An IoT system administrator wants to mitigate the risk of rainbow table attacks. Which of the following methods or technologies can the administrator…

A rainbow table attack is an offline method for cracking password hashes. For this attack to be successful, an attacker must first gain access to the database file containing the stored password hashes. By enabling account database encryption, the data is protected at rest. If an attacker manages to steal the database file, the hashes within it will be encrypted and unreadable without the corresponding decryption key. This directly prevents the attacker from obtaining the necessary input (the hashes) to use a rainbow table, effectively mitigating the risk of this specific attack.

A. Enable account lockout: This is a countermeasure for online brute-force attacks, where an attacker repeatedly guesses passwords through a live login interface, not for offline attacks on stolen hashes.

C. Require frequent password changes: This limits the duration a compromised password is valid but does not prevent the offline cracking of a stolen password hash itself.

D. Require complex passwords: This increases the size and computational cost of creating a rainbow table, making the attack more difficult but not impossible. It is a weaker mitigation than preventing access to the hashes entirely.

---

1. NIST Special Publication 800-63B

"Digital Identity Guidelines: Authentication and Lifecycle Management" (June 2017). Section 5.1.1.2

"Memorized Secret Verifiers

" mandates that password hashes (verifiers) "SHALL be stored in a form that is resistant to offline attacks." Encrypting the database where these verifiers are stored is a primary technical control to achieve this resistance against an attacker who has exfiltrated the database file.

2. Mazières

D. (2020). CS 155: Computer and Network Security

Lecture 4: Passwords and Web security. Stanford University. The course material explains that the prerequisite for an offline attack

such as a rainbow table attack

is the theft of the password file. This establishes that protecting the file at rest

for instance through encryption

is a fundamental defense to prevent the attack from being initiated.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). "The Protection of Information in Computer Systems". Communications of the ACM

18(7)

377-410. https://doi.org/10.1145/361011.361062. This foundational paper on computer security introduces the principle of "defense in depth." Encrypting the account database is a direct application of this principle. It adds a critical layer of security that protects the password hashes even if an attacker bypasses file system access controls.