iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect cloud accounts by requiring multi-factor authentication (MFA), prioritizing phishing-resistant sign-in for administrators and other high-impact accounts, limiting each identity’s access, and treating API keys, service credentials, and session tokens as credentials too. If an attacker steals one, those controls can reduce what the credential opens and help your team find and revoke it.
How credential theft puts cloud businesses at risk
A phished or reused password can let an attacker impersonate an employee, especially if the same password protects multiple services. Stolen session credentials and cloud tokens create a related risk: they may provide access without a fresh interactive sign-in. CISA’s July 2025 TIC 3.0 Cloud Use Case notes that tokens such as API keys can enable access to cloud services without a comparable level of identity verification.
That means account security is not just a password problem. A practical defense needs to protect sign-ins, restrict what an identity or token can reach, and provide a way to detect and cut off suspicious access.
Recommended Free Tools
How to protect business accounts from phishing and password theft
Require MFA, then prioritize phishing-resistant methods
Enable MFA across business accounts, starting with administrators and accounts that can access sensitive information. Include email, remote access, file storage, and the other cloud services employees use. MFA adds a check beyond the password, but methods differ in how well they withstand phishing.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CISA identifies FIDO/WebAuthn as the only widely available phishing-resistant authentication and recommends making a move toward it a high priority. A FIDO security key or other compatible FIDO/WebAuthn sign-in can help prevent a user from approving a sign-in on a fake site. Check that your identity provider, applications, devices, and account-recovery process support the method before choosing how to deploy it.
| Method | Phishing resistance | Practical considerations |
|---|---|---|
| FIDO/WebAuthn, including compatible security keys | Phishing-resistant when properly supported and configured. | Confirm provider and device compatibility. Plan enrollment, replacement, and recovery for lost or unavailable keys. |
| Number-matching push approval | An interim improvement over approving an ordinary push prompt, but not phishing-resistant. | Can help reduce push-fatigue approvals. Use it where stronger methods are not yet available, while planning the move to phishing-resistant MFA. |
| Ordinary push approval | Less resistant to phishing and push-fatigue attacks than phishing-resistant MFA. | Users may be pressured or tricked into approving an unexpected prompt. Avoid treating an approval notification alone as strong protection. |
| SMS code | Not phishing-resistant; CISA describes phishing-resistant MFA as stronger than SMS. | Use only where stronger options are not supported, and do not consider an SMS code equivalent to a security key or FIDO/WebAuthn. |
CISA’s October 2022 MFA fact sheet says any MFA is better than none, while phishing-resistant MFA is the gold standard. Treat weaker methods as a starting point rather than the end state. Give employees a clear way to report unexpected authentication prompts, and tell them not to approve sign-ins they did not initiate.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reduce password reuse and protect account recovery
Use unique passwords for business accounts. A business password manager can help employees create and store them, but it does not replace MFA or access controls. Review account-recovery options as part of deployment: recovery should restore legitimate access without becoming an easier route around the protections you put in place.
Limit what a compromised identity can reach
Separate routine work from administration
Use distinct administrative access for administrative tasks instead of giving everyday user accounts standing privileges. Remove accounts that are no longer needed, and review who can create accounts, change security settings, manage access, or reach sensitive data.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Apply least privilege to users and workloads
Give each user and service only the permissions it needs for its work. Scope roles and access policies to restrict both user-to-resource and resource-to-resource access; avoid broad permissions that let one compromised account reach unrelated systems. Review assignments periodically and when responsibilities change.
CISA’s cloud guidance also highlights device posture and behavioral baselining. Where your identity and cloud services support them, use device signals in access decisions and establish a picture of normal sign-in and access patterns so unusual activity is easier to spot.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Protect API keys, service credentials, and scripts
Inventory tokens and assign clear ownership
Identify the API keys, access tokens, service credentials, and other non-human credentials that can reach your cloud services. Record what each one is for, which workload or person owns it, what it can access, and how it can be disabled or replaced. CISA’s cloud use-case guidance specifically calls for understanding and tracking token creation and lifecycle; the ownership, scope, storage, rotation, and revocation practices here are operational ways to carry that out. Confirm the available controls and procedures in your cloud provider’s current documentation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Keep secrets out of source code and plaintext scripts
Do not embed credentials in source code or leave them in plaintext scripts. CISA’s 2023 red-team advisory describes finding a PowerShell script with plaintext credentials that enabled escalation. Use your provider’s supported secret-storage and access mechanisms, restrict who and what can retrieve a secret, and avoid copying secrets into logs or shared documents.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Revoke exposed credentials and reduce their scope
If a key or token is exposed, treat it as compromised: disable or revoke it through the provider’s supported process, investigate its use, and issue a replacement only where needed. Keep token permissions narrow so exposure of one credential does not automatically grant broad access. For custom programmatic cloud access, CISA recommends signed API requests where supported; check provider documentation for the applicable signing requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Detect suspicious access and rehearse recovery
Monitor sign-ins and access changes
Review authentication and cloud audit logs for anomalies such as sign-ins that do not fit established patterns, unusual access to sensitive resources, unexpected privilege changes, or use of a service credential outside its expected purpose. Investigate rather than assuming that a successful MFA event proves an activity was legitimate. CISA cloud guidance points organizations toward monitoring, behavioral baselines, and device posture.
Practice cutting off access
Document how authorized responders will disable an account, revoke tokens, invalidate sessions where the provider supports it, and restore access for the legitimate user or workload. Rehearse the sequence with the people who would handle an incident, including how they will identify affected credentials and check for activity before and after revocation. Exact controls and recovery steps vary by provider, so validate them against current provider documentation.
A practical first-week plan
- List high-impact access. Identify administrator accounts and accounts or services that can reach sensitive data. Include business email, remote access, file storage, and cloud consoles.
- Turn on MFA. Require it for those accounts first, then expand it across the organization’s business services. Make sure users know how to report unexpected prompts.
- Choose a phishing-resistant path. Check FIDO/WebAuthn support across your identity provider, applications, and devices. Define enrollment and recovery before broad rollout. Use number matching as an interim measure where appropriate, not as a substitute for that plan.
- Trim access. Remove unneeded accounts and privileges, separate administrative access from routine work, and narrow user and workload permissions.
- Find and secure non-human credentials. Inventory keys and service credentials, assign owners, remove plaintext secrets from scripts, and document how to revoke and replace exposed credentials.
- Check visibility and response. Confirm that someone reviews relevant sign-in and audit events. Walk through account disablement, session invalidation where available, token revocation, investigation, and restoration.
For small businesses, CISA’s SCuBA resources provide guidance for assessing and hardening SaaS configurations. Use them alongside your providers’ current documentation for exact settings and recovery procedures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
