| Authorization for access to any network element requires an approved and assigned individual account identifier. To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organization-defined frequency. Password strength is a measure of the effectiveness of a password in resisting guessing, dictionary attacks, as well as, brute-force attacks. A password must have an expiration date to limit the amount of time a compromised password can be used by a malicious user. However, changing the password too frequently may result in the user changing a small portion of the password, or the user could mishandle the password in an attempt to remember the new password. |
