The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to Network Administrators regarding an increase in Password Spraying attacks.
What is a Password Spraying Attack?
Pretty much exactly what it sounds like. It’s a brute-force style attack where a would-be attacker literally sprays passwords at a user accounts until one sticks.
By using one password at a time across multiple accounts the attacker is usually able to remain undetected.
Typical Targets
Attackers go after a wide array of targets including, but not limited to:
- Webmail
- Remote Desktop Software
- Active Directory Federated Services
- Cloud Services (i.e. Office365)
What to Look For
- A high number of authentication attempts within a set period of time
- Large numbers of bad usernames
- High number of account lockouts within a set period of time
How to Stop a Password Spraying Attack
- Implement multifactor authentication
- Use complex passwords
- Implement a strong password reset policy
- Increase alerting and monitoring
Like our blog? Subscribe using the CTA in the upper right hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.
