Re: Brute force credentials protection

["Laverty, Patrick" <patrick_laverty () BROWN EDU>]

The article that Phil links does make some interesting points. I also like
that the author brought up the IP based lockouts, which help against brute
force attacks. One thing to keep in mind with those is while they will
protect the services that they are in front of, if you have any service
exposed to the internet that uses domain authentication, that will be used
for password brute force guessing. The article does also stress using
"strong passwords" but what that means is not always clear to people. For
example, the most common password policy is to require:
Minimum 8 characters
Complexity with at least 3 out of 4 of uppercase, lowercase, special
characters, digits.
Change every 90 days
Can't use an old password.

That's pretty standard, and at first glance, seems pretty good. However
Password1 fits that criteria. As does Winter2019. As does Classof 2022.

These are all passwords that the brute force guessers are aware of and will
be trying. With a large enough username set (often universities make lookup
publicly available) there will be weak passwords found, allowing the
attacker to get VPN access into the network.

Another behavior you can look for with regard to brute force is a single IP
trying to log in with different usernames. I would probably not implement
this on campus, as a residence hall would get triggered pretty quickly. But
from off-campus, there might not be a valid use case for a single IP to be
trying to log in to a service with 25+ different usernames.

Thanks!

Patrick


On Tue, Mar 5, 2019 at 6:18 AM Maud, Phil <P.H.Maud () cranfield ac uk> wrote:

> This makes interesting reading
>
>
> https://ravingroo.com/295/active-directory-account-lockout-policy-threshold-counter-strong-password/
>
> Regards
>
> Phil Maud
> Information Security Analyst
> Information Services, Building 63 (IT) G7
> E: P.H.Maud () cranfield ac uk
> T: +44 (0) 1234 75 4879
>
>
> -----Original Message-----
> From: The EDUCAUSE Security Community Group Listserv <
> SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Mike Dronen
> Sent: 04 March 2019 20:04
> To: SECURITY () LISTSERV EDUCAUSE EDU
> Subject: [SECURITY] Brute force credentials protection
>
> All - Looks like it's been a while since this topic has come up in the
> forum. I'm wondering how you protect against brute force password attempts,
> i.e. two-factor auth. In our environment we set an attribute in AD to lock
> the user account for a prescribed period of time after four failed
> attempts. This appears to work for us. Just wondering if there are other
> mechanisms just as good or better? Thanks.