Automated security testing was performed by attempting to log in to the new product with a known username using a collection of passwords. Access was…

The scenario describes a successful brute-force attack, where an automated tool made hundreds of login attempts against a single username. The fundamental security failure is that the system's authentication mechanism did not prevent or mitigate this high volume of repeated attempts. Implementing brute-force resistance, such as account lockout after a certain number of failed attempts, rate limiting, or CAPTCHA challenges, would directly thwart this attack vector by making it impractical for an attacker to try hundreds of passwords in a short period.

A. Ensure passwords are encrypted when stored in persistent data stores: This control protects passwords at rest (e.g., in a database) but does not prevent an attacker from making live login attempts against the authentication endpoint.

C. Ensure strong password policies are enforced: While a strong password policy makes guessing harder, it does not stop the attack method itself. The core vulnerability is allowing unlimited or a high number of guesses.

D. Ensure credentials and authentication tokens are encrypted during transit: This protects against man-in-the-middle (MITM) attacks by securing data on the network. It does not defend the login form from being targeted by brute-force attempts.

---

1. OWASP Application Security Verification Standard (ASVS) v4.0.3. This standard explicitly calls for protection against brute-force attacks as a key authentication control.

Reference: Section V2: Authentication Verification Requirements, Control 2.2.1: "Verify that the application has a mechanism to protect against credential stuffing, password spraying, and brute-force attacks on all authentication endpoints, such as by using account lockouts, rate limiting, or CAPTCHA." This directly supports implementing controls to resist brute-force attacks.

2. NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management. This publication provides federal guidance on authentication systems and emphasizes the need for brute-force mitigation.

Reference: Section 5.2.2, Brute Force Mitigation: "The verifier SHALL implement a rate-limiting mechanism that effectively limits the number of failed authentication attempts that can be made on an account... The mechanism can be implemented on a per-account basis, on a per-IP-address basis, or on any other basis that the verifier deems appropriate."

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 387-402. This foundational paper on computer security principles, often cited in university curricula, discusses the importance of limiting exposure. Allowing unlimited login attempts violates the principle of minimizing attack surfaces.

Reference: Section I.A.3, Psychological Acceptability: While not a direct technical control, the principles imply that systems should not have easily exploitable mechanisms. A system allowing hundreds of login attempts is not psychologically acceptable from a security design standpoint and fails to limit the attack mechanism. (This is a foundational reference supporting the why behind the technical control).

DOI: https://doi.org/10.1145/361011.361062