Password Policy and Guidelines

Policy Statement

All Business Users are responsible for safeguarding their system access login and password credentials and must comply with the password parameters and standards identified in this policy. Passwords must meet the complexity requirements outlined and must not be shared with or made available to anyone in any manner that is not consistent with this policy and procedure.

Reason for Policy

Assigning unique user logins and requiring password protection is one of the primary safeguards employed to restrict access to the Business network and Business data stored within it to only authorized users. If a password is compromised, access to information systems can be obtained by an unauthorized individual, either inadvertently or maliciously. Individuals with access are responsible for safeguarding against unauthorized access to their account, and as such, must conform to this policy in order to ensure passwords are kept confidential and are designed to be complex and difficult to breach. The parameters in this policy are designed to comply with legal and regulatory standards, including but not limited to the Privacy Act 1988 and the Payment Card Industry Data Security Standard (PCI DSS).

Who Should Read this Policy

All users of Business.

1. Individual Responsibilities

Individuals are responsible for keeping passwords secure and confidential. As such, the following principles must be adhered to for creating and safeguarding passwords:

1. Business passwords must be changed immediately upon issuance for the first-use. Initial passwords must be securely transmitted to the individual, either via the individual’s supervisor or Human Resources at New Hire Orientation/Induction.
2. Business passwords must never be shared with another individual for any reason or in any manner not consistent with this policy. A shared or compromised access password is a reportable ITS security incident.
3. Employees including Subcontractors and Partners must never ask anyone else for their password. If you are asked to provide your password to an individual or sign into a system and provide access to someone else under your login, you are obligated to report this to the ITS.
4. Business passwords must never be written down and left in a location easily accessible or visible to others. This includes both paper and digital formats on untagged (unsupported) devices. Passwords should not be stored in a web browser’s password manager on an untagged device.
5. Individuals must never leave themselves logged into an application or system where someone else can unknowingly use their account.
6. To access multiuser workstations, ITS will provide a limited-use shared account for the workstation. Individual credentials must then be used for accessing applications.
7. ITS will never ask for a password. In ITS support scenarios where an ITS account cannot be used, an individual may allow a technician to utilize his/her computer under the individual’s account even if the individual is unable to be present during the entire support session. The individual should not share his/her password with the technician. All ITS support technicians are expected to abide by the ITS – Responsible Use of Information Technology Resources policy and their actions may be audited upon request.
8. In the event of a hardware malfunction and the device needs to be repaired by a third-party, the device hard drive should be backed up to a secure storage device and wiped securely prior to being handed over to an external technician. ITS can assist with a secure backup and the drive erasure and other exceptional circumstances. Passwords should not be shared with an external technician.
9. In the event that a password needs to be issued to a remote user or service provider, the password must never be sent without the use of proper safeguards (e.g., do not send passwords through email without encryption).
10. If a password needs to be shared for servicing, ITS Security should be contacted for authorization and appropriate instruction.
11. Passwords for Business must be unique and different from passwords used for other personal services (e.g., banking).
12. Business passwords must meet the complexity requirements outlined in this policy.
13. Business passwords must be changed regularly, as outlined in this policy, at the regularly scheduled time interval or sooner if there is suspicion of a compromise.
14. In the event a breach or compromise is suspected, the incident must be reported to ITS immediately.

2. Responsibilities of Systems Processing Passwords

All Business systems including servers, applications, and websites that are hosted by or for Business must be designed to accept passwords and transmit them with proper safeguards.

1. Passwords must be prohibited from being displayed when entered.
2. Passwords must never be stored in clear, readable format (encryption must always be used).
3. Passwords must never be stored as part of a login script, program, or automated process.
4. Systems storing or providing access to confidential data or remote access to the internal network should be secured with multifactor authentication.
5. Encrypted password hashes must never be accessible to unauthorized individuals.
6. Where possible, salted hashes should be used for password encryption. Exceptions should be filed and reviewed on a regular basis.
7. Where any of the above items are not supported, appropriate authorizations and access control methods must be implemented to ensure only a limited number of authorized individuals have access to readable passwords.

3.   Password Requirements

The following parameters indicate the minimum requirements for passwords for all individual accounts where passwords are:

1. At least eight (10) characters;
2. Not based on anything somebody else could easily guess or obtain using person related information (e.g., names, , telephone numbers, dates of birth, etc.);
3. Not vulnerable to a dictionary attack (see Recommendations for Creating Compliant Passwords section); and,
4. English uppercase letters (A-Z),
5. English lowercase letters (a-z)
6. Base 10 digits (0-9)
7. Non-alphanumeric (such as ` ~ ! @ # $ % ^ & * ( ) _ + - = { } | \ : " ; ' < > ? , . / and space)

4. Password Expiration

In order to prevent an attacker from making use of a password that may have been discovered, passwords are deemed temporary and must be changed regularly. ITS Security reserves the right to reset a user’s password in the event a compromise is suspected or reported. The required frequency at which passwords must be changed varies based on the type of user, as defined below.

4.1  Standard Users

Standard users consist of Business (including Subcontractors and Partners), that are not (1) system administrators or (2) processing credit card payments.

1. Passwords must be changed every six (6) months.
2. Passwords must not be reused for at least four (4) generations.
3. Passwords must not be changed more than one (1) time per day.
4. At least four (4) characters must be changed when new passwords are created.
5. New passwords must comply with the password requirements defined in the previous section.

4.2  Privileged Users

Privileged users consist of users with elevated access to administer information systems and applications, most often in the Information Technologies & Services Department. Such users have administrator access and these accounts are at a higher risk for compromise.

1. Passwords must be changed every ninety (90) days.
2. Passwords must not be reused for at least six (6) generations.
3. Passwords must not be changed more than one (1) time per day.
4. At least four (4) characters must be changed when new passwords are created.
5. New passwords must comply with the password requirements defined in the previous section.

