A penetration tester was able to gather MD5 hashes from a server and crack the hashes easily with rainbow tables. Which of the following should be included as a recommendation in the remediation…

The fact that MD5 hashes were easily cracked with rainbow tables indicates that the system is using a weak, unsalted hashing algorithm for password storage. The most direct and effective remediation is to recommend stronger algorithmic requirements, specifically transitioning to modern, cryptographically secure hashing functions that incorporate salting and iteration (e.g., Argon2, bcrypt, scrypt) to make rainbow table attacks and brute-force cracking significantly more difficult.

While access controls are important for general server security, they do not directly address the weakness in the password hashing mechanism itself.

Passwords should be *hashed*, not encrypted, for storage. If passwords were encrypted, the encryption key would still need to be stored, creating a single point of failure and allowing decryption back to plaintext.

A patch management program addresses vulnerabilities in software, not the fundamental weakness of using a cryptographically weak hashing algorithm for passwords.