{"id":357,"date":"2024-07-22T16:03:06","date_gmt":"2024-07-22T16:03:06","guid":{"rendered":"https:\/\/www.mtsu.edu\/policies\/?page_id=357"},"modified":"2026-07-27T01:11:56","modified_gmt":"2026-07-27T01:11:56","slug":"p925","status":"publish","type":"page","link":"https:\/\/www.mtsu.edu\/policies\/p925\/","title":{"rendered":"925 \u00a0Implementation of Secure Passwords"},"content":{"rendered":"\n

Approved by President<\/strong>
Effective Date: June 5, 2017
Responsible Division: Information Technology
Responsible Office:  Information Technology
Responsible Officer: <\/strong>Vice President for Information Technology<\/strong><\/p>\n\n\n\n

I. Purpose<\/strong><\/p>\n\n\n\n

This policy ensures the security and confidentiality of login passwords to 乐播传媒入口\u2019s (MTSU or University) information systems. A combination of a personal user login ID for identification and a unique password for authentication will be required of all users before they are allowed to access University networks and systems. Passwords will be used for authentication of access to all University network and systems, except where stronger authentication methods (such as biometric authentication or two-factor authentication) are deemed necessary. The effectiveness of passwords to protect access to the University\u2019s information directly depends on strong construction and handling practices.<\/p>\n\n\n\n

This policy provides clear guidance for the creation and maintenance of login passwords. <\/p>\n\n\n\n

II.<\/strong> D<\/strong>efinitions<\/strong><\/p>\n\n\n\n

    \n
  1. User Account. A collection of data associated with a particular user of a multiuser computer system. Each account comprises a user name and password and defines security access levels for that user.<\/li>\n\n\n\n
  2. Privileged Account. A user account that has been allocated security access levels within a multiuser computer system, which are significantly greater than those available to the majority of user accounts.<\/li>\n\n\n\n
  3. Service Account. Accounts used for automated processes without user interaction; accounts used for device management.<\/li>\n<\/ol>\n\n\n\n

    III. Policy Development and Maintenance<\/strong><\/p>\n\n\n\n

    This policy will be reviewed at least annually by the Chief Information Security Officer and suggestions for changes will be submitted to the Vice President for Information Technology and Chief Information Officer (CIO).<\/p>\n\n\n\n

    IV. S<\/strong>cope<\/strong><\/p>\n\n\n\n

    This policy applies to all University students, faculty, staff, affiliates, third-party support contractors, and all others granted access to MTSU information assets.<\/p>\n\n\n\n

    V.<\/strong> Procedure for User Accounts<\/strong><\/p>\n\n\n\n

    The\u00a0Information Technology Division (ITD) Help Desk<\/a>\u00a0will assist users with the creation and maintenance of their user account logins. More information on passwords can be found on ITD’s\u00a0Passwords website<\/a>. \u00a0<\/p>\n\n\n\n

      \n
    1. A.  Mandatory Requirements: Listed below are the mandatory requirements and guidelines that must be followed when selecting a password:\n
        \n
      1. Passwords must not be stored in a manner which allows unauthorized access.<\/li>\n\n\n\n
      2. Passwords will not be stored in a clear text file.<\/li>\n\n\n\n
      3. Passwords will not be sent via unencrypted email.<\/li>\n\n\n\n
      4. Users must change their passwords at least annually.<\/li>\n\n\n\n
      5. Users with privileged accounts must change their passwords at least every ninety (90) days.<\/li>\n\n\n\n
      6. Password construction must meet the requirements listed within the MTSU Password Change application<\/a>.<\/li>\n<\/ol>\n<\/li>\n\n\n\n
      7. B.  Passwords must be changed immediately if any of the following events occur:\n
          \n
        1. Unauthorized password discovery or usage by another person.<\/li>\n\n\n\n
        2. System compromise (unauthorized access to a system or account).<\/li>\n\n\n\n
        3. Insecure transmission of a password.<\/li>\n\n\n\n
        4. Accidental disclosure of a password to an unauthorized person.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n\n\n\n

          VI. Procedure for Service Accounts<\/strong><\/p>\n\n\n\n

          The ITD Enterprise Server Services will assist users with the creation and maintenance of service accounts. Mandatory requirements:<\/p>\n\n\n\n

            \n
          1. Service accounts are not required to expire but must meet the password construction requirements above.<\/li>\n\n\n\n
          2. Vendor provided passwords (also known as default passwords) must be changed upon installation, using the password construction requirements above.<\/li>\n\n\n\n
          3. If there is a status change of any personnel with knowledge of service accounts, those account passwords must be changed within twenty-four (24) hours after the status change.<\/li>\n<\/ol>\n\n\n\n

            Forms:  none.<\/p>\n\n\n\n

            Revisions: none.<\/p>\n\n\n\n

            Last Reviewed: June 2017.<\/p>\n\n\n\n

            References: none.<\/p>\n","protected":false},"excerpt":{"rendered":"

            Approved by PresidentEffective Date: June 5, 2017Responsible Division: Information TechnologyResponsible Office:  Information TechnologyResponsible Officer: Vice President for Information Technology I. Purpose This policy ensures the security and confidentiality of login passwords to 乐播传媒入口\u2019s (MTSU or University) information systems. A combination of a personal user login ID for identification and a unique password for authentication […]<\/p>\n","protected":false},"author":166,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-bannernosidebar.php","meta":{"footnotes":""},"class_list":["post-357","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/pages\/357","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/users\/166"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/comments?post=357"}],"version-history":[{"count":1,"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/pages\/357\/revisions"}],"predecessor-version":[{"id":3827,"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/pages\/357\/revisions\/3827"}],"wp:attachment":[{"href":"https:\/\/www.mtsu.edu\/policies\/wp-json\/wp\/v2\/media?parent=357"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}