Security

Ask something
Discussion Locked

Passwords

0 helpful
3 replies

by james schroer

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

How do YOU handle passwords. We are looking at redoing the way we handle passwords and was wanting a little feed back from everyone else in the field. So if you could answer some of these questions and if you want to add more info that would be great. We are a law firm so we are a little different. We have Float Secretaries that need to work on different secured documnets on different days.

1. What is your policy on password retention? 90 days, 120 days?

2. How many times do they have to use a new password before they can use the one again. 3, 5, ?

3. What kind of combination do the have to have for a password? 5 letters 1 number, min 5 characters ?

4. What do you do about making sure the passwords are secure?

5.What do you do with Float Secretaries? Do they use the normal secretaries password, or do you set security equivalent rights?

6. Does the IS keep a password list in case that they have to work on the machines?

3 replies

by paulo540

The stringency of your password policy may depend on your exposure. With my computers that are connected to the Internet, I am rather careful about passwords. I change them at least every 30 days and never store them on the computer. The average length is 8-12 characters. With my non-connected computer, I am a bit more relaxed.
I may suggest that the systems manager/administrator, or whoever is responsible for services, be the only one with a list of passwords to the computers. He/she could then have them stored in an encrypted file where only select people know the decryption code.
A combination of letters, numbers, and symbols is the way I write passwords. Mixing CAPS and lowercase is good too. The less it resembles legible english,the harder it is to crack (to a point).
There are numerous password crackers (software)out there that you can use to test if your passwords are strong enough. Various Hacker websites should have downloadable versions.
Keep in mind, I am not an IT Pro or system admin, my security outline may not be the most appropriate solution. If anybody has amendments to my reply, I welcome them greatly.

by dbgirl

Our password policy is that a user is not to give their password to anyone, and that includes IS. The administrator password is what the IS department uses when they need to work on a machine. If a user gives their password to IS, then their password is reset and they have to come up with another one. This helps to discourage the sharing of passwords.

Our passwords are to be a minimum of 6 characters. They are not to be dictionary words, names, etc. Passwords are supposed to contain uppercase and lowercase letters and at least one number that is not at the beginning or end of the password. Special characters &,*,$,#, etc. are encouraged.

For the Float secretaries, we set equivalent rights. Policy also states that passwords areto be changed every 45 days, and are never to be reused. I personally think that never reusing a password is extreme in most (but not all) cases.

by vawns

Where I work, the retention is 90 days, if a user has not changed their password by then their account gets locked out. Once a password has been used it can't be used again and we encourage users to make up passwords in a mixture of upper case and lower case letters, numbers and symbols. I've used intranet notices and poster campaigns to enhance user awareness on the issue.

This discussion is closed to new replies.