Posted by PRO
Thu, 30 Nov 2006 15:50:00 GMT
Password Policy
1.0 Overview
Passwords are an important aspect of computer security. They are the front line of protection for user accounts. A poorly chosen password may result in the compromise of an entire corporate network. As such, all ABC REALTY employees (including contractors and vendors with access to ABC REALTY systems) are responsible for taking the appropriate steps, as outlined below, to select and secure their passwords.
2.0 Purpose
The purpose of this policy is to establish a standard for creation of strong passwords, the protection of those passwords, and the frequency of change.
3.0 Scope
The scope of this policy includes all personnel who have or are responsible for an account (or any form of access that supports or requires a password) on any system that resides at any ABC REALTY facility, has access to the ABC REALTY network, or stores any non-public ABC REALTY information.
4.0 Policy
4.1 General
All system-level passwords (e.g., root, enable, administrator, application administration accounts, etc.) must be changed on at least a quarterly basis.
All production administrator passwords must be part of the ABC REALTY administered global password management database, to be stored in encrypted format and made available only to management staff with a need-to-know.
All user-level passwords (e.g., email, web, desktop computer, etc.) must be changed at least every six months.
User accounts must have a unique password from all other accounts held by that user.
Passwords must not be inserted into email messages or other forms of electronic communication.
All user-level and system-level passwords must conform to the guidelines described below.
4.2 Guidelines
A. General Password Construction Guidelines
Passwords are used for various purposes at ABC REALTY. Some of the more common uses include: user level accounts, web accounts, email accounts, screen saver protection, voicemail password, and local router logins. Since very few systems have support for one-time tokens (i.e., dynamic passwords which are only used once), everyone should be aware of how to select strong passwords.
Poor, weak passwords have the following characteristics:
- The password contains less than eight characters
- The password is a word found in a dictionary (English or foreign)
- The password is a common usage word such as:
- Names of family, pets, friends, co-workers, fantasy characters, etc.
- Computer terms and names, commands, sites, companies, hardware, software.
- The words "ABC REALTY", the name of the county, city, region, state, regional sports teams - or any derivation.
- Birthdays and other personal information such as addresses and phone numbers.
- Word or number patterns like aaabbb, qwerty, zyxwvuts, 123321, etc.
- Any of the above spelled backwards.
- Any of the above preceded or followed by a digit (e.g., secret1, 1secret)
Strong passwords have the following characterstics:
- Contain both upper and lower case characters (e.g., a-z, A-Z)
- Have digits and punctuation characters as well as letters e.g., 0-9, !@#$%^&*()_+|~-=`{}[]:";’<>?,./)
- Are at least eight alphanumeric characters long.
- Are not a word in any language, slang, dialect, jargon, etc.
- Are not based on personal information, names of family, etc.
- Passwords should never be written down or stored on-line. Try to create passwords that can be easily remembered. One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~" or some other variation.
NOTE: Do not use either of these examples as passwords!
B. Password Protection Standards
Do not use the same password for ABC REALTY accounts as for other non-ABC REALTY access (e.g., personal ISP account, option trading, benefits, etc.). Where possible, don’t use the same password for various ABC REALTY access needs. For example, select one password for the accounting system and a separate password for logging on to your PC. Also, select a separate password to be used for an NT account and a UNIX account where applicable.
Do not share ABC REALTY passwords with anyone, including administrative assistants or secretaries. All passwords are to be treated as sensitive, Confidential ABC REALTY information.
Here is a list of "don’ts":
- Don’t reveal a password over the phone to ANYONE
- Don’t reveal a password in an email message
- Don’t reveal a password to the boss
- Don’t talk about a password in front of others
- Don’t hint at the format of a password (e.g., "my family name")
- Don’t reveal a password on questionnaires or security forms
- Don’t share a password with family members
- Don’t reveal a password to co-workers while on vacation
If someone demands a password, refer them to this document or have them call someone in the Information Security Department.
Do not use the "Remember Password" feature of applications (e.g., Eudora, Outlook, Netscape Messenger).
Again, do not write passwords down and store them anywhere in your office. Do not store passwords in a file on ANY computer system (including Palm Pilots or similar devices) without encryption.
Change passwords at least once every six months (except system-level passwords which must be changed quarterly).
If an account or password is suspected to have been compromised, report the incident to ABC REALTY management and change all passwords.
