Strong Password Requirement

PDF Version for Print

  • Policy Statement

    Password Use

    1. Passwords are to be treated as sensitive and confidential information:
      1. Avoid writing your passwords down - including in emails, printed, and electronic forms.
      2. Avoid hinting at the format of your passwords (i.e., "it uses by family name").
      3. Avoid mentioning your passwords where they may be overheard by others. 
      4. Be aware of your surroundings when typing your password.
      5. Do not save your passwords onto a plain text file.
      6. Do not share your passwords with anyone - including IT staff, supervisors, administrative assistants, colleagues, friends, and family members.

    Note: IT staff will never ask for your password. If someone does ask for your password, report it to the Chief Information Security Officer.

    1. Create unique passwords for each of your accounts and websites.

    Note: Password managers such as LastPass, Dashlane, KeePass, and others can help you generate unique and strong passwords. A password manager that automatically fills your login information on a website could help you identify phishing and fake websites when the login information is not automatically populated. Also, if you use a password manager, use a strong passphrase to protect all your passwords. Finally, enable two-factor authentication when offered by the password manager or website.

    1. Enable the use of passwords on desktops, as well as mobile devices such as tablets, smart phones, and laptops.
    2. If someone demands to know your password, refer them to this document or have them contact the Chief Information Security Officer. 
    3. If you suspect that your password has been compromised, report it to the Chief Information Security Officer and change the password immediately.
    4. Avoid reusing passwords or portions of a passphrase of a compromised account.

    Password Creation

    1. ETSU systems automatically enforce the use of complex passwords, require passwords to be changes on a periodic basis, prevent users from re-using passwords, and implement and enforce various other password controls that may make it more challenging to select a complex and easy to remember password.

    Use the following tips to create a password that is easy to remember, hard to guess, and compliant with ETSU requirements:

      1. Use a passphrase, or multiple words as the basis for a strong password.
      2. Use character substitution for the first letter of each word:
        1. I Like This Policy may become 1L1k3Th1$P0l1cy
        2. I Already Know How To Create Strong Passwords may become iAkH2CsP
      3. Start, end or add special characters, i.e. 1L1k3Th1$P0l1cy!
      4. Add some numbers if needed, i.e. 1L1k3Th1$2017P0l1cy!
      5. The <space>, <dash>, <underline>, or any other special character can be used to separate words in passphrases and add complexity, i.e.:
        1. D0 Y0u Hav3 Ch@ng3 4$5?
        2. Y0u_L00k_@_8it_:-(">Y0u_L00k_@_8it_:-(
        3. --->My-S3cr3t-H3r3!<---
    2. Avoid using the following in passwords or passphrases:
      1. Demographic information.
      2. Dictionary words or common word misspelling.
      3. Computer names, account information, or sample passwords.
      4. Phone, social security, credit card, identification, or other financial numbers.
      5. Common and notable phrases, i.e. "to be or not to be", "E=mc2", etc.
    3. Avoid using personal information in password reset questionnaires and password hints whenever possible. They could be easily found on social media or public records.
    4. Attempting to collect, guess, crack, or obtain someone else's password is a violation of University policies.
    5. Sharing ETSU passwords and login information is also a violation of University policy policies.

    This policy applies to ETSU passwords used to log onto campus Windows workstations, Desire2Learn, ETSU email, Sherrod Library Services, and any other services that use ETSU authentication. It is good practice to extend these practices to safeguard personal accounts. Requests for assistance can be directed to the ITS Help Desk at itshelp@etsu.edu or 423-439-4648.

  • Responsible Office
    Information Technology Services
  • History

    Effective Date: February 2017

    Revised Effective Date: March 24, 2017

  • Related Links
    N/A

Share