“123456” is the most commonly used password worldwide. We repeatedly see this or similar passwords during our IT security operations. You don"t even need special software to crack passwords like this in a matter of seconds.
With an account hacked in this way, we can regularly take over our customers" entire networks during our pentests. This shows how important the topic of authentication is.
In this article, we provide an overview of the login procedures and explain which variant we consider to be secure.
The primary goal of a password is to prevent unauthorized persons from accessing a system and to allow only authorized users to enter. Ideally, a password should work like a digital key: it protects sensitive information and helps to securely confirm the user"s identity. Unfortunately, passwords have been the standard means of securing digital systems for decades because they have serious weaknesses. One of the main problems is that many users still choose simple and easy-to-guess passwords, such as “123456” or “password”. But even more complex combinations can quickly be cracked using brute force attacks. In this method, a hacker systematically tries out all possible password combinations until they find the right one. Using software, hundreds of variants can be tested per second. Even complex passwords don"t offer complete protection, because many users tend to use the same password for several accounts. If one of these accounts is hacked, the others are often at risk as well. In addition, there is the problem of phishing attacks: attackers try to deceive users and trick them into revealing their passwords. This is a major risk, especially for companies where the loss of access data can have serious consequences. The IT security world is therefore increasingly working on alternatives, such as biometric authentication or multi-factor authentication (MFA), to further increase protection and reduce dependence on passwords alone.
Our experience in incident response (supporting customers immediately after a successful attack on their IT infrastructure) over the last few years clearly shows that passwords, even when combined with all types of two-factor authentication, cannot withstand an automated attack and are therefore obsolete.
While multi-factor authentication still helps against so-called “password breaches” (this describes the disclosure of passwords when they are used multiple times and these become known through a hack on another system), it cannot withstand a phishing attack.
The only thing that offers long-term protection in practice is the phishing-resistant “Passkeys” procedure. The following diagram explains the way in which a complete authentication should be implemented within an organization, as proposed by Trufflepig.
However, you should make sure that they have been certified using the “FIDO2” standard (a standard that was launched in 2015. It technically prevents the entry of access data on third-party websites). You can use the public database to see whether your preferred Passkey follows this standard.
Many systems (including log-in to Windows workstations) do not fully support the use of passkeys in today"s world.
In practice, this cannot always be avoided, which is why a compromise often has to be made – a classic password.
When onboarding new employees, you should generate a password with at least 32 characters and not let the end user choose it freely.
Important: The employee only needs this password when setting up a new work device; after that, the password can be forgotten and destroyed.
As a next step, we recommend enforcing “Windows Hello” at the workstations. It is an alternative to the classic password login on Windows devices to unlock the workstation. A variety of authentication options can be selected here:
Fingerprint
Face recognition (please only with infrared cameras that have 3D recognition, otherwise a good picture of an employee is enough to unlock the system)
There are many different systems in a company that require authentication for a secure network. The diagram illustrates various options, ranging from secure (centrally manageable, not vulnerable to attack) to insecure methods.
Unfortunately, even today not all systems support the FIDO2 standard, which was developed in 2015 and is currently considered to be phishing-resistant.
In principle, we recommend implementing an SSO (Single Sign-On) solution across the company. Single Sign-On (SSO) is an authentication procedure in which users log in once and then gain access to several connected applications or services without having to log in again. This simplifies the login process and saves time, since users only need a single password to access all authorized systems. This offers two fundamental advantages:
A login via SSO looks like this:
In this example, the login is done via Google / Entra ID (Microsoft). This offers users the advantage of being able to log in to the system (e.g. Microsoft) once and then access the necessary tools without having to re-authenticate.The Remote Desktop Protocol (RDP) was developed by Microsoft and enables a connection from one computer to another computer in the network. Clients from Windows 10 and servers from Windows Server 2022, which are in the “Azure Active Directory” (meaning the Active Directory in the cloud of Microsoft itself), can store a security key for RDP users in the group policy (the administration of settings on the Windows devices) for the login. There are some useful instructions on how to do this from Token2.
RADIUS stands for “Remote Authentication Dial-In User Service (RADIUS)”. It is a central authentication server. Clients can dial into a network via VPN. Some corporate networks operate according to the zero-trust principle. This means that a component in the network can be trusted until it has authenticated itself. We often see RADIUS servers in practice. This Radius server must then be stored in the VPN, but also for 802.1x authentication, to enforce authentication using FIDO2. Unfortunately, the integrated Windows Radius server also does not currently support passkeys, which is why we recommend a Radius server such as FreeRADIUS for this type of authentication.
Some sites do not support SSO but do allow the use of passkeys. Sometimes (e.g. for software developers with Github) private accounts are used. In this case, the use of FIDO2 should also be enforced, or rather required. The problem: Since these accounts cannot be managed centrally, it is often forgotten to revoke access rights after a change of department or after the employee has left the company. This can lead to compliance violations or subsequent attacks on your company if access is not reliably blocked.
Unfortunately, there are still some programs that do not allow Passkeys. If there is no alternative that is more secure, we recommend introducing an enterprise-wide password store such as Vaultwarden or Bitwarden including the corresponding browser extension. This makes it easier for employees to use. However, access to this password store itself should always be via SSO or at least passkeys. In this password vault, a separate entropy-based password with at least 32 characters should then be generated for each access that requires a password. These passwords never have to be entered by hand, but can always be entered using this solution by copy and paste or using the browser plug-in itself. It is also recommended to store a TOTP (Time-Based One-Time Password) for each login. This is probably the best-known type of two-factor authentication. Typically, it is a six-digit numerical code that is entered from an app, e.g. from a smartphone. This can also be stored in the corresponding password store and is only intended to protect against attacks on the target system"s database. Important: As with the previous solution, it is easy to forget to disable accounts – for example, after an employee changes departments or leaves the company. Furthermore, the last step, entering the password, is not safe from phishing attacks. The attacker could attack the authentication, steal it and thus log into the employee"s user session. This method should be the last resort if SSO, Passkey or RADIUS are not supported.
