Many security incidents start with a stolen or guessed password rather than anything sophisticated. The good news is that the most effective protections are simple and cheap.
1. Longer beats complicated
A long passphrase is easier to remember and generally harder to crack than a short password stuffed with symbols. Aim for at least 12 characters, and more for important accounts.
2. Never reuse passwords
When one website is breached, attackers try those details elsewhere. A different password for every service limits the damage.
3. Use a password manager
It creates and remembers strong passwords for you. Many offer business plans that make it safe to share logins that genuinely must be shared.
4. Protect your email first
Email resets almost every other password, so it is your most important account. Turn on two-factor authentication there before anywhere else.
5. Replace shared logins
Generic accounts make it impossible to know who did what and difficult to remove someone's access. Give each person their own login wherever you can.
For more guidance aimed at small organisations, see the National Cyber Security Centre's Small Business Guide.