Enzoic Navigation
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP
  • PRODUCTS & SOLUTIONS
    • PRODUCTS
      • Enzoic for Active Directory
      • Active Directory Lite
      • Enzoic APIs
      • Breach Monitoring
    • SOLUTIONS
      • ATO Protection
      • NIST Password Compliance
    • INDUSTRIES
      • Hospitals & Healthcare
      • Government
      • Education
      • Financial Service
  • RESOURCES
    • CONTENT
      • Resource Hub
      • Blog
      • FAQ
      • Case Studies
      • Videos
    • DEVELOPERS
      • Support
      • Active Directory Tech Docs
  • COMPANY
    • OVERVIEW
      • About Us
      • Security
      • Threat Intel
      • Newsroom
      • Partners
      • Careers
      • Contact Us
  • PRICING
  • LOGIN
  • SIGN UP

The City of Prescott Utilizes Automated Password Security to Protect Employees from ATO

The City of Prescott, Arizona overlooks an authentically American western landscape. This mountainous countryside gives birth to a booming metropolitan city that attracts people from around the world to its many museums, art galleries, and antique shops in addition to its wonderful outdoor recreational activities.

Just like in the Wild West, where sheriffs fought outlaws for control, the City of Prescott faced a battle with threat actors attempting to wrangle control of the city’s resources and sensitive data. Nate Keegan, IT Director for the City of Prescott, knew that he had to harden the most vulnerable layer of their cyber security stack—the password.

What prompted the City of Prescott to look for this type of solution?

We wanted an automated and reliable method to assess and enforce password security in our organization. There are many solutions available, but they seemed to be a mixture of tools that we would have to cobble together rather than an all-in-one tool. The result was not going to be the friend of automation, reliability, and precision, all of which was our end goal. Enzoic allowed us to easily achieve want we wanted and eliminate password vulnerabilities with a single application.

What types of cyberattacks were you most concerned about? Has your organization been a victim previously?

Our biggest concern was centered around identity theft as well as reconnaissance activities related to that. In the past, there had been some attempts, like password spraying, for this sort of thing against our organization. Even though these attacks were not successful, it was enough to scare us into action.

Honestly, with more and more cloud adoption, federated identity services, and users being prone to reusing credentials, it is insane not to have a way to ensure you’re not using weak or compromised passwords in your environment. Studies have repeatedly shown that the majority of breaches are the result of a compromised password and we wanted to make sure that we were not a victim of this type of attack.

What solutions did you consider? What set Enzoic apart from the alternatives?

We initially looked at putting together our own solution with some available tools, like HIBP’s free API, but at the end of the day, you must be able to rely upon your credential watchdog and make sure that the data is both clean AND frequently updated. Creating something ourselves, maintaining it, and paying all the overhead costs wasn’t something we could afford. The cost of Enzoic, combined with its ability to do things out of the box, is a sound investment. Enzoic shortcuts all of the work that isn’t free in terms of time or energy if we would have had to complete this project ourselves.

How did you secure internal support for this investment?

Identified the need based on an attempted attack against our organization combined with seeing more and more federated identity applications. From there, I bounced the idea off my staff and vetted options. After doing our research and evaluating other vendors in the space, we found Enzoic and scheduled a demo/proof of concept because it seemed like the best bang for your buck in terms of cost, time, and reliable results.

Upon seeing what Enzoic would deliver for us, it was clear to everyone in the organization that it was the right choice to solve our password security needs and protect our employees from account takeover. They told us it would be “set and forget” and it truly has been. It gives me and my team great peace of mind and easier sleep at night knowing that our passwords are both secure at creation and then continuously monitored for compromise.

How complicated was the deployment?

The installation was incredibly quick and smooth. We had Enzoic for Active Directory implemented and saw results within 30 minutes. We could identify which accounts and weak or compromised passwords instantaneously.

Enzoic was also able to provide us with e-mail templates and extra guidance to ensure that user adoption went as smoothly as possible. We were worried that there would be a lot of pushback for having such a tough password policy, but the help Enzoic provided almost completely eliminated the user friction that we were concerned about.

What else would you tell a friend about this type of security solution?

“I would tell them that it would be foolish in today’s cybersecurity world to not have a security solution like Enzoic place to protect your organization from unsafe passwords. Having good passwords and knowing that compromised or weak passwords are dealt with automatically is a huge boost to your overall cybersecurity stance and peace of mind. I sleep better every night knowing that my passwords are secure.”

