NIST 800-44 Version 2 Guidelines on Securing Public Web Servers

GUIDELINES ON SECURING PUBLIC WEB SERVERS
Dictionary Attacks—Attackers use common dictionary words and their variants to attempt to gain
access to a user’s account.
Brute Force Attacks—Attackers try every possible password to attempt to gain access to a user’s
account.
There are a number of methods for reducing a Web server’s vulnerability to brute force attack:
Use Strong Authentication—Strong authentication techniques, such as hardware tokens, one-time
passwords, biometric authentication, and SSL/TLS client certificates, are much more resistant to brute
force attacks than passwords. Stronger authentication can be achieved by combining multiple
authentication mechanisms to form a multi-factor authentication scheme. However, strong
authentication may be prohibitively expensive or difficult to incorporate into a system.
Use Timeouts—Incurring a delay of several seconds after a failed login attempt can slow an attacker
down. However, attackers can attempt multiple logins at the same time from different clients.
Use Lockouts—Locking out a user account after a number of failed login attempts prevents the
attacker from successfully logging into an account. The primary disadvantage of this technique is
that it can leave the system open to a DoS attack. Also, an attacker may try several common
passwords against random usernames, which may grant the attacker access to the system while
bypassing the lockout [Whit06].
Enforce a Password Policy—By requiring passwords to be of a certain length and to contain
lowercase letters, uppercase letters, numerals, and/or symbols, a simple dictionary attack will not
work on the system.
Enforce a Password Change Policy—By requiring passwords to be changed on a regular basis, an
attacker might not have enough time to brute-force a potential password. However, strict password
change policies can frustrate users and weaken passwords by causing users to follow patterns, such as
using password1, password2, etc. [Bell06]
Use Blacklists—Blocking IP addresses or domains known to attempt brute force attacks from
accessing the system may stop some attackers, but it is possible that some attacks may come from
compromised systems that would otherwise be considered legitimate.
Use Log Monitoring Software—Vigilantly monitoring logs of invalid password attempts may help
an organization detect brute force attacks, potentially giving the organization time to respond before
the attack has been successful.
Aside from strong authentication, none of these mechanisms completely prevent brute force attacks;
however, using one or more of these techniques makes it more difficult for an attacker to gain access to
the system. Nevertheless, when considering which technologies to adopt, it is important to consider
passwords as part of the system as a whole. For example, a Web site that uses usernames and passwords
to retrieve user customizations may not need to concern itself with preventing brute force attacks
[Bell06]. In systems where sensitive information is being protected, some of these techniques may be
necessary. Regardless, an organization may already have policies regarding brute force attacks. If so,
those policies should be followed and enhanced if necessary.
7-13