ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Offline brute-force and dictionary attacks succeed by rapidly hashing word-list or key-space candidates and comparing them to the stolen hashes. The most effective mitigation is to store passwords with an adaptive, slow hash function such as bcrypt (or scrypt/Argon2) and add a unique random salt plus a high iteration count. The salt defeats pre-computed tables, while the work factor forces attackers to spend far more CPU/GPU time per guess, exponentially reducing the feasible guessing rate. Account lockout policies only impede online guessing, not offline cracking performed on the attacker's hardware. Frequent password changes do not significantly slow an offline attack once the hash file is in hand. Encrypting the hash file with AES offers little protection if the encryption key is stored on the same server and might be compromised along with the hashes; moreover, once decrypted, the underlying fast SHA-1 hashes remain vulnerable. Therefore, migrating to salted, iterated bcrypt provides the strongest defense against offline brute-force and dictionary attacks.