Password cracking or guessing may be performed on a periodic or random basis by ABC REALTY or its delegates. If a password is guessed or cracked during one of these scans, the user will be required to change it.
C. Application Development Standards
Application developers must ensure their programs contain the following security precautions. Applications:
- should support authentication of individual users, not groups.
- should not store passwords in clear text or in any easily reversible form.
- should provide for some sort of role management, such that one user can take over the functions of another without having to know the other’s password.
D. Use of Passwords and Pass phrases for Remote Access Users
Access to the ABC REALTY Networks via remote access is to be controlled using either a one-time password authentication or a public/private key system with a strong pass phrase.
E. Pass phrases
Pass phrases are generally used for public/private key authentication. A public/private key system defines a mathematical relationship between the public key that is known by all, and the private key, that is known only to the user. Without the pass phrase to "unlock" the private key, the user cannot gain access.
Pass phrases are not the same as passwords. A pass phrase is a longer version of a password and is, therefore, more secure. A pass phrase is typically composed of multiple words. Because of this, a pass phrase is more secure against "dictionary attacks."
A good pass phrase is relatively long and contains a combination of upper and lowercase letters and numeric and punctuation characters. An example of a good pass phrase:
"The*?#>*@TrafficOnThe610Was*&#!#ThisMorning"
All of the rules above that apply to passwords apply to pass phrases.
5.0 Enforcement
Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
6.0 Definitions
|
Terms
|
Definitions
|
|
Application Administration Account
|
Any account that is for the administration of an application (e.g., Oracle database administrator, ISSU administrator).
|
7.0 Revision History
Posted in Sample Information Protection Policies
back to top
Posted by PRO
Thu, 30 Nov 2006 15:19:00 GMT
THIS DOCUMENT IS PROVIDED BY THE PINELLAS REALTOR® ORGANIZATION AS A SAMPLE TOOL AND IS NOT INTENDED TO BE AND DOES NOT CONSTITUTE LEGAL ADVICE, OR A SUBSTITUTE FOR SPECIFIC LEGAL ADVICE OR OPINIONS. THE USER OF THIS SAMPLE DOCUMENT SHOULD NOT ACT OR REFRAIN FROM ACTING, OR USE THIS DOCUMENT WITHOUT CONSULTING LEGAL COUNSEL. THE CONTENTS OF THIS DOCUMENT SHOULD BE MODIFIED TO ADDRESS THE SPECIFIC LEGAL AND BUSINESS NEEDS OF THE USER AND THEIR WEBSITE.
Information Protection Policy
1.0 Purpose
The Information Protection Policy is intended to help employees determine what information can be disclosed to non-employees, as well as the relative sensitivity of information that should not be disclosed outside of ABC REALTY without proper authorization.
The information covered in these guidelines includes, but is not limited to, information that is either stored or shared via any means. This includes: electronic information, information on paper, and information shared orally or visually (such as telephone and video conferencing).
All employees should familiarize themselves with the information labeling and handling guidelines that follow this introduction. It should be noted that the sensitivity level definitions were created as guidelines and to emphasize common sense steps that you can take to protect ABC REALTY Confidential information (e.g., ABC REALTY Confidential information should not be left unattended in conference rooms).
Please Note: The impact of these guidelines on daily activity should be minimal.
Questions about these guidelines and the proper classification of a specific piece of information should be addressed to your manager.
2.0 Scope
All ABC REALTY information is categorized into two main classifications:
- ABC REALTY Public
- ABC REALTY Confidential
ABC REALTY Public information is information that has been declared public knowledge by someone with the authority to do so, and can freely be given to anyone without any possible damage to ABC REALTY Systems, Inc.
ABC REALTY Confidential contains all other information. It is a continuum, in that it is understood that some information is more sensitive than other information, and should be protected in a more secure manner. Included is information that should be protected very closely, such as trade secrets, development programs, potential acquisition targets, and other information integral to the success of our company. Also included in ABC REALTY Confidential is information that is less critical, such as telephone directories, general corporate information, personnel information, etc., which does not require as stringent a degree of protection.
