Password Requirements

Computers store information of all types, ranging from incidental information that only the owner of the data cares about, to sensitive, personal, or confidential data that must be protected. Very often, passwords are among the first and most important lines of defense used to protect our information. With that in mind, it is important to make sure your passwords are not a weak link. Below are some password "best practices" that should always be used both at work and at home. Please keep in mind that many of these guidelines are also implemented on the Mat-Su campus computer network as policies, so passwords which do not meet these guidelines may not be accepted by our systems.

Best Practices

Passwords must be at least eight characters long, and must contain characters from at least three of the following four categories to remain secure:

• Uppercase letters: ABC
• Lowercase letters: abc
• Numeric characters: 123
• Special characters: !@#$%^&*().? or s p a c e s.
• Passwords should never be words found in any dictionary – including non-English dictionaries.
• Passwords should never be lingo, slang, jargon, or names of people or places–-including fictional people and places.
• Passwords should never be something obvious about you, like your birthday or name.
• Passwords should never be simple variations on any of the above. For example: college1 or Smith52
• Passwords should never contain "patterns" such as abcd1234, 0987654321, or qwerty.

Password hacking programs can easily crack passwords that do not follow the above guidelines, thereby compromising sensitive information.

Here are a few more tips:

• Passwords should never be shared with anyone. CTS will never ask you for your password, and you should not give any password to anyone – including co-workers.
• Passwords should not be written down.
• If passwords must be written down due to extenuating circumstances which are out of your control, the password should never be kept near a computer. An unfortunate amount of passwords can be easily "discovered" by reading sticky notes on desks, monitors, in desk drawers, or under keyboards . When we find passwords attached to keyboards, monitors, or other equipment they will be destroyed and discarded.
• Many people store passwords in files or in software on their computers. This should always be avoided if possible. One available option for storing passwords securely is the use of a password management software utility. It allows you to keep a secure encrypted database of frequently used passwords in which you will only have to remember one password to access. Most good password managers have many other valuable features included.
• If you do decide to use a password manager, make sure you purchase one from a reputable company. Small companies will often sell flawed and insecure password managers, while many "free" and "shareware" password managers are either insecure, or actively and intentionally expose your passwords for others to use. The only password manager we currently recommend is Norton Password Manager. You can find more information on this product at Symantec's website.

Examples:

This example shows how you can use a pass phrase to create a unique password.

• math has its place
  M@th h@s its pl@c3

Here are two examples of how you can use special characters and non-standard spelling to create a word to be used as a password.

• January
  J@ny0uairy ("Jan" spelled with an @ instead of an "a," replace the "u" with the word you except spelled with a 0 instead of a "o," and finally replace "ary" with the word "airy." )
   
• October
  0ctoeBrrr! (0 instead of "O," "toe" instead of "to," and "Brrr!" instead of "ber.")

Please do not use any of the above examples. Also, passwords containing Mat-Su, Mat-Su College, or University of Alaska, including any abbreviation or derivation should never be used.