Unsecure passwords can be the undoing of
organizational security

Despite that hackers often breach organizational networks by leveraging a compromised password, many organizations still allow employees to set weak passwords that are easy to guess. Weak passwords are still the norm, and bad practices like reusing passwords or using usernames as passwords are rampant. Password statistics depict worrying figures on poor password hygiene:

• Verizon reports that over the past 10 years, stolen credentials were responsible for almost one-third of breaches.
• The top five most commonly used passwords of 2023 were:
  • 123456 (4.5m)
  • admin (4m)
  • 12345678 (1.3m)
  • 123456789 (1.2m)
  • 1234 (96k)
• Over 44 million Microsoft users were vulnerable to account compromise, as they employed passwords that have already been leaked.

Password strength contributes to data security

Personal data of over 5.2 million guests was exposed during a breach at a major hospitality company. The cause of the breach has been linked to the leak of two employee credentials.

Exposure of even a single employee password can jeopardize the security of organizational data. Data breaches not only cost organizations their revenue and reputation, but can also lead to legal ramifications. Since passwords are our first line of defense against cyberattacks, they must be chosen carefully. Implementing password security best practices helps prevent account hijacking and data leaks.

Pillars of password strength

Use the below factors as a guide to ensure employees create strong passwords:

Passphrases

Passphrases are a good alternative to passwords. They are longer and easier to remember.

Enforcing secure passwords through password policies

While complying with the guidelines mentioned above can help create strong passwords that are resistant to hacks, making sure your organization's employees follow them can be challenging. Enforcing password policies helps admins achieve this and helps meet regulatory compliance. Password policies are rules that, when enforced during a password change and a password reset, permit the creation of passwords only when all the guidelines are adhered to. Implementing the best practices for password policies helps administrators effectively secure their organization and meet compliance.

Active Directory password policy

Active Directory provides domain password policies that help admins mandate parameters like complexity, length, and age of the domain passwords. The password policy is created by configuring policy settings according to the organization's security stance. These settings are:

Password history

Set the number of new passwords that must be used before an old password can be reused.

Maximum pas sword age

Specify the maximum time that a password can be used before a change is mandated.

Minimum password age

Set the minimum amount of time that a password has to be used before it can be changed.

Minimum password length

Mandate the minimum number of characters that the password must contain.

Minimum password length audit

Audit password changes that violate a new minimum password length policy before enforcing it .

Reversible encryption

Determine if an OS will use reversible encryption to store passwords for easier decryption.

Passwords must meet complexity requirements:

To satisfy this setting requirement, these rules must be meet:

• Should not contain the user’s account name or parts of the user’s full name exceeding two consecutive characters in common.
• Be at least six characters in length.
• Contain characters from three of the four character types (uppercase and lowercase letters, numbers, and symbols).

Fine-grained password policies

Active Directory also provides Fine-grained password policies (FGPPs). These policies can be, as the name suggests, configured on a granular level for specific sets of users. FGPPs are composed of the same five settings as domain password policies. Here are some differences between the two:

The pitfalls of Active Directory password policies

Although domain password policies and FGPPs help ensure that domain users uphold strong password creation and regular password updates, they come with their own set of challenges.

• They cannot be applied to specific OUs.
• Dictionary words, patterns, and palindromes cannot be restricted.
• Consecutive repetition of the same character cannot be prevented.
• The Password must meet complexity requirements policy setting cannot be customized to specify the number of characters that must be used for a certain character type.
• The password policy cannot be enforced during password reset by admins in t he Active Directory Users and Computers (ADUC).

How ADSelfService Plus goes a step further

ManageEngine ADSelfService Plus is an identity security solution with MFA, SSO, and self-service password management capabilities. It provides the Password Policy Enforcer feature that empowers admins to create and enforce custom password policies fo r Active Directory and c loud application passwords.

The password policies can be created by configuring the required policy rules from the list provided. The rules are offered to ensure the passwords created by employees are secure according to four factors:

Characters

• Specify the number of uppercase and lowercase letters, numerals, and symbols that must be included.
• Specify the character type the password must begin with.
• Mandate the inclusion of Unicode characters.

Patterns

• Restrict the use of palindromes.
• Prevent the use of dictionary words and patterns from a customizable list.

Repetition

• Restrict character repetition.
• Prevent the use of consecutive characters from usernames and old passwords.

Length

• Specify both the minimum and maximum password lengths allowed.

Benefits of using ADSelfService Plus' Password Policy Enforcer

Fine-grained application

Custom password policies can be applied to users belonging to specific domains, OUs, and groups. Different password policies can be applied to particular applications as well.

Compliance

Password policies help comply with password requirements for regulations like NIST, CJIS, PCI DSS, and HIPAA.

Password strength analyzer

This meter depicts how strong the user's password is during creation.

Universal password policy

The password policy created can be enforced during password changes using the Ctrl+Alt+Del portal and password resets using the ADUC console. Password policies can also be applied for accounts of enterprise applications.

Password policy display

The password policy requirements will be displayed during password changes and resets.

Other password security features offered

Ban breached passwords

ADSelfService Plus' integration with Have I Been Pwned—the service that compiles and updates databases of exposed credentials—prevents employees from using passwords that have previously been exposed.

Weak passwords report

This tool helps you find weak passwords in Active Directory by comparing users’ passwords against a list of over 100,000 commonly used weak passwords. When it finds a match, the report will display the users' details. You can then force a password change for these employees.

Password audits

ADSelfService Plus generates reports that audit password-based actions like password resets and changes performed by the user. Detailed information like the time of the action and the device from which it was performed is stored as well.

While creating strong passwords can contribute to data security, including additional authentication methods through multi-factor authentication can further strengthen system and network security. ADSelfService Plus helps secure local and remote access to endpoints and enterprise applications through multi-factor authentication.