This approach is necessary to ensure that all the information required
for a log-on has been submitted and to avoid providing information
that would aid a cracker in trying to gain unauthorized access to the
workstation or network. If a log-on attempt fails, information as to
which part of the requested log-on information was incorrect should
not be supplied to the user.
Answer "Provide a Help mechanism that provides log-on assistance" is incorrect since a
Help utility
would provide help to a cracker trying to gain unauthorized access to
the network.
For answer "Place no limits on the time allotted for log-on or on the number of unsuccessful log-on attempts", maximum and minimum time limits should be placed on the log-on process. Also, the log-on process should limit the number of unsuccessful log-on attempts and temporarily suspend
the log-on capability if that number is exceeded. One approach is to
progressively increase the time interval allowed between unsuccessful
log-on attempts.
Answer "Not provide information on the previous successful log-on and on previous unsuccessful log-on attempts" is incorrect since providing such information will alert an authorized user if someone has been attempting to gain unauthorized access to the network from the user's workstation.