Password Security

Choosing a Password

Your password is one of your first lines of defense when it comes to IT security.  Therefore, it's important to have a good password.  UM requires the following characteristics for all passwords:

  • 9 characters or more
  • 3 of the following four:
    • a lower case letter
    • an upper case letter
    • a number
    • a non-alphanumeric character (e.g. @#$%^&*!?,.)
  • no words or simple phrases
  • no part of your name or uniqname

Given these security characteristics, people often find it difficult to come up with a password that will satisfy all the criteria.  SNRE IT suggests that you pick a phrase you will remember, use the first letter of each word in the phrase, capitalize at least one of the letters, and add a punctuation mark at the end.  For example:

"My baloney has a first name, it's Oscar" becomes "Mbhafn,io!"

It's a password you are unlikely to forget, but seems to be a random collection of letters and punctuation.

Changing passwords

You should plan to change your passwords at least twice a year.  One easy way to remember this is to change your passwords when you change your clocks to and from daylight savings time.

Sharing passwords

Never, ever, EVER share your password with anyone.  Never.  Under any circumstances.  Keep in mind that if you share your password with someone, he now has access to:

  • your computer
  • all of your email
  • all of the files you have access to on the network
  • all of your data in Wolverine Access, including your direct deposit and financial info, home address, contact info, academic records, etc.
  • all files in your UM IFS space
  • any UM-hosted websites you have access to (including the SNRE site, your personal UM webspace, Ctools, and Sitemaker)
  • the UM password change website, which allows him to change your password, so he now knows it and you don't
  • and, if you use the same credentials for any non-UM websites, he also have access to all of them

Occasionally faculty or staff will be working with colleagues from outside UM will log in to a computer and then allow their colleague to work on the computer.  This is considered tantamount to sharing your password.  If anyone needs access to SNRE or UM resources, they need to come to the SNRE IT office or Dean's office to get the proper access.

Passwords at home

The secure password rules above should also be applied to your home computer and any websites you may use in your personal life (banking sites, online stores, etc.).  This applies to both Macs and PCs!  Keep in mind that if your computer logs in automatically, it is dangerously unprotected.  If someone steals your computer, he only has to boot it up to get access to everything on it.