UBITName Password Policy Revised

The University at Buffalo is committed to ensuring the confidentiality, integrity, and availability of its online information technology (IT) resources and information systems. Digital credentials are a fundamental component of the university’s approach to information security. A UBIT digital credential is composed of a UBITName and its associated password. UBITName account holders must create strong passwords and protect password privacy to prevent and minimize compromised digital credentials.

A UBIT digital credential:

• Is classified as Category 1 – Restricted Data
• Must not be shared or disclosed
• Must be protected from unauthorized use
• For a group account, the digital credential may be shared or disclosed only with those who are authorized to access the group account

UBIT passwords must be:

• Unique to a person's UBITName account
• Different than the password used for any other account, including personal accounts not associated with the university
• Secure
  • Password guidance is available at Creating a Secure UBITName Password or Passphrase

The policy was updated to:

• Revise the following:
  • Policy Statement
    ▫  State the university’s commitment to ensuring the confidentiality, integrity, and availability of its online information technology (IT) resources and information systems
    ▫  State the requirements of UBIT digital credentials and passwords
    ▫  Include a reference to creating a secure UBITName password or passphrase
  • Background section
    ▫  Include examples of protective or corrective measures
• Remove the following sections:
  • Password Strength Requirements
  • Password Refresh (Aging)
  • System Requirements
• Add the following sections:
  • Sanctions
  • Definitions
  • Responsibility

This policy applies to all individuals with customer accounts and system accounts in any university IT system capable of interfacing with university authentication systems.