The purpose of this policy is to establish a standard for the creation of strong passwords and the protection of those passwords across Franklin & Marshall (F&M). This policy also defines multifactor authentication requirements for accessing the College's information resources. At their discretion, the College Infrastructure Committee reserves the right to modify this policy at any point in time.

Information security requires the participation and support from all members of the F&M community with access to information assets. It is the responsibility of every member of the F&M community to help ensure that all information assets are kept secure and available. Information about how to change the password associated with your F&M NetID is found on the account management page at password.fandm.edu. Log in and follow the directions.

II. Scope

This policy applies to all members of the F&M community, which includes, but is not limited to employees, students, visitors, volunteers, third parties, contractors, consultants, clients, temporaries, and others (collectively known as "users"), who have access to, support, administer, manage, or maintain F&M information assets.

III. Definitions

"Multifactor authentication" is an additional layer of security used during a logon process. A user will enter their account name, such as netid or email address, followed by the account password. At this point, if the particular system has multifactor authentication enabled, the user will be challenged for an additional piece of information that is generated in real-time from a registered device or available from an alternative method of authentication.

"Registered device" is commonly:

• • A cell phone capable of receiving sms/text messages.

  • A smartphone or mobile device with an authenticator application installed that produces a code that changes every 30-60 seconds.

  • A smartphone or mobile device with an authenticator application installed that prompts to approve or deny a logon request at the time of authentication.

"Alternative method of authentication" refers to:

• • A telephone number capable of receiving voice calls that will be available at the time of authentication. These are commonly home or office phones.

  • A USB key made specifically for this use.

  • A list of printed backup codes.

IV. Policy 

Passwords are a critical aspect of information security; they are the front line of protection for user accounts. A poorly chosen password may result in the compromise of F&M's entire campus network. Therefore, all F&M users are responsible for taking the appropriate precautions while selecting and securing their passwords.

You must never share your login and password with anyone.

Access Control
All access to systems must be controlled by an authentication method involving a minimum of a Username/Password combination. The Username/Password combination must provide verification of the user's identity.

Initial Passwords
New users receive an alert indicating they can go to the password change system and create a password. They will need to have a mobile phone number on record. If they do not have a mobile phone number on record, they will need to contact the Help Desk. In the event a user requires assistance from Help Desk staff in resetting their password, upon verifying the user's identity, the temporary password the Help Desk provides can only be conveyed to the user in person or on the phone. It will not be sent through email. This temporary password will also require the user to immediately change the password upon first use. The requirements are made available upon changing your password.

Password Storage
Passwords must never be stored in clear text. Users must not 'hard code' any username/passwords in scripts or clear text files such as system shell scripts, batch jobs, or word processing documents.

For all employees, passwords should not be stored in plain text in word processing documents or elsewhere. For assistance managing passwords, contact the Help Desk for advice on best practices and tools available.

Locking Accounts
Users should never use their F&M username and password on other systems not managed by the College or not used exclusively for College business. In the event an F&M username is discovered in a security breach on the Internet or has been compromised, the account may be immediately locked and require a password change to regain access.

Multifactor User Responsibility
Users must register a supported device or alternative method of authentication to provide an additional factor for authentication. This additional factor may or may not be required at every login regardless of time, location, or circumstance. Failure to register a device or alternative method of authentication will prevent access to the systems protected by multifactor authentication.

Users must promptly report the theft, loss, or unauthorized use of their registered device or alternative method of contact to the helpdesk.

Authorized personnel may monitor transmissions from the registered device or alternative method of authentication in the course of performing routine maintenance or troubleshooting problems.

Exceptions
The CIO or CISO may approve, in advance, exception requests to this policy based on the perceived threat to the College's information assets. Any exemptions granted will be reviewed periodically and may be revoked at any time.

-----
Policy Maintained by: Information Technology Services, Vice President and Chief Information Officer
Last Reviewed: January 29, 2024