Skip to main content
Indiana Wesleyan University Support Knowledge Base

Security Standard 06: Passwords

  1. Last updated
  2. Save as PDF

Summary

This standard shall delineate the specific minimum password requirements, tailored to the respective account types in use, to reinforce our commitment to safeguarding sensitive information.
Corresponding Policy:
The official Information Security Policy that is the parent to this standard is located in the Official IWU Policy Warehouse

The purpose of an organizational password standard is to establish a framework and set of rules for managing and securing access to digital resources within the organization. This standard aims to enhance the overall security posture by ensuring that passwords, a fundamental component of access control, meet specific criteria and are managed in a manner that mitigates security risks for all university login accounts.

In our continuous efforts to bolster password security, IWU will, when necessary, augment the length of passwords to ensure that, in the event of an unauthorized acquisition of an encrypted password, it remains resilient against quick decryption attempts.

This standard applies to all Indiana Wesleyan University (IWU) login accounts including but not limited to employees, students, contractors, third-party vendors, and systems accounts.

Outline

 (A) EMPLOYEE & STUDENT PASSWORDS
  1. Minimum password character length:
    1.  Students = (12)
    2.  Employees = (14)
  2. Password special character requirement
    1. All passwords must contain (3) of the (4) following character types:
      1. (1) upper case letter
      2. (1) lower case letter
      3. (1) number
      4. (1) special character ( for example: ,!$%^&*()_+|~-=\`{}[]:";'<>?,/ )
  3. Important restrictions when selecting a password
    1.  Substitution of Letters with Numbers
      1.  Passwords employing letter-to-number substitutions may face rejection if the resulting normalized words are found within a cracking dictionary. For instance, the password 'C0ntos0Blank12' would be declined due to the presence of two compromised passwords, namely 'Contoso' and 'Blank.' Extending the password by several characters would potentially override this restriction, allowing the password to proceed, regardless of any compromised passwords.
    2. Avoidance of Previous Password Variations
      1. Users are advised against utilizing modified versions of past passwords that may have been previously employed to access their account.
    3. Personal Account Distinction
      1.  Employee passwords must differ from those used for personal accounts, such as personal email or bank accounts.  While strongly advised for Students this is not a requirement.
    4. Exclusion of Personal Information
      1.  Passwords must not incorporate the user's first name, last name, login name, or email address.
    5. Prohibition of Consecutive Repeating Characters
      1. Passwords featuring three or more consecutive repeating characters will be rejected.
    6. Restrictions On Using Specific Words Within a Password
      1. Users are urged to abstain from incorporating any words listed in the restricted passwords knowledge base article.
  4.  Password Expiration, Management & Protections
    1. How often do I need to change my password?
      1. Password changes will not be mandated at regular intervals unless the IWU password hygiene monitoring platform identifies the password in a public breach database. In the event of detection, the account holder will receive notification through the university email, prompting them to change their password within a specified timeframe provided in the notification.
    2. Secure Transmission:
      1. Account passwords must not be transmitted via email, text, or any other digital forms. If unique situations necessitate credential transmission, it must be encrypted using the IWU Secure encryption procedure.
    3. Browser Password Storage (Employees)
      1. Employee are prohibited from saving passwords prompted by web browsers. Existing browser-stored passwords, as of the policy's enactment, must be purged, and the option for saving passwords should be disabled.
    4. Documentation of Passwords (Employees)
      1. Employee passwords must not be documented or stored outside of an approved password manager. Employees managing a substantial number of institutional passwords may be eligible for an IWU-provided password manager. Instructions for disabling password retention can be found in this knowledge base article.

 

