What is a password spray attack?

With the number of cybersecurity threats increasing by the day, it can be hard to keep up with the latest terms and phrases used to describe them. A password spray attack is an unsophisticated method that has been around for a long time, but you might not have necessarily come across before.

Brute force attack

This is a type of so-called 'brute force' technique, which feeds a large volume of usernames and passwords into an account in an effort to find the right combination. Because many people still use common passwords, this can be surprisingly effective once usernames are guessed successfully or acquired through different means. Passwords from sites that have been compromised in a separate attack can also be used.

Aims of attack

The aims of a hacker using a password spray attack are usually to gain access to accounts to steal personal information and data that can then be used in financial fraud crime. If the attack is targeted at a particular individual or business, it might be used to gain access to systems to engage in further types of cybersecurity threats, such as planting ransomware, or other destructive code aimed at disrupting productivity, or damaging day-to-day operations.

Levels of threat

While this style of the attack goes back several years in terms of hacking activities and is, in itself, quite unsophisticated, the aims of malicious users can be complex. It means that the risks associated with password spray threats can be greater than the simplicity of the method used might suggest. As with most cyber crime, it is often difficult to determine the aims of the attack until it is too late, which is why it is vital to keep one step ahead and make sure you are protected.

Failed logins

There are various signs that can indicate that a password spray attack is taking place. An example of this could be individuals from departments of a large organisation attempting to log in and see data that they would not normally have access to, or they might be trying to connect to a network that they have never previously used.

A large number of failed logins is probably the biggest give away because, by the very nature of the attack, most attempts at gaining access will not work. Businesses can keep track of these activities by analysing network traffic data and see what each username is accessing in terms of data. By blocking the IP address that the logins originate from, you should be able to nip the attack in the bud.

Making sure that all employees have two-factor authentication enabled will also significantly reduce the risk of data falling into the wrong hands.

Third-party help

This type of threat is only one example of how modern business owners can be at risk in the cyber domain. By using third-party service providers, you can make sure that you are protected by taking advantage of cloud systems, multi-factor authentication logins, and many other types of positive pre-emptive actions. Find out more by talking to us today.