There’s been a lot of chatter lately about moving on from passwords. But long passwords are still a good defense against some types of attacks. Brute force attack actors dedicate just a fraction of their efforts to cracking them, a Microsoft researcher found.

The researcher analyzed over 25 million brute force attack attempts that occurred across their employer’s sensor network. What they found means most of these passwords are safe from this particular type of attack. It won’t help if your password has been leaked online, though. It also doesn’t help if your password already exists as part of an attacker’s brute force attack dictionary. But it does count for something.

“77% of attempts used a password between one and seven characters. A password over 10 characters was only seen in 6% of cases,” the researcher explained, as quoted by The Record.

In his analysis of those attack attempts, the security researcher found that less than half (39%) of the brute force attack attempts involved at least one number. Just 7% of those attack instances contained a special character, while none of the brute-force attempts included white space.

Attackers Using This Method More Often

Bruce force attacks are becoming more common. In September 2021, MSSP Alert reported that the share of brute-force campaigns compared to all other attack operations increased from 13% to 32% between September 2020 and September 2021. About a quarter (26%) of organizations were on the receiving end of brute force attacks during that period.

In September, Threatpost reported on a campaign in which threat actors compromised as many as 100,000 inboxes on a daily basis. The operation consisted of malicious actors targeting gift cards and customer-loyalty program data. Once they grabbed it, they monetized it on the darknet or redeemed it for goods and services.

How to Defend Against Brute Force Attacks

One effective deterrent is to implement a policy that requires users to leverage passwords consisting of at least 10 characters. There’s an important caveat here, however, in that longer passwords don’t automatically increase organizations’ overall level of digital security.

At best, there’s the potential for longer passwords to translate into more password reset requests and, by extension, more wasted time for help desk teams. At worst, these types of policies could motivate users to reuse variants of the same password across multiple web accounts, a practice that increases their exposure to credential stuffing.

Organizations therefore might want to consider combining this type of policy with other security controls such as multi-factor authentication, single-sign-on and password managers. Or, ditch passwords altogether and embrace passwordless authentication.

More from Identity & Access

How to Keep Your Secrets Safe: A Password Primer

There are two kinds of companies in the world: those that have been breached by criminals, and those that have been breached and don't know it yet. Criminals are relentless. Today’s cyberattacks have evolved into high-level espionage perpetrated by robust criminal organizations or nation-states. In the era of software as a service (SaaS), enterprise data is more likely to be stored on the cloud rather than on prem. Using sophisticated cloud scanning software, criminals can breach an enterprise system within…

Making the Leap: The Risks and Benefits of Passwordless Authentication

The password isn't going anywhere. Passwordless authentication is gaining momentum, though. It appears to be winning the battle of how companies are choosing to log in. Like it or not, the security industry must contend with both in the future.  But for some businesses and agencies, going passwordless is the clear strategy. Microsoft, for instance, has recently stopped forcing users to use a password to access their account, which allows access to a wide range of Microsoft business and personal…

Old Habits Die Hard: New Report Finds Businesses Still Introducing Security Risk into Cloud Environments

While cloud computing and its many forms (private, public, hybrid cloud or multi-cloud environments) have become ubiquitous with innovation and growth over the past decade, cybercriminals have closely watched the migration and introduced innovations of their own to exploit the platforms. Most of these exploits are based on poor configurations and human error. New IBM Security X-Force data reveals that many cloud-adopting businesses are falling behind on basic security best practices, introducing more risk to their organizations. Shedding light on…

Why Your Success Depends on Your IAM Capability

It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM). Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users' perception of the…