Password Management Policy -IT006

Introduction

Passwords are important aspect of computer security; they constitute the front line of protection for user accounts. A poorly chosen password may result in compromising the security of Alfaisal entire computer networks. As such, all Alfaisal users (faculties, staff, students, contractors, and visitors) are responsible for taking the appropriate steps, as outlined below, to select and manage their passwords.

Password Management Policy

• All users are required to change their password after the receipt of their account details from ITS.
• All users will be required to change their passwords periodically or at least every two months.
• Passwords are case sensitive.
• All user-level and system-level passwords must conform to the guidelines described below.
• In case a password is forgotten, then the user shall contact IT Services to reset the password.

Policy Guidelines

Strong Password Characteristics:

• Must be at least eight alphanumeric characters in length
• Contains Upper Case (A-Z), Lower Case (a – z) Numeric (0 – 9) & Special Characters (?, !, @, #, %, etc.)
• Should NOT be a word found in a dictionary (English or foreign).
• Should NOT have common usage word such as: Names of family, pets, friends,
• Should NOT have Birthdays and other personal information such as addresses and phone numbers.
• Should NOT be a word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, abc123 etc.
• Should NOT be any of the above spelled backwards.

Protecting Passwords:

• Choose a password that is memorable.
• Try to avoid writing down passwords and under no circumstances leave a password in a place readily accessible to others.
• A user should not give password to other users. ITS will never ask for your password to complete a support query or other tasks. The only person who needs to know a user password is the user him-or-herself.
• The user should take care when entering the password to prevent others from seeing what was typed.
• Users should not enter their passwords into computers or websites unless they are sure that it is a university related system/website.
• Don't reveal a password directly or indirectly to ANYONE.
• Don't reveal a password on questionnaires or security forms.
• Don't reveal a password to co-workers while on vacation.
• If someone demands a password, refer them to this document or have them to contact IT Services
• Do not store the passwords in a file on any computer system (including PDA, Mobile phones, or similar devices) without encryption.
• If an account or password is suspected to have been compromised, change the password immediately

Exemptions

Exception to or exemptions deviating from any provision of this policy must be approved by the VP for Finance & Administration. Similarly, any questions about the contents of this policy, or the applicability of this policy to a particular situation should be referred to the IT Director.

Enforcement

Any employee found to have violated this policy may be subject to disciplinary action as per the University code of conduct.

Definitions

Alfaisal User Password: Any computer user with user identification name that have access to Alfaisal computer facilities in or off campus. This covers permanent and temporary Faculties, Staff, Visitors, Guests, Contractors, Vendors, or any Third parties.

Policy Password: A password policy is a set of rules designed to enhance computer security.

Password: A password is a secret word or string of characters that is used for user authentication.

PDA: Personal Digital Assistant.

Encryption: Encryption is the process of converting computer data into a form that cannot be easily understood by unauthorized people.

User Identification Name (ID): Is the unique name you use to identify a User, it can be any sequence of characters.