DataTerminology.comNEW
Also known as: Exhaustive Search
An attack that systematically tries all possible keys or passwords until the correct one is found.
DESCRIPTION
A brute-force attack enumerates possibilities to defeat authentication or encryption by trial and error. Its feasibility depends on keyspace size, hashing algorithm strength, rate limiting, and available compute resources. Modern defenses include strong password policies, salts and slow hash functions, MFA, account lockouts, and anomaly detection. While conceptually simple, distributed and GPU-accelerated attempts make naive defenses ineffective. Proper cryptographic choices render brute force impractical by making exhaustive search computationally prohibitive.
ALTERNATIVE DEFINITIONS
NIST Computer Security Resource Center
A cryptanalytic attack that involves trying all possible keys or passwords until the correct one is found.
Focuses on exhaustive key or password search as a cryptanalytic method.
OWASP
A brute force attack consists of an attacker trying many passwords or passphrases with the hope of eventually guessing correctly.
Highlights web application context and practical mitigation tips.
Wikipedia
A brute-force attack is a cryptographic hack that uses trial and error to guess login info, encryption keys, or find a hidden web page.
Covers multiple targets beyond passwords, including hidden resources.
RELATED TERMS
Password Cracking Rainbow Table Rate Limiting Multi-Factor Authentication Hash Function Salt Password Policy CAPTCHA Data Encryption
COMPETING TERMS
Dictionary Attack Rainbow Table Attack
RELATIONS
- Broader: Password Cracking
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Chief Information Security Officer IT Auditor DevOps Engineer Application Administrator IT Manager
EXTERNAL SOURCES
- Wikipedia - Brute-force attack
- NIST CSRC - Canonical glossary definition
- OWASP - Mitigations and attack patterns
- CISA - Context for exploit trends and risks
TOP QUESTIONS
Why is a Brute-Force Attack still relevant today?
Automation, leaked credential reuse, and cheap compute keep brute force effective against weak defenses. Robust hashing and MFA significantly reduce its success.
Category: Relevancy
How do I prevent Brute-Force Attacks?
Implement MFA, rate limiting, account lockouts, strong password policies, and slow salted hash functions like bcrypt, scrypt, or Argon2.
Category: Requirements
What is the biggest misunderstanding about Brute-Force Attacks?
Many assume complexity alone suffices; length and uniqueness matter more, and MFA is crucial.
Category: Misunderstanding
What’s the difference between Brute-Force and Dictionary Attacks?
Brute force tries all combinations; dictionary attacks try common words and patterns first. Hybrid attacks combine both.
Category: Alternatives
How does password hashing impact Brute-Force practicality?
Memory-hard, slow hashes dramatically increase cracking time, rendering exhaustive search impractical at scale.
Category: Explanation
What indicators suggest a Brute-Force Attack is occurring?
Spikes in failed logins, repeated attempts from many IPs, and uniform timing patterns are red flags.
Category: Example
Are Brute-Force Attacks a compliance concern?
Yes, successful attacks may trigger breach notification and sanctions under GDPR, HIPAA, and other regulations.
Category: Risk
How does credential stuffing relate to Brute-Force Attacks?
Credential stuffing reuses known username–password pairs; it’s not exhaustive but exploits password reuse.
Category: Explanation
Can captchas stop Brute-Force Attacks?
They help slow scripted attempts but are not foolproof. Combine with rate limiting and MFA.
Category: Risk