5.2.1 Passwords. Information Technology Policy. Policy. Purpose. Policy Statement. Applicability of this Policy

Transcription

1 Infrmatin Technlgy Plicy Passwrds Plicy Area: 5.2 Security Title: Passwrds Issued by: Assistant Vice-President/CIO, ITS Date Issued: 2006 July 24 Last Revisin Date: 2011 Octber 19 Apprved by: Assistant Vice-President/CIO, ITS Purpse Passwrds, as nrmally used, are the minimum level f electrnic security fr prtecting identities and the security f persnal and ther infrmatin. Passwrds must be chsen and used with care in rder t give reasnable assurance f that prtectin. Plicy Statement 1. An initial passwrd may be assigned t a user nly after that user's identity has been reasnably established. 2. A user must be allwed t change his r her wn passwrd after lgging n using the existing passwrd, prvided the existing passwrd has nt been made unusable. 3. Passwrds the user has previusly used may nt be reused within the time specified in the attached prcedures. 4. Passwrds: must be resistant t brute-frce attacks; and must nt be frced t be mre cmplex r difficult t use than is required t meet changing security requirements. 5. Prtectin f passwrds is the user's respnsibility. Persnal passwrds must nt be shared with r revealed t anyne else. Prject passwrds may nly be shared amng thse identified by the prject leader as having a legitimate need t knw the passwrd. 6. Frgtten r unusable passwrds may be reset fr a user nce there is a reasnable assurance f crrect identity, but this level f assurance will generally be mre strict than that required fr the initial passwrd. A cpy f the new passwrd must nt be kept by anyne except the legitimate persnal user r prject users. Applicability f this Plicy This plicy applies t passwrds used fr cmmn services and assciated with the fllwing authenticatins: Systems using Dalhusie NetID authenticated via the Enterprise Directry service, fr example MyDal. Other systems using NetID and synchrnized with the Enterprise Directry passwrd This plicy sets base requirements fr passwrds. Sme situatins, such as privileged access t servers, may have mre stringent requirements and will be the subject f separate plicies.

2 Prcedures Setting the initial passwrd Persnal accunts When a NetID is initially assigned there is n assciated passwrd (i.e. the passwrd is reset and the NetID is nt functinal). The user t whm the NetID has been assigned may set the initial passwrd by supplying their Banner ID number and their birth date. Users are tld their Banner ID number by nnelectrnic means when they are first registered as students, r first emplyed, r when a relatinship is first established. Guest accunts The initial passwrd fr a guest accunt will be autmatically generated and given t the user wh has authrized the accunt (usually a faculty r staff member). Prject accunts An initial passwrd is assigned by Netwrks and Systems when a prject accunt is created. This passwrd is securely transmitted t the prject leader. The passwrd shuld be set t expire within 1 week. Changing a passwrd Users will be prvided with a secure web page that can be used t change their passwrd at any time. Knwledge f the NetID and the currently usable passwrd is sufficient t make the change. Passwrd re-use New passwrds must be checked t ensure they have nt been used fr this NetID within the past 12 mnths. Passwrd Strength Passwrds must be checked fr cmpliance with the attached standard befre they are accepted. Frgtten r unusable passwrds Persnal accunts Self Service: Users may reset (make unusable) their wn passwrd by ne f the fllwing: A valid lgin t DalOnline where they will be presented with a functin that will reset their NetID passwrd; r Specifying their NetID, Banner ID, and EM address t a web page, which will result in a limited lifetime URL that can reset the passwrd being sent t that address; r Specifying their NetID and Banner ID t a web page, which will result in a limited lifetime URL that can reset the passwrd being sent t the pstal address n recrd. Assisted Service: Authrized staff may reset (make unusable) a frgtten passwrd nce the identity f the user is reasnably established. The user may then set a new passwrd by knwing their Banner ID number and their date f birth as recrded in Banner.

3 A user requesting a passwrd reset must be identified by prviding their Banner ID number and at least ne f the fllwing: Appearance in persn and presentatin f an acceptable pht ID; r A FAXed r ed cpy f an acceptable pht ID tgether with a signed request fr the reset specifying the user's Banner ID and NetID: An acceptable pht ID is ne f the fllwing valid dcuments: Dalhusie ID card (the Dalhusie ID card may be expired if the user des nt have a current affiliatin with Dalhusie that requires an ID card, e.g. alumnus); r: Passprt; r Canadian r US driver's license with pht. Only the fllwing persns will be cnsidered fr authrizatin t reset users' passwrds. This authrizatin will expire in n mre than 12 mnths and renewal must be requested by the persn's dean r senir directr and accepted by the Directr r Assciate Directr f Netwrks & Systems, and audited by the ITS Infrmatin Security Manager. This authrizatin will be withdrawn when the persn's status changes r n any breach r suspected breach f these prcedures. ITS Directrs and Managers ITS Help Desk staff ITS wrkgrup managers Regular full time user supprt staff in Faculties and departments A lg entry f all passwrd resets will be maintained fr at least tw years. The lg will include the affected NetID, a lg f the identifying infrmatin supplied by the user, a timestamp, IP number r ther identificatin f the wrkstatin used, and identificatin f the persn carrying ut the reset. Guest accunts Passwrds fr guest accunts may be changed by the guest accunt user but cannt be reset. Prject accunts A frgtten r expired passwrd may be changed by Netwrks and Systems n the request f the prject leader. The prject leader's identity will be established as abve. The new passwrd shuld be set t expire within 1 week. Exceptins Exceptins t these prcedures may nly be made n the written directin f the Assistant VP/CIO, ITS. Standards Passwrds gverned by the Passwrd Plicy must meet all f the fllwing minimum standards: At least 8 characters, including at least three f the fllwing fur character types: Uppercase letters Lwercase letters Numbers Symbls fund n yur keybard; a blank space is nt permitted but all f the fllwing are: ~@%^&*_={}[]()+;,./<>?# - N embedded NetIDs r Banner numbers N embedded sequences f fur r mre characters f the fllwing types: Repeated characters, such as AAAA r 5555; Alphabetic sequences, such as abcd r DCBA; Numeric sequences, such as 1234 r 4321; Cmmn keybard sequences, such as QWER r piu. N embedded wrds frm a dictinary f English wrds r names. Shrt wrds f fur r fewer characters are permitted.

