If anyone asks a user for their password, they are obligated to report this to ITS Security as a security incident.Į. Passwords must not be shared for any individual accounts, including with IT support professionals, and only shared for other account types as defined in UI Identity and Access Management ( APM 30.10) to the minimum extent required. All passwords must be changed at first issuance or use.ĭ. Passwords are confidential university information and should never be stored electronically without strong encryption.Ĭ. Passwords should not be written down and/or left in an easily accessible location.ī. Users are responsible for keeping passwords and all other types of authentication secure and confidential, including not sharing or storing passwords in an insecure manner. All authentication types must be secured as appropriate for the level of risk.Ī. Consistent with the university’s requirements for identity and access management, users must protect the integrity of their authentication methods, for all UI technology resources requiring their authentication. Multi Factor Authentication (MFA): Using two or more authentication factors: typically passwords, biometrics, or tokens, to achieve authentication.ī. Personal Identification Number (PIN): a short number or password used locally on a device as a convenient authentication alternative to typing a full password.Ī-7. API Token: for purposes of this policy, an application program interface (API) token is a unique, long, token or key that may provide authentication for an application to access another service or application.Ī-6. Geolocation: for purposes of this policy, geolocation refers to the process of identifying the locations of a user based upon the known locations of their Internet Protocol (IP) addresses, or from data collected from their authenticated devices with built-in location detection.Ī-5.

Token: a hardware or software device that can be cryptographically verified as unique.Ī-4. Biometric: unique physical or behavioral characteristics of a person that can be analyzed to uniquely identify and authenticate a person to an account for accessing a technology resource.Ī-3. Long forms of passwords are sometimes called a passphrase.Ī-2. Password: a combination of letters, numbers, symbols, and special characters that can be used to authenticate a person to an account accessing a technology resource. Below are the most common types of authentication used at the university.Ī-1.

This policy establishes authentication requirements for the use of University of Idaho technology resources.Ī. Preamble: Authentication of users and applications, accessing or processing data is a fundamental requirement of information security to ensure confidentiality and integrity of data.

User authentication policy