Skip to main content

IA-5 Authenticator Management

Description​

User authentication is a means to control who has access to university information resources. The confidentiality, integrity, and availability of information can be lost when access is gained by a non-authorized entity. This, in turn, may result in negative impacts such as loss of revenue, liability, loss of trust, or embarrassment to the university. This Control establishes procedures for the creation, distribution, safeguarding and termination of university user password authentication mechanisms.

Applicability​

  • The intended audiences are university employees who are required to ensure that password-based authentication procedures are followed (e.g., unit heads, information resource owners and custodians); and, those individuals who need to be aware of the procedures (e.g., non-technical university employees, staff, faculty, student, guest, or visitor). This Control also applies to any other entity that uses university information resources that require authentication

Implementation​

  • 1Passwords must be treated as confidential information:

    • 1.1If the confidentiality of a password is in doubt, the password shall be changed immediately.
    • 1.2Upon returning from international travel, the password shall be changed immediately.

  • 2Users must change default or assigned passwords where possible.

  • 3Users cannot use the same password for different accounts.

  • 4Passwords shall be protected both in storage and in transit.

    • 4.1When passwords are stored, they shall be encrypted using current Advanced Encryption Standard (AES) approved algorithms.
    • 4.2Passwords that must be transmitted shall be encrypted.
    • 4.3Temporary passwords that are transmitted for the sole purpose of establishing a new password or changing a password can be excepted from the requirement to encrypt provided it is a one-time transmission and the user must also change the password upon first logon.
    • 4.4Whenever possible, passwords should be stored as hashes instead of plain text passwords. Hashes should include current AES approved algorithms, be salted, and each salt should be varying across the account population.

  • 5Forgotten passwords shall not be reissued, but rather replaced with a new password.

  • 6If a user requests a password change, the identity of the user must be verified before the password is changed (see AC-2 Account Management):

    • 6.1The password must be changed to a temporary password; and

    • 6.2The user must change the temporary password at first logon (where applicable).

      Related Resource

      Password Recovery

  • 7Where possible, passwords that are user selected shall be checked by a password audit system, including complexity features, that adheres to the criteria in Section 10.

  • 8When automated password generation programs are utilized:

    • 8.1Non-predictable methods of generation must be employed;

    • 8.2Systems that auto-generate passwords for initial account establishment must, where possible, force a password change upon entry into the system; and

    • 8.3Wherever possible, password management and automated password generation systems must have the capability to maintain auditable transaction logs containing information such as:

      • 8.3.1Time and date of password change, expiration, and administrative reset;
      • 8.3.2Type of action performed; and
      • 8.3.3Source system (e.g. IP and/or MAC address) that originated the change request.

  • 9If a password has been compromised, the event shall be reported as a security incident in accordance with Texas A&M Information Security Control IR-6 Incident Reporting.

  • 10Complexity for passwords used for authentication must meet at least one of the following requirements:

    • 10.1The password is a randomly generated and must be generated by a password method approved by the university Chief Information Security Officer. These types of passwords are often used for machine-to-machine interactions. This type of password never expires.

    • 10.2The password is a passphrase of 16 characters or more. This type of password never expires and has no complexity requirements.

    • 10.3If an authentication mechanism is not configured to accommodate the standards stated in Section 10.1 or 10.2, then passwords must:

      • 10.3.1Be at least eight characters in length;
      • 10.3.2Contain three of the following four groups of characters: lower case letters, upper case letters, symbols or numbers;
      • 10.3.3May not contain anything that can be easily associated with the account owner, such as: username, SSN, UIN, given names or nicknames, birth date, telephone number, etc.;
      • 10.3.4May not be a single dictionary word or an acronym regardless of language of origin; and
      • 10.3.5May not be a repetitive sequence.

  • 11Maintain a list of commonly-used, expected, or compromised passwords and update the list periodically and when organizational passwords are suspected to have been compromised directly or indirectly; and

    • 11.1Verify, when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords on the list.