Identify and prevent brute-force attacks

Passwords are the most targeted attack vectors for gaining access to critical enterprise resources. An organization's IT admins must ensure that stringent password policies are enforced to avoid dire consequences. While healthy password practices are evolving and improving, hacker strategies to break them are increasing as well. It is high time to adopt the proper tools to survive these cyberthreats.

ManageEngine ADSelfService Plus provides multiple ways to identify and prevent credential-based attacks. In this article, we explain how to prevent brute-force attacks. Brute-force is a mostly automated trial-and-error attack method to identify user passwords. Attackers or bots test password after password from a dictionary or list attempting to to exploit the correct password for a username.

Action plan to mitigate brute-force attacks

1. Identify the attack: Continuous login failures are the sign of brute-force attacks. Auditing users' login attempts is one way to track login attempts and act on suspicious repetitive failures.
2. Prevent the attack: Preventing a hacker with brute-forced credentials from logging into the system is another way to mitigate attacks. MFA, conditional access, and CAPTCHA are useful in preventing brute-force attacks.

ADSelfService Plus, an identity security solution, can aid in brute-force attack identification and prevention!

Mitigate brute-force attacks with ADSelfService Plus

ADSelfService Plus enables you to proactively take actions that help prevent brute-force attacks on your users' Active Directory domain credentials.

Audit login attempts

ADSelfService Plus' Identity Verification Failures Audit Report helps you identity brute-force attacks by providing details on the login attempts of users. You can evaluate the failed login attempts to obtain more details, such as time of failure, and device used to authenticate.

Implement MFA

ADSelfService Plus offers protection against brute-force attacks aimed at AD domain accounts via additional layers of authentication using methods such as biometrics, YubiKey authenticator, and OTP. This prevents attackers who have cracked an user's AD password from penetrating into the enterprise network. The MFA feature can be used to secure logins into machines (Windows, macOS, Linux), VPNs, and enterprise applications via SSO.

Configure conditional access

With ADSelfService Plus' conditional access feature, IT admins can set predefined conditions based on risk factors such as IP address, device used, time of access, and geolocation. Based on whether the conditions are met or not, authentication can be made more stringent or lenient. Any out-of-the-ordinary access attempts, including brute-force attacks, can also be blocked.

Enable CAPTCHA

Enabling CAPTCHA is the most common way to prevent an automated brute-force attack. ADSelfService Plus allows you to enable image and audio CAPTCHA. As an added advantage, you can also configure when and where the CAPTCHA must be used.

Passwordless authentication

This is another effective method to prevent brute-force attacks as, without passwords, attackers have no point of access into the network. ADSelfService Plus offers passwordless authentication for access to enterprise applications such as Salesforce, Google Workspace, and Microsoft 365.

Other features that help with enterprise security

• Password policy enforcer: This ADSelfService Plus feature lets you create and enforce custom password policies for with rules that govern characters, patterns, repetition, and length for Active Directory and cloud application passwords.
• Password audits: ADSelfService Plus offers reports that audit password-based actions like password resets and changes performed by the user. Detailed information like the time of the action and device from which it was performed is stored as well.
• Integration with Have I Been Pwned?: ADSelfService Plus' integration with Have I Been Pwned?—the service that compiles and continually updates databases of exposed credentials—prevents employees from using passwords that have previously been exposed.