A subset of ABC REALTY Confidential information is "ABC REALTY Third Party Confidential" information. This is confidential information belonging or pertaining to another corporation which has been entrusted to ABC REALTY by that company under non-disclosure agreements and other contracts. Examples of this type of information include everything from joint development efforts to vendor lists, customer orders, and supplier information. Information in this category ranges from extremely sensitive to information about the fact that we’ve connected a supplier / vendor into ABC REALTY’ network to support our operations.
ABC REALTY personnel are encouraged to use common sense judgment in securing ABC REALTY Confidential information to the proper extent. If an employee is uncertain of the sensitivity of a particular piece of information, he/she should contact their manager
3.0 Policy
The guidelines below provide details on how to protect information at varying sensitivity levels. Use these guidelines as a reference only, as ABC REALTY Confidential information in each column may necessitate more or less stringent measures of protection depending upon the circumstances and the nature of the ABC REALTY Confidential information in question.
Minimal Sensitivity: General corporate information; some personnel and technical information
Marking guidelines for information in hardcopy or electronic form:
Note: any of these markings may be used with the additional annotation of "3rd Party Confidential".
Marking is at the discretion of the owner or custodian of the information. If marking is desired, the words "ABC REALTY Confidential" may be written or designated in a conspicuous place on or in the information in question. Other labels that may be used include "ABC REALTY Proprietary" or similar labels at the discretion of your individual business unit or department. Even if no marking is present, ABC REALTY information is presumed to be "ABC REALTY Confidential" unless expressly determined to be ABC REALTY Public information by an ABC REALTY employee with authority to do so.
Access: ABC REALTY employees, contractors, people with a business need to know.
- Distribution within ABC REALTY: Standard interoffice mail, approved electronic mail and electronic file transmission methods.
- Distribution outside of ABC REALTY internal mail: U.S. mail and other public or private carriers, approved electronic mail and electronic file transmission methods.
- Electronic distribution: No restrictions except that it be sent to only approved recipients.
- Storage: Keep from view of unauthorized people; erase whiteboards, do not leave in view on tabletop. Machines should be administered with security in mind. Protect from loss; electronic information should have individual access controls where possible and appropriate.
- Disposal/Destruction: Deposit outdated paper information in specially marked disposal bins on ABC REALTY premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
- Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.
More Sensitive: Business, financial, technical, and most personnel information
Marking guidelines for information in hardcopy or electronic form:
Note: any of these markings may be used with the additional annotation of "3rd Party Confidential". As the sensitivity level of the information increases, you may, in addition or instead of marking the information "ABC REALTY Confidential" or "ABC REALTY Proprietary", wish to label the information "ABC REALTY Internal Use Only" or other similar labels at the discretion of your individual business unit or department to denote a more sensitive level of information. However, marking is discretionary at all times.
- Access: ABC REALTY employees and non-employees with signed non-disclosure agreements who have a business need to know.
- Distribution within ABC REALTY: Standard interoffice mail, approved electronic mail and electronic file transmission methods.
- Distribution outside of ABC REALTY internal mail: Sent via U.S. mail or approved private carriers.
- Electronic distribution: No restrictions to approved recipients within ABC REALTY, but should be encrypted or sent via a private link to approved recipients outside of ABC REALTY premises.
- Storage: Individual access controls are highly recommended for electronic information.
- Disposal/Destruction: In specially marked disposal bins on ABC REALTY premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
- Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.
Most Sensitive: Trade secrets & marketing, operational, personnel, financial, source code, & technical information integral to the success of our company
Marking guidelines for information in hardcopy or electronic form:
Note: any of these markings may be used with the additional annotation of "3rd Party Confidential". To indicate that ABC REALTY Confidential information is very sensitive, you may should label the information "ABC REALTY Internal: Registered and Restricted", "ABC REALTY Eyes Only", "ABC REALTY Confidential" or similar labels at the discretion of your individual business unit or department. Once again, this type of ABC REALTY Confidential information need not be marked, but users should be aware that this information is very sensitive and be protected as such.
- Access: Only those individuals (ABC REALTY employees and non-employees) designated with approved access and signed non-disclosure agreements.
- Distribution within ABC REALTY: Delivered direct - signature required, envelopes stamped confidential, or approved electronic file transmission methods.
- Distribution outside of ABC REALTY internal mail: Delivered direct; signature required; approved private carriers.
- Electronic distribution: No restrictions to approved recipients within ABC REALTY, but it is highly recommended that all information be strongly encrypted.
