Password Policy Article Index for
Password 		Website Links For
Password 		 

Information About

Password Policy
  CATEGORIES ABOUT PASSWORD POLICY
   
authentication methods
   
APPAREL
BABY
BEAUTY
BOOKS
CAR TOYS
CELL PHONES
DVD'S
ELECTRONICS
GOURMET FOOD
GROCERIES
HEALTH & PERSONAL
HOME & GARDEN
JEWELRY
MUSIC
MUSIC INSTRUMENTS
OFFICE PRODUCTS
SOFTWARE
SPORTING GOODS
TOOLS & HARDWARE
TOYS
VIDEO GAMES
SHOPPING HOME
MORE SHOPPING...



Typical components of a password policy include:


PASSWORD LENGTH

Many policies require a minimum password length, typically 6 or 8 characters. Some systems impose a maximum length for compatibility with Legacy System s.


PASSWORD FORMATION

Some policies suggest or impose requirements on what type of password a user can choose, such as:
  • the use of both upper- and lower-case letters (case sensitivity)

  • inclusion of one or more numerical digits

  • inclusion of special characters

  • prohibition of words found in a dictionary or crackers list

  • prohibition of passwords that are valid calendar dates or License Plate numbers


As of October 2005 , employees of The UK Government are advised to use passwords of the following form: consonant, vowel, consonant, consonant, vowel, consonant, number, number (for example ''pinray45''). This form is called an Environ password and is case-insensitive.

Other systems create the password for the users or let the user select one of a limited number of displayed choices.


PASSWORD DURATION

Some policies require users to change passwords periodically, e.g. every 90 or 180 days. Systems that implement such policies sometimes prevent users from picking a password too close to a previous selection.


PASSWORD HYGIENE

Password policies often include advice on proper password management such as:
  • never sharing a computer account

  • never using the same password for more than one account

  • never telling a password to anyone, including people who claim to be from customer service or security

  • never writing down a password

  • never communicating a password by telephone, e-mail or instant messaging

  • being careful to log off before leaving a computer unattended

  • changing passwords whenever there is suspicion they may have been compromised



SANCTIONS

Password policies may include progressive sanctions beginning with warnings and ending with possible loss of computer privileges or job termination. Where confidentiality is mandated by law, e.g. with Classified Information , a violation of password policy could be a criminal offense. Some consider a convincing explanation of the importance of security to be more effective than threats of sanctions.


SECURITY CONSIDERATIONS

The level of password strength required depends, in part, on how easy it is for an attacker to submit multiple guesses. Some systems limit the number of times a user can enter an incorrect password before some delay is imposed or the account is frozen. At the other extreme, some systems make available a , Password Length Equation . Stricter requirement are also appropriate for accounts with higher privileges, such as root or system administrator accounts.

Password policies are usually a tradeoff between theoretical security and the practicalities of human behavior. For example:
  • Requiring excessively complex passwords and forcing them to be changed frequently can cause users to write passwords down in places that are easy for an intruder to find, such as a Rolodex or Post-it Note near the computer.


  • Users often have dozens of passwords to manage. It may be more realistic to recommend a single password be used for all low security applications, such as reading on-line newspapers and accessing entertainment web sites.


  • similarly, demanding that users never write down their passwords may be unrealistic and lead users to choose weak ones. An alternative is to suggest keeping written password in a secure place, such as a Safe or an encrypted master file.


  • Inclusion of special characters can be a problem if a user has to Logon a computer in a different country. Some special characters may be difficult or impossible to find on keyboards designed for another language.



Other approaches are available that are generally considered to be more secure than simple passwords. These include use of a Security Token or One-time Password system, such as S/Key . Programs like SSH allow remote access without exposing user passwords.


SEE ALSO



EXTERNAL LINKS