ALERT: If you are NOT a StealthINTERCEPT Enterprise Password Enforcer or StealthAUDIT customer, view this blog for greater relevance and a more appropriate read.
With 34% of people saying they share passwords with coworkers1 and 62% reusing the same password for work and personal accounts2, the importance of checking passwords is paramount.
Last Friday (June 19, 2020) we saw our first update to the “Have I Been Pwned” (HIPD) database in almost 12 months. The database jumped from 555,278,657 to 572,611,621, an increase of 17.3 Million or 3%. I am not shocked that “123456” is even more popular today, being detected 23,597,311 times. My favorites, “p@ssw0rd” and “P@ssw0rd” have been used 53,154 and 54,230 times respectively.
Maybe more importantly are the ones that are seen less frequently:
Regardless how often they are used, it only takes one to impersonate the right user and you’re breached.
Both StealthINTERCEPT Enterprise Password Enforcer and StealthAUDIT leverage the HIPB database to audit and prevent known bad passwords from being used within Active Directory. Adding these 17 million new passwords enables Stealthbits to provide better password security.
1. Launch the StealthINTERCEPT Console.
2. Navigate to “Configuration” then “EPE Settings“.
3. Click “Check current version” (This validates a new version is available). Click “Update“.
1. Launch the StealthINTERCEPT Console.
2. Navigate to “Configuration” then “EPE Settings“.
3. Open a web browser and navigate to: https://haveibeenpwned.com/Passwords
Download NTLM Ordered by hast the last option. Uncompress the file using 7zip or tool of your choice.
4. Select “File” as the option for “Update from“. Click “Select File” and browse to the uncompressed file. Click “Update“.
Follow the instructions below to update StealthAUDIT.
1. Open a web browser and navigate to https://haveibeenpwned.com/Passwords
2. Download NTLM Ordered by hash the last option. Uncompress the file using 7zip or another tool of your choice.
3. Open the StealthAUDIT Windows Console
4. Navigate to the “WeakPasswords” job (Jobs -> Active Directory -> Users -> AD_WeakPasswords
5. Expand the weak passwords job and navigate to “Queries” (AD_WeakPasswords -> Configure -> Queries). Click “Configure“
6. Click “Dictionaries“. If you plan to use the HIBP database then you can uncheck the option for Use Stealthbits dictionary as it is a subset of the HIBP database.
Click “Add” and Navigate to your previously downloaded and uncompressed HIBP file.
1https://www.surveymonkey.com/curiosity/why-people-share-passwords-with-coworkers/
Rod Simmons is VP of Product Strategy at STEALTHbits Technologies responsible for the vision and strategy of their Active Directory Management and Security solutions. Rod has been in the technology space for over 20 years.
Prior to joining STEALTHbits, he served as Director of Product Management at BeyondTrust responsible for the Privileged Access Management products. He has also held positions leading Solution Architects and Product Managers at Quest Software and Netpro Computing Inc.
Proper data security begins with a strong foundation. Find out what you're standing on with a free deep-dive into the security of your Structured and Unstructured Data, Active Directory, and Windows infrastructure.
Read more© 2022 Stealthbits Technologies, Inc.
Leave a Reply