[ISN] Password rule change tightens account security

[InfoSec News]

http://www.spectatornews.com/media/paper218/news/2005/09/26/CampusNews/Password.Rule.Change.Tightens.Account.Security-998087.shtml

By Nathaniel Shuda
September 26, 2005 

With technology constantly evolving, regulating access to 
computer-related systems and services with passwords has become 
widespread.

But if a person use a simple password, it could be very easy for 
someone to hack into his or her system, especially with the use of 
special programming software designed to seek out patterns in 
passwords, said Chip Eckardt of Learning and Technology Services. 

It is for this reason that LTS, along with the university, will 
require students and faculty to change their passwords to fit criteria 
that will make their accounts less susceptible to intrusion. The 
switch will begin Nov. 1.

More hackers are surfacing all the time, and accounts already have 
been compromised in several cases because of easy access to computer 
accounts, Eckardt said.

"We've even had Mac boxes get hacked," he said. "That's been real 
unusual because ... when you have something like Windows, (which) 
everybody goes after, it's a common target. But we're even seeing 
attacks in areas where we've never saw them before."

The LTS office plans to send three reminder messages via e-mail to 
warn users of the change: one informing all university computer users 
of the change, as well as reminders 10 and three days before current 
passwords expire.

Users who recently have changed their passwords will not have to 
perform the switch until their new passwords expire in a year, Eckardt 
said.

Those who do not change their password by the time it expires will be 
prompted the next time they log in and won't be allowed to connect to 
the system without first changing their password.

If users forget their passwords, Eckardt said, they can visit a Web 
site LTS will create to reset them.

The new requirements, however, have some students worried about 
accessing the university's computer system.

"I think it's a good idea, if you could remember your password," 
freshman Meghan Hamre said. "There's no way I could remember that kind 
of (password), especially eight (characters) long."

Eckardt recommended using a password that has a personal meaning, but 
not something hackers could easily guess.

He said Eau Claire's change precedes a possible UW System-wide 
password policy.

"I know the UW System is looking at passing a statewide policy on 
this, and ours will comply with theirs, but their policy's probably 
not going to hit for another year," he said. "We're trying to be 
proactive."


-=-

Valid passwords will have to meet these minimum requirements:

* Must be at least eight characters in length
* Must contain characters from three of the following four categories: 
- English uppercase characters (A through Z)
- English lowercase characters (a through z)
- Base 10 digits (0 through 9)
- Non-alphabetic characters (for example, $, # or %)
* Cannot contain significant portions of the user's account name or 
  full name