15.9 Login Credentials and Access Control

Login credentials must meet certain minimum guidelines. Serious damage can be done to the University and the IT Resources if someone obtains a user’s login credentials. The following shall apply to all login credentials and access controls:

1. Users must choose a strong password that is complex and random (e.g., a password must never include a User’s login ID, name, family member’s name, pet’s name, or any other names commonly known to others, and it must never be a word pertaining to the University or a User’s work, studies, or activities).
2. Passwords must be kept strictly confidential and must immediately be changed whenever a User thinks or knows that it has become known to someone else. Passwords must not be shared with anyone. Users are prohibited from allowing anyone else to access their accounts, and Users are prohibited from accessing anyone else’s account.
3. Passwords must not be kept or written down where someone else can find it, and must never be sent over email, text message, or any other communication.
4. No User may enter their login credentials if someone else can see them typing in their password.
5. Users will be prompted to change their passwords from time to time.
6. Users are responsible for all actions taken with their passwords. Users must immediately report to the Administrator any known or suspected use by another of their account or login credentials.
7. Employees must leave their computers on at night but reboot them each morning. Employees using a remote access program must keep their computers locked and in a locked room.
8. Users shall not leave any computer unlocked when unattended. When stepping away from a computer at any time (even if for just a short period of time), users must make sure that the screen is locked, and password protected. Users shall not rely on a screensaver to automatically lock a computer after a certain amount of time.
9. Users shall immediately report to the administrator any irregularities, alerts, or errors flagged by a computer. No university employee or service provider will ever ask a user for their password. Users should contact the administrator if they have any questions about these procedures.