password strength audits and mitigations

Question

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good password complexity policy and a good account lockout policy in place, but if someone just wants to try 100 worst passwords that still match the policy and change the username with each login attempt instead of the password, then it seems given that eventually they'll find a user with a bad password. So my questions are:

1. has anyone attempted this on their Active Directory hashes? How did you sell it to management?
2. Has anyone used some mitigation strategies such as maintaining a list of 100 to 500 hashes of easy passwords that still meet the password policy and block users from using these? How effective would this be?

Answer 1

Yes, regularly. For many of my clients we create policies that require at least annual audits of passwords across all devices, including Windows AD, that tests accounts against the top 500 most popular passwords (and also a list of password derived from their names etc. using various encodings). Accounts in non compliance are marked as having to change at the next login and the users are reminded of the password strength policy.

Management in all case have understood the risks of not checking for this kind of weak password and has been supportive. Given that the number of violations almost always decreases year on year the 'sell' to management seems to get easier.

Answer 2

Security Weekly episode 436 had a section about password cracking that may be worth checking out if this is new terrain for you. About the effectiveness you can have lengthy discussions as recent hacks have shown. All the password policies are basically forcing people into making passwords in a smaller namespace then without strict password policies. Most passwors nowadays start with a capital character and end with one or more numbers that in most cases reflect the month or year.

And selling it to management depends on the organisation. Towards my current client is was easier to sell them better and earlier detection of (possible) abuse with easier unlocking and resetting of accounts, and adding two factor authentication for public facing services or services with high risk data/processes/accounts. Also a good automated joiners and leavers process reduced a lot risk.

Do we still do crack password? Yes, but mostly incidental during an audit. The main reason was that we assigned the money to other preventive measures as we couldn't check if passwords weren't reused outside of the company for example. We from "security and compliance" moved from the No-department to the department that enables the company to do their business safely and with reduced risks. This resulted in more productive hours and less interruptions for customers and users.

So find out how you can motivate your management as some want to have all the ticks they're required to have for the auditor/accountant and don't want to overpay. Others may be willing to take a risk and set some cash a side for it as long as they can make higher profits.

From a technical point of view it is great to get more awareness and to bring your organisation to a higher level.