Passwords

Although user names are publicly known, passwords must be kept secret and known only to users. Each user account should be assigned a password, which is a combination of six to eight letters, numbers, or special characters. You can set a user's password when you create the user account and have the user change it when logging in to a system for the first time.

To make your computer systems more secure, ask users to change their passwords periodically. For a high level of security, you should require users to change their passwords every six weeks. Once every three months is adequate for lower levels of security. System administration logins (such as root and sys) should be changed monthly, or whenever a person who knows the root password leaves the company or is reassigned.

Many breaches of computer security involve guessing a legitimate user's password. You should make sure that users avoid using proper nouns, names, login names, and other passwords that a person might guess just by knowing something about the user.

Good choices for passwords include:

• Phrases (beammeup)

• Nonsense words made up of the first letters of every word in a phrase (swotrb for SomeWhere Over The RainBow)

• Words with numbers or symbols substituted for letters (sn00py for snoopy)

Do not use these choices for passwords:

• Your name, forwards, backwards, or jumbled

• Names of family members or pets

• Car license numbers

• Telephone numbers

• Social Security numbers

• Employee numbers

• Names related to a hobby or interest

• Seasonal themes, such as Santa in December

• Any word in the dictionary