Should accounting and the manager encrypt accounts and passwords or keep them in plain text? How does the dual-signature rule ensure security?

we share each other's passwords too, but since there's a risk we added phone confirmation at the bank.. but now it's a bit more comfortable

Setting up a dual signature system: 1. Enable 'Dual Approval' in the bank app 2. Accountant: request the transaction 3. Manager: approve with SMS code 4. Transfer is made 5. Archive the report

Password manager: Open BitWarden (encrypted), create a shared vault group for the accountant and manager. Access logs are kept automatically.

sharing passwords but writing them in plain text isn't secure. anyway it's better if you use a locked file or vault

if the accountant and manager get together, they can change the password and steal your money, right?

Dual signature control mechanism: It's done based on risk. High-risk transfers require more approvals.

Yes, that's exactly how it is with dual signature rule. Start with a small trial; don't commit to everything at once.

When making decisions, write down the worst-case scenario too, not just the best. Good luck with that.

ive been dealing with this for a long time. the answer varies greatly by industry; therre is no one-size-fits-all rule.

processes without records never improve because you don't know what to fix.

Here's how it went for us. If 2FA is on, a stolen password alone is useless.

The biggest time-waster for us was not knowing who had the final say.

We need to make a distinction here. The answer varies greatly by industry; there is no one-size-fits-all rule.

That's all, sorry if I went on too long.

We've heard this a lot, but it never happened like that for us. Mistakes made on the dual signature rule side are usually reversible but expensive.

If you scold false alarms, nobody will report again. I'm also curious if anyone does it differently.

Here's how it went for us. If you get three different answers on a topic, the question was asked wrong.

If I were you, I'd go this route.

There are three things to check when doing this. Mistakes made on the dual signature rule side are usually reversible but expensive.

This is my opinion, I'm not claiming it's absolute truth.

Generally correct, but one part is missing. If its your first time start small; scaling comes later.

The real issue isnt the number, but what its based on. This is my opinion Im not claiming its absolute truth.

i agree.

Great work.

There is something to watch out for. Processes without records never improve, because you don't know what to fix.

If I were you, I'd go this route.

Let me summarize what's been said so far. Most incidents start with a leaked password, not a vulnerability.

Just leaving this note, it might be useful.