Hot take: a shared spreadsheet of office passwords is a bigger risk than most of the scams I post about here.
Almost every small office has one. "Passwords.xlsx" on the shared drive, or a notebook in the top drawer. It works, right up until it doesn't.
What this means in plain English
That spreadsheet is a single file with the keys to everything: the bank, the supplier portals, the website, the Wi-Fi, the alarm company. Anyone who can open the shared drive can usually open it. So can anyone who gets into one staff member's computer or email.
It also tends to have no history. You don't know who looked at it, who copied it, or who still has a copy on a laptop they took home.
And when someone leaves, the honest answer is usually that nobody changes the passwords, because changing them all is a pain.
How a password manager is different
A password manager like 1Password or LastPass is a locked vault for every login.
Each person gets their own vault, locked with their own master password and the code-on-your-phone sign-in step.
Shared logins go in shared folders. Staff only see the ones they need for their job.
When someone leaves, you remove their access in one place instead of changing every shared password.
It can create long, random passwords, so nobody reuses their dog's name everywhere.
It fills in passwords only on the real website, which helps people avoid typing them into fake sign-in pages.
Full disclosure: Nautalex resells both, so weigh my opinion accordingly.
Why a small business should care
Reused and shared passwords are one of the most common ways criminals get in. One leaked password from some unrelated website gets tried on your email, your bank and your remote access. If it's the same password, they're in.
What to do: everyone
Stop reusing the same password for work and personal accounts.
Don't save work passwords in a document, an email to yourself or a sticky note.
Turn on the code-on-your-phone sign-in step wherever it's offered.
What to do: if you run the business
Find the spreadsheet. There is one. Then plan to retire it.
Pick a business password manager and move the shared logins into it, starting with banking, email and anything with money attached.
When someone leaves, remove their access and change any shared passwords they used. Make that part of your exit checklist.
Questions to ask your IT provider
Where are our shared passwords kept today, and who can open them?
Which accounts have the code-on-your-phone step turned on, and which don't?
What's our process for changing passwords when someone leaves?
Contact Nautalex to see how we can help you with password managers.
