Blog, FastPassCorp IVM Blog
How to Avoid Weak Passwords in Active Directory | FastPassCorp
How to Avoid Weak Passwords in Active Directory
This article was originally published by LOGON’s partner FastPassCorp. Click here to view the original article.
Weak or stolen passwords are involved in more than 80% of data breaches according to Verizon DBIR. This poses a risk and is a common concern among CISOs (Chief Information Security Officer), IT Security Managers & Compliance Team. One of the best practice is to prevent this is to implement password policies to prevent weak passwords and attempt to make stolen passwords irrelevant through regular and frequent change of passwords.
The Challenge
Weak Passwords in Active Directory means Trouble
How would you know if you have old and weak passwords in your Active Directory?
Are unencrypted passwords present?
Eliminate accounts that are easy targets
How can this pose a threat to your company?
Modern attacks with passwords can originate from some of these strategies:
Rainbow tables: When a WEB solution is breached the hackers can see the e-mail account, and this helps them to identity corporate accounts. The hackers hope that the person uses the same password for corporate use and for the hacked system. The password is probably hashed however. The criminal then compares the hashed value against hashed values of 5-10000 well-known passwords to find matches. When a match is found, the hacker will use it in an attack on that company.
Spray attack: The hacker knows that users try to make passwords simple and easy to remember. This is often done by using easy-to-remember phrases. This means that company name, product name themes or other words related to the employer are often part of the password. Combine this with month, year and season the hacker can simply try as many combinations as possible for as many accounts as possible – and he might be lucky!
CISOs, IT Security and others in charge of company’s cyber security want to prevent these attack types to avoid data breaches.
Stop social engineering against your service desk
Workflow for secure verification of employees phoning in to get a service, like a new password, personal information, payment transaction, etc.
Get a Free Demo
Book a demo with our specialist to discover how IVM stops social engineering attacks against your service desk
Read Next:
