Additional protections against cracking attacks

The cracking attacks we have discussed in this book have almost always focused on ‘offline attacks’ – the idea of cracking an individual’s credentials after accessing it from a database or other system. While these attacks are significant, we can attempt to protect systems from unauthorized access to these systems, which somewhat limits this risk. While a worthy objective, the means of securing information systems vary greatly across systems and are outside the scope of this book.

However, even if a user has chosen a poor password and placed that password in a system that was compromised, and their password was cracked, the attacker will still need to access that system to do anything of value. This is where we can employ systems such as multi-factor authentication (MFA) to protect the user, even if their password is compromised.

You are already familiar with how this works – after authenticating...