Encouraging good passwords

ABSTRACT

This paper describes an assignment to non-computer science majors aimed at improving students' password selection and management practices. The study analyzes student passwords based on an anonymous questionnaire. Results indicate the majority of students either had changed or plan to change their passwords following the assignment to meet good password guidelines. The analysis revealed three guidelines that were not being followed that need additional emphasis when presenting good password guidelines: not using personal information in passwords, frequently changing to a new password, and using a mix of lower and upper case letters, numbers and special characters.

REFERENCES

• 1: Barnett, S. Biometrics: get ready to destroy all passwords. BIOS Magazine. http://www.biosmagazine.co.uk/op.php?id=81 (Jan 20, 2004).
• 2: Akhilesh Chandra , Thomas Calderon, Challenges and constraints to the diffusion of biometrics in information systems, Communications of the ACM, v.48 n.12, p.101-106, December 2005 [doi>10.1145/1101779.1101784]
• 3: Foster, A. Insecure and Unaware. The Chronicle of Higher Education, 50, 35 (May 7, 2004). 33--35.
• 4: Frank H. Katz, The effect of a university information security survey on instruction methods in information security, Proceedings of the 2nd annual conference on Information security curriculum development, September 23-24, 2005, Kennesaw, Georgia [doi>10.1145/1107622.1107633]
• 5: Lucas J. and Moeller B. The Effective Incident Response Team. Addison-Wesley Professional, Boston, MA, 2004, 25.
• 6: Stanton, J., Stam, K., Mastrangelo, P., Jolton, J. Analysis of end user security behaviors. Computers & Security, 24 (2005), 124--133.
• 7: Jeff Yan , Alan Blackwell , Ross Anderson , Alasdair Grant, Password Memorability and Security: Empirical Results, IEEE Security and Privacy, v.2 n.5, p.25-31, September 2004 [doi>10.1109/MSP.2004.81]

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.3 COMPUTERS AND EDUCATION
      K.3.2 Computer and Information Science Education

Additional Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.0 General
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)

General Terms:
Human Factors, Security

Keywords:
access control, active learning, computer fluency, computer literacy, computer security, passwords, security training, students, user awareness