[MUSIC]
Aakashi Kapoor: Welcome, everyone. And thanks a lot for joining
us in a discussion on Azure AD Password Protection. In this
series of videos, we will cover details of password protection
and smart lockout. The password validation algorithm
and the steps to deploy password protection on-premises.
My name is Aakashi Kapoor and I’m a Senior PM in Microsoft’s
Identity division.
Rohini Goyal: Hello, everyone. My name is Rohini Goyal and
I am a PM in Microsoft Identity Division as well. Now more
than ever, it’s becoming increasingly important for us to
secure our online accounts. We are all using several digital
services and we constantly find ourselves having to configure
passwords, every time we create a new account. We’re falling
into unsecure habits by using common expressions and
reusing these common passwords. Now, unfortunately,
hackers are smart and they understand these tendencies.
They know that the passwords that are easy for us to
remember are also easy for them to guess.
Identity related attacks are on the rise. Hackers are getting
smarter and more strategic in performing attacks and
compromising user accounts. If we look at the statistics,
there has been a 250% increase in phishing attempts in
2018. Microsoft’s lead credentials service has processed over
five billion credentials in 2019 alone, of which 50 million
accounts were marked as compromised. As password
spray attacks are becoming increasingly prevalent, this is
when a hacker chooses a set of passwords and uses them
across multiple accounts. They just need one account to
match one of these passwords to get access to your
organization’s resources. Common passwords that users
can figure and bad actors attack includes words such as
the different seasons, months in a year, numbers themselves,
or number patterns. However, when performing targeted
attacks, bad actors choose words and phrases that are
unique to your organization. Users in your organization will
be more inclined to use passwords that include product
names, location of your headquarters, and your CEO’s name.
And once again, bad actors are smart and know about these
patterns, so we need to start preventing our users from
using these easily guessable passwords.
Aakashi: Well said, Rohini. To add to what you said, the
best way to solve this issue is to actually completely move
away from passwords and go passwordless. Microsoft has
been on a journey to provide a seamless, secure, and
passwordless access to all your Azure AD connected apps
and services. While we’re in the middle of this transition to
passwordless authentication, we still need a solution to help
our customers protect their environments against weak
passwords, both in the on cloud and on-prem. This is where
Azure AD Password Protection comes in.
Azure AD Password Protection helps you eliminate easily
guessable passwords and customize your lockout settings
for your environment. Enabling this can dramatically lower
the risk of being compromised by password spray and brute
force attacks. It protects accounts in Azure AD and Windows
Server Active Directory by preventing your users from using
one of the million weak passwords. It checks from a
constantly growing list of most commonly used passwords,
plus millions of character substitution variations of those
passwords.
After performing extensive research and analyzing passwords
that commonly appear in breaches, Microsoft has developed
the Global Banned Password List, which is a list of common
passwords. It is powered by Azure AD, which regularly
updates based on learnings from billions of authentications
and analysis of leaked credentials across the web.
To help protect you against targeted attacks, you can also
configure your own custom banned password list, which
contains words and phrases which are unique to your
organization. These two lists combined with the Banned
Password Algorithm are then used to generate a password
validation score.
Every single password change and reset in Azure as well
as on-prem is assessed for password strength. And only
the strong passwords that are hard to guess are then
allowed.
Azure AD Password Protection also provides an integrated
admin experience to control checks for passwords in
your organization in Azure and on-premises. One thing I
would like to emphasize here is that password protection
is not a traditional password policy. It’s not about min and
max complexity requirements and so forth. Our research
actually shows that having these password complexity
requirements are causing users to opt for guessable
password patterns, which we need to avoid. Instead, password
protection checks for your password strength using a password
validation algorithm.
Rohini: In addition to leveraging the banned password lists,
password protection also enables customers to set their
own lockout settings. Now, account lockout is something you
may have experienced with other services. We’ve all forgotten
our passwords and tried to guess it multiple times, only to
end up being locked out of our account. If a bad actor is
attempting to guess your password and assuming you have
configured your custom banned password lists and deployed
password protection in your environment, a bad actor won’t
be able to guess your password. These failed authentication
attempts will lockout the account. Traditional lockout systems
lockout both the bad actor and the genuine user.
We wanted to make a protection mechanism that prevented
bad actors from getting into your account while allowing
the genuine user access to their account. And this is
where smart lockout comes into play. Smart lockout is
just that. It’s smart. It differentiates login attempts
coming from a bad actor versus that of the account’s
genuine user. The added benefit of smart lockout is the
ability to configure your own lockout settings. The default
setting which is on for all cloud based authentications is
10 failed login attempts will result in a 60-second lockout
period. Once the 60 seconds have passed, if the 11th
login attempt is still incorrect, the 60 seconds will start over
again. And over time, this behavior will cause the 60-
second period to grow.
Depending on your organization’s policy or different compliance
rules, you can configure a stricter policy by decreasing the
number of attempts and increasing the lockout period.
Now, just a few things to look out for, repeating the same
incorrect password will not contribute to the lockout counter,
only unique passwords will increment the counter. And
additionally, smart lockout works with passthrough
authentication.
So, thank you so much, Aakashi, for being here with me
today.
Aakashi: Thank you so much for having me here.
Rohini: And thanks to all of you for watching the video.
And we hope this was helpful for you to understand
what password protection is. If you have any questions,
feel free to reach out to aadppfeedback@microsoft.com.
And Aakashi or myself will be more than happy to help.
We hope to see you all again in our next videos, which
will dive deeper into Azure AD Password Protection Banned
Passwords and how to deploy it in your environment.
[MUSIC]