Password legislation/rulings

[K.C.Leblanc]

Sorry to be so negative in my first post, the school were I used to work had some very vindictive staff. They also had no training policy so they had lots of staff who had 0 confidence in IT.

 

We had 90 day password changes with your last 6 passwords not permitted. We however had no restricton on how often you could change your password. Net result was some teachers when asked to change their password would then change it 6 times so they could change it back to te one they had before.

[Grommit]

typical username and password for a user

 

User Mark Bell

 

username 09MBELLI9F

password ntlznh4b

 

took about a month for kids and staff to get used to the new username password policy but its worked.

 

Its completely cut out the problems we had before i.e. kids loging on to other kids email accounts, loging on to network to delete work.

 

You are having a laugh...

[Michael]

I'm surprised some of you mentioned you have no password policies or no password at all. Staff generally have higher access rights/access to sensitive data and the school overall has a responsibility to protect this data.

 

Believe me, I've had my fair share of problems getting security to what I consider a reasonable standard. I think the key to it all, is firstly to make the Head and ICT Co. aware and to get them on your side. The ICT Co. should create and have policies in place that all staff should agree and adhere to.

 

Once you've got this far, the rest is easy as it's all enforced by GPO. I do think it's important to get an equal/fair balance of number of days a password is valid for, number of characters required, but also the history of passwords remembered. If you find people writing passwords down then I would say the password policy needs tweaking or staff need one to one support to give them a clearer understanding of the importance of network security.

[OverWorked]

Printed out on sticky labels so they can stick into their planners at the start of the year - not with their passwords on of course.

 

Now that's a good idea! I might try that.

[localzuk]

We don't currently have a password policy as such (ie, not a GPO one) but I believe something was started on a written one before I came. I'm not sure what happened with it though.

[elsiegee40]

We don't currently have a password policy as such (ie, not a GPO one) but I believe something was started on a written one before I came. I'm not sure what happened with it though.

 

So you don't requre passwords from anyone?

 

I think you have some sort of policy

[enjay]

We ask for 6+ characters mixed-case and alpha-numeric, which we force people to change every term. In general, this isn't a problem, although there are lots of forgotten passwords among Year 7 in the first week of each term.

 

IMHO, there isn't a "perfect" solution to password complexity, especially in such a mixed environment as a school. Too simple, and people will guess them / set obvious ones; too complex and people will write them down or type them so slowly that any fool could shoulder surf them. I do think that some form of complexity is essential though - before we started this policy, too many people had their husband/wife/child/cat's name as the password. We see less "borrowing" of accounts among students now, too.

 

Some people, when asked to change their password, are simply putting a "1" at the end, or swapping the order of the password (if, for example, the numbers relate to a significant date), but even that is better than nothing - it at least means that if their password becomes known to someone, they can only use it for a short while.

 

As for usernames, we use surname and the first 2 letters of the first name, e.g. jonesni, with email addresses building off that, e.g. [email protected]. This is the same for staff and students alike. This masks name, age and gender.