Information Security Standards Users

Initial Version Release Date: 2023-02-09
Approved By: BCIT CSO under Policy 3502

Purpose

This document defines minimum standards and recommendations for the creation and use of passwords and passphrases for all BCIT staff, faculty, students, alumni, retirees, and contractors.

Minimum Password/Passphrase Requirements

Passwords/Passphrases must have a minimum of 15 characters and include at least:

• ONE UPPER CASE LETTER;
• one lower case letter;
• 1 number;
• Optional: For additional security, you may include special characters, the only accepted special characters are: $ ! # _ + = : . ~ ^ ( ) { } [ ].

In addition to the complexity standards above, passwords in any PCI Card Data Environment:

• must be a minimum of 12 characters;
• must be changed every 90 days;
• must be different from the last four passwords used;
• must be set to a unique value for new users and changed on first use.

Due to the increased power of password cracking technologies, BCIT recommends using passphrases with a minimum of 16 characters where systems allow. Consider using a phrase of disconnected words that you can picture in your head.

To create a complex password when a passphrase is not an option, consider using the first letter of each word in a phrase. For example, “I used to bake 15 chocolate layer cakes in a day!” becomes “Iutb15clciad!”.

Your password/passphrase should be easy for you to remember but hard for others to guess or crack.

Passphrase/Password Management

Ways to keep your password/passphrase safe:

• create a strong passphrase/password;
• never share or write your passphrase/password down;
• do not use BCIT passwords for systems outside of BCIT;
• change your password immediately if it is compromised;
• use a password vault such as 1password or KeePass to securely store and retain your passphrases/passwords.

Touchscreen Devices

On devices such as smartphones and tablets with touch-screen interfaces it might not be practical to use a long and strong password/passphrase. Instead, a numeric password/PIN (minimum 5 characters) may be used.

Biometric Interfaces

Biometric access controls such as fingerprint readers and facial recognition are acceptable alternatives to passphrases/passwords/PINs.

Remember:

BCIT IT Services will never ask for your password by email.

Users must immediately report all compromised account incidents to: BCIT IT Services @ BCIT IT Service Desk (ITS) Information Technology Services
Tel: 604-412-7444 (Option 1), 1-800-351-5533 (Option 2), Email: ITShelp@bcit.ca