Stop Password Spraying: Lockouts, MFA and Detection Tactics
Relying on account lockout policies alone creates a denial-of-service vector that attackers exploit to disrupt legitimate user access.
Enforce multi-factor authentication for all external access to neutralise credential-based attacks. Implement conditional access policies that block sign-ins from anomalous locations or devices. Monitor for widespread failed login attempts across multiple accounts, which indicates a spray attack rather than a targeted brute-force effort.
The Mechanics of Distributed Failure
Password spraying differs from traditional brute-force attacks in its approach to volume and timing. Instead of attempting thousands of passwords against a single account, an attacker submits one common password against thousands of accounts. This method bypasses many security controls that trigger after a specific number of failed attempts on one user profile.
By spreading the attempts over time and across many targets, the attack stays below the threshold that triggers automated blocking mechanisms. This slow, distributed approach makes detection difficult for systems that only look at individual account activity.
Why Lockout Policies Fail
Many organisations implement account lockout policies to prevent guessing attacks. These policies disable an account after a set number of incorrect password attempts. While this stops rapid guessing against a single user, it creates a significant vulnerability when faced with a spraying campaign.
An attacker can intentionally trigger lockouts for hundreds of accounts by guessing the correct password once for each. This results in a denial-of-service condition where legitimate users cannot access their accounts. The organisation must then spend considerable time unlocking accounts, disrupting business operations. This side effect is often more damaging than the initial compromise.
Multi-Factor Authentication as the Primary Control
The most effective defence against password spraying is multi-factor authentication. This security process requires users to provide two or more verification factors to gain access to a resource. Even if an attacker guesses the correct password, they cannot complete the login without the second factor.
This control removes the risk of account takeover entirely, regardless of password complexity. It shifts the security burden from memorising complex strings to possessing a physical device or receiving a time-based code. Implementing this for all external-facing services neutralises the core objective of the spraying attack.
Conditional Access and Risk-Based Sign-In
Modern identity providers offer conditional access policies that evaluate the risk of a sign-in attempt. These policies consider factors such as the user’s location, the device health, and the time of day. If a login attempt appears anomalous, the system can block it or require additional verification.
For example, if a user normally logs in from London but an attempt originates from a country with no business presence, the policy can flag this as suspicious. This dynamic approach adapts to the context of the login rather than relying solely on static rules. It helps identify spraying attempts that might otherwise look like normal user error.
Detecting the Spray Pattern
Detection relies on identifying the unique signature of a password spray. Unlike a brute-force attack, which shows many failures for one account, a spray shows one failure for many accounts. Security information and event management tools can aggregate these events to reveal the pattern.
Look for a sudden increase in failed logins across multiple users within a short timeframe. The passwords attempted are often common variations of default or simple strings. Alerting on this distributed failure pattern allows security teams to respond before any account is successfully compromised. This requires correlating data across the entire user base, not just individual logs.
See also: Password Policies Examples That Reduce Password Fatigue · How to Prevent Account Takeover Fraud: Priority Controls
Managing Shadow IT Exposure
Organisations often overlook applications that exist outside their centralised identity management. This shadow IT creates additional entry points where password spraying can succeed. If these services do not enforce multi-factor authentication or integrate with the main identity provider, they remain vulnerable.
Regular audits of cloud service usage help identify these gaps. Ensuring that all services, including those used by specific departments, adhere to the same security standards reduces the attack surface. Integrating these services with the central identity provider allows for consistent application of conditional access policies.
| Measure | Effort | What it stops |
|---|---|---|
| Multi-factor authentication | Medium | Account takeover even with correct password |
| Conditional access policies | Medium | Logins from anomalous locations or devices |
| Distributed failure detection | Low | Identification of the attack pattern |
| Account lockout policies | Low | Rapid guessing against single accounts |
What Does Not Work
Blocking IP addresses is often ineffective against password spraying. Attackers frequently use distributed networks of compromised devices or residential proxies. This makes the source of the attack appear to come from many different, legitimate locations. Blocking one IP address does little to stop the campaign.
Similarly, forcing complex passwords does not prevent spraying. Attackers do not need to guess a complex password; they only need to find the few users who use simple ones. Focusing on password complexity alone ignores the statistical nature of the attack. It also increases the burden on users without significantly reducing the risk of this specific technique.
Immediate Actions for Today
Implementing these controls requires prioritisation based on risk and effort. The following steps provide immediate reduction in exposure. These actions complement broader identity security strategies and address the specific mechanics of spraying.
- Enable multi-factor authentication for all external-facing applications and remote access services.
- Configure alerts for distributed failed login attempts across multiple user accounts.
- Review and disable unnecessary external access for service accounts and dormant profiles.
Key takeaways
- Multi-factor authentication renders stolen or guessed passwords useless for account takeover.
- Account lockout policies can be abused to deny service to legitimate users during a spray attack.
- Detecting the pattern of distributed failures is more effective than blocking individual IP addresses.
Password spraying exploits statistical probabilities and weak detection thresholds rather than technical vulnerabilities. Implement multi-factor authentication immediately to render password guessing ineffective.
Frequently asked questions
How do I distinguish password spraying from a brute-force attack?
Brute-force attacks show many failed attempts against a single account. Password spraying shows one failed attempt against many different accounts in a short period.
Should I disable account lockout policies?
Not necessarily, but you should raise the threshold significantly or combine it with other controls. Relying solely on lockouts creates a denial-of-service risk.
Can multi-factor authentication be bypassed?
No, but users can be tricked into approving legitimate-looking requests. This is a separate social engineering risk, not a password spraying vulnerability.
Does this apply to internal networks?
Yes, if attackers gain initial access, they may spray credentials to move laterally. Internal identity protection is just as critical as external.
How this guide was produced: written by the Vector Bulletin editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
