Hook one: access
Giving access without giving away the account
Give an outside manager their own way in, with only the access their work needs, rather than your password. That follows the Australian Cyber Security Centre’s small business handbook, which asks for individual accounts for staff wherever possible and only the access each person needs, and asks businesses to turn on multi-factor authentication wherever it is available.
General information. This is general security information, not technical advice for your own accounts. The Australian Cyber Security Centre’s handbook at cyber.gov.au is the place to check, and for personal information, the OAIC.
Why the owner keeps the master key
The ACSC describes account compromise as someone getting unauthorised access to your account, and lists social media accounts alongside email and bank accounts. Among its warning signs: you can’t get into an account even though your login details are right, or you have been logged out on every device without doing it yourself.
Those signs read differently when someone else also holds the login. If a manager knows the only password, and the recovery details point to their email or phone, the business has no separate way back in. The ACSC lists “your password recovery details are changed without your permission” as a warning sign in its own right. Keeping the owner’s login, and the recovery email and phone, in the business’s own hands is what lets it take the account back later.
Three ways in, from the handbook
| Way in | What the handbook says | For an outside manager |
|---|---|---|
| Administrator | Administration access lets users do much more than standard access, such as bypass security controls. Create separate administrator accounts for staff who need administrative privileges. | Kept with the owner, unless a manager’s work truly needs it. |
| Their own login, limited | Create individual accounts for staff wherever possible. Staff should have the minimum permissions they need to do their work. | The handbook’s preferred shape, where a service lets you give someone their own login with set permissions. |
| A shared password | Shared accounts increase security risks and make activity harder to track. Where shared access is needed, it should be tightly controlled. | A last resort: recorded, limited, and changed when the manager leaves. |
business.gov.au’s advice on keeping social media accounts from being hacked includes sharing social media passwords only with staff who need them. The ACSC goes a step further and asks for individual accounts for staff wherever possible. An outside manager is not staff, and the handbook treats external providers as a separate item: a business should understand which of its accounts they can reach, review that access regularly, and remove it when it is no longer needed.
Multi-factor authentication, on both sides
The handbook calls MFA one of the most effective ways to protect business accounts: it adds a second step to logging in, so a stolen password alone can’t be used to get in. Its advice is to turn MFA on wherever it is available, starting with high-risk accounts, and it names social media among them. It adds that the setting is usually found under account security, and some services call it two-factor authentication or two-step verification.
The methods are not equal. The handbook describes passkeys as a more secure way to log in than a password, and one that helps stop people being tricked into logging in to a fake website. It calls one-time codes sent by SMS or email “the least secure option due to the ease in which SMS and email accounts can be compromised.”
When a manager has their own login, their MFA protects their door and yours protects the owner’s. When a password is shared, so is the second factor, and the question of whose phone receives the code becomes part of the arrangement.
If a password has to travel
- Make it long and unique. The handbook says each account should have a strong and unique password, and that where MFA can’t be used, passwords should be at least 15 characters long.
- Keep it in a password manager rather than a message thread. The handbook describes a password manager as one secure place to create, manage and store passwords and passkeys, protected by a long, unique master password and MFA.
- Write it in the register: which account, who knows the password, and when it will next change. The handbook asks for a record of shared accounts and who has access, and for login details to change when people leave or change roles.
eSafety’s advice for individuals is plainer still: “Never share your passwords or passphrases with anyone else.” A shared business login is the exception the handbook allows, and only under tight control.
Watching the door while the keys are out
Restricting access is half of the handbook’s advice; the other half is monitoring it, to check it is being used appropriately. It suggests reviewing access logs regularly for unusual or unauthorised behaviour, and setting alerts for suspicious activity such as repeated failed logins. Logins at unusual times, from unfamiliar places or on unknown devices are on the ACSC’s list of warning signs. With a manager posting at odd hours, it helps to know which device and which login are theirs, so the unfamiliar one stands out.
When the inbox holds customers’ details
What a manager may do with customers’ messages belongs in the agreement, and taking access back is the last hook, ending the arrangement. While the arrangement runs, privacy law may also have a say.
If the accounts’ messages hold customers’ personal information, and the business is one the Privacy Act covers, the OAIC’s guide to securing personal information is relevant. It says a business that outsources is likely to give third parties, including contractors, access to its personal information, and that the reasonable steps it takes may differ because of that. Its general advice is, when possible, to limit internal access to personal information to those who need it to do their job, on a need-to-know basis.