ÌÇÐÄvlog¾«Æ·

Acceptable Password and Passphrase Procedure

Approver:
Academic Coordinating Committee
Policy Owner:
Vice President, Information Technology & Systems
Policy Lead(s):
Manager, IT & Systems Budget, Assets & Reporting
Defining policy:
Technology Governance Policy
Effective date:
2024-11-20
Date of last approval:
2024-11-20
Status:
Approved

Procedure Statement

This procedure outlines the use of passwords and passphrases for technology at the ÌÇÐÄvlog¾«Æ· Institute of Technology and Advanced Learning (Conestoga). Conestoga uses passwords and/or passphrases where applicable to provide authentication services to technology.

Definitions

ÌÇÐÄvlog¾«Æ· maintains a glossary of terms specific to the institution. The ones in use for this document are defined below.

Cellular Device
Any electronic device that can connect to a cellular network using the mobile service provider’s SIM card installed within it.
Conestoga Business
Activities performed for business and operations purposes on behalf of Conestoga including academic, administrative and research activities and purposes.
Contractor
Any person or entity contracted by Conestoga to provide goods or services on Conestoga-owned or leased property or at Conestoga coordinated off-site programs, functions, or events. A contractor shall be considered an employer and meet or exceed Conestoga’s health and safety management system requirements unless otherwise determined to be a constructor.
Data
Individual symbols or pictures that represent raw facts or figures, which on their own do not comprise meaning and have no discernible arrangement. It can be processed by a computer, computer system or application.
Employee
An individual employed by the College, whether employed full-time, part-time, or on a contract basis, and includes, but is not limited to, faculty, researchers, support staff and administrators.
Guest
An individual who is not an employee, contractor, or student and is external to Conestoga, which includes, but is not limited to, Board members, visitors, alumni, and volunteers.
Information
Data that has been given value or meaning through interpretation or analysis and that has been organized to create meaning.
Mobile Device
Any communication device that does not require a physical wire to relay information from one device to another. It is designed or architected product that is able to be moved easily and used at a variety of locations.
Multifactor Authentication (MFA)
Authentication using two or more different factors to achieve authentication. Factors include something you know (e.g., PIN, password), something you have (e.g., cryptographic identification device, token), or something you are (e.g., biometric). MFA is generally considered secondary authentication in addition to a primary authentication method.
Passphrase
A secret consisting of a sequence of words or other characters to authenticate an identity or to authorize access to data. A passphrase is like a password in usage but is generally longer for added security.
Password
A protected/private string of letters, numbers, and/or special characters used to authenticate an identity or to authorize access to data.
Technology
Any computing and/or communications hardware and/or software components and related resources that can collect, store, process, maintain, share, transmit, or dispose of data or information. Components can include, but are not limited to, computers and associated peripheral devices, computer operating systems, utility/support software, accounts, and communications hardware and software.
Technology Resource
Any hardware, software, or communication equipment that a user interacts with for data or information management. This includes but is not limited to computers, mobile devices, cellular devices, applications, user accounts, wired and wireless network services that a user uses for tasks such as creating documents, sending messages, or retrieving data or information from repositories. These resources are owned, leased or in the care, custody, or control of Conestoga.
Technology User
An individual or entity that uses technological tools, devices, or systems for various information and data tasks, which includes, but is not limited to, guests, contractors, students, and employees. These users are authorized to use technology resources owned, leased or in the care, custody, or control of Conestoga with proper authentication and/or identification.

Responsibilities

Technology Users 

All technology users are responsible for safeguarding their password/passphrase and to not share or publicize it. It is the responsibility of the technology user to adhere to all requirements of this procedure, all Conestoga policies, and procedures. 

Cyber Security 

The Cyber Security team is responsible for ensuring the security of technology resources via the implementation of technical solutions to identify compromised passwords or passphrases, protect passwords or passphrases, remediating technology resources with weak or compromised passwords or passphrases, and providing instructions on setting strong passwords or passphrases.

Procedure

  1. In all cases where a password or passphrase is used for authentication, the following standards must be adhered to. 
    1. Each technology user will have a unique password or passphrase for each technology resource and will not reuse a password or passphrase across multiple technology resources. 
    2. The required minimums for passwords or passphrases are in the Password/Passphrase Technical Standards document. Information and guidance is available on the IT and S password page. 
    3. Passwords or passphrases will become expired after a set timeframe as defined in the Password/Passphrase Technical Standards document. 
      1. An exception to this is if a password or passphrase has been flagged for compromise or identified in a known leak. In these instances, a password or passphrase would be forced to be reset at that time. 
    4. No technology user shall request a reset of another technology user’s password or passphrase under any circumstance, nor shall passwords or passphrases be shared among any technology users. A technology user's identity will be confirmed before a reset will be completed. 
    5. Multifactor authentication will be enforced and used for multiple layers of authentication. The most secure form of multifactor authentication will be used. 1.4.If and when a technology user knows or suspects their password and/or passphrase has been compromised, they must immediately contact the IT and S department via one of the contact methods listed on the IT Service Desk page. 

Revision Log

‸¾²¹³Ù±ð

‸¾±ð³Ù²¹¾±±ô²õ

​2024-03-13​1.0 draft created for policy review
​2024-11-20​Academic Coordinating Committee approval

Acceptable Password and Passphrase Procedure