A user logs in with the same credentials across multiple websites. Which of the following password policies would most likely prevent this practice?

The practice of using the same credentials across multiple websites is known as password reuse. A password reuse policy, typically implemented as "password history," is the specific control designed to prevent a user from using the same password multiple times on a single system. While a policy on one system cannot technically prevent a user from reusing that same password on external, unaffiliated websites, it is the only policy option listed that directly addresses the principle of reusing passwords. The intent is to train users against the practice of reuse in general.

B. Complexity: This policy mandates the use of different character types (e.g., uppercase, lowercase, numbers, symbols) but does not prevent a user from reusing the same complex password on other sites.
C. Privacy: A privacy policy governs how user data is collected, used, and protected. It is not a technical control that defines the construction or history of a user's password.
D. Length: This policy enforces a minimum number of characters for a password. A user can still create a long password and reuse it across multiple services, which this policy would not prevent. ---

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5. Security and Privacy Controls for Information Systems and Organizations.

Reference: Control IA-5

Authenticator Management

Enhancement (1)(e).

Details: This control specifies the requirement to "Prevent password reuse for [Assignment: organization-defined number] generations." This directly links the concept of a "reuse" policy to preventing the use of historical passwords.

2. Microsoft Corporation Documentation. Password Policy.

Reference: Security Policy Settings

Account Policies/Password Policy.

Details: The "Enforce password history" policy setting is defined as determining "the number of unique new passwords that have to be associated with a user account before an old password can be reused." This is the technical implementation of a password reuse policy.

3. University of California

Berkeley

Information Security Office. Credential Management Standard.

Reference: Section 6.2

"Password Construction and Management."

Details: The standard outlines requirements for password management

including "Password Reuse

" which states

"Do not reuse passwords for a privileged account for at least one year. Do not reuse passwords for a regular user account for at least three months." This illustrates how an organization formally defines a reuse policy.