Which of the following would BEST deter an attacker trying to brute force 4-digit PIN numbers to
access an account at a bank teller machine?
A.
Account expiration settings
B.
Complexity of PIN
C.
Account lockout settings
D.
PIN history requirements
Explanation:
By Bank Teller Machine I suppose that the question is talking about an ATM- An automated teller machine (ATM) which as we all know is an electronic banking outlet, which allows customers to complete basic transactions without the aid of a branch representative or teller. Anyone with a credit card or debit card can access most ATMs.
So the attack is not on the actual ATM, but on a given account in an ATM, which pre-supposed the fact that the attacker is in possession of a stolen bank-card.
INCORRECT ANSWERS:
Pins at the end of the day are simply numeric passwords, and can be treated the same way as normal alpha-numeric passwords in a Domain for example
A.Account expiration settings can be set to a year from now, so this is not the best way to “deter an attacker trying to brute force 4-digit PIN”
Complexity of PIN – The Pins complexity is limited to x4 digits. This is as complex as it gets. A white paper has shown that a good tool with some inside information can guess a pin in x15 tries.
D.PIN history requirements –All this does is to stop the user from using a previous pin. Since the hacker does not know what the pin is in the first place, what difference does it make? Again, this is not the best way to “deter an attacker trying to brute force 4-digit PIN”
So the only possible answer is: “C.Account lockout settings”
• As a rule, the chip embedded in the smart card locks itself after a defined number of incorrect PIN entries, typically between 3 and 10 attempts.
• This means that “account lockout settings” are already set in place as a standard practice in all smartcards used in ATMs
• Account lockout settings determine the number of failed login attempts before the account gets locked and how long the account will be locked out for. For example, an account can be configured to lock if three incorrect passwords (or in this case PIN’s) are entered.
• The account can then be configured to automatically unlock after a period of time or stay locked until someone manually unlocks it.
1
0