Skip navigation

Gloucestershire Business News

Business expert: Password spraying attacks - more common than you think

By David Woodfine, director at Cyber Security Associates 

Keeping passwords safe, secure and changed regularly are 'cyber tips' most people hear on a frequent basis.

But despite this many users, both at work and home, continue to use basic and simple passwords for multiple accounts.

The National Cyber Security Centre (NCSC) recently reported that one common way that online accounts are breached is through password spraying. This is simply where a small number of common passwords are used to brute force large numbers of accounts. These attacks can be very successful because for any given large set of users there will likely be some who are using very common passwords.

The NCSC reported that:

• 75% of the participants' organisations had accounts with passwords that featured in the top 1,000 passwords

• 87% had accounts with passwords that featured in the top 10,000

This data suggests that password spraying attacks are likely to have some success against these organisations, and many other organisations across the UK. Whilst account lockout policies may limit attackers to trying (for example) 10 passwords against a single account per day, the account lockout counters usually reset over time. This allows persistent attackers to try more passwords, and they can (and do) end up trying hundreds or even thousands of common passwords.

Password complexity doesn't guarantee that passwords will be more difficult for attackers to break, but it usually does make them harder for users to remember - which can lead to weaker passwords and more password reuse overall.

So instead, users should be encouraged to disable complexity requirements and adopt other strategies such as 'three random words'. However, this means that the onus is now even more on users to pick 'good' passwords (that is, passwords that cannot easily be guessed).

Fortunately, there are actually a variety of approaches organisations can take to mitigate these attacks, and the number of available options is growing regularly.

As a starting point, Cyber Security Associates recommends making sure that you do some of the following:

• One of the most effective approaches to stopping these attacks is to prevent users from using common passwords in the first place.

• Consider using outsourced protective monitoring over externally-reachable authentication endpoints to look for password spraying attacks.

• Enforce multi-factor authentication on your externally-reachable authentication endpoints.

• Provide pragmatic advice and training to users on how to choose 'good' passwords.

Are you in need of comprehensive cyber security advice, guidance and managed services for your business? Click here, email info@csa.limited or call 01452 886982 for more information.

Subscribe to Punchline

Related Articles

Stroud industrial estate to be redeveloped Image

Stroud industrial estate to be redeveloped

Planning has been approved to demolish and transform a dilapidated trading estate off Bath Road in Stroud.

Men jailed after attempted robbery and stabbing Image

Men jailed after attempted robbery and stabbing

Two men who stabbed a member of staff during an attempted to robbery of a business in Gloucestershire, have been jailed.

Business expert: Ssshhhush! Don’t mention GDPR, it might just all go away Image

Business expert: Ssshhhush! Don’t mention GDPR, it might just all go away

The General Data Protection Regulation arrived at our doors last year and it triggered a rush of activity in most organisations.

Authority rules on controversial Boots Corner road closure Image

Authority rules on controversial Boots Corner road closure

Objections from businesses, a petition signed by more than 5,700, and pressure from a packed public gallery failed to influence the minds of councillors in Cheltenham.

Copyright 2019 Moose Partnership Ltd. All rights reserved. Reproduction of any content is strictly forbidden without prior permission.