To promote a secure networking environment, W&L currently requires faculty, staff and students to change their university password at least once annually. For those who have been here 12 months or more, you’re all too familiar with the automated “password expiration notice” coming from ITS alerting you that your personal password deadline is fast approaching. If that special time of the year leaves you troubled, we have some good news. ITS will soon be updating and simplifying the password policy, giving users the opportunity to forgo the annual change.
Will the Network Become Less Secure?
The university network will not become less secure, and here’s why. For more than two years, ITS has been in the process of testing, configuring, and adding layers of protection to the on campus network, as well as the productivity applications used by employees and students on a daily basis. In addition to a variety of threat intelligence solutions now in place, we’ve expanded identity and access management through our single sign-on tool (myapps.wlu.edu). Most recently, we completed the final stage of ensuring all faculty, staff and students are protected by Duo multi-factor authentication through policies that extend to both on and off campus scenarios.
What Will the New Policy Look Like?
The new policy will require a few more keystrokes than we’re currently used to, but will eliminate the need for special characters and numbers, making it much easier to type into mobile devices. In fact, users will now log into their university accounts using a “passphrase”. Passphrases are longer, easier to remember and are considered a more secure industry-standard best practice. Here’s a summary of what’s in store.
- Passphrase will need to be a minimum of 16 characters, but longer is accepted.
- At least one uppercase and one lower case letter is required.
- Numbers can be used, but are not required.
- Special characters (e.g., !@#$) can be used, but are not required.
- Spaces can be used, but are not required.
- Your passphrase will not expire, unless your account is compromised.