“At the City of Prescott, we take a proactive approach to security. Enzoic was the perfect fit for our strategy and keeping our employees and city secure.” – Nate Keegan, IT Director

Active Directory passwordsGovernmentPassword Securitypassword spraying

Search

Assess your cyber vulnerabilities with a free password audit tool
Start Now

Browse blog categories

  • Account Takeover (30)
  • Active Directory (46)
  • all posts (164)
  • Continuous Password Protection (26)
  • COVID-19 (7)
  • Cracking Dictionaries (6)
  • Credential Screening (22)
  • Cybersecurity (80)
  • Data Breaches (37)
  • EdTech (4)
  • Enzoic News (19)
  • Financial Services Cybersecurity (6)
  • GovTech (4)
  • Healthcare Cybersecurity (15)
  • Law Firm Cybersecurity (2)
  • NIST 800-63 (30)
  • Password Security (44)
  • Password Tips (59)
  • Regulation and Compliance (13)

Stay up to date

Research, news, and more right to your inbox

More

  • Learning about strong, but unsafe passwords
  • What is a credential stuffing attack?
  • What is account takeover (ATO) fraud?
  • Eliminating password reuse to prevent ATO fraud
  • Developer Documentation (APIs)

Recent blog posts

  • Password Tips for Your Employees
  • Bolstering AD Password Policies
  • How Weak Passwords Lead to Ransomware Attacks
  • [ Sign Up for a Free Account ]
  • Contact Us
  • 1-720-773-4515

Enzoic ©2022 | Privacy Policy | Acceptable Use

3800 Arapahoe Avenue, Ste 250 l Boulder, CO 80303

Enzoic’s password auditor provides a great baseline for assessing password vulnerability. Get next level of compromised credentials protection and try the full Enzoic for Active Directory at no cost.

Cookies

This website uses cookies to improve your experience. Continue to use the site as normal if you agree to the use of cookies. To find out more about our use of cookies or to opt-out, please see our Privacy Policy.

More Information
This site is for EDUCATIONAL PURPOSES ONLY.
Your password will be sent securely to the Enzoic servers to check if it is compromised. We do not store your password or use it for any other purpose. If you are not comfortable with this, do not enter your real password.
What is this?

Password Check is a free tool that lets you determine not just the strength of a password (how complex it is), but also whether it is known to be compromised. Billions of user passwords have been exposed by hackers on the web and dark web over the years and as a result they are no longer safe to use. So even if your password is very long and complex, and thus very strong, it may still be a bad choice if it appears on this list of compromised passwords. This is what the Password Check tool was designed to tell you and why it is superior to traditional password strength estimators you may find elsewhere on the web.

Why is it needed?

If you are using one of these compromised passwords, it puts you at additional risk, especially if you are using the same password on every site you visit. Cybercriminals rely on the fact that most people reuse the same login credentials on multiple sites.

Why is this secure?

This page, and indeed our entire business, exists to help make passwords more secure, not less. While no Internet-connected system can be guaranteed to be impregnable, we keep the risks to an absolute minimum and firmly believe that the risk of unknowingly using compromised passwords is far greater. Since our database of compromised passwords is far larger than what could be downloaded to the browser, the compromised password check we perform must occur server-side. Thus, it is necessary for us to submit a hashed version of your password to our server. To protect this data from eavesdropping, it is submitted over an SSL connection. The data we pass to our server consists of three unsalted hashes of your password, using the MD5, SHA1, and SHA256 algorithms. While unsalted hashes, especially ones using MD5 and SHA1, are NOT a secure way to store passwords, in this case that isn’t their purpose – SSL is securing the transmitted content, not the hashes. Many of the passwords we find on the web are not plaintext; they are unsalted hashes of the passwords. Since we’re not in the business of cracking password hashes, we need these hashes submitted for more comprehensive lookups. We do not store any of the submitted data. It is not persisted in log files and is kept in memory only long enough to perform the lookup, after which the memory is zeroed out. Our server-side infrastructure is hardened against infiltration using industry standard tools and techniques and is routinely tested and reviewed for soundness.

More…
  • Visit our FAQ to learn more
  • Contact us for press or sales inquiries
  • Add a free password strength meter to your website