1. Information Systems Desktop Support
Password Security
Information Systems Desktop Support

2. We need your help
The IT department uses the latest technology and techniques to maintain the highest level of security possible, but we can’t do the job without your help. Every employee plays a critical role in keeping our computer network secure.
One of the greatest security vulnerabilities lies in the improper or ineffective use of passwords. Here are some important guidelines to keep in mind.

3. What is a weak password? A weak password:
Contains fewer than six characters
Is a word found in a dictionary (English or foreign)
Is a common usage word such as:
Passwords containing the user ID in any form
Names of family, pets, friends, or co-workers
Birthdays and personal information, such as addresses and phone numbers
Any of the above spelled backward
Any of the above preceded or followed by a digit (secret1, 1secret) or the same letter (ssecret, secrett)

4. What is a strong password?
Contains digits, symbols, and uppercase and lowercase characters. For example: a-z, A-Z, 0-9,
Is at least eight characters long
Isn’t a word in any language, slang, or dialect
Isn’t based on personal information, names of family, etc.

5. Note: Do not use these as your password; they’re just examples!
Good one-time use password (> 16 char)
Example: a file-level protected Excel 2003 workbook
“ThisIsMy1timePasswordx2791”
A concatenated sentence plus extension
<company> [Shift]1 <date> [Shift]2 <type> [Shift]3 <extension>
Good normal use password (> 8 char)
Example: application login password
#win8hir05
[Shift]3 <first 3 letters of your firstname> <random number> <last 3 letters of your lastname> <year>
Use a pattern that you can remember without writing it down
Here are some examples of how to create and remember strong passwords. A lot of times people will create passwords but will not remember it or will tape it on the monitor. The idea is to create a strong password that is easy for you to remember, but hard for others to guess

6. Loss of Information
The time to crack/hack passwords with respect to the password length and its complexity. The search speed supposedly equals 100,000 passwords per second (a very decent speed).
Password length /charset
26 (no case, letters only)
36 (no case, letters & digits)
52 (case sensitive)
96 (all printable) 4
1 min
13 min 5
10 min
1 hr
22 hr 6
50 minutes
6 hrs
2.2 days
3 months 7
22 hrs
9 days
4 months
23 yrs 8
24 days
10.5 months
17 yrs
2,287 yrs 9
21 months
32.6 yrs
881 yrs
219,000 yrs 10
45 yrs
1,159 yrs
45,838 yrs
21 million yrs

7. Password do’s and don’ts
Keep your user ID and password to yourself
Use antivirus software (both at home and at work)
Screen-lock or log off your computer desktop when you are away from the computer
Report security incidents immediately
DON’T:
Reveal your password to anyone over the phone, , or IM
Share your password with your boss, family members, or a co-worker while you’re on vacation
Reveal a password on questionnaires or security forms
Use the “Remember Password" feature of applications in any public computer (conference room, airport, Internet café, etc).

8. The password policy
Policy location: UVM Computer and Network Use Policy and Administrative Interpretation
Highlights
Minimum recommended password length is 8 characters
Complexity is strongly recommended
Responsible use includes choosing passwords that are not easily deduced by others.
Voluntary unauthorized disclosure of a password may be result in suspension, revocation and/or denial of computing privileges. Disclosure of passwords to persons responsible for departmental computing, local LAN supervisors and the Office of Computing and Information technology ("CIT") is considered authorized disclosure.

9. For more information Policies Governing UVM Information Technology
Security policies
Guidelines and examples
Incident reporting
Copyright information and complaints

10. Additional resources TechRepublic's Downloads RSS Feed
Sign up for our Downloads Weekly Update newsletter
Sign up for our Network Security NetNote
Check out all of TechRepublic's free newsletters
“Help users recognize and defend home networks against spam, spyware, scams, pop-ups and cookies” (TechRepublic download)
“End-user security education quiz” (TechRepublic download)
“Tips to help users remember passwords” (TechRepublic article)
Version history
Version: 1.0
Published: November 17, 2005
Copyright ©2005 CNET Networks, Inc. All rights reserved. For more downloads and a free TechRepublic membership, please visit