September 5, 2007
Some recent events involving user credentials (NetworkID and password use) on campus highlight the need to faculty, students, and staff to change network passwords on a frequent basis. The higher frequency of password changes reduces the probability that an unauthorized user can compromise your password via guessing. Case currently does not require an enterprise-wide password change window, although individual departments do have more stringent requirements (here is the policy for the IT Services).
For students, we recommend you change your passwords once every semester. If your personal computer was involved in a security event (e.g. theft, or you were a victim of malware or a bot), you must change your Case and local passwords immediately after the clean up has been completed because often infections are loaded with keystroke loggers.
You can use the Case Password Utility to check the age of your password. Keep it less than 180 days old as a benchmark. If you need to change, follow this link to the password change utility.
Here is what can happen when somebody else knows your password:
- they can access any Case LDAP-enabled service, such as your personal email, calendar, MyCase Portal, Software Center, Wiki, Blog, Filer, Forum, etc.
- if you are student employee, they can access your personal information, change your bank deposit, etc.
- they might register a computer in your name.
Remember, everything done with your Case NeworkID and Password is attributed to you. Individuals are held responsible for actions taken with their credentials and are therefore responsible for protecting them from disclosure.
Okay, what about all the other passwords you need to keep handy, such as Facebook, Yahoo, or Monster.com (for you seniors)? Try PasswordSafe. Case has a Wiki for the use of PasswordSafe.
Posted by Thomas Siu at 11:32 AM
