DARREN JAMES at Specops Software describes how weak passwords are (still) a major problem for businesses.

Strong passwords (passwords that are long, unique, and hard-to-guess) are perhaps the most basic cyber-security measure there is. And yet, despite decades of security professionals espousing the importance of good password practices, far too many users fail to implement them.

Considering the increase of credential stuffing and brute force attacks in recent months, poor password hygiene is clearly still a major problem for businesses. The Specops 2023 Global Weak Password Report highlights the true extent of the issue.

Most passwords are too weak

Unsurprisingly, the report found that 88 per cent of breached passwords contained 12 characters or less. Security professionals may be astounded that so many users persist in using weak passwords but considering that 41 per cent of Americans rely on memory alone to store their passwords, these results are par for the course.

Worse still, 24 per cent of breached passwords consisted of only 8 characters, while 18.2 per cent contained only lower-case letters. The most common base terms used in passwords were: “password”, “admin”, “welcome” and “p@ssw0rd”.

It’s incredibly concerning that in 2023, with the vast amount of information regarding good cyber-security practices available, users are still failing to follow even the most basic advice.

These results, however, don’t simply highlight the widespread failure of users to protect themselves and their employers – they reveal the true danger of weak passwords. The 800 million breached passwords analysed in this report are a small subset of 3 billion unique compromised passwords within the Specops Breached Password Protection List.

With more than 15 billion stolen credentials circulating the internet, one can only judge that a weak password doesn’t just pose a risk of being breached, but, given enough time, it will inevitably be leveraged in an attack.

However, as disappointing as these results are, they will come as little surprise to anyone plugged into cyber-security news feeds. Human error is and always will be a major thorn in the side of cyber-security teams.

More concerning is that 83 per cent of compromised passwords satisfied both length and complexity requirements for cyber-security compliance standards such as NIST, PCI, ICO for GDPR, HITRUST for HIPAA and Cyber Essentials for NCSC.

The ramifications of this discovery are enormous; even widely accepted good password practices are no longer enough to protect us from cyber-crime.

Password crime in the real world

We are not only speaking in hypotheticals here. Brute force attacks, which involve cyber-criminals using common, probable, and even breached passwords to run against a user’s login to gain access to the account and potentially steal sensitive data are becoming increasingly common.

The Specops team even found that cyber-criminals were still leveraging “homelesspa” in their attacks, a password term found in a 2016 MySpace data leak. This proves that “old”, breached passwords are still being used many years later.

It would be understandable if, looking at these results, you assumed that those employing weak passwords such as those listed above are largely out of the cyber-security loop. Children, perhaps, or the elderly.

This is not the case. In 2022, Nvidia, an American technology goliath, suffered a major breach that leaked thousands of employee passwords. Keep in mind that this is not only one of the largest companies in the world, but a technology company to boot; we would assume that their employees recognise the importance of solid password practices, right?

Unfortunately not. Many of Nvidia’s employees had used passwords such as “Nvidia”, “qwerty” and “nvidia3d”. Passwords related to the organisation are extraordinarily bad practice as they will be among the first credentials cyber-criminals try. The inadequacy of “qwerty” as a password should be obvious to anyone with a keyboard.

The solution to weak passwords

But it isn’t all doom and gloom. Even when end-user training fails to prevent password reuse and other risky practices, there are steps organisations can take to protect corporate data. The three key enforcement measures all businesses must implement in order to protect themselves are:

Recognising that the default password policy settings in Active Directory (the universal authentication solution for Windows domain networks) do not go far enough. Implement third-party password security software to strengthen your Active Directory accounts.

Looking for a solution that can block the use of compromised passwords and commonly used terms with custom dictionaries.

Using multi-factor authentication wherever possible alongside a strong password policy for a layered security approach.

• James is Senior Product Manager at Specops Software.