Password Policies
Set and enforce secure password policies for accounts.
Techniques Addressed by Mitigation
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1110 | Brute Force |
Refer to NIST guidelines when creating password policies.[1] |
|
.001 | Password Guessing |
Refer to NIST guidelines when creating password policies. [1] |
||
.002 | Password Cracking |
Refer to NIST guidelines when creating password policies. [1] |
||
.003 | Password Spraying |
Refer to NIST guidelines when creating password policies. [1] |
||
.004 | Credential Stuffing |
Refer to NIST guidelines when creating password policies. [1] |
||
Enterprise | T1555 | Credentials from Password Stores |
The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. Organizations may consider weighing the risk of storing credentials in password stores and web browsers. If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations. |
|
.001 | Keychain |
The password for the user's login keychain can be changed from the user's login password. This increases the complexity for an adversary because they need to know an additional password. |
||
.003 | Credentials from Web Browsers |
Organizations may consider weighing the risk of storing credentials in web browsers. If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers. |
||
Enterprise | T1187 | Forced Authentication |
Use strong passwords to increase the difficulty of credential hashes from being cracked if they are obtained. |
|
Enterprise | T1601 | Modify System Image |
Refer to NIST guidelines when creating password policies. [1] |
|
.001 | Patch System Image |
Refer to NIST guidelines when creating password policies. [1] |
||
.002 | Downgrade System Image |
Refer to NIST guidelines when creating password policies. [1] |
||
Enterprise | T1599 | Network Boundary Bridging |
Refer to NIST guidelines when creating password policies. [1] |
|
.001 | Network Address Translation Traversal |
Refer to NIST guidelines when creating password policies. [1] |
||
Enterprise | T1003 | OS Credential Dumping |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
|
.006 | DCSync |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.001 | LSASS Memory |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.002 | Security Account Manager |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.007 | Proc Filesystem |
Ensure that root accounts have complex, unique passwords across all systems on the network. |
||
.008 | /etc/passwd and /etc/shadow |
Ensure that root accounts have complex, unique passwords across all systems on the network. |
||
.005 | Cached Domain Credentials |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.004 | LSA Secrets |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.003 | NTDS |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
Enterprise | T1201 | Password Policy Discovery |
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory ( |
|
Enterprise | T1563 | .001 | Remote Service Session Hijacking: SSH Hijacking |
Ensure SSH key pairs have strong passwords and refrain from using key-store technologies such as ssh-agent unless they are properly protected. |
Enterprise | T1021 | .002 | Remote Services: SMB/Windows Admin Shares |
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. |
Enterprise | T1072 | Software Deployment Tools |
Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network. |
|
Enterprise | T1558 | Steal or Forge Kerberos Tickets |
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.[3] Also consider using Group Managed Service Accounts or another third party product such as password vaulting.[3] |
|
.002 | Silver Ticket |
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.[3] Also consider using Group Managed Service Accounts or another third party product such as password vaulting.[3] |
||
.003 | Kerberoasting |
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.[3] Also consider using Group Managed Service Accounts or another third party product such as password vaulting.[3] |
||
.004 | AS-REP Roasting |
Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire. Also consider using Group Managed Service Accounts or another third party product such as password vaulting. [3] |
||
Enterprise | T1537 | Transfer Data to Cloud Account |
Consider rotating access keys within a certain number of days to reduce the effectiveness of stolen credentials. |
|
Enterprise | T1552 | Unsecured Credentials |
Use strong passphrases for private keys to make cracking difficult. Do not store credentials within the Registry. Establish an organizational policy that prohibits password storage in files. |
|
.001 | Credentials In Files |
Establish an organizational policy that prohibits password storage in files. |
||
.002 | Credentials in Registry |
Do not store credentials within the Registry. |
||
.004 | Private Keys |
Use strong passphrases for private keys to make cracking difficult. |
||
Enterprise | T1550 | .003 | Use Alternate Authentication Material: Pass the Ticket |
Ensure that local administrator accounts have complex, unique passwords. |
Enterprise | T1078 | Valid Accounts |
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. [4] When possible, applications that use SSH keys should be updated periodically and properly secured. |
|
.003 | Local Accounts |
Ensure that local administrator accounts have complex, unique passwords across all systems on the network. |
||
.004 | Cloud Accounts |
Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network. Passwords and access keys should be rotated regularly. This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge. Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.[5] |
||
.001 | Default Accounts |
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. [4] |
References
- Grassi, P., et al. (2017, December 1). SP 800-63-3, Digital Identity Guidelines. Retrieved January 16, 2019.
- Microsoft. (n.d.). Installing and Registering a Password Filter DLL. Retrieved November 21, 2017.
- Metcalf, S. (2015, December 31). Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Active Directory Domain. Retrieved March 22, 2018.