1 / 10

NID Password Change Frequency

NID Password Change Frequency. PIC Submission dated 7/10/13. University Audit and Finance & Accounting Tax. Summary. As UCF implements shibboleth, the need for different log-ins and passwords will be reduced.

ajay
Download Presentation

NID Password Change Frequency

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. NID Password Change Frequency PIC Submission dated 7/10/13 University Audit and Finance & Accounting Tax

  2. Summary • As UCF implements shibboleth, the need for different log-ins and passwords will be reduced. • The myUCF Federated Identity login system has allowed for ARGIS, PARIS, AURORA, TERA, COI and interlibrary loan to be accessed via a single-sign in. • UCF uses best-practices for its password requirements.

  3. Reason for Password Changes • to reduce the risk that passwords may be discovered by unauthorized users who may gain access to the University’s critical information. • The risk increases with the length of time between password changes

  4. Basis for the 60 Day Interval • UCF Policy 4-008 Data Classification and Protection requires “passwords on systems holding confidential data must be changed every 60 days or less” • CS&T University Standards 501-101 Password Standards recommends that systems “observe these requirements via technical controls (e.g. password expiration controls) so that all university affiliated account passwords follow this policy.”

  5. Basis for the 60 Day Interval • In a State Audit of CS&T completed in 2011, the Auditor General recommended  the 60 day frequency for “general user accounts for critical or sensitive applications”.

  6. Regulatory Requirements • Federal regulations (HIPPA Security Rule/ HiTech Act Section 164.308 (a)(5)(ii)(D) ) require only that passwords be changed and do not stipulate an interval. • Board of Governors Regulation 3.0075 Security of Data and Related Information Technology Resources, (3) states “the university’s security plan should be “based on best practices acquired from resources such as: Educause, National Institute of Standards (NIST), Information Systems Audit and Control Association (ISACA) or other recognized sources of information security practices and procedures.”

  7. Industry Best Practices • NIST Standards / FISMA Provision Section 15.1.6 suggests that passwords are changed at least every ninety days. • ISO 17799_2005 Standards Section 11.3.1 Password Use, also only suggest that passwords be changed at regular intervals, and avoid re-using or cycling old passwords.

  8. Impact of Single Sign On • The CS&T university wide initiative toward a single login credential using Shibboleth Federated Identity software allows users to sign in to the portal and transfer to other applications without having to sign in again. • The progression of this initiative will help to mitigate inefficiencies associated with more restrictive password change frequency requirements.

  9. Summation • The current password change frequency is set at a 60 day interval to comply with an Auditor General recommendation, reduce risk of unauthorized users, and follow best practice.

  10. Action Plan • To address community concerns, CS&T could clarify purpose for password changes and associated risk in university standards documentation.

More Related