Weak / Compromised Password Monitoring

[robcivitello]

Hello - Does Saviynt currently support the ability to reject known compromised or weak passwords* as part of the password change flow?  I see the ability to reject common dictionary words but I am not seeing the ability to deny compromised or weak passwords.  

A compromised password blacklist is table stakes for a password management tool and if it is not currently supported, I hope it is planned for future release.

Thanks

*Weak passwords are those that meet complexity policy but are still very easy to guess ( "P@ssw0rd" for example).

[rushikeshvartak]

You can define same in File Directory - Blacklisted keywords

Use Blacklist Dictionary

You can update the password blacklist dictionary file (blacklist.txt) to prevent certain words from being used in passwords Yes: Select this option to enable the dictionary. A password is rejected if its value matches a term in a dictionary that you configure, containing a list of unwanted terms. No: Select this option to disable the dictionary. Note To configure the dictionary, see Managing the Password Blacklists Files.

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter06-EIC-Configurations/Config...

[robcivitello]

HI @rushikeshvartak  - my understanding is that the blacklist is a static list of words. I was looking for a deny based on known compromised passwords.  

[rushikeshvartak]

You can update known comprised passwords in blacklist.txt

[Manu269]

@robcivitello We have used the Blacklisted Keywords to accertain this.

There is no way to dynamically identify those list.

[Rajesh-R · Accepted solution]

@robcivitello 

Currently Blacklist.txt is a static dictionary list which has to be maintained. There is no dynamic list or known / compromised keywords validation as such.

Saviynt does not analyze the password dynamically.  However we can add more passwords to the blacklist.txt. We can use global blacklist password list. Some samples attached below.

[robcivitello]

Thank you for the information. We will go the manual route for now, but since weak and compromised password detection is required as part of NIST 800-63 compliance I think Saviynt should consider supporting this globally.  

I created an idea for that:
EIC-I-5357

[DanielA23]

Has there ever been a consideration with integrating with something like Have I Been Pawned??? (HIBP)

[rushikeshvartak]

No