Password Standard

1. Background

   Passwords are an important aspect of computer security. They are the front line of protection for user accounts. Passwords can preserve the confidentiality of password-protected data and are the sole property of account holders. As such, all California State University, Long Beach (CSULB) employees, including contractors and vendors with access to CSULB systems, are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.

2. Purpose

   The purpose of this standard is to communicate the composition of strong passwords, the protection of those passwords, and the frequency of change.

3. Scope

   This standard applies to all individuals who have or are responsible for an account or any form of access that supports or requires a password on any CSU system, has access to the CSULB network, or stores any non-public CSULB information.

4. Standard

   1. Password Composition

      Passwords are used for various purposes at CSULB. Some of the more common uses include: user level accounts, email accounts, screen saver protection, and local router logins.

      Passwords shall at least adhere to the following complexity guidelines:

      • Be case sensitive
      • Be at least ten characters in length
      • Contain three of the following four character types:
        • Uppercase English characters (A through Z)
        • Lowercase English characters (a through z)
        • Numbers (0 through 9)
        • Special characters (` ~ ! @ # $ % ^ & * ( ) _ + - = { } | [ ] \ : " ; ' < > ? , . /)
      • Contain no spaces
      • Include no part of a person’s full name
      • Contain no non-English language characters
      • Not match any of a person’s previous passwords

      To the extent that password complexity is supported by respective devices and/or systems, passwords should also:

      • Not contain personal information such as user name or CSULB ID number
      • Not contain a complete dictionary word from English or another language
      • Be significantly different from previous passwords
      • Not be incremental with every password change (Example: Password 1, Password 2, Password 3... )
      • Be difficult to crack, but easy to remember (Example: make up a sentence, and then use the first letter of each word or sound, adding a couple of digits or symbols and uppercase letters. For instance, “Tennis later anyone??” becomes the password: “10sL8rne1??” or “I really love 8 hot fudge sundaes best,” becomes “irL8htfsB!”
      • Not have more than two characters repeated consecutively
      • Not use adjacent keyboard characters (Example: asdfghjkl:, qwertyuiop, 1234567890)

   2. Password Protection

      Your password is to be treated as confidential information. To protect your confidential information, you should take the following measures:

      • Do not use the same password for CSULB accounts as for your personal accounts.
      • Do not reveal a password over the phone to ANYONE.
      • Do not reveal a password in an email message.
      • Do not talk about your password in front of others.
      • Do not hint at the format of your password (e.g., “ my dogs name”).
      • Do not reveal a password on questionnaires or forms.
      • Do not reveal a password to co-workers while on vacation.
      • Do not write passwords down and store them anywhere in your office.
      • Do not store passwords in a file on ANY computer systems without encryption.
      • Do not use the “Remember Password” feature of applications or web browsers.

   3. Password Change Frequency

      System	Employees	Students
      Common Financial System	Annual	n/a
      Oracle HCM (HR/SA) administrative system	Annual	n/a
      BeachID/campus LDAP, AD-based systems	Annual	Upon account activation, account lock or difficulty

      For systems not named above, a generally recommended change interval for passwords is at least annually.

Further Information

Information Security Office
Email: security@csulb.edu