How to secure AD passwords without sacrificing end-user experience

Hackers are constantly attempting to steal passwords, with Microsoft tracking 1,287 password attacks every second in 2022. If successful, the stolen passwords could open the door to other accounts, and increase the likelihood of being targeted for more malicious attacks.

To increase password security, regulatory organizations are promoting longer and unique passwords for each account. Despite this, many people still stick to using the same easy-to-guess passwords for the sake of convenience.

This creates a breeding ground for security breaches and exposes organizations to vulnerabilities outside of their direct control. The good news is that there's an alternative approach that supports security and end-user experience at the same time.

Rethinking traditional password security best practices

There are a few reasons why users resort to poor password practices, the main one being that the standard best practice advice does not align with with how people generate and remember passwords. For example, for the longest time users have been told to create 8-character passwords consisting of different character types.

Yet, short passwords are more likely to be based on common words, and patterns, which are easy-to-remember, and also easy-to-crack using dictionary or pattern-based attacks.

Arbitrary password changes, such as requiring users to change their passwords every 90 days, are also still a common practice in some organizations as a security measure to mitigate the risk of unauthorized access to user accounts. Yet, frequent password changes also lead to password fatigue causing users to pick memorable passwords that can be easily guessed.

Aligning password security with the end-user experience

Given the prevalence and increased sophistication of password attacks, organizations need to be even more mindful of their password security practices. The following measures can enable users to create stronger passwords.

Enforcing longer passwords/passphrases

In 2021, the National Cyber Security Centre, issued the three random words advice.

The rule is simple: instead of using commonly known names and dates, create a password string of three unrelated words. This makes it harder for hackers to guess as there is no obvious link between the words.

Remembering a phrase is also simpler for end-users and means it is less likely to be forgotten.

Correlating password expiration with password length

Another way to implement user-friendly password policies is to associate password length with its expiry date. This means that the longer a password is, the longer its expiry date would be. 

Length-based password aging can encourage employees to use longer passwords while keeping your organization in line with industry standards and policies. 

The National Institute of Standards and Technology (NIST) advises against periodic password expirations as these are shown to have negative effects on users and security.

Instead, using the password length to determine the expiry date prevents frequent changes as well as indefinite use of the same password. 

Eliminating breached passwords

Using longer passwords alongside a password deny database of breached passwords provides the best protection. Specops Password Policy with Breached Password Protection allows organizations to block the use of over four billion (and growing) known compromised passwords and prevents users from selecting them for their Active Directory account.

The continuous scan feature also performs daily scans to ensure that your organization is protected from the latest breaches. The requirement for the system to only accept strong, hard-to-crack passwords helps shift the burden away from the user and also enhances the end-user experience.

Simplifying password security

Staying in front of password security practices is more important than ever given the ever-increasing number of online accounts and services. The good news is that implementing airtight password policies doesn’t have to be a pain.

Sophisticated password security tools can help you enforce what employees can and cannot do.

With Specops Password Policy you can enforce longer passwords, length-based password aging, and block the use of breached passwords in Active Directory.  

Learn more on how Specops Software could help increase your password security with a free trial

Sponsored and written by Specops Software.