4 Guidelines Yur NetID, authenticated by yur passwrd, permits yu t access electrnic services that are restricted t the Dalhusie cmmunity. These services are imprtant t yu and t the University and must be prtected by a passwrd. Yur passwrd shuld be easy fr yu t remember, but difficult fr anyne else t discver r guess. Dn't base yur passwrd n persnal infrmatin; avid using yur spuse's r children's name, the names f pets, birth dates, hbbies, favurite sprts, yur address r phne number, Scial Insurance Numbers, license numbers, etc. Here are tw methds f arriving at a gd passwrd: 1. Passwrds based n mnemnic phrases are amng the mst secure and easiest t remember. Start with a line frm a favrite sng, pem, film, r speech. Take the first letter f each wrd and keep the punctuatin, r pick ne r tw letters r symbls t represent each wrd, and then mix in punctuatin and numbers that are meaningful t yu. Example: Take the phrase "And that's the kind f day it's been" t create the passwrd &T'stkdib Example: Take the phrase "I was 21 when I first visited Paris" t create the passwrd Iw21wIfvP Example: The sng chrus "We'll rant and we'll rar..." cmbined with the year f the Halifax explsin culd becme wr&we'llr17! 2. Start with a real wrd, r wrds, and then mdify slightly. But d nt rely n simple substitutins, such as replacing the letter O with the number zer, because these are well knwn t passwrd crackers. Take tw shrt unrelated wrds and cmbine them with special characters r numbers. Example: Game48keys r eye!!week Intrduce 'silent' numbers int a real wrd (yu'll need at least ne uppercase t). Example: termin7al Deliberately misspell a wrd r phrase (yu'll still need at least ne number and uppercase). Example: 37ChkLuts Regardless f the methd yu use, chse passwrds that yu can remember that will be difficult fr even thse wh knw yu t guess. Dalhusie enfrces rules that help make yur passwrd strnger. Thse rules include a minimum length f 8 characters, n embedded dictinary wrds, mixture f alphanumeric and special characters, etc. Passwrd change pages have a help sectin that explains this in mre detail. Dn't use any f the example passwrds shwn n this page! Nw that yu have a passwrd... Passwrds must be kept secret and must nt be shared with anyne. It is best t remember yur passwrd and nt write it dwn anywhere. If yu must write yur passwrd dwn, make sure yu keep it in a safe place such as in yur wallet. Never stre it near yur cmputer r in a file n yur cmputer. Change yur passwrd immediately (at if yu suspect that smene may have guessed it. Use yur new passwrd immediately after changing it t help make it stick in yur memry.

5 Definitins authenticatin Banner ID Authenticatin is the prcess f determining whether smene r smething is, in fact, wh r what it is declared t be. Fr example, it is the prcess f deciding whether the persn attempting t use a NetID is the persn t whm that NetID was assigned. A user's Banner ID is the identificatin number assigned t a user by the University's central administrative system. It is als knwn as a Dalhusie ID, a Student ID, r an emplyee ID and has the frm f the letter 'B' fllwed by 8 digits. brute-frce attack EM address A brute-frce attack is an attempt t determine a passwrd by trying all pssible cmbinatins. Fr example, a 6 digit PIN cnsisting nly f the digits 0-9 can be guessed in at mst 1,000,000 tries. Even strngly encrypted passwrds can quickly fall t brute frce attacks if the attacker has a cpy f the encrypted passwrd and if the passwrd is nt well chsen. An EM address is ne f the nn-dalhusie addresses recrded in Banner as 'Persnal' addresses. Enterprise Directry guest accunt passwrd prject accunt Dalhusie's Enterprise Directry cntains digital infrmatin that, amng ther things, facilitates the authenticatin prcess. Managed by ITS it is the nly authritative directry fr electrnic authenticatin purpses at Dalhusie. It may take the frm f OpenLDAP, Active Directry, r ther sme technlgy in the future. A guest accunt is a shrt-duratin accunt with strictly limited privileges that is designed t be used by visitrs and guests at Dalhusie. Guest accunts may be generated by any faculty r staff, wh then becme respnsible fr the use f that accunt. A passwrd is a string f characters that is used in assciatin with a username/identifier t authenticate a user t an electrnic applicatin. The passwrd shuld nly be knwn t the user. A prject accunt is an accunt and assciated NetID that is nt assciated with any ne persn, but rather with a grup f persns fr a particular purpse. A prject accunt t be used fr a cnference website is an example. Althugh several peple may access the accunt, ne persn is ultimately respnsible fr its use. persnal accunt A persnal accunt is an accunt and assciated NetID assciated with ne persn nly. Mst accunts are examples.

6 Related Dcuments Official NetID passwrd page: Revisin Histry 2011 Octber 19 updated Prcedures t match current practices 2009 Octber 13 changed frm 'UCIS' t 'ITS' 2008 January 09 updated language abut wh can d resets, allwed ed pht ID, allw expired ID in sme cases 2006 July 24 initial apprved versin