02-16-16-WS - Laserfiche WebLink

Home Browse Search

Alk)EN HILLS Password Policy February 29,2016 PURPOSE: To set a standard for creating,protecting,and changing passwords such that they are strong,secure,and protected. BACKROUND: Passwords are a critical part of information and network security. Passwords serve to protect user accounts, but a password, if compromised, could put the entire network at risk of unauthorized access and loss of electronic data. As a result, all employees are required to take appropriate steps to ensure that they create strong, secure passwords and keep them safeguarded at all times. SCOPE OF THE POLICY This policy applies to all employees, volunteers or contractors of the City who have or are responsible for a computer account, or any form of access that supports or requires a password on any system that resides at any City facility,has access to the City network,or stores any non-public City information. POLICY General 1. Passwords must be changed every 90 days. 2. Passwords must be unique from the past 10 passwords(you cannot use the same password as before). 3. Users will be notified by system prompts two weeks in advance of password expiration date. At this time, users will be prompted to select a new password. Password Construction Guidelines Passwords are used to access any number of City information systems,including the network,database applications, email,and the Internet. Poorly designed passwords are easily cracked, and put the entire system at risk. Therefore, strong passwords are necessary to protect the integrity of the network data. Try to create a password that is also easy to remember. 1. Passwords should not be based on well-known or easily accessible personal information. 2. Passwords must contain at least 8 characters. A strong password would contain the following: Contain characters from three of the following four categories: English uppercase characters(A through Z) English lowercase characters(a through z) Base 10 digits(0 through 9) Non-alphabetic characters(for example, !,$,#, %) Complexity requirements are enforced when passwords are changed or created. 3. Passwords must not be based on an users' personal information or that of his or her friends, family members, or pets. Personal information includes logon I.D.,name,birthday,address,phone number,social security number,or any permutations thereof. 4. Passwords must not be words that can be found in a standard dictionary (English or foreign) or are publicly known slang or jargon. 5. Passwords must not be based on publicly known fictional characters from books,films,and so on. 6. Passwords must not be based on the company's name or geographical location. Password Protection Guidelines