Active Directory - Password blacklist software

[localzuk]

In light of the CESG/CPNI password guidance that advises against forced password changes, amongst other things, and advises for password blacklisting to be used, is anyone using such software with their Active Directory domains?

 

There's a variety of it on the market, but just wanted to see if any of you guys and gals are using anything already.

 

Here's the guidance for anyone interested:

 

https://www.gchq.gov.uk/news-article/password-guidance-simplifying-your-approach

https://www.ncsc.gov.uk/guidance/password-guidance-simplifying-your-approach

https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/458857/Password_guidance_-_simplifying_your_approach.pdf

[Michael]

If you enforce certain password complexity requirements and then relax how frequently it's to be changed, surely that's the better solution?

 

So if it's 8 characters, one capital, one symbol or number, then it's impossible to have 'password' for example.

[mjk]

Periodically pull the ntds.dit file from your domain controller and crack it with John the Ripper. Any account cracked within X hrs gets a forced reset.

[localzuk]

If you enforce certain password complexity requirements and then relax how frequently it's to be changed, surely that's the better solution?

So if it's 8 characters, one capital, one symbol or number, then it's impossible to have 'password' for example.

That wouldn't be following the advice of CESG/CPNI/GCHQ.

 

An 8 character password that complies with your rules but would be cracked in seconds is P4ssword or P@ssword. Password1 would pass too, but is also the most common password used in the world.

[Michael]

That wouldn't be following the advice of CESG/CPNI/GCHQ.

 

An 8 character password that complies with your rules but would be cracked in seconds is P4ssword or P@ssword. Password1 would pass too, but is also the most common password used in the world.

 

You have to draw the line somewhere - any password is breakable and you can of course tweak it even higher as you require, to say 12 characters.

 

I think that's why (for years) regular password changes rather than very long complex ones are considered better, simply because if it's too long/complex, Staff will just write it down.

[localzuk]

You have to draw the line somewhere - any password is breakable and you can of course tweak it even higher as you require, to say 12 characters.

I think that's why (for years) regular password changes rather than very long complex ones are considered better, simply because if it's too long/complex, Staff will just write it down.

That's the thing though, what you're proposing goes directly against the advice given!

 

A blacklist isn't complex technology, but improves security dramatically. So, the topic still stands - has anyone used this tech with Active Directory?

[ellsandell]

A few threads on Reddit. Edited February 9, 2017 by ellsandell

[Arthur]

So if it's 8 characters, one capital, one symbol or number, then it's impossible to have 'password' for example.

While that's true, it also means that users predictably do what's mentioned below and end up with weaker passwords.

 

Microsoft Password Guidance (PDF)

 

Advice to IT Administrators

Azure Active Directory and Active Directory allow you to support the recommendations in this paper:

1. Maintain an 8-character minimum length requirement (and longer is not necessarily better).
   
2. Eliminate character-composition requirements.
   
3. Eliminate mandatory periodic password resets for user accounts.
   
4. Ban common passwords, to keep the most vulnerable passwords out of your system.
   
5. Educate your users not to re-use their password for non-work-related purposes.
   
6. Enforce registration for multi-factor authentication.
   
7. Enable risk based multi-factor authentication challenges.
   

 

2. Anti-Pattern #2: Requiring the use of multiple character sets

Password complexity requirements reduce key space and cause users to act in predictable ways, doing more harm than good. This is shown in the Microsoft Research paper "Do Strong Web Passwords Accomplish Anything?" by Cormac Herley and Dinei Florencio.

 

Most systems enforce some level of password complexity requirements. Example:

 

• Passwords need characters from all three of the following categories:
  
  • Uppercase characters
    
  • Lowercase characters
    
  • Non-alphanumeric characters
    

Most people use similar patterns (i.e. capital letter in the first position, a symbol in the last, and a number in the last 2). Cyber criminals know this, so they run their dictionary attacks using the common substitutions, such as "$" for "s", "@" for "a," "1" for "l" and so on. More info from the “Schneier on Security” blog is here. There’s also a Wall Street Journal article here that explains common behaviors when users pick passwords. Thus advocating a combination of upper, lower, digits, special characters has a negative effect.

 

Some complexity requirements even prevent users from using very secure but memorable passwords and force them into coming up with a new less secure and less memorable password. An example is the error that “Your password can’t contain &. Please try again by avoiding the use of # & * < > [ ] { }”.

Edited February 9, 2017 by Arthur

[Michael]

So essentially are we all saying Microsoft's default Active Directory password policy is inadequate, even in the likes of Server 2016?

[localzuk]

So essentially are we all saying Microsoft's default Active Directory password policy is inadequate, even in the likes of Server 2016?

Yup. That's what we're saying.

[FN-GM]

Not ideal but an idea that will work for new accounts only, its free but a little messy.

