John works as a professional Ethical Hacker. He has been assigned a project to test the security of www.we-are-secure.com. He successfully performs a…

The most effective and direct countermeasures against an online brute-force attack on a web application's login form are those that interrupt or halt the automated guessing process. Implementing a CAPTCHA (A) after several failed attempts forces a challenge-response test that is difficult for automated scripts to solve, thereby thwarting the attack. Similarly, restricting the number of login attempts and implementing an account lockout policy (B) directly stops the attacker after a small, predefined number of failures, making a brute-force approach computationally infeasible. Both are standard, recommended industry practices for mitigating this specific threat.

C. The site should force its users to change their passwords from time to time.

This is a password lifecycle policy, not a direct defense against an active brute-force attack. An attacker can still brute-force the current password.

D. The site should increase the encryption key length of the password.

This confuses hashing with encryption and online with offline attacks. Stronger hashing slows down offline cracking of a stolen password database, not an online attack against a live login form.

---

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines.

Reference for B: Section 5.2.2

"Memorized Secret Verifiers

" states: "The verifier SHALL implement a mechanism that slows online guessing attacks on the memorized secret. A common mechanism is to throttle the rate of login attempts... After a predetermined number of consecutive failed attempts

the CSP SHALL lock the account". This directly supports account lockout as a primary countermeasure.

2. OWASP Foundation. (2023). OWASP Authentication Cheat Sheet.

Reference for A & B: In the section "Authentication Brute Force Protection

" the document recommends several controls. It explicitly lists "Account Lockout" (supporting option B) and "CAPTCHA" (supporting option A) as effective measures to protect against brute-force password guessing attacks.

3. Zeldovich

N.

& Solar

D. (2014). 6.858 Computer Systems Security

Fall 2014 Lecture Notes. Massachusetts Institute of Technology: MIT OpenCourseWare.

Reference for A & B: Lecture 15

"Web security

" discusses defenses against common web attacks. The notes identify "Rate-limiting login attempts" (a form of lockout/throttling) and "CAPTCHAs" as key defenses to prevent attackers from guessing user passwords through brute-force attempts.