Strong Passwords & Network Security

1. Strong Passwords& Network Security Kenn McDermottAdministrative ManagerFacilities Planning & Construction Dept. in association with: Gary RichardsonNetwork AdministratorBusiness Management Services Dept. UVA Facilities Management

2. Our Situation • Facilities Management has over 450 computers on the “FM Domain” of the Facilities Management Network, which is connected to the University of Virginia network, which is connected to the Commercial Internet • Access to any FM computer may allow access to all FM files, documents and data – as well as other UVA computers UVA Facilities Management

3. Is There Any Legal Liability? • The Federal Trade Commission recently showed there are legal consequences for organizations that have weak security. Expect a surge of security audits, demand for better training for system administrators and application developers, and a quest for "minimum standards of due care" in security. UVA Facilities Management

4. But What About Here At UVA? • Losses resulting from security breaches can mean lost revenue to the University and additional costs associated with lost productive/billable time, clean-up, loss of data, liability and loss of faculty/staff/student confidence. UVA Facilities Management

5. So How Does That Affect Me? • University policy states that all employees are responsible for protecting University records • Personnel records, health records, student educational records, financial records, contracts, etc., generally must be safeguarded UVA Facilities Management

6. What Can Happen? • One Friday an intruder broke into a workstation in Clark Hall and ran a "sniffer" program that intercepted all network traffic in Clark Hall. The sniffer was not discovered and shut down until 3 weeks later. All passwords were considered compromised for anyone who used a computer in Clark OR connected via network to any computer in Clark • DON’T FORGET - Your Login ID & password are the equivalent of your electronic identity UVA Facilities Management

7. How Did We Get To This Point? • Early academic computer networks did not focus on security as a primary issue • Our FM network was relatively small and required little data security • The network grew in size along with the Internet becoming a worldwide phenomenon – which increased the associated risks UVA Facilities Management

8. We’re Upgrading Computers • Because Microsoft’s Windows Operating Systems called “Windows 2000” and the newer “Windows XP” are much more secure – we are in the process of upgrading all Windows 95 and Windows 98 machines. • We have about 150 on WIN2K • All new PC’s & rebuilds will be WINXP UVA Facilities Management

9. So What Do We Do Now? • One critical element of computer and network security is the login password • At Facilities Management your Login password grants you access to our FM Domain. • CTL-ALT-DEL (for WIN2K & XP) • Login Name – Password - Domain UVA Facilities Management

10. UVA Facilities Management

11. FM Password Construction • Password must be at least six (6) characters long • Passwords may not contain your user name or any part of your full name UVA Facilities Management

12. FM Password Construction (Cont.) • Password must contain characters from at least three of the following four classes: • Upper case letters • Lower case letters • Numerical • Non-alphanumeric characters (Special characters) like % $ # ! ? UVA Facilities Management

13. Sample Strong Password • Using part of a song lyric which goes like this: • I won’t dance, can’t make me • Take the first letter and make it a capital • Use the remaining letters as lower case • Finish it off with an exclamation mark • Result: Iwdcme! OR Iwd,cme UVA Facilities Management

14. Sequence of Change Screens • Login using old password as normal • Click OK on screen advising you to change your password • Type in your new password • Type in your new password again • Click OK on screen announcing that your password was changed UVA Facilities Management

15. UVA Facilities Management

16. UVA Facilities Management

17. UVA Facilities Management

18. UVA Facilities Management

19. Caution …!! • Although you may want to write down your new strong password initially to make sure you enter it correctly DON’T SAVE IT • Memorize your new strong password using the phrase, slogan or saying you came up with to create the password UVA Facilities Management

20. Summary • “Strong Passwords” are an important security element for safe computing & will be implemented between July 14–Aug 11 • An e-mail to ALL FM has been published with instructions and the schedule • A web page will be available for reference • An announcement will be taped to your computer monitor on change day UVA Facilities Management