Neco 2025 Data Processing Question 2

A company enforces a password policy that requires passwords to be exactly 8 characters long, using uppercase letters (26), lowercase letters (26) and digits (10). An attacker attempts a brute‑force attack, trying \(1{,}000{,}000\) random passwords uniformly from all possible passwords that meet the policy. (a) Compute the probability that the attacker guesses a particular strong password within these attempts. (b) In practice, 10\% of users choose simple passwords that effectively reduce the password space to \(10^{6}\) possible passwords, while the remaining 90\% use passwords that fully exploit the policy. Assuming the attacker's attempts are equally likely to target any user, calculate the overall probability that the attacker compromises an account in one attack session. (c) If the organisation considers a policy acceptable only when the overall compromise probability is less than \(0.001\), should the current policy be retained? Justify your answer.