Overview
Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of CSU-Pueblo's entire network. As such, all CSU-Pueblo employees (including contractors and vendors with access to CSU-Pueblo systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.

Purpose
The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change. The scope of this policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at any CSU-Pueblo facility, has access to the CSU-Pueblo network, or stores any non-public CSU-Pueblo information.

Policy

• All passwords (e.g.; network, e-mail, web, etc.) must be changed at least every 180 days, and passwords for Administrative Information System (AIS) must be changed at least every 90 days.
• All passwords must conform to the guidelines described below.
• Passwords can not be reused for a period of one year
• Initial passwords will be required to be changed on first logon

Guidelines
General Password Construction Guidelines
Passwords are used for various purposes at CSU-Pueblo. Some of the more common uses include: eAccounts (e.g.; network, e-mail, web), Administrative Information System (AIS), screen saver protection, and voicemail password. Everyone should be aware of how to select strong passwords.
 
Poor, weak passwords have the following characteristics:

• The password contains less than six characters
• The password is a word found in a dictionary (English or foreign)
• The password is a common usage word such as:
• Names of family, pets, friends, co-workers, fantasy characters, etc.
• Computer terms and names, commands, sites, companies, hardware, software.
• The words "CSU-Pueblo", "thunderwolf", "CSUP" or any derivation.
• Birthdays and other personal information such as addresses and phone numbers.
• Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
• Any of the above spelled backwards.
• Any of the above preceded or followed by a digit (e.g.; secret1, 1secret)

• Contain both upper and lower case characters (e.g.; a-z, A-Z)
• Have digits and/or punctuation characters as well as letters (e.g.; 0-9, ! # $ % ^ & * ( ) _ + | ~ - = ` { } [ ] : ; ' < > ? , Note: the following special characters may not be used @ . / \ " ) (hint: use punctuation characters that resemble letters as substitutions, e.g.; i = !, s = $, etc)
• Are at least six alphanumeric characters long (eight is preferred).
• Are not a word in any language, slang, dialect, jargon, etc.
• Are not based on personal information, names of family, etc.
• Passwords should never be written down or stored on-line unencrypted.
• Try to create passwords that can be easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "I can't remember my pass word" could be "1CrmPw" or "!cR^^pw" or some other variation.

Password Protection Standards
Do not use the same password for CSU-Pueblo accounts as for other non-CSU-Pueblo access (e.g.; personal ISP account, option trading, benefits, etc.). Do not share CSU-Pueblo passwords with anyone, including supervisors, administrative assistants or co-workers. All passwords are to be treated as sensitive, Confidential CSU-Pueblo information.
 
Here is a list of "don'ts":

• Don't reveal a password over the phone to ANYONE
• Don't reveal a password in an email message
• Don't reveal a password to your boss
• Don't talk about a password in front of others
• Don't hint at the format of a password (e.g.; "my family name")
• Don't reveal a password on questionnaires or security forms
• Don't share a password with family members
• Don't reveal a password to co-workers while on vacation

Changing Passwords
Passwords may be changed while logged on to a computer on campus by pressing the CTRL, ALT, and DEL keys simultaneously and choosing the "Change Password" button. The existing password will be required and then the new password twice to complete the process. From off campus the password may be changed by logging on to the WebMail interface and selecting the Options folder and then choosing the "Change Password" button.

Application Development Standards
Application developers must ensure their programs contain the following security precautions. Applications:

• Should support authentication of individual users, not groups.
• Should not store passwords in clear text or in any easily reversible form.
• Should provide for some sort of role management, such that one user can take over the functions of another without having to know the other's password.

Enforcement
Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.