4.3  Payment Card Industry (PCI) Users

Users responsible for processing payments in Business's financial systems, must adhere to the Payment Card Industry’s (PCI) Data Security Standard for password expiration.

1. Passwords must be changed every ninety (90) days.
2. Passwords must not be reused for at least four (4) generations.
3. Passwords must not be changed more than one (1) time per day.
4. At least four (4) characters must be changed when new passwords are created.
5. New passwords must comply with the password requirements defined in the previous section.

5. Account Lockout

In order to limit attempts at guessing passwords or compromising accounts, an account lockout policy is in effect for all systems. Account lockout thresholds and durations vary based on the type of user, as defined below.

5.1 Standard Users

Standard user accounts have the following lockout policy:

1. Accounts will lockout after eighteen (18) invalid password attempts in fifteen (15) minutes.
2. Accounts will remain locked for a duration of fifteen (15) minutes, unless the ITS Service Desk is contacted and the user’s identity is verified in order for the account to be unlocked sooner.

5.2 Privileged Users

Privileged user accounts have the following lockout policy:

1. Accounts will lockout after twelve (12) invalid password attempts in fifteen (15) minutes.
2. Accounts will remain locked for a duration of fifteen (15) minutes, unless the ITS Service Desk is contacted and the user’s identity is verified in order for the account to be unlocked sooner.

5.3 Payment Card Industry (PCI) Users

Payment card industry (PCI) users have the following lockout policy:

1. Accounts will lockout after six (6) invalid password attempts in fifteen (15) minutes.
2. Accounts will remain locked for a duration of thirty (30) minutes, unless the ITS Service Desk is contacted and the user’s identity is verified in order for the account to be unlocked sooner.

6.   Mobile Devices

Mobile devices accessing or storing Business data, such as smartphones and tablets, shall be tagged and managed by the mobile device management (MDM) platform. The following minimum password policy is in effect for all mobile devices, where passwords are:

1. At least six (6) complex digits;
2. No repeating or sequential digits (e.g., 111111, 123456, or 101010); and,
3. Changed every six (6) months.
4. Fingerprint readers on mobile devices may be used to unlock the device, but a compliant password must still be established.

A mobile device will erase after ten (10) invalid password attempts. The device manufacturer may automatically impose time limitations after several unsuccessful password attempts before the wipe is triggered. ITS Support can provide assistance in resetting device passcodes.

7. Recommendations for Creating Compliant Passwords

In order to create a password that is compliant with the parameters specified in this policy, use one of the three methods below.

7.1 Use a Passphrase

A passphrase is similar to a password, but it is generally longer and contains a sequences of words or other text to make the passphrase more memorable. A longer passphrase that is combined with a variety of character types is exponentially harder to breach than a shorter password. However, it is important to note that passphrases that are based on commonly referenced quotes, lyrics, or other sayings are easily guessable. Passphrases should be unique to you.

1. Use at least twenty (20) characters
2. Incorporate the four character types (a space or special character can be used to separate words or phrases in order to add complexity)
3. Use a phrase that is easy to remember
4. Abbreviate most of the words in the phrase to increase complexity
5. Examples:
   1. Phrase:            “When I was five, I learned how to ride a bike.”
   2. Password:        When I was 5, I learned to ride a bike.
   3. Phrase:            “When I was five, I learned how to ride a bike.”
   4. Password:        WheIwas5,Ilear2ridabik.

7.2 Use an Acronym

An acronym can be used to constitute a strong and compliant password by taking the first letter of each word in a phrase (including punctuation) to form the password.

1. Incorporate the four character types (forming your phrase in sentence case with punctuation can be used to meet the requirements)
2. Use a phrase that is easy to remember
3. Example:
   1. Phrase:            “When I was five, I learned how to ride a bike.”
   2. Password:        WIw5,Ilhwrab.

7.3      Use a Secret Code

A secret code can be used in conjunction with the previous methods simply by substituting letters for other numbers or symbols. Combining these methods will make it easy to incorporate the four character types in order to meet the password complexity requirements.

1. Use a phrase that is easy to remember
2. Capitalize the first letter of every word
3. Substitute letters for numbers or symbols
4. Incorporate spaces or substitute with a different character
5. Example:
   1. Phrase:            “When I was five, I learned how to ride a bike.”
   2. Password:        WhenIwa$5,Ilh0wt0rab1k3.

A secret code can also be generated by using a keyboard pattern. Patterns can be generated by using geometric patterns, such as diagonal lines, series of lines, etc.

1. Use a pattern that is easy to remember
2. Incorporate letters, numbers, and/or symbols
3. Enter passwords with caution as patterns may be easily visible
4. Examples:
   1. Pattern:            a triangle starting with ‘z’ and incorporating an uppercase letter
   2. Password:        Zse4rfvcx
   3. Pattern:            the third, sixth, and ninth keys of each row, with one row of uppercase letters
   4. Password:        369eyoDHLcn.
   5. Pattern:            a series of lines, starting with %, r, d, and b, with one row of uppercase letters
   6. Password:        %^&rtyDFGbnm

8.   Password Reset Options

Various options are available to assist users with changing a forgotten or expired password. The preferred and fastest method is through the use of the password management system. Personalized security questions must be setup in order to use this system to reset your password.

8.1 Password Self Service

Login to the system with your username and current password and depending on the system you logged in, the reset password option is usually found under "Account" or "Settings". If you have any trouble locating the function of resetting your password, you must contact ITS Support.

9. Reporting a Suspected Compromise or Breach

If you believe your password has been compromised or if you have been asked to provide your password to another individual , promptly notify ITS.