What strategy would be most effective in mitigating the risk of brute force attacks for a corporation?

• A. Implementing strong password policies
• B. Enforcing regular security audits
• C. Implementing two-factor authentication for all sensitive applications and systems
• D. Restricting IP addresses from which logins can originate

Answer: (C)

Implementing two-factor authentication (2FA) for all sensitive applications and systems is an effective strategy for mitigating the risk of brute force attacks. This method adds an extra layer of security beyond just user credentials. Even if a malicious actor successfully guesses or steals a user's password through methods like brute force attacks, they would still require a second form of authentication, such as a temporary code sent to a mobile device or generated by an authenticator app.

The principle behind two-factor authentication is that it significantly increases the complexity and difficulty for attackers to gain unauthorized access. Even with brute force techniques that might allow an attacker to crack a password, without the second factor, access remains denied, effectively reducing the risk of a successful attack.

In contrast, while strong password policies and regular security audits improve overall security, they do not provide the same immediate barrier to unauthorized access that 2FA offers. Additionally, while restricting IP addresses can help limit access to trusted locations, it would not account for users who need to access systems remotely or from varying locations, potentially leading to usability challenges without significantly enhancing security against sophisticated brute force attempts.