Many organizations blindly make policy without ever checking effectiveness. As an example, many organizations still have a password policy where the password has to be eight (8) characters with at least one (1) of each: uppercase, lowercase, special character, and number. The policy will further state that passwords should be changed every 90 days. Do you think this is an effective password policy? Explain your rationale.