|
|
 |
Staff
Password Service
| Passwords are an important aspect of
computer and information security. They are the front line of protection for user
accounts. A poorly chosen and managed password may result in the compromise of the
security of the University's entire corporate network and therefore of
the information hosted on it. The information contained on this page is
derived from the University's Electronic Information Assurance Policy
– Identity and Access Management Code of Practice – Password Standard
and published on the Information Services Governance and Strategy
Committee website.
Significant changes to user password
management have
been incorporated within University IT systems. These are listed below and
are based on the
Password Standard. It is important that you become familiar with them.
Please read below before proceeding to change your password (by clicking on
the Continue to Staff Password Service button at the bottom
of the page).
|

|
Password Lifetime
|
 |
This is the amount of time a password remains
valid and usable. At the end of this period, the password will expire and
the user will be denied access. Your University network (email) password is
set to expire at 90 days. You must change your password to a new one
before the expiration date. Once you do so, the 90-day period begins
again. |
When to Change Your Password
 |
If you log onto our Active Directory desktop
service (NGDS), our system will prompt you when you are within 14 days of
the expiration date. It will continue to prompt you each time you log in.
You will have the opportunity to change your password on each occasion. If you only use our email system, you will
receive an email alert within 14 days of the expiration date. You must
change your password via the Continue to Staff Password Service
button shown below.
Other University services which use this
password system (such as WebCT and
the Portal, see below) will prompt you prior to login and you will have the opportunity
to change your password then.
If you believe your password has been
compromised in any way, you must change the password immediately and contact
the Information Services
Service Desk.
| Note: If you are accessing the online
password changer for the first time or have not yet set a secret
question and answer, you will need to have your National Insurance
number in order to verify your identity. The secret question and
answer is an enhanced feature of the password changer (introduced
in Spring 2010).
More details about the operation of
the enhanced features of the online password changer are available
by clicking
here.
|
|
What Services Are Affected When a Password
is Changed?
 |
Once you have changed your network (email)
password, the new password will be valid for the following services:
 |
Staff desktop (if
applicable) |
 |
WebCT |
 |
Email (web access etc) |
 |
PDS |
 |
University Portal |
 |
University wireless service |
|
Password Characteristics
 |
Our system will retain a record of passwords
that you have used previously. Note that passwords cannot contain your given
name or surname. You must create a new password on each
occasion you are prompted. The new password must be at least eight
characters long and must contain at least three from:
a. Uppercase alphabetic (A – Z);
b. Lowercase alphabetic (a – z);
c. Digit (0 – 9);
d. Non-alphabetic, from (!, $, #, %, _, @, ^, &, *, +, -, =)
Note: Passwords cannot contain your given name or surname.
|
Good Practice
 |
The
Password Standard contains guidelines for the creation and safekeeping
of passwords. Key points that should be adhered to are:
 |
Do not reveal a password over the phone
to ANYONE |
 |
Do not reveal a password to a co-worker
or line manager for any reason |
 |
Do not talk about a password in front of
others |
 |
Do not hint at the format of a password
(e.g., "my family name") |
 |
Do not reveal a password on
questionnaires or security forms |
 |
Do not share a password with family
members |
 |
Do not write passwords down and store
them where they can be found or accessed by others |
 |
Do not insert passwords into email
messages or other forms of electronic communication. |
|
|