Strong Passwords

1
Strong Passwords Network Security

• Kenn McDermottAdministrative ManagerFacilities
  Planning Construction Dept.
• in association with
• Gary RichardsonNetwork AdministratorBusiness
  Management Services Dept.

2
Our Situation

• Facilities Management has over 450 computers on
  the FM Domain of the Facilities Management
  Network, which is connected to the University of
  Virginia network, which is connected to the
  Commercial Internet
• Access to any FM computer may allow access to all
  FM files, documents and data as well as other
  UVA computers

3
Is There Any Legal Liability?

• The Federal Trade Commission recently showed
  there are legal consequences for organizations
  that have weak security. Expect a surge of
  security audits, demand for better training for
  system administrators and application developers,
  and a quest for "minimum standards of due care"
  in security.

4
But What About Here At UVA?

• Losses resulting from security breaches can mean
  lost revenue to the University and additional
  costs associated with lost productive/billable
  time, clean-up, loss of data, liability and loss
  of faculty/staff/student confidence.

5
So How Does That Affect Me?

• University policy states that all employees are
  responsible for protecting University records
• Personnel records, health records, student
  educational records, financial records,
  contracts, etc., generally must be safeguarded

6
What Can Happen?

• One Friday an intruder broke into a workstation
  in Clark Hall and ran a "sniffer" program that
  intercepted all network traffic in Clark Hall.
  The sniffer was not discovered and shut down
  until 3 weeks later. All passwords were
  considered compromised for anyone who used a
  computer in Clark OR connected via network to any
  computer in Clark
• DONT FORGET - Your Login ID password are the
  equivalent of your electronic identity

7
How Did We Get To This Point?

• Early academic computer networks did not focus on
  security as a primary issue
• Our FM network was relatively small and required
  little data security
• The network grew in size along with the Internet
  becoming a worldwide phenomenon which increased
  the associated risks

8
Were Upgrading Computers

• Because Microsofts Windows Operating Systems
  called Windows 2000 and the newer Windows XP
  are much more secure we are in the process of
  upgrading all Windows 95 and Windows 98 machines.
• We have about 150 on WIN2K
• All new PCs rebuilds will be WINXP

9
So What Do We Do Now?

• One critical element of computer and network
  security is the login password
• At Facilities Management your Login password
  grants you access to our FM Domain.
• CTL-ALT-DEL (for WIN2K XP)
• Login Name Password - Domain

10
(No Transcript)
11
FM Password Construction

• Password must be at least six (6) characters long
• Passwords may not contain your user name or any
  part of your full name

12
FM Password Construction (Cont.)

• Password must contain characters from at least
  three of the following four classes
• Upper case letters
• Lower case letters
• Numerical
• Non-alphanumeric characters (Special characters)
  like ! ?

13
Sample Strong Password

• Using part of a song lyric which goes like this
• I wont dance, cant make me
• Take the first letter and make it a capital
• Use the remaining letters as lower case
• Finish it off with an exclamation mark
• Result Iwdcme! OR Iwd,cme

14
Sequence of Change Screens

• Login using old password as normal
• Click OK on screen advising you to change your
  password
• Type in your new password
• Type in your new password again
• Click OK on screen announcing that your password
  was changed

15
(No Transcript)
16
(No Transcript)
17
(No Transcript)
18
(No Transcript)
19
Caution !!

• Although you may want to write down your new
  strong password initially to make sure you enter
  it correctly DONT SAVE IT
• Memorize your new strong password using the
  phrase, slogan or saying you came up with to
  create the password

20
Summary

• Strong Passwords are an important security
  element for safe computing will be implemented
  between July 14Aug 11
• An e-mail to ALL FM has been published with
  instructions and the schedule
• A web page will be available for reference
• An announcement will be taped to your computer
  monitor on change day