More Password Protection Tips - Information Technology at the University of Northern Colorado

Information Security

More Helpful Password Information

Is your password strong enough?

Your UNC Digital ID gives you access to UNC computer systems, to an increasing number of applications, and to an equally increasing amount of valuable information.

Your Digital ID replaces the many userid/password combinations required to access information across campus and therefore makes life easier for all of us. However, it is vital to protect the confidentially and integrity of your ID and Password.

To maintain the integrity of your UNC Digital ID and safeguard access to UNC electronic assets:

Think of a quality password.
You can use numeric charters, alphabetic charters (uppercase and lower case) and symbols to create a strong passphrase.
Keep you password secret.
Change your password if it has been compromised.

Password Tips and Tricks

Below are some tips and tricks to help choose new passwords given the new rules and restrictions:

Use the first characters of a sentence you can easily remember. i.e., I am enjoying my 3 Plants (Iaem3P) or I go on Holiday 13 May (IgoH13M).
Combine numbers and words (for example the age of your partner or friend).
Use numbers in a word. For example a 5 in stead of an s, and a 3 instead of an e. partn3r5.
Substituting special characters for letters. I go on Holiday 13 May could be Igo#13M.

Why would anyone need your password?

You are given access to UNC services to enable you to do your work. Means of access are created to uniquely identify the users (UNC Digital ID) and his/her access. Under no circumstances will anyone ever need to have your password.

This applies to IT technical staff maintaining computers and applications.

Therefore:

Never disclose your password to any one
IT technical staff must only be allowed access to your machine if YOU have reported a problem to the Technical Support Center (TSC)
If someone tries to elicit your password, report this to the Technical Support Center (TSC) as an information security incident.

Ever wonder why they need to know?

Social engineering is the techniques of talking people into disclosing information by misusing the natural tendency to trust other people.

A social engineering attempt may seem innocent as the perpetrator may identify him/herself as an authorized colleague or UNC affiliate. By combining information from different sources a lot of damage can be caused. However, you can prepare yourself by asking yourself the following questions:

Can I positively identify the person calling?
Should the information be disclosed (i.e. should I be giving my password to anyone else?)
Should I be the one giving the requested information?
Are you entitled to release the information or should it actually be released?
Why would the caller need the information?
What is the normal process for someone to get the information?