Password management
In case of a discrepancy between this translation and the Swedish announcement, the Swedish version takes precedent.
1 Introduction
This document specifies Uppsala University's procedures for the quality and handling of passwords, in accordance with the Swedish Academic Identity Federation’s (SWAMID) assurance profile and password policy¹.
The purpose of the procedures is to support the secure handling of passwords at the university, personal as well as system-managed, in order to protect the university's information in various systems from unauthorized users.
The procedures apply to all IT systems and services at the university and include both password quality and password protection. They are based on the university's Procedures For Information security (UFV 2017/93) and the Procedures For Risk Management (UFV 2018/211).
2 Definitions
Information system
Includes applications, services, storage solutions, cloud services or other components that manage and process information/data. The term also includes networks and infrastructure.
Joint Web Login
Joint Web Login is a central authentication service for access to all the web services at Uppsala university. This solution enables the use of the same login credentials for access to many different web services. Joint Web login provides a higher level of security since users only supply their login credentials to the Joint Web Login and not to all web services. Web services that use Joint Web Login only have access to selected personally identifiable information.
Multi-factor authentication (MFA)
Is a method used to confirm a user’s identity with two or more factors in several steps, giving a higher security than solely relying on a password. The factors consist of something owned (card, cell phone), something known (password, PIN code), and something personal (biometry, like fingerprints).
3 Scope
3.1 For system managers
IT systems in general
• All system must be linked to the joint web login, unless there are special reasons. Such reasons must be documented. The joint web login contains system support for compliance with the procedures.
• In case of systems using their own password management, the system owner is responsible for compliance.
• Systems not connected to the joint web login must store any passwords using a secure one way encryption (SHA2) format, to ensure that any leaked information cannot be used by a third party.
• In regards to outsourcing or cloud services, requirements for secure password management must be included in the procurement procedure and regulated in agreements.
Password quality
A high quality password is long and complex enough to reduce the risk of an intruder being able to guess it.
Length and complexity together form the so-called entropy for the password. The higher the entropy of a password, the more difficult and time consuming it is to guess or test. For more information, see NIST SP 800-63.²
In order for a password to be of high quality, it needs to be at least 10 characters – of which at least one must be a capital (uppercase) letter, one a lowercase letter, and at least one special character or a number.
Password control
The university's Joint Web Login provides technical support to ensure a high password quality. At any password change, the passwords are checked to ensure they
• are composed according to the requirements above,
• inte not found in any catalogs of poor quality passwords (such as number combinations, proper names, seasons, car brands, etc),
• are not the same as, nor too similar to, any immediately preceding password.
When the user enters the suggested new password, the quality of the password is displayed according to a color scale;
• Red – does not meet the minimum requirement,
• Yellow – meets the minimum requirement,
• Green – exceeds the minimum requirement.
Passwords cannot be saved until the minimum requirements are met.
Password protection
Secure password management means that the login service protexts passwords from unautorized access and use. In addition to this, each user is responsible for keeping their own passwords secret and secure.
Data storage and password transportation
- To reduce the risk of unauthorized access to passwords, the following applies to the storage and transport of passwords:
Passwords must never be communicated via e-mail, telephone or similar. - Electronic storage and transport:
- Passwords must always be stored and transported in encrypted form, even on backup media
- Passwords should never be presented in readble form
- Personnel with technical access to computers, server or data media where passwords are stored (so-called privileged permissions) must sign särskilda ansvarsförbindelser.
- An up-to-date list of employees with privileged access must be available where the Daily system operations are managed, managed, which in most cases is the University IT Services (UIT).
Protection against password guessing attacks (Brute Force Attacks)
To reduce the risk of automated guessing attacks, the login must be protected by restrictions that prevent someone from making a large number of repeated login attempts (password guesses) in a short time span, so-called rate limiting.
The University Joint Web Login has a designed protection so that only a certain number of attempts can be done in an hours, then the account will be locked out automatically for a specified number of minutes.
Password guessing attacks are classified as either brute force attacks or dictionary attacks.
3.2 Exceptions
There might, in some individual systems, be special reasons not to follow the above procedures for password quality or password protection. If so, exceptions can be approved by the system owner.
Exceptions must be documentet in the system’s management specifications. In addition, special consideration must be given when accessing data retrieved from other systems.
Notes
- https://wiki.sunet.se/display/SWAMID/SWAMID+Policy, 2021-02-26
- https://www.nist.gov/itl/tig/projects/special-publication-800-63, 2018-08-01