NID Password Change Frequency PIC Submission dated 7/10/13 University Audit and Finance & Accounting Tax

Summary As UCF implements shibboleth, the need for different log-ins and passwords will be reduced. The myUCF Federated Identity login system has allowed for ARGIS, PARIS, AURORA, TERA, COI and interlibrary loan to be accessed via a single-sign in. UCF uses best-practices for its password requirements.

Reason for Password Changes to reduce the risk that passwords may be discovered by unauthorized users who may gain access to the University’s critical information. The risk increases with the length of time between password changes

Basis for the 60 Day Interval UCF Policy Data Classification and Protection requires “passwords on systems holding confidential data must be changed every 60 days or less” CS&T University Standards Password Standards recommends that systems “observe these requirements via technical controls (e.g. password expiration controls) so that all university affiliated account passwords follow this policy.”

Basis for the 60 Day Interval In a State Audit of CS&T completed in 2011, the Auditor General recommended the 60 day frequency for “general user accounts for critical or sensitive applications”.

Regulatory Requirements Federal regulations (HIPPA Security Rule/ HiTech Act Section (a)(5)(ii)(D) ) require only that passwords be changed and do not stipulate an interval. Board of Governors Regulation Security of Data and Related Information Technology Resources, (3) states “the university’s security plan should be “based on best practices acquired from resources such as: Educause, National Institute of Standards (NIST), Information Systems Audit and Control Association (ISACA) or other recognized sources of information security practices and procedures.”

Industry Best Practices NIST Standards / FISMA Provision Section suggests that passwords are changed at least every ninety days. ISO 17799_2005 Standards Section Password Use, also only suggest that passwords be changed at regular intervals, and avoid re-using or cycling old passwords.

Impact of Single Sign On The CS&T university wide initiative toward a single login credential using Shibboleth Federated Identity software allows users to sign in to the portal and transfer to other applications without having to sign in again. The progression of this initiative will help to mitigate inefficiencies associated with more restrictive password change frequency requirements.

Summation The current password change frequency is set at a 60 day interval to comply with an Auditor General recommendation, reduce risk of unauthorized users, and follow best practice.

Action Plan To address community concerns, CS&T could clarify purpose for password changes and associated risk in university standards documentation.