- Storage: Individual access controls are very highly recommended for electronic information. Physical security is generally used, and information should be stored in a physically secured computer.
- Disposal/Destruction: Strongly Encouraged: In specially marked disposal bins on ABC REALTY premises; electronic data should be expunged/cleared. Reliably erase or physically destroy media.
- Penalty for deliberate or inadvertent disclosure: Up to and including termination, possible civil and/or criminal prosecution to the full extent of the law.
4.0 Enforcement
Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
5.0 Definitions
|
Terms
|
Definitions
|
|
Appropriate measures
|
To minimize risk to ABC REALTY from an outside business connection. ABC REALTY computer use by competitors and unauthorized personnel must be restricted so that, in the event of an attempt to access ABC REALTY corporate information, the amount of information at risk is minimized.
|
|
Configuration of ABC REALTY-to-other business connections
|
Connections shall be set up to allow other businesses to see only what they need to see. This involves setting up both applications and network configurations to allow access to only what is necessary.
|
|
Delivered Direct; Signature Required
|
Do not leave in interoffice mail slot, call the mail room for special pick-up of mail.
|
|
Approved Electronic File Transmission Methods
|
Includes supported FTP clients and Web browsers.
|
|
Envelopes Stamped Confidential
|
You are not required to use a special envelope. Put your document(s) into an interoffice envelope, seal it, address it, and stamp it confidential.
|
|
Approved Electronic Mail
|
Includes all mail systems supported by the IT Support Team. These include, but are not necessarily limited to, [insert corporate supported mailers here…]. If you have a business need to use other mailers contact the appropriate support organization.
|
|
Approved Encrypted email and files
|
Techniques include the use of DES and PGP. DES encryption is available via many different public domain packages on all platforms. PGP use within ABC REALTY is done via a license. Please contact the appropriate support organization if you require a license.
|
|
Company Information System Resources
|
Company Information System Resources include, but are not limited to, all computers, their data and programs, as well as all paper information and any information at the Internal Use Only level and above.
|
|
Expunge
|
To reliably erase or expunge data on a PC or Mac you must use a separate program to overwrite data, supplied as a part of Norton Utilities. Otherwise, the PC or Mac’s normal erasure routine keeps the data intact until overwritten. The same thing happens on UNIX machines, but data is much more difficult to retrieve on UNIX systems.
|
|
Individual Access Controls
|
Individual Access Controls are methods of electronically protecting files from being accessed by people other than those specifically designated by the owner. On UNIX machines, this is accomplished by careful use of the chmod command (use man chmod to find out more about it). On Mac’s and PC’s, this includes using passwords on screensavers, such as Disklock.
|
|
Insecure Internet Links
|
Insecure Internet Links are all network links that originate from a locale or travel over lines that are not totally under the control of ABC REALTY.
|
|
Encryption
|
Secure ABC REALTY Sensitive information in accordance with the Acceptable Encryption Policy. International issues regarding encryption are complex. Follow corporate guidelines on export controls on cryptography, and consult your manager and/or corporate legal services for further guidance.
|
|
One Time Password Authentication
|
One Time Password Authentication on Internet connections is accomplished by using a one time password token to connect to ABC REALTY’ internal network over the Internet. Contact your support organization for more information on how to set this up.
|
|
Physical Security
|
Physical security means either having actual possession of a computer at all times, or locking the computer in an unusable state to an object that is immovable. Methods of accomplishing this include having a special key to unlock the computer so it can be used, thereby ensuring that the computer cannot be simply rebooted to get around the protection. If it is a laptop or other portable computer, never leave it alone in a conference room, hotel room or on an airplane seat, etc. Make arrangements to lock the device in a hotel safe, or take it with you. In the office, always use a lockdown cable. When leaving the office for the day, secure the laptop and any other sensitive material in a locked drawer or cabinet.
|
|
Private Link
|
A Private Link is an electronic communications path that ABC REALTY has control over it’s entire distance. For example, all ABC REALTY networks are connected via a private link. A computer with modem connected via a standard land line (not cell phone) to another computer have established a private link. ISDN lines to employee’s homes is a private link. ABC REALTY also has established private links to other companies, so that all email correspondence can be sent in a more secure manner. Companies which ABC REALTY has established private links include all announced acquisitions and some short-term temporary links
|
6.0 Revision History
Posted in Sample Information Protection Policies
back to top
