Password Security

00:00

welcome back to student data privacy fundamentals. This lesson is on password security.

00:07

In this video, you will learn recommendations and guidelines for password security.

00:14

Here. You'll want to explain a little bit about how your district addresses passwords, security, For example, The district requires the use of strictly controlled passwords for network access and for access to secure sites and information.

00:28

All staff passwords to district systems shall meet or exceed the following requirements. Where possible. All student passwords shall follow staff password policies whenever possible.

00:40

Then you will want to list the specific requirements for your organization. Here are some specific examples that you can use or adjust to fit your district's needs.

00:52

District network Access to resource is managed through active directory or a single sign on should require passwords that are strong. Meeting the following complexity requirements at least eight characters in length. At least one uppercase letter. At least one lower case letter. At least one special character.

01:11

At least one number

01:12

users will not be allowed to use your two previous passwords.

01:18

Users. Passwords must not include his or her first or last name or district user Name and password must be reset at least once per semester.

01:30

Quiz. Consider these password requirements. Are there any additional that you think would be beneficial or any listed here? That you see is unnecessary.

01:45

Now you will want to state some guidelines for password security. For example, passwords shall never be shared with another person. Outside of the technology department.

01:55

Every password shall be changed every 180 days and be different from previous two passwords.

02:00

Every password shall use two factor authentication whenever possible.

02:06

User created passwords should adhere to the same criteria as required for district network access. As outlined previously,

02:14

passwords shall never be saved when prompted by any application. With the exception of single sign on systems as approved by the Technology department,

02:23

passwords shall not be programmed into a PC or recorded anywhere that someone may find and use them

02:30

when creating a password for secure information or sites. It is important to avoid passwords that are easily guessed due to their association with the user. For example, your child's name, your pets name or your birthday.

02:44

Users and employees who have reason to believe a password is lost or compromised must notify the I so or designee as soon as possible. The technology department will verify the identity of the person or questing the change before resetting the password.

03:00

Where possible system software should enforce the following password standards. Passwords routed over a network shall be encrypted.

03:08

Passwords shall be entered in a non display field

03:12

system. Software shall enforce the changing of passwords and the minimum length

03:16

system. Software shall disable the user password when more than five consecutive invalid passwords or given

03:23

system software should maintain a history of previous passwords and prevent there being easily guessed due to their association with the user.

03:31

Lockout time shall be set at a minimum of 30 minutes.

03:37

In today's video, we discussed recommendations for secure passwords, including specific requirements and guidelines for password management. Reset, etcetera.

03:47

In our next lesson, we will tackle the technology disaster recovery plan.