Skip to main content
Office of Information Technology
BYU Logo_Blue.svg

PASSWORD AUTHENTICATION

Type: Standard
Last Updated: December 27, 2023
Sponsor: Scott Hunt, Assistant Vice President, OIT
Owner: Damon Darais, Identity Portfolio Director, OIT
Custodian: Mary Stevens, IT Governance, OIT
Version: 1.0

PURPOSE

Protect university passwords and authentication processes to reduce the risk of unauthorized access to university IT Resources, systems, data, and services.

SCOPE

These standards apply to all faculty, staff, student employees, contractors, and anyone else approved to use university accounts or systems.

POLICY BASIS

These standards support the Appropriate Use of Information Technology Resources Policy and the Data Use, Privacy, and Security Policy.

REQUIREMENTS

Authorized Use of Accounts and IT Resources

  • Use only IT Resources that the individual user is authorized to use and only in the manner and to the extent authorized.
  • Do not share or transfer individual university accounts, including network IDs, passwords, or other access codes that provide access to IT Resources.

Password Requirements

  • Passwords must be at least 15 characters long.
  • Passwords must include at least two of the following:
    • Uppercase letters
    • Lowercase letters
    • Numerals
    • Symbols
  • Passwords must be different than the current password, previous passwords, BYU NetID, and NetID password reset answer.
  • Passwords must be different than passwords used elsewhere.

Note: At some point in the future, passwords will expire after one year. This change will be communicated.

Protect Passwords

  • Do not share passwords with anyone, including coworkers, teaching assistants, students, assistants, or family.
  • Do not accept any authentication prompts you have not initiated.
  • Report suspicious activity to the CES Security Operations Center at 801-422-7788 or cessoc@byu.edu.

Multifactor Authentication

  • The approved tools for multifactor authentication are Duo and Okta Verify.
  • All systems that perform authentication, except laptops and desktops, need multifactor authentication.
  • MFA should be applied for:
    • Website login
    • All administrative access
    • Any remote login
    • Access to backup systems and data
    • In front of all critical SaaS solutions

GUIDELINES

  1. Create and keep a password that meets current BYU requirements.
  2. Use unique passwords.
  3. Do not share passwords.
  4. Do not accept any MFA authentication prompt you did not initiate.
  5. Report suspicious activity.
  6. User password updates can be made at accounts.byu.edu.
  7. CSRs and self-service technology managers should instruct users to protect all passwords and follow these standards.

ROLES & RESPONSIBILITIES

Users:

Create and use passwords that meet these standards, keep passwords unique, protect passwords from sharing, respond only to authentication prompts they initiate, and report suspicious activity.

CSR / IT Support Team Members: Instruct users in password protection practices, reinforce password expiration and MFA requirements, and direct users to password and MFA resources. Report suspicious activity.

System and Application Owners: Apply multifactor authentication to systems that perform authentication and use MFA for website login, administrative access, remote login, access to backup systems and data, and critical SaaS solutions.

COMPLIANCE & ENFORCEMENT

All users of IT Resources must adhere to the IT Standards, promptly report known or suspected breaches of data or compromises of IT Resources, abnormal or systematic unsuccessful attempts to compromise university data or IT Resources, or suspected or actual weaknesses in safeguards protecting data or IT Resources to the CES Security Operations Center.

Employees and students who commit a violation of the Appropriate Use of Information Technology Resources Policy may be subject to disciplinary actions by the university and may also be prosecuted under applicable local, state, or federal civil or criminal law.

The Appropriate Use of Information Technology Resources Policy states:

The university reserves the right, in its sole discretion and for any reason or no reason, to immediately revoke authorization to access or use any or all IT Resources.

STANDARDS & OWNERSHIP REVIEW

This standard is reviewed every year, or sooner if there is a major change in policy, regulations, or systems.

RELATED RESOURCES

IT Standards are developed by subject matter experts and approved by the Information Technology Committee, which consists of the CIO, the CISO, University Vice Presidents and other senior leaders.

PRINT VERSION