How to protect your data from password lists

Organizations use many security controls to decrease their attack surface against password-related threats. Unfortunately, even with advanced password policy settings, Active Directory remains vulnerable.

Hackers have always targeted end-users because they are thought to be the weakest link. Their tactics prey on human interaction, where they trick users into breaking standard security practices. Now, armed with a never-ending collection of credential data, they are banking on user predictability and password reuse.

In addition to carefully crafting phishing emails, and cycling through millions of random password permutations in a brute force attack, hackers can also employ a list of high-probability passwords. The passwords can be generated with popular composition patterns, such as character substitutions (P@$$w0rd), and common keyboard patterns (qwerty123). If the attack is aimed at a specific organization, they will create a password list using words relevant to the organization, including name, location, services, relevant acronyms, or even local sports teams. With a finite and targeted number of guesses, they can hijack the account without triggering a lockout.

For more information about this hacking method, see What is a Password Dictionary Attack?

Until recently, stolen passwords were sold on the dark web for thousands of dollars. Now they are available for free, in plain-text, and billions strong. This means that anyone can break into an account by manually testing a leaked username and password against online logins. Alternatively, they could use a list of common passwords and test against random usernames in the hopes that someone in the organization is using a weak password. In response, organizations need to block the same passwords for their users – or risk data exposure.

You can enhance your password settings by not only blocking leaked passwords, but also high-probability passwords within your organization. Active Directory password screening allows you to relax policy requirements such as character complexity, and expiration periods, while maintaining your desired level of security.

It takes a single leaked password to create risk and potential compromise. While a limited password list of 1000 passwords offer some protection, a larger list will consider billions of passwords, some of which are considered weak solely because they can be found on a leaked password list.

Blocking billions of leaked passwords in your organization can be a manual process. To stay protected against new threats, organizations will need to continually grow and update their list. A third-party password screening service can simplify the process of managing the list of leaked passwords. With the service protecting your organization from leaked passwords, you can focus on building a custom dictionary to cover more targeted attacks.

A custom dictionary should include passwords relevant to your organization – anything containing company name, locations, services, industry terms, and any relevant acronyms. With the right solution in place, you can apply additional settings to ensure users cannot bypass the dictionary with predictable patterns, such as character substitution, the password in reverse, or even adding a number or exclamation mark to the end of the password. For more information, see our Best practices for configuring a custom dictionary.