I found the same weak admin password across multiple systems, with little MFA, missing documentation, and gaps in device management and patching. This is a small social services organization, so both client information and physical access are concerns. What should I tackle first?
Where do you start when the old admin reused one password everywhere?
Asked by
Jelmar.6h
Answers
Start by identifying everywhere that password works, especially identity, email, remote access, backups, and the door access system. Replace it with a unique, strong credential for each account and store those credentials in an approved password manager. Check for shared and forgotten admin accounts while you're at it.
Turn on MFA for administrator accounts and then roll it out to everyone else. Plan for recovery access before enforcing it, so a lost device or misconfiguration doesn't lock the whole organization out.
Reply to this answer
The keycard system deserves a close look, not just a password change. Review who can administer it, which credentials are active, and whether access logs are available. If the shared password could have let someone create a door pass, raise that physical safety risk with the people responsible for the building.
Reply to this answer
Get a reliable device inventory before assuming the management console tells the whole story. Devices showing as inactive may still be in use, so reconcile the console against actual assigned computers and phones, then investigate why they're not checking in.
From there, work through disk encryption, endpoint protection, and a patching process you can verify. Pick a manageable group first, check for problems, and expand. A policy that says updates are required isn't much help if you can't see whether devices receive them.
Reply to this answer
Write down the risks and ask leadership to help prioritize and fund the fixes. A small nonprofit may have limited staff and budget, but that doesn't make the exposure disappear. An outside security assessment could help identify gaps and give you another set of eyes, especially if a local nonprofit offers that service.
Keep the discussion focused on what needs fixing and what support you need. The existing problems don't by themselves tell you why the previous setup ended up that way.
b406+gearwhistle_2:
A simple risk register with the affected system, impact, owner, and target date can make those conversations less abstract.
Reply to this answer
Don't let the security backlog hide the operational stuff. Broken call forwarding and missing documentation can hurt the people relying on the organization too. Fix the phone routing, then document key systems, recovery steps, and who to contact when something fails.
Reply to this answer
Add your answer
Answers are reviewed before publication.
q715+ferrule_3:
Don't forget service accounts and devices that might break when a password changes. Inventory dependencies first and coordinate changes with whoever supports those systems.