Farewell to the first day passwords: so you turn the onboarding into a security fortress

The process of employee incorporation is often an anti-time race for IT equipment: equipment to provide, accounts to create, permissions to assign. In this context, it is tempting to send a "first day" password by email or SMS so that the user can log in immediately. However,these temporary passwords become too often an Achilles heelwhen shared in flat text, reused between systems or simply never changed.

The problem is not just theoretical. The default or test credentials that remain active in production systems have been exploited in real incidents, with consequences ranging from access to sensitive data to control of industrial operating systems. Beyond the technical impact, these failures generate reputational risk and may involve regulatory sanctions if personal data are exposed. Access management from the first day should be treated as part of the attack surface not as an administrative procedure.

Send a password by mail or SMS is fast but unsafe: these channels can be intercepted, unchecked or read on unmanaged personal devices. Providing credentials by phone or in person reduces digital exposure, but introduces operational friction and increases the number of hands a key passes through, which increases the probability of error or oblivion. In practice, none of these methods scale well or guarantee that the temporary password will be replaced correctly.

An alternative that balances security and usability is to allow the user to create his or her own password from the first day through a secure registration process: an activation link sent to a verified personal mail or to a mobile number, identity check and establishment of a key that meets the organization's policy. Reestablishment and encoding management tools such as those offered by specialized suppliers can completely eliminate the need to distribute temporary passwords. To understand best practices in the authentication and design of safe flows, NIST guides are a technical reference: NIST SP 800-63B and the OWASP project collects practical measures on authentication: OWASP Authentication Cheat Sheet.

Technology alone is not enough: controls that address the entire life cycle of credentials must be integrated. This includes detection of accounts with default credentials, forced expiration of temporary credentials, audit of who created or distributed passwords and alerts when a temporary password has not been renewed. It is also appropriate to apply checks against lists of committed and political passwords that favour real length and entropy above obsolete rules of complexity.

Beyond passwords, organizations should prioritize complementary mechanisms such as multifactor authentication, access with minimum privileges and just-in-time access for sensitive resources. For critical or managerial environments, the management of privileged access (PAM) and automatic credentials rotations significantly reduce the exposure window. In operational infrastructure, the recommendation is clear: disconnect controllers and PLCs from direct Internet exposure and audit any factory or test account that has become active.

In practice, an effective strategy combines automation and clear policies: implement safe self-managed enlistment for new employees, force first access to create own credentials and verify compliance through regular audits. Automating the creation and revocation of access avoids human errors, and recording each step of the process facilitates rapid response to incidents. If your organization needs a specific solution to remove first-day passwords without increasing the IT load, there are products on the market that integrate these flows, for example, re-establishment and encoding solutions that include mail or mobile verification and password creation from the first access: Spacops uReset.

For security equipment, the immediate priority should be to audit current onboard flows, identify accounts with temporary or default credentials and apply immediate mitigation: expire temporary passwords, add MFA, and block orphan accounts. In parallel, design a plan to replace manufacturing with automated and traceable processes. Convert the first access to a strength point - not an exception - reduces exposure, facilitates compliance and improves the new employee's experience.

In short, reducing the attack surface on the onboarding does not require sacrificing speed or comfort: it requires rethinking who controls the first password, how identity is verified and how it is ensured that this credential is no longer relevant as soon as the user establishes his or her official identity. Incorporating safe encoding processes, life cycle controls of credentials and mitigation technologies such as MFA and PAM transforms a frequent risk vector into a managed safety practice.