Business password security goes beyond creating strong credentials. Most organizations already encourage employees to use unique logins, enable multi-factor authentication (MFA), and follow safer sign-in practices. But there’s another risk that’s much easier to overlook:
What happens when a credential is stored somewhere it should never have been?
A recent security issue involving Applebee’s is a powerful example.
What is Business Password Security?
Business password security is the practice of protecting the credentials that provide access to company systems, applications, and data.
It extends beyond what employees type at a login screen. Organizations also need to consider where sensitive credentials are stored, who has access to them, how privileged accounts are controlled, and what happens when something is compromised.
Ultimately, the goal is simple: make credentials difficult to steal, misuse, or overlook.
What Happened at Applebee's
According to a report from TechCrunch, a security researcher discovered a credential for an internal database embedded in Applebee’s Android app. The credential provided access to the company’s customer database.
The affected database reportedly contained customer names, email addresses, dates of birth, phone numbers, ZIP codes, and recent login IP addresses. The researcher said the credential could potentially have been used to change customer data. Applebee’s parent company, Dine Brands, told TechCrunch it had addressed the issue and that its ongoing investigation had not found evidence of unauthorized access.
The Problem With Hardcoded Credentials
Embedding a password, API key, database credential, or other secret directly in software is known as hardcoding credentials. In this case, TechCrunch reported that the credential was buried in thousands of lines of the app’s code, and the researcher used AI to help find it.
Sensitive credentials don’t have to sit in a document labeled “PASSWORDS” to be exposed. They can find their way into:
-
- Applications and scripts
- Configuration files and source code
- Automation processes
- Documentation and shared folders
- Old employee accounts
- Service accounts
- Cloud applications
Effective business password security means understanding where these credentials exist and how they’re protected, not simply requiring users to create stronger logins.
AI Makes Hidden Credentials Easier to Find
The researcher said AI helped find the exposed credential among thousands of lines of code. That ability to analyze large amounts of information quickly means businesses should assume exposed credentials and other security mistakes can be found faster than ever.
Security through obscurity is becoming even less effective. Don’t assume sensitive information buried in code, documentation, or configuration files is safe simply because it would be difficult for a person to find.
Business Password Security: 6 Best Practices
Even a highly complex credential offers little protection if it’s exposed in an application or other accessible location. Effective business password security requires multiple layers of protection:
1. Use Multi-Factor Authentication
Wherever it’s supported, protect sensitive accounts with multi-factor authentication (MFA). The additional verification step is especially important for cloud services and administrator accounts.
But MFA isn't the whole solution. Application credentials, service accounts, tokens, and database connections work differently from an employee signing in to Microsoft 365, so they require their own controls.
2. Stop Sharing Passwords
Shared administrator logins and password spreadsheets create unnecessary risk. Give each person an individual account where possible so access can be controlled and activity can be traced to a specific user. Just as importantly, have a clear process for removing access when employees, vendors, or contractors no longer need it.
3. Use a Business Password Manager
Employees shouldn’t have to remember dozens of complex passwords. A business password manager, such as Bitwarden, generates and securely stores unique credentials to reduce the temptation to use predictable or repeated passwords.
Your IT team should also understand how administrator credentials, service accounts, and other privileged secrets are managed.
4. Protect Privileged Credentials
Not every credential carries the same level of risk. A login for a low-risk application shouldn’t receive the same level of protection as a credential that provides access to a customer database.
Pay particular attention to credentials that provide access to:
-
- Microsoft 365 administration and Microsoft Entra ID
- Servers, firewalls, and network equipment
- Backup platforms
- Financial applications
- Customer databases
- Remote access systems
- Cloud environments and business-critical applications
These privileged credentials deserve stronger controls, tighter access, regular review, and monitoring.
5. Monitor Identity, Not Just Devices
Traditional cybersecurity focused heavily on protecting devices. Today, attackers increasingly target the identities behind them. A stolen credential can give an attacker access to email, cloud apps and company data without ever installing malware on an employee’s computer.
That’s why TCI recommends a layered approach. Endpoint detection and response (EDR) protects computers and servers, while identity threat detection and response (ITDR) watches for suspicious activity involving user accounts and credentials. The goal isn’t to replace MFA, endpoint security, email filtering, or training. It’s to make sure your business doesn’t depend on a single control to stop every attack. See how TCI provides 24/7 security monitoring across endpoints and identities.
6. Secure Application and Service Credentials
The Applebee’s story highlights something easy to overlook: cybersecurity isn’t only an IT department problem. If your organization builds applications or connects cloud platforms, passwords, database credentials, and API keys shouldn’t be embedded in software just because it’s convenient. Secure development should include secrets management, access control, code review, vulnerability testing, and logging.
Interestingly, the researcher reportedly had trouble notifying Applebee’s or Dine Brands because neither offered a way to report security issues. The researcher eventually turned to TechCrunch for help. That’s another lesson: have a plan for receiving security reports, not just for preventing incidents.
Business Password Security Checklist: 7 Questions to Ask
-
- Do all employees use unique passwords for business systems?
- Is MFA turned on everywhere it’s practical and supported?
- Are administrator accounts separate from everyday user accounts?
- Are credentials being shared by email, spreadsheets, documents, or Teams messages?
- Do you know which service accounts and application credentials exist?
- Is unnecessary employee and vendor access removed promptly?
- Can you detect suspicious account and sign-in activity?
If the answer to several of these is “we’re not sure,” that’s a cybersecurity issue worth investigating.
Password Security Is Really Identity Security
The Applebee’s incident reinforces an important lesson: effective business password security is part of a broader identity and cybersecurity strategy. TCI Technologies takes a layered approach to cybersecurity, bringing together identity protection, Microsoft 365 security, endpoint protection, email and phishing protection, vulnerability management, and security awareness.
Not sure where credential or identity risks may be hiding in your organization? Take our free Cybersecurity Risk Assessment to uncover gaps before they become incidents, or call us at (516) 484-5151.
The Applebee’s security incident shows why business password security goes beyond strong passwords. Here’s how to protect credentials, identities and data.