A common tactic sued by cybercriminals are brute force attacks used to gain access into an organization’s network and steal sensitive data. Common, probable and breached passwords are systematically run against a user’s email to gain access, the report states.

While the annual report showed weak passwords were often used in successful attacks, it also revealed that 83% of compromised passwords satisfied both length and complexity requirements of cybersecurity compliance standards such as NIST, PCI, ICO for GDPR, HITRUST for HIPAA and Cyber Essentials for NCSC.

“This shows that while organizations are making concerted efforts to follow password best practices and industry standards, more needs to be done to ensure passwords are strong and unique,” said Specops Software Product Manager Darren James. “With the sophistication of modern password attacks, additional security measures are always required to protect access to sensitive data.”

With these results in mind, the report offered some password protection best practices for organizations to protect corporate data.

• For most business, this starts with protecting Active Directory, the universal authentication solution for Windows domain networks.
• Default password policy settings in Active Directory do not go far enough. Third-party password security software can strengthen Active Directory accounts.
• Look for a solution that can block the use of compromised passwords and commonly used terms with custom dictionaries.