Information Technology Services

Account Management Procedure

The University of North Carolina at Greensboro

Policy Reference: Acceptable Use of Computing and Electronic Resources
Approved: November 30, 2006
Document Maintainer: Associate Vice Chancellor, ITS - Systems and Networks

Purpose

Computer service accounts are the main mechanism governing access to UNCG entities for data services. Accounts serve two specific purposes: to identify and prove that the right individual is using the account and to grant access according to least privilege to data and services.

Accounts are unique to the individual for the purposes of access control, accountability, and auditing. This procedure addresses the following sections of the related policies:

Acceptable Use of Computing and Electronic Resources Policy

Section III.A
"Students and employees are permitted to use University-owned machines in computer labs and in public locations after authenticating with the central account database. Any public non-authenticated access will be restricted to limited network resources for specific, defined purposes."

Section III.C.i.e.
"Revealing account passwords to others or allowing use of accounts by others. This includes family and other household members."

Section III.C.i.g
"Originating from any University account or equipment commercial offers of products, items, or services in violation of the Umstead Act."

Section III.C.i.h.
"Effecting security breaches or disruptions of network communication such as accessing data of which the employee is not an intended recipient, logging into a server or account that the employee is not expressly authorized to access, attempting to intercept others’ passwords, or impersonating another user."

Section III.C.i.k
"Circumventing user authentication or security of any host, network, or account."

Security of Networks and Networked Data Policy

Section III.A.iv.d
"Do not allow others to use a workstation when logged in with your authentication credentials."

Section III.A.iv.g
"Employ mobile device startup password protections."

Section III.B
"Passwords are an important aspect of computer security. Passwords represent the front line of protection for all user accounts. A poorly chosen password may compromise UNCG’s entire network.

• General Requirements
  • System or user-level passwords must be changed on the currently recommended standard periodic basis.
  • Passwords must be kept secure, and sharing of accounts is prohibited. Authorized users are responsible for the security of all assigned account and equipment activity and should follow security procedures determined by ITS standards.
  • User accounts that have system-level privileges through some form of group membership or other implementation must have a unique password from other accounts held by that user.Passwords must not be inserted into email messages or any other form of electronic communication.
  • All manufacturer default passwords must be changed before network connection.
  • The use of ITS enterprise authentication services is required.
• Application Developer Requirements
  • Application developers with applications containing passwords, shared secrets, or key phrases contained within should adhere to the following guidelines:
    • Support authentication through ITS enterprise authentication services.
    • Support authentication of individual users and not groups.
    • Must not store passwords in clear text or any form that is reversible

 Section III.C.iv
"All remote access will be encrypted and authenticated using ITS enterprise authentication services."

Section III.E.iv
"Faculty and staff must not share their account information with non-affiliates."

Enterprise Systems Policy
"...accessible through a single log-in, and back-ended (where appropriate) with a common database."

Scope

This procedure covers the following University accounts:

• Novell/LDAP directory
• ADS domain account
• Blackboard
• UNIX
• VMS
• Banner/UNCGenie
• Lotus
• Any other UNCG computing account not listed above

Responsible Parties

• Faculty/Staff
• Students
• Non-Affiliates
• Guests

Procedure

Account management follows the industry lifecycle:

• Gathering user details
• Vetting
• Account creation
• Access of least privilege
• Access logging
• Password management
• Account expiration
• Database audit
• Deactivation
• Expulsion