How Companies Can Protect Themselves from Password Spraying Attacks

guest · Aug 12, 2021

How Companies Can Protect Themselves from Password Spraying Attacks
August 12, 2021
https://thehackernews.com/2021/08/how-companies-can-protect-themselves.html

However, one of the most common ways that hackers get into your environment is by compromising passwords.

The password spraying attack is a special kind of password attack that can prove effective in compromising your environment. Let's look closer at the password spraying attack and how organizations can prevent it.
Click to expand...

Beware of compromised credentials
Are compromised credentials dangerous to your environment? Yes! Compromised credentials allow an attacker to "walk in the front door" of your environment with legitimate credentials.
The compromise of a privileged account is even worse. Privileged accounts are accounts that have high levels of access, such as an administrator user account.
What is a password spraying attack?
The password spraying attack is a slightly different take on the brute force attack. In a typical brute force attack, an attacker tries an exponential number of passwords against a single account to crack that single account. With the password spraying attack, the attacker "sprays" multiple accounts with the same password.
Click to expand...

Prevent password spraying attacks
As with many cybersecurity threats, there is no one "silver bullet" that prevents all types of attacks. Instead, password security involves a multi-layered approach that includes many mitigations. So, what do these mitigations include?

Enforce account lockout policies limiting bad password attempts

Effective password policies enforcing good password hygiene

Use breached password protection

Implement multi-factor authentication

Click to expand...

guest · Oct 28, 2021

Microsoft talks password sprays, attack vectors, and how you can stay protected online
October 27, 2021
https://www.windowscentral.com/micr...vectors-and-how-you-can-stay-protected-online

What you need to know

Microsoft DART (Detection and Response Team) has a PSA for PC users on what password sprays are.

Password sprays attempt to match lots of usernames with common passwords in the hope of infiltrating as many accounts as possible.

Microsoft recommends multifactor authentication (MFA) as well as other methods to combat being the victim of a threat actor's password spray.

Click to expand...

Cybercrime is everywhere online, and having even a single account with a username and password means you're a hypothetical victim in the making. No password is invulnerable, after all. That's why Microsoft has taken the time to whip up a blog post on the topic of password sprays, how they affect you, and what you can do to prevent yourself from getting got.

The long and short of a password spray is this: It's when a threat actor gathers a list of usernames and common passwords and tries them against each other in hopes of stumbling upon correct combos. Microsoft outlines two different kinds of password sprays in its security blog post:
Click to expand...

Low and slow: Patience is key for a determined threat actor. The most sophisticated password sprays will use several individual IP addresses to attack multiple accounts at the same time with a limited number of curated password guesses.

Availability and reuse: With a new breach being announced publicly every month, the amount of compromised credentials posted on the dark web is rising rapidly. Attackers can utilize this tactic, also called "credential stuffing," to easily gain entry because it relies on people reusing passwords and usernames across sites.

Click to expand...

Two big items on Microsoft's guidance list are MFA (multifactor authentication) as well as dropping traditional passwords altogether. You can check out the company's blog post for further advice and details.
Click to expand...

Microsoft: Protect your business from password sprays with Microsoft DART recommendations

Log in or Sign up

How Companies Can Protect Themselves from Password Spraying Attacks

guest Guest

guest Guest

Log in or Sign up

How Companies Can Protect Themselves from Password Spraying Attacks

guest Guest

guest Guest

Useful Searches