• Home
  • Report an Incident
  • Read Bulletins
  • Discuss Viruses
• Articles & Guides
  • For Everyone
  • For Sysadmins
  • For IT Managers
  • Recent Articles
• Resources
  • External Advisories
  • Vendor Information
  • Further Reading
• Tools
  • Network Scanner
  • Web Scanner
  • Certificate Authority
• Training
  • LSP Services
  • Unix Systems Support Group
  • Windows: End-User Security
  • Awareness and Education
  • SANS Partnership Series
• About
  • Contact Information
  • ITSO Staff
  • Mission Statement
  • Recent Changes
  • Site Index
  • Colophon
• Search

Protecting Your Personal Computer Accounts

Here are a few tips on keeping attackers out of your personal accounts on central and departmental computing systems.

Why it's important

Occasionally, intruders attempt to gain access to shared computer systems through the accounts of others. Their motives vary from curiosity to criminal malice. At risk are:

Your files

An intruder can steal, modify, or destroy the information you keep in your account on the shared computer. The privacy of your e-mail and other personal files is also at stake.

Your reputation

An intruder can send slanderous, defamatory, or otherwise embarrassing