Password Policy

Passwords are an essential aspect of computer security, providing important front-line protection for electronic resources by preventing unauthorized access.  Passwords help the University limit unauthorized or inappropriate access to various network resources at the University of Kansas, including user-level accounts, web accounts, email accounts, screen saver protection, and local router logins.

A poorly chosen password may result in the compromise of University systems, data, or the network.  Therefore, all KU students, faculty, and staff are responsible for taking the appropriate steps, as outlined below, to select appropriate passwords and protect them.  Contractors and vendors with access to University systems shall observe these requirements.

A department and/or system administrator may implement a more restrictive policy on local systems where deemed appropriate or necessary for the security of electronic information resources.  The Information Technology Security Office may require a more restrictive policy in protection of confidential information or data as defined in the Data Classification and Handling Policy.

Creation of Passwords

Passwords created by users of University systems, and on systems where technology makes it possible, shall conform to the following standards:

Your password must be 8 to 32 characters long and must contain:

• At least one special character (&,#,-,_, etc.)
• At least one uppercase letter
• At least one lowercase letter
• At least one digit (0-9)

These provisions shall be enforced electronically whenever possible. 

Changing Passwords

Passwords must expire after no longer than 210 days.  Passwords are not allowed to be repeated within one year.

Protecting a Password

• Passwords must be treated as confidential information.
• Passwords must not be included in email messages or other forms of electronic communication.

Sharing a Password

• KU Online IDs are issued to individuals for their exclusive use, and passwords may not be shared. 
• Departmental account passwords must be shared only with appropriately designated departmental personnel.
• Users need to beware of “phishing” or other social engineering scams where a user may have a password requested over the phone.  University information technology personnel (i.e., IT Customer Service Center, ITSO, Departmental Technical Staff), as a best practice, do not request a user’s password over the phone. 

Reporting a Password Compromise

• Suspected compromises of passwords must be reported immediately to the KU IT Customer Service Center at 4-8080.
• The password in question must be changed immediately.