10 Essential Defenses Against Password Cracking Every Business Must Implement

The Weakest Link

Password-based attacks are behind an estimated 63% of all data breaches. They are a favourite among hackers because they are less complex than other methods and exploit a universal vulnerability: human nature. Since every account has a password, it’s a reliable attack surface. The good news is that with robust defences, you can significantly reduce this risk.

Here are 10 essential tips to fortify your organisation against password cracking.

1. Enforce a Strong Password Policy

A formal policy sets the ground rules for creating secure passwords. Mandate:

• Minimum length (12+ characters)
• Complexity: Mix of uppercase, lowercase, numbers, and symbols
• No common patterns: Ban passwords like “Password123” or “123456”
• Regular rotation: Force password changes every 60-90 days
• No password reuse: Prevent recycling old passwords

2. Implement Login Attempt Limits

Never allow unlimited password guesses. Configure all login portals to:

• Lock an account after 3-5 failed attempts.
• Require a password reset via email to unlock, thwarting automated brute-force attacks.

3. Add Salt to Your Password Hashes

“Salting” is a critical cryptographic practice that adds random data to a password before it’s hashed. This makes pre-computed “rainbow table” attacks useless, as each stored hash is unique even if the original passwords are the same.

4. Mandate Multi-Factor Authentication (MFA)

MFA adds a crucial second layer of security. Even if a password is cracked, the attacker cannot log in without the second factor, which can be:

• A code sent to a phone or email
• A biometric scan (fingerprint, face ID)
• A physical security key

5. Use Geo-Locking for Sensitive Accounts

If feasible, restrict account logins to specific geographical locations or IP address ranges. This drastically reduces the attack surface by limiting who can even attempt to access the account.

6. Change All Default Passwords Immediately

Default passwords are low-hanging fruit for attackers, who can easily find them online. Make it mandatory to change all default credentials on software, hardware, and user accounts upon setup.

7. Prohibit Password Sharing

Never share passwords. In a corporate setting, this creates an “insider threat” where a colleague could misuse access. Use secure methods for credential handover if necessary.

8. Promote a Company-Wide Password Manager

Password managers help users:

• Generate and store strong, unique passwords for every account.
• Securely autofill login fields.
• Receive alerts if a password appears in a known data breach.

9. Monitor the Web for Leaked Credentials

Since password reuse is common, a breach on another site can compromise your corporate accounts. Use monitoring services to:

• Scan data dumps and code repositories (like GitHub) for leaked corporate emails and passwords.
• Force a password reset immediately if a leak is detected.

10. Continuously Monitor User Accounts for Anomalies

Proactive monitoring can detect compromise early. Track:

• Failed login attempts
• Logins from unknown devices or unusual locations
• Activity outside of normal working hours
• Set alerts for suspicious activity that falls outside a user’s typical pattern.

A Layered Defence is Key

Password security is not about one silver bullet but a layered defence. By combining technical controls (MFA, salting, monitoring) with strong policies and user education, you can transform your passwords from a critical vulnerability into a robust first line of defence.

How BG Cyber Connections Can Help

Implementing these controls can be complex. BG Cyber Connect provides expert services to fortify your identity and access management, including:

• Security Policy Development: Crafting and enforcing robust password and access policies.
• MFA Implementation: Seamlessly deploying multi-factor authentication across your organisation.
• Proactive Threat Monitoring: 24/7 surveillance of your accounts and systems for signs of compromise.

Ready to lock down your login security?

Contact us for a Free Security Consultation