Which authentication requirement should be enforced for OIMS access?

Which authentication requirement should be enforced for OIMS access?

• A. Strong password policies
• B. Session timeouts
• C. Account lockout after failed attempts
• D. Multi-factor authentication

Answer: (D)

Multi-factor authentication provides the strongest assurance for verifying a user’s identity by requiring more than just a password. It adds a second (or even third) form of proof, such as a one-time code from a mobile app or hardware token, or a biometric check. For a system like OIMS that handles sensitive offender information, this layered approach means that even if a password is stolen or phished, the attacker still cannot access the account without the additional factor. That extra barrier significantly reduces the risk of unauthorized access. Strong password policies, session timeouts, and account lockout are important security controls, but they address only parts of the authentication process. A password alone can be compromised; session timeouts limit how long a session stays open but don’t prevent initial unauthorized access; and account lockout helps deter brute-force attempts but doesn’t confirm the user’s identity if credentials are compromised. Multi-factor authentication combines these ideas into a much more robust defense, which is why it’s the best requirement to enforce for OIMS access.

Multi-factor authentication provides the strongest assurance for verifying a user’s identity by requiring more than just a password. It adds a second (or even third) form of proof, such as a one-time code from a mobile app or hardware token, or a biometric check. For a system like OIMS that handles sensitive offender information, this layered approach means that even if a password is stolen or phished, the attacker still cannot access the account without the additional factor. That extra barrier significantly reduces the risk of unauthorized access.

Strong password policies, session timeouts, and account lockout are important security controls, but they address only parts of the authentication process. A password alone can be compromised; session timeouts limit how long a session stays open but don’t prevent initial unauthorized access; and account lockout helps deter brute-force attempts but doesn’t confirm the user’s identity if credentials are compromised. Multi-factor authentication combines these ideas into a much more robust defense, which is why it’s the best requirement to enforce for OIMS access.