Question

As Chief Information Security Officer (CISO) for McAllen Medical Center, one of your job roles is to develop policies to protect the information assets of the hospital. Many computer accounts have been breached due to a lack of password policies and brute force attacks. Develop a set of policies that will govern how passwords will be implemented for your organization. Your response must address factors such as number of characters, length of password, password history, and expiration. Justify your response by explaining your choices for each factor. (200 Word Minimum)

Answer 1

Develop a set of password policies to protect the information assets of the hospital, considering factors such as number of characters, password length, password history, and expiration.

Step-by-step explanation:

As the Chief Information Security Officer (CISO) for McAllen Medical Center, it is important to develop a set of password policies to protect the information assets of the hospital. The following factors should be considered:

1. Number of characters: Passwords should have a minimum of 8 characters to ensure an acceptable level of complexity and security.
2. Password length: A longer password length, such as a minimum of 12 characters, can significantly increase the difficulty for brute force attacks.
3. Password history: Implement a password history policy that prevents users from reusing their previous passwords. This helps in preventing potential password guessing or reuse attacks.
4. Password expiration: Set a policy to enforce password expiration every 90 days, ensuring users update their passwords regularly to minimize the risk of compromised accounts.

These choices are based on best practices in password security. By having a minimum number of characters and a longer password length, the complexity of the password is increased, making it more difficult for hackers to crack. The password history policy prevents users from recycling passwords, reducing the risk of compromised accounts. Regular password expiration ensures that even if a password is compromised, it will not remain valid for an extended period.