(B) PRIVILEGED ADMIN, CONTRACTOR, SYSTEM SERVICE & TEST ACCOUNT PASSWORDS  
  1. Minimum password character length:
    1.  Privileged Admin Accounts = (16)
    2.  Contractors = (16)
    3. Test Accounts = (16)
    4. System Service Accounts = (20)
  2. Password Character Requirements, Restrictions, Storage and Management
    (Sections  3 and 4 from the Employee / Student password standard are applicable unless otherwise noted below)
    1. All passwords must contain (3) of the (4) following character types:
      1. (1) upper case letter
      2. (1) lower case letter
      3. (1) number
      4. (1) special character ( for example: ,!$%^&*()_+|~-=\`{}[]:";'<>?,/ )
    2. Secure Storage
      1. System service and test account passwords must be documented in an IWU approved secure password manager
    3. Password Expiration
      1. Privileged Admin accounts: Any accounts lacking multi-factor authentication (MFA) are subject to expiration with a frequency of every 90 days.
      2. Test Accounts: Passwords for test accounts should undergo rotation every 90 days unless Multi-Factor Authentication (MFA) is implemented. Regular quarterly audits of all test accounts are required, with inactive accounts being promptly removed from the system.
      3. Contractor Accounts: Contractors typically are engaged with IWU for a limited period of time.  The length of a contractor’s engagement must be communicated to the IAM manager, and any associated accounts should be set to expire on the expected engagement end date.  Ongoing contractor support accounts are required to be changed every 90 days.
      4. System Service Accounts: Passwords are required to be changed upon the departure or role change of an individual with access to a service account.  In instances where an appropriate risk assessment has been completed and the risk found to be acceptable this requirement can be waived by the CISO.  It is the responsibility of the supervisor of the employee in question to notify the CISO and to discuss the individual case details.
    4. Duplication of Passwords
      1. System Service and Test Account Passwords: The same password cannot be used for multiple system, service, or test accounts.  This includes utilizing a similar password with a slight variation in each account. (i.e. – Password1!, Password2!, Password3!)
      2. Privileged user accounts must have unique passwords distinct from their owner's standard user accounts.
    5. Transmission of Passwords
      1. Secure Transmission is required: Account passwords must not be transmitted via email, text, or any other digital forms. If unique situations necessitate credential transmission, it must be encrypted using the IWU Secure encryption procedure.
    6. Default Passwords for Systems and Network Devices
      1. Default passwords for systems, network devices, embedded devices, IoT (sensors, appliances etc.) devices or infrastructure equipment must be changed before or shortly after connecting the system to the IWU network.
  3.  Responsibility of Systems Processing Passwords
    1. Design and Security Standards for Password Handling
      1. Password Display Restrictions
        1. Systems, , applications, and websites hosted by or for IWU should be designed to refrain from displaying passwords upon entry. However, a toggle option for visibility may be incorporated as needed.
      2. Secure Storage Practices
        1. Passwords must never be stored in a clear, readable format. Robust and brute-force resistant hashing methods or encryption must be consistently employed.
      3. Restricted Access to Hashed or Encrypted Passwords
        1. Hashed or encrypted passwords must always remain inaccessible to unauthorized individuals.
      4. Prohibition of Clear Text Password Storage
        1. Clear text passwords should never be stored as part of a login script, program, or automated process.
      5. Usage Instances Requiring Review
        1. In cases where the aforementioned procedures lack support, it is necessary to submit a formal request for a review of the specific usage scenario to the CISO. 

 

(C) RELATED INFORMATION
  1. General Recommendations on Password Creation
    1.  Please view the video below as a tool that can assist any IWU user in selecting a password.  
    2. Individuals shall consider using passphrases, such as a song title, affirmation, or another phrase, since they are relatively long and constructed of multiple words, which provides greater security against dictionary attacks. Secure passphrases shall follow the general password construction guidelines to include upper and lowercase letters, numbers, and special characters (for example, !TheTrafficOnI95WasBadThisMorning!).
  2. Definitions
    1. Encrypted Password
      1. An encrypted password refers to a password that has undergone a process called encryption to protect it from unauthorized access. Encryption is a security technique that transforms information, in this case, a password, into a format that is unreadable without the appropriate decryption key or algorithm. This helps enhance the security of sensitive information, such as user passwords.
    2. Cracking Dictionary
      1. A cracking dictionary, often referred to as a password dictionary or word list, is a file or database containing a list of words, phrases, or combinations of characters that are commonly used as passwords. These dictionaries are used by attackers in password cracking attempts to systematically try each entry in the list as a potential password, either through brute-force attacks or more sophisticated methods like dictionary attacks.
    3. Privileged Admin Accounts
      1. Privileged admin accounts encompass individuals with elevated access to administer systems, applications, and network devices. Given the heightened value of their administrator access, these accounts are particularly attractive targets for threat actors, posing an increased risk of compromise.
    4. System Accounts
      1. These accounts are created to allow systems, applications, processes, or integrations to perform specific functions or tasks within a computer system. System service accounts typically have elevated access rights or privileges to administer systems, applications, and network devices. Due to their elevated privileges, system service accounts can be attractive targets for unauthorized access, making their security crucial.
    5. Test Accounts
      1. These accounts created for temporary use in imitating specific roles, individuals, or training scenarios within a system or application. These accounts are valuable for testing the functionality, performance, and security of systems and applications before they are deployed for actual use.
    6. Password Manager
      1. A password manager is a software application or service designed to store, manage, and organize passwords for various online accounts and services. Its primary purpose is to help users generate strong, unique passwords for each of their accounts and then securely store and retrieve those passwords as needed.
    7. Passphrase
      1. Unlike traditional passwords, which are typically shorter and consist of a combination of letters, numbers, and symbols, passphrases are longer and often composed of multiple words. Example of a passphrase: "1MountainBlueSkyRainyDay!"

 

Publication Tracking

Author Madl, Michael , Chief Information Security Officer
Revision Date: Mon, 08 Jan 2024 - ver.20 
Notes: Final Version - Approved by COO

 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Reference
  2. Tags
    1. IT-Security-Policy-Standard
    2. Official-Policy-Related