Information Systems Desktop Support Password Security Information Systems Desktop Support

We need your help The IT department uses the latest technology and techniques to maintain the highest level of security possible, but we can’t do the job without your help. Every employee plays a critical role in keeping our computer network secure. One of the greatest security vulnerabilities lies in the improper or ineffective use of passwords. Here are some important guidelines to keep in mind.

What is a weak password? A weak password: Contains fewer than six characters Is a word found in a dictionary (English or foreign) Is a common usage word such as: Passwords containing the user ID in any form Names of family, pets, friends, or co-workers Birthdays and personal information, such as addresses and phone numbers Any of the above spelled backward Any of the above preceded or followed by a digit (secret1, 1secret) or the same letter (ssecret, secrett)

What is a strong password? Contains digits, symbols, and uppercase and lowercase characters. For example: a-z, A-Z, 0-9, !@#$%^&*()_+|~-=\`{}[]:";'<>?,./ Is at least eight characters long Isn’t a word in any language, slang, or dialect Isn’t based on personal information, names of family, etc.

Note: Do not use these as your password; they’re just examples! Good one-time use password (> 16 char) Example: e-mail a file-level protected Excel 2003 workbook “ThisIsMy1timePasswordx2791” A concatenated sentence plus extension “CNET!2005Jun@hipaa#2791” <company> [Shift]1 <date> [Shift]2 <type> [Shift]3 <extension> Good normal use password (> 8 char) Example: application login password #win8hir05 [Shift]3 <first 3 letters of your firstname> <random number> <last 3 letters of your lastname> <year> Use a pattern that you can remember without writing it down Here are some examples of how to create and remember strong passwords. A lot of times people will create passwords but will not remember it or will tape it on the monitor. The idea is to create a strong password that is easy for you to remember, but hard for others to guess

Loss of Information The time to crack/hack passwords with respect to the password length and its complexity. The search speed supposedly equals 100,000 passwords per second (a very decent speed). Password length /charset 26 (no case, letters only) 36 (no case, letters & digits) 52 (case sensitive) 96 (all printable) 4 1 min 13 min 5 10 min 1 hr 22 hr 6 50 minutes 6 hrs 2.2 days 3 months 7 22 hrs 9 days 4 months 23 yrs 8 24 days 10.5 months 17 yrs 2,287 yrs 9 21 months 32.6 yrs 881 yrs 219,000 yrs 10 45 yrs 1,159 yrs 45,838 yrs 21 million yrs

Password do’s and don’ts Keep your user ID and password to yourself Use antivirus software (both at home and at work) Screen-lock or log off your computer desktop when you are away from the computer Report security incidents immediately DON’T: Reveal your password to anyone over the phone, e-mail, or IM Share your password with your boss, family members, or a co-worker while you’re on vacation Reveal a password on questionnaires or security forms Use the “Remember Password" feature of applications in any public computer (conference room, airport, Internet café, etc).

The password policy Policy location: UVM Computer and Network Use Policy and Administrative Interpretation Highlights Minimum recommended password length is 8 characters Complexity is strongly recommended Responsible use includes choosing passwords that are not easily deduced by others. Voluntary unauthorized disclosure of a password may be result in suspension, revocation and/or denial of computing privileges. Disclosure of passwords to persons responsible for departmental computing, local LAN supervisors and the Office of Computing and Information technology ("CIT") is considered authorized disclosure.

For more information Policies Governing UVM Information Technology Security policies Guidelines and examples Incident reporting email Copyright information and complaints

Additional resources TechRepublic's Downloads RSS Feed Sign up for our Downloads Weekly Update newsletter Sign up for our Network Security NetNote Check out all of TechRepublic's free newsletters “Help users recognize and defend home networks against spam, spyware, scams, pop-ups and cookies” (TechRepublic download) “End-user security education quiz” (TechRepublic download) “Tips to help users remember passwords” (TechRepublic article) Version history Version: 1.0 Published: November 17, 2005 Copyright ©2005 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit http://techrepublic.com.com/2001-6240-0.html