Page
86
Finding 20: KSU Did Not Implement Adequate Password and Identification Controls
KSU did not implement adequate identification and authentication (IA) controls for their Network, the Banner accounting system, and ADP payroll system. IA is critical to securing organizational information; it focuses on the assignment and management of accounts to users and devices.
Unlike ADP, the KSU network and Banner do not automatically require users to change their passwords at initial login. As a result, the user's default password, which is set by KSU, can be used for 180 days until the password expires. KSU provided a listing of 417 users that have a KSU network account. Of the 417 listed, 47 users, or 11.3 percent, had not changed their password since their account was created. As such, they are using the default password provided when their account was created. 11.3 % of KSU network account users had not changed their password since their account was created.
11.3 % of KSU network account users had not changed their password since their account was created.
KSU has password complexity requirements in place for the KSU network, Banner, and ADP. The Network and Banner passwords must:
be at least 12 characters in length.
contain at least one of the following:
Upper-case alphabet character (e.g., A, C, Q, etc.) or
Special character (e.g., *, %, !, etc.) or
Numeric character (e.g., 1,2,4, etc.)
Network and Banner passwords cannot match the last 3 passwords used.
ADP passwords can range from 8 to 64 characters in length and must contain one or more characters from the following:
English uppercase or lowercase letters (e.g., A,B,C,...,Z or a,b,c,...,z)
Westernized Arabic numerals (e.g., 0,1,2,...,9)
Use of mixed case and special characters is permitted, but not required. All special characters on the keyboard are accepted. In addition, ADP passwords cannot match the last 4 passwords used.
Neither complexity requirement setting agrees with Commonwealth Office of Technology (COT) standards, which adhere to the National Institute of Standards and Technology (NIST).
In addition, ADP applicant and self-service user accounts are suspended 480 days after creation and 480 days after last login if no activity. Administrator accounts are suspended 365 days after last login if no activity. These settings are also not in agreement with COT standards.
Furthermore, KSU has not documented the formal naming convention of IDs to be used by the Network, Banner and ADP. The naming convention of Network, Banner and ADP IDs is FirstName.LastName. However, the Banner user listing shows all IDs are setup as FirstName_LastName. KSU stated that Oracle does not allow periods in the naming convention; therefore, underscores were used instead. Multiple naming conventions are used for ADP. Review of the ADP user listings revealed IDs used could include the user's email address, initial of first name followed by the last name, an 8-digit number (i.e. 10040621), a combination of letters and numbers (i.e. APOSTLE_11008065), or a name that included all letters (i.e. RUHRI).