The security of digital platforms depends largely on protecting user accounts. Brute force attacks are among the oldest attack methods, yet they remain widely used. In these attacks, the attacker tries to guess passwords or codes through a large number of automated attempts until the right combination is found.
In this article, we explain how brute force attacks work, which variants exist, what impact they can have on a document management platform and which measures are currently recommended to prevent them. We also highlight outdated practices that are still applied, even though current guidance no longer recommends them.
What is a brute force attack
A brute force attack consists of systematically testing credential combinations until one works. The attacker does not need to know the password: time and processing power are enough. For this reason, short, predictable or reused passwords are the most vulnerable.
Today, these attacks are almost always automated. Tools and networks of compromised computers make it possible to carry out thousands of attempts, spread across many different addresses, which makes detection harder.
Types of brute force attacks
| Type | How it works |
|---|---|
| Simple brute force | Tests every possible combination of characters |
| Dictionary attack | Uses lists of words and common passwords |
| Credential stuffing | Reuses credentials stolen from other services |
| Password spraying | Tests a few common passwords across many accounts to avoid lockouts |
| Offline hash attack | Tries to recover passwords from a stolen database |
Of these, credential stuffing is now one of the most effective, because many users reuse the same password across several services. As a result, a data leak on one website can give access to a completely different business platform.
The impact on a document management platform
A compromised account can give access to workers’ documents, contracts, insurance policies and personal data. The attacker can also alter or delete documents, upload malicious files or use the account to send fraudulent messages to contractors. When personal data is involved, the organisation may have to notify the CNPD within 72 hours. Protecting accounts is, therefore, a priority.
Recommended protection measures
Multi-factor authentication
This is the most effective measure. Even if the attacker discovers the password, they cannot log in without the second factor. Whenever possible, it is best to choose authenticator apps, security keys or passkeys, which resist phishing better than SMS codes.
Long, unique passwords
Current recommendations, such as NIST guidance, favour length over complex rules. Long passphrases that are unique to each service and stored in a password manager are safer and easier to use. In addition, the platform should reject passwords that appear on lists of compromised credentials.
Limiting login attempts
The platform should limit the number of attempts per account and per address, progressively increasing the waiting time. Similarly, detecting suspicious patterns, such as many attempts from several addresses, helps to stop distributed attacks.
Secure password storage
The platform should never store passwords in plain text. Instead, it should protect them with password-specific hashing algorithms, such as Argon2, bcrypt or PBKDF2, with a unique salt. By contrast, older algorithms such as MD5 or SHA-1 do not offer adequate protection.
Monitoring and alerts
The security team should analyse login records to detect mass failed attempts, access from unusual countries or several accounts being attacked at once. In this way, it can react before the attacker succeeds.
Brute force beyond passwords
Brute force attacks do not target passwords alone. In fact, any short code can be a target: access PINs, verification codes sent by SMS, account recovery links or poorly protected API keys. For example, a six-digit code has only one million combinations. Without attempt limits and a short expiry time, an automated attacker can find it quickly.
Therefore, the platform should apply the same protections to all authentication and recovery mechanisms. Likewise, recovery links should expire quickly and work only once. In the same way, API keys should be long, random, stored securely and renewed whenever exposure is suspected.
How to respond to an ongoing attack
When monitoring detects an attack, the response must be fast and coordinated. First, block the source addresses or networks and temporarily tighten attempt limits. Next, identify the targeted accounts and check whether any had a suspicious successful login. Then force a password reset for those accounts and confirm that multi-factor authentication is active. Finally, record the incident and assess whether personal data was accessed, to decide whether to notify the CNPD.
A practice to abandon: Mandatory periodic changes
For years, many organisations required users to change their password every 30, 60 or 90 days. Today, international recommendations advise against this practice when there is no sign of compromise. Forced changes generally lead users to choose predictable passwords, such as small variations of the previous one. Accordingly, the organisation should only require a change when there is suspicion that the password has been exposed.
Practical example: Password spraying on a platform
Suppose that, one night, the platform records login attempts on 300 different accounts, each with only two common passwords. Because each account sees few attempts, per-account lockouts are not triggered. However, the monitoring system detects the overall pattern and blocks the source addresses. Since the targeted accounts had multi-factor authentication, none were compromised. As a result, the attack fails with no impact on users.
Checklist against brute force attacks
- Multi-factor authentication enabled for all users.
- Long passwords checked against compromised lists.
- Attempt limits and progressive delays.
- Secure hashing of stored passwords.
- Monitoring of distributed attack patterns.
- User training on password reuse.
The role of users
Technology solves much of the problem, but users still play a decisive role. First, they should use a different password for each service, especially for work accounts. Second, they should enable multi-factor authentication whenever it is available. In addition, they should be wary of unexpected requests for verification codes, which may indicate that someone is trying to access the account. Finally, they should immediately report any login alert they do not recognise. That is why regular training is an essential part of protection against these attacks.
Indicators to monitor
To assess protection, the security team can track the percentage of accounts with multi-factor authentication, the number of failed attempts per day, locked accounts and suspicious access alerts. In this way, it can see whether the measures are working and where to strengthen them.
A frequent mistake is relying solely on account lockouts, which do not stop attacks spread across many accounts. Another mistake is leaving accounts without multi-factor authentication for convenience, especially administrator or external user accounts. Furthermore, many organisations do not check whether users’ passwords appear in known data leaks.
Frequently asked questions
Does a CAPTCHA solve the problem?
It helps to stop simple automated attacks, but it does not replace multi-factor authentication or attempt limits.
Are password managers safe?
Yes, when protected with a strong master password and multi-factor authentication. They are the most practical way to have long, unique passwords for every service without relying on memory.
What should I do if my password appears in a data leak?
Change the password immediately on that service and on any others where you have reused it. It is also advisable to enable multi-factor authentication and check the account’s recent activity.
Conclusion
Brute force attacks remain a real threat, especially the variants that exploit reused credentials. Effective protection combines multi-factor authentication, long and unique passwords, attempt limits, secure storage and monitoring.
At the same time, organisations should update their policies, dropping practices that are no longer recommended, such as mandatory periodic changes. In this way, they protect digital platforms without making users’ lives unnecessarily complicated.
Read also: Essential rules for choosing a strong password and Protecting against hackers: Who they are, how they operate and what measures to take.
For further cybersecurity guidance, see the Portuguese National Cybersecurity Centre (CNCS).
Does biometrics replace passwords?
Mobile phone biometrics, such as fingerprint or facial recognition, are often used to unlock passkeys stored on the device itself. In this model, biometric data never leaves the device, which makes authentication more convenient and more resistant to remote attacks.