Purpose
The purpose of this guideline is to establish a standard for account use and creation of strong passwords which adheres to CSU policy and conforms to NIST Level of Assurance 2 requirements.
User Account Usage, Deletion, Suspension or Termination
Accounts assigned to employees are subject to deletion immediately upon termination of employment unless prior arrangements have been made and approved by the former employee’s supervisor.
Accounts assigned to students are subject to deletion one hundred eighty days after graduation or withdrawal from the University unless specific arrangements have been made and approved by the Office of Student Affairs.
Assigned accounts may be suspended (i.e., inaccessible to the user) immediately and temporarily under three circumstances:
- Upon recommendation of the appropriate judicial body in writing or email sent to the Vice President of Information Technology or Information Security Officer;
- When Information Technology staff responsible for systems management have credible evidence that continued use of an account constitutes a threat to the integrity, security, or functionality of computing systems, or to protect the University from liability. Every reasonable effort will be made to notify the Vice President of Information Technology as soon as possible of any such suspension.
- When the account is inactive for 180 (one hundred and eighty) days or more.
Assigned accounts may be terminated immediately and permanently upon the recommendation of the appropriate judicial body in writing or email sent to the Vice President of Information Technology. An individual whose assigned account has been permanently terminated may not seek to have a new account assigned to them without approval of the appropriate judicial body.
Use of shared accounts is not allowed. However, in some situations, a provision to support the functionality of a process, system, device (such as servers, switchers or routers) or application may be made (e.g., management of file shares). Such exceptions will require documentation which justifies the need for a shared account; a copy of the documentation will be shared with the Information Security Office.
Each shared account must have a designated owner who is responsible for the management of access to that account. The owner is also responsible for the above mentioned documentation, which should include a list of individuals who have access to the shared account. The documentation must be available upon request for an audit or a security assessment.
Password Creation, Maintenance and Configuration
Based on security best practices and audit requirements the campus password expiration, in the administrative domains, will be based on forced password changes occurring every year in February, May and September respectively. Additionally, the default domain password policy will be set to enforce password changes every 180 days to assure all passwords meet this expiration requirement.
- All system-level (non-service accounts) passwords (e.g., root, enable, NT admin, application administration accounts, etc.) must be changed on at least a quarterly basis.
- Service accounts set to never expire must be approved by the Information Security Officer.
- Changed passwords are remembered 24 times and cannot be re-used.
- Minimum password length is 12 characters.
- Maximum password length is 20 characters.
- Password must meet complexity requirements.
- Password must contain at least 3 of the following 4 character types:
- a lower case letter ( a b c d ...)
- an upper case letter ( A B C D ...)
- number (0 1 2 3 4 5 6 7 8 9 )
- a special character ( = + * $ ? ) ( ! , . @ )
- Account lockout duration is 60 minutes.
- Account lockout threshold is 20 invalid login attempts.
- Passwords must not be inserted into email messages or other forms of electronic communication, with the exception of initial One Time Passwords (OTP).
- All user-level and system-level passwords must conform to the guidelines described below.
