| Authorization for access to any network element requires an approved and assigned individual account identifier. To ensure only the assigned individual is using the account, the account holder must create a strong password that is privately maintained and changed based on the organization defined frequency. Password strength is a measure of the effectiveness of a password in resisting guessing, dictionary attacks, as well as, brute-force attacks. Network elements can be compromised by personnel with physical access to the communication room. It is imperative for passwords to be stored encrypted, so they cannot be viewed by unauthorized staff. This requirement is applicable to network device management and is not applicable to the routing function. |
