; whoever manages the stock has no need to see payslips. Even whoever administers the systems should have two accounts: a normal one for everyday work, and an administrator one to use only when needed. That way, if an account is compromised, the damage stays small.

The same goes for suppliers: whoever built your website should not still have, years later, the password to the domain control panel. Who the domain, server and accounts should be registered to, and who should hold the keys, is something I go into in the chapter on who really owns your website. And for a portal with private customer areas, access security is designed together with everything else, as I explain in the chapter on integrated portals, bookings and PWAs.

Locking the doors cuts the risk enormously, but it doesn't eliminate it: for the day something goes wrong you need the right copies, as I explain in the chapter on backup and the 3-2-1 rule. And if a breach affects customer data, the obligations of the GDPR come into play, which I explain in the chapter on GDPR and cookies for a small business website.

Frequently asked questions

Sources

1. NIST, SP 800-63B-4, "Authentication and Authenticator Management" (final version, July 2025): minimum length, no composition rules or periodic changes, checks against lists of breached passwords, password managers.
2. CISA, FBI, NSA, MS-ISAC, "#StopRansomware Guide": phishing-resistant multi-factor authentication for email, remote access and critical systems.
3. passkeys.dev, "What are passkeys?": how passkeys work and how they sync between devices.
4. Have I Been Pwned: the free service for finding out whether an email address appears in known data breaches.
5. Agenzia per la Cybersicurezza Nazionale (Italy's National Cybersecurity Agency), "CSIRT Italia" (in Italian): alerts on current threats and reporting of cyber incidents.

Chapter updated October 2026. The passwords shown in the plates are illustrative examples and must not be used; the guidance on authentication methods follows the public guidelines cited.