Administrator Accounts: Keeping the Keys Safe
Admin accounts can change everything: users, email rules, security settings and billing. How small businesses should protect them with separate accounts, strong sign-in and few admins.
An administrator account can create users, read mailboxes, change security settings and sometimes change billing. If an attacker gets one, they effectively own your systems. Protecting admin accounts gives a lot of protection for little effort.
Four rules for admin accounts
- Separate accounts: admins use a normal account for daily work and a separate admin account only for admin tasks.
- Strongest sign-in: passkeys or security keys where possible. See security keys.
- Few admins: at least two, as few as possible beyond that. See least privilege.
- Review regularly: check who has admin rights each quarter. See access reviews.
Where admin accounts hide
- Email and office suites. See securing office suites.
- Domain registrar and website hosting. See domain security.
- Social media business pages. See business social media.
- Accounting, payroll and payment platforms.
- Routers and office Wi-Fi. See office Wi-Fi.
Admins are prime phishing targets. See phishing aimed at admins.
Plan for lockouts too: break-glass access. For more, see protecting small businesses from digital threats.
Frequently asked questions
Why use a separate admin account?
So everyday email and browsing, where phishing happens, are not done with the account that controls everything.
How many admins should a small business have?
At least two, so you are not locked out, but as few as possible beyond that.
What sign-in should admins use?
The strongest available: passkeys or security keys where supported, and never text-message codes alone if you can avoid it.
Sources
- Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
- 10 Steps to Cyber Security, UK National Cyber Security Centre
- Small organisations guide to cyber security, UK National Cyber Security Centre