 

You set the password policy to remember say 99 past passwords. You get a list of say 50 commonly used passwords. With that list you use a script to rest the new accounts password 50 times with the password from the list. Finally reset it 1 last time with the password you want them to have.

 

Should they try to change the password to one of those commonly used passwords it will reject it.

[Michael]

A quick Google reveals Quest Password Manager, but at nearly £5 a user, it's just laughable.

[Arthur]

A quick Google reveals Quest Password Manager, but at nearly £5 a user, it's just laughable.

Specops Password Policy and nFront Password Filter are probably in the same price range too (no prices listed on their websites so could be $$$!).

 

Password Policy Enforcer is $1,800 to $4,290! :eek:

[kearton]

I've also been contemplating password policies etc lately, particularly blacklisting etc.

Having searched EG a bit more, I was happy to see some (old) posts about Specops Password Policy Basic which was free

Having contacted them last night, I got a reply from Alan today.

Sadly, the 'Basic' product is no longer offered, and the full-fat version comes at a cost of several hundreds of pounds

[Sagima]

I was reading about something similar in azure last year. https://blogs.technet.microsoft.com/enterprisemobility/2016/05/24/another-117m-leaked-usernames-and-passwords-new-best-practices-azuread-and-msa-can-help/

 

No idea about costs but we seem to get a lot free from MS so maybe that will help?

 

We enforce an 11 character complex password policy here for pupils in years 5 and above and all staff which causes us very few difficulties and doesn't seem to involve too much writing down that we've noticed. We haven't forced password changes on our users in four years now.

[fiza]

Resurrecting this thread. Is anyone using a solution to ban certain passwords?

 

Is 2FA viable for students?

[Arthur]

Resurrecting this thread. Is anyone using a solution to ban certain passwords?

Currently considering ActivePasswords which was mentioned in another thread since the pricing is actually reasonable.

 

Is 2FA viable for students?

Not in my school. Mobile phones are banned and I doubt students would want to buy Yubikeys (or equivalent).

Edited December 13, 2017 by Arthur

[fiza]

Currently considering ActivePasswords which was mentioned in another thread since the pricing is actually reasonable.

 

Any ideas on price?

 

Would be interested in the outcome if you trial the software.

[Arthur]

Any ideas on price?

I have just e-mailed them for education pricing and will update this thread when I find out.

 

Even their list price is cheaper than the competition...

 

=50&languageid=1&nolselection=1"]https://secure.shareit.com/shareit/checkout.html?PRODUCT[300609334]=50&languageid=1&nolselection=1

 

For reference, nFront give a 30% discount for staff licenses and a 60% discount for student licenses. For my school that came to around $1,800 per year for the multi-policy edition and $1,600 for the single policy edition (both include a $500 domain setup fee).

 

Specops offer a 30% discount for their Password Policy software, but it's so ludicrously expensive to start with it was a complete non-starter.

 

Perpetual pricing (inc. support & maintenance for 12 months)

Staff = £9.78 per user/year

Students = £3.76 per user/year

 

Subscription pricing (3 years, inc. support & maintenance)

£3.78 per user

Edited December 13, 2017 by Arthur

[Arthur]

Any ideas on price?

Just had the EDU pricing for ActivePasswords. They offer a 30% discount, so 1,000 users would cost £525 + VAT.

 

E-mail [email protected] for a coupon code you can use during the checkout process if ordering by credit card.

[localzuk]

Just got my price too. At that price, it isn't bad at all. I'd be able to eliminate the 45 day password changes in line with that GCHQ advice.

[fiza]

Just had the EDU pricing for ActivePasswords. They offer a 30% discount, so 1,000 users would cost £525 + VAT.

 

E-mail [email protected] for a coupon code you can use during the checkout process if ordering by credit card.

Is that an annual cost? If so will it go up by 30% after year 1?

[Arthur]

Is that an annual cost?

Yes.

 

If so will it go up by 30% after year 1?

Good question. I will find out (unless @localzuk already knows?).

[kearton]

Wow. Waiting on my quote from WizardSoft now, but based on .90 euros (79p?) per user, less 30% discount, that's a decent price. Thanks for the heads up, @Arthur

Here's the pricing I've had (based on using it for 250 staff only, no students) so far for comparison if anyone else is interested

Edited December 14, 2017 by kearton

[fiza]

Wow. Waiting on my quote from WizardSoft now, but based on .90 euros (79p?) per user, less 30% discount, that's a decent price. Thanks for the heads up, @Arthur

Here's the pricing I've had (based on using it for 250 staff only, no students) so far for comparison if anyone else is interested

[ATTACH=CONFIG]46734[/ATTACH]

 

How does it work if you buy it only for Staff? How would you set it to only work with Staff Accounts?