Password Security
A
good password is
one that cannot be easily guessed.
How scoring works: Your password will be checked for complexity against the
guidelines below (See Suggestions). In addition, your password will also be checked
against a hacking dictionary containing commonly used passwords and keystroke
combinations.
Please note that although we will not store the password you enter, it's never a good idea to send your password to someone you don't know. Instead, we recommend testing a password which is *similar* to one you might use.
All
users of information resources are responsible for assisting in the protection of the
systems they use. Many intruders enter systems simply by guessing passwords and even the
best passwords can eventually be defeated mathematically, given enough time. The use of
strong passwords acts as a firm deterrent against password guessing attacks, and buys
additional time against other attacks.
| DO’S |
DONT’S
|
- DO
use a password with mixed-case letters. Use uppercase letters throughout the password.
|
|
- DO
use a password that contains alphanumeric characters and include punctuation, where
supported by the operating system.
|
- DO
NOT use your first, middle or last name or anyone else’s in any form. Do not use your
initials or any nicknames you may have or anyone else’s.
|
- DO
use a password with mixed-case letters. Do not just capitalize the first letter, but add
uppercase letters throughout the password.
|
- DO
NOT use a word contained in English or foreign dictionaries, spelling lists, or other word
lists and abbreviations.
|
- DO
use at least six characters, eight characters for Windows NT.
|
- DO
NOT use other information easily obtained about you. This includes pet names, license
plate numbers, telephone numbers, identification numbers, the brand of your automobile,
the name of the street you live on, and so on. Such passwords are very easily guessed by
someone who knows the user.
|
- DO
use a seemingly random selection of letters and numbers.
|
- DO
NOT use a password of all numbers, or a password composed of alphabet characters. Mix
numbers and letters.
|
- DO
use a password that can be typed quickly, without having to look at the keyboard. This
makes it harder for someone to steal your password by looking at your keyboard (also known
as "shoulder surfing").
|
- DO
NOT use dates e.g., September, SEPT1999 or any combination thereof.
|
- DO
change passwords regularly. The more critical an account to network integrity (such as
root on a Unix host or Administrator on Windows NT), the more frequently the password
should be changed. This change stops someone who has already compromised an account from
continued access.
|
- DO
NOT use keyboard sequences, e.g., qwerty.
|
|
- DO
NOT use a sample password, no matter how good, that you’ve gotten from a book that
discusses information and computer security.
|
|
- DO
NOT use any of the above things spelled backwards, or in caps, or otherwise disguised.
|
|
- DO
NOT write a password on sticky notes, desk blotters, calendars, or store it online where
it can be accessed by others.
|
|
- DO
NOT use shared accounts. Accountability for group access is extremely difficult.
|
|
- DO
NOT reveal a password to anyone.
|
|
SUGGESTIONS
Common
suggestions for constructing seemingly random passwords are:
1. Use
the first letter of each word from a line in a book, song, or poem. For example: "Who
ya gonna call? Ghost Busters!" would produce "Wygc?GB!”
2. Use
the output from a random password generator. Select a random string that can be pronounced
and is easy to remember. For example, the random string "adazac123" can be
pronounced a-da-zac, and you can remember it by thinking of it as "A-to-Z,1 through
3." Add uppercase letters to create your own emphasis, e.g., aDAzac.2
3. Use
two short words connected by punctuation, e.g., T1me#0ff
4. Use
numbers and letters to create an imaginary vanity license plate password, e.g., 1H8work!
A
common theme of these suggestions is that the password should be easy to remember. Avoid
passwords that must be written down to be remembered. If unrecallable, someone in your
office may find the password you have written down, and compromise your network identity.
|
