Protecting your business inside online software such as Xero starts with a handful of habits. These are the seven we set up with every client.
- Multi-factor authentication is the single highest-value change you can make
- Role-based access decides how much damage a compromised account can do
- Verify changed bank details by phone, on a number you already held
- Most breaches are a shared password and an account nobody switched off
The seven
- Turn on multi-factor authentication for every user, without exception.
- Give each person their own login. Never a shared account.
- Set access by role, so nobody has more than the job needs.
- Remove access the day somebody leaves, not the month after.
- Review the user list quarterly and remove what you do not recognise.
- Use a password manager rather than a pattern you can remember.
- Verify any change to supplier bank details by phone before paying.
The one that catches people. A convincing email asking you to update a supplier's bank details before the next payment run. Verify by phone on a number you already held, not one from the email.
Why minimum access matters
Full access for everyone is the path of least resistance, and it means any single compromised account exposes everything. Role-based access does not stop an attack, but it decides how much of your business one compromised login reaches.
Most breaches are not clever. They are a shared password and an account nobody switched off.
Get your time back from your books
Book a free 30-minute Initial Discovery Session. Tell us what is going on in your file, and we will tell you what we would do about it.
Related plain-English guidance
When your BAS is due, and what to check before it is
The due date is the easy part to look up and the wrong thing to worry about. What decides whether a BAS is right is...
What JetConvert does, and what it hands back to you
A conversion tool moves your data into Xero and it does that job well. What it does not do is build the file around...
