Finding 20: KSU Did Not Implement Adequate Password and Identification Controls

Recommendations:

• KSU configure their Network and Banner to require passwords to be changed prior to first use.

Response: KSU has implemented this recommendation.

• The Network, Banner, and ADP require passwords to be changed at least every 60 days for all privileged accounts and every 90 days for all non-privileged accounts.

Response: KSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards, employing multi-factor authentication and complex password requirements. Following the guidelines of NIST Special Publication 800-63B, there is no longer a need for passwords to automatically expire. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable.

• Banner passwords be required to contain both alphanumeric and special characters. The password history for both Banner and ADP should be increased to 24 passwords.

KSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards, employing multi-factor authentication and complex password requirements. Following the guidelines of NIST Special Publication 800-63B, there is no longer a need for passwords to automatically expire. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable.

Response: KSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards. NIST Special Publication 800-63B does not make a recommendation regarding password history settings. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable.

• KSU document the naming convention of Banner and ADP user IDs within a written policy. KSU should then regularly monitor user IDs established within Banner and ADP to ensure these adhere to the naming convention established within this policy.

KSU has not implemented this recommendation. The University's Network, Banner, and ADP passwords adhere to the latest industry standards. NIST Special Publication 800-63B does not make a recommendation regarding password history settings. KSU has compared its standards with other Kentucky Higher Institutions and found them to be comparable.

Response: KSU has implemented this recommendation. Information Technology has drafted a Banner and ADP guideline which documents the naming convention and is currently reviewing user IDs to ensure these adhere to the established naming convention.

KSU has implemented this recommendation. Information Technology has drafted a Banner and ADP guideline which documents the naming convention and is currently reviewing user IDs to ensure these adhere to the established naming convention.

Sixty-Day Management Response can be found here.

Kentucky State University – APA Special Examination 90-Day Response –