Full Report
Plain text passwords are a critical security risk. See a real attack where exposed credentials led to a breach and how Huntress helps prevent it.
Analysis Summary
# Best Practices: Credential Hygiene & Plain Text Password Prevention
## Overview
These practices address the critical security risks associated with storing credentials (passwords, recovery codes, and secrets) in unencrypted or "plain text" formats. Failure to secure these assets allows attackers to bypass Multi-Factor Authentication (MFA), escalate privileges, and move laterally through a network without needing to "crack" codes.
## Key Recommendations
### Immediate Actions
1. **Purge "Quick-Note" Credentials:** Audit employee desktops and "My Documents" folders for files named `passwords.txt`, `codes.txt`, or `credentials.xlsx`.
2. **Secure Recovery Codes:** Move MFA recovery/backup codes out of digital text files and into an encrypted enterprise password manager or physical vault.
3. **Enforce MFA:** Ensure MFA is active on all external-facing portals (like Huntress, VPNs, and Email) to mitigate the impact of a single leaked password.
4. **Identify "Password Emailers":** Identify any internal or third-party services that email passwords in plain text; immediately prioritize replacing these services or changing how they handle resets.
### Short-term Improvements (1-3 months)
1. **Deploy Managed Password Managers:** Roll out a corporate-sanctioned password manager (e.g., Bitwarden, 1Password) to eliminate the "spreadsheet habit."
2. **Implement Hashing Standards:** Audit internal databases to ensure passwords are saved using modern, non-reversible hashing algorithms like **Argon2** or **bcrypt** with unique **salts**.
3. **Endpoint Monitoring:** Deploy EDR (Endpoint Detection and Response) to detect "cleartext shenanigans" and unauthorized access to sensitive local files.
### Long-term Strategy (3+ months)
1. **Transition to Passwordless:** Move toward phishing-resistant authentication (FIDO2/WebAuthn) to reduce reliance on passwords entirely.
2. **Automated Secret Scanning:** Implement tools in the CI/CD pipeline or file servers to automatically flag and redact plain text secrets or keys.
3. **Formal Offboarding Procedures:** Ensure credential revocation is a Day 1 priority during employee offboarding to prevent insider threats.
---
## Implementation Guidance
### For Small Organizations
- Focus on **user education**: Teach staff that "temporary" text files are never temporary.
- Use a free or low-cost reputable password manager for all shared team logins.
### For Medium Organizations
- Implement **Group Policy Objects (GPOs)** or MDM profiles to restrict saving passwords in web browsers.
- Conduct quarterly "Discovery Scans" to find unprotected spreadsheets containing sensitive data.
### For Large Enterprises
- Standardize on **Single Sign-On (SSO)** to reduce the number of unique passwords users must manage.
- Integrate **Managed EDR** to monitor for credential-stealing malware (like NPPSPY) that intercepts cleartext passwords during the login process.
---
## Configuration Examples
### Secure Hashing Best Practices
When developing internal applications, avoid basic MD5 or SHA1. Use the following logic:
- **Algorithm:** Argon2id or bcrypt.
- **Salt:** A unique, random string added to each password *before* hashing.
- **Iteration Count:** High enough to slow down brute-force attacks without degrading user login experience (e.g., bcrypt cost factor of 10-12).
---
## Compliance Alignment
- **NIST SP 800-63B:** Guidelines on Digital Identity and memorized secret verifiers.
- **CIS Controls (v8):** Control 6 (Access Control Management) and Control 5 (Account Management).
- **ISO/IEC 27001:** Annex A.9 (Access Control) regarding the management of secret authentication information.
- **PCI DSS:** Requirement 8.2.1 (Render all passwords unreadable during transmission and storage).
---
## Common Pitfalls to Avoid
- **The "Just for Now" Trap:** Saving a recovery code to the desktop with the intent to delete it later.
- **Generic Hashing:** Using algorithms like MD5 or SHA-1 which are easily cracked by modern hardware.
- **Lack of Salting:** Not using salts, which allows attackers to use "Rainbow Tables" to instantly unmask thousands of passwords.
- **Trusting "Unencrypted" Channels:** Sending passwords via Slack, Teams, or Email without using a "one-time secret" link tool.
---
## Resources
- **Huntress Managed EDR:** [https://www.huntress.com/platform/managed-edr]
- **OWASP Password Storage Cheat Sheet:** [https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html]
- **Argon2 Documentation:** [https://github.com/P-H-C/phc-winner-argon2]