Re: Password reset/expiration policies

["Palmer, Kevin" <kpalmer () CCIS EDU>]

At Columbia College:
Complex password without repeats
Faculty and Staff: 90 days
Students: As needed (forgot, so a password reset is initiated)
Different groups: Yes
Enforcement by technology.  Several warnings are sent, then the password will no longer work after the expiration date. 
 User may reset via self-service.
Kev
Kevin Palmer
CIO - Columbia College

[Description: Description: Description: Description: Description: Description: Description: Description: 
CC_logo_4c_colorbuild_lg]

From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Louis 
APONTE
Sent: Wednesday, February 08, 2012 2:50 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: [SECURITY] Password reset/expiration policies

Hi

How often do you force password changes at your institutions for central credentials?  Do you have different policies 
for different groups?  Are they enforced by technology or just "suggested best practices"?

Louis Aponte
Weber State University
Ogden, Utah
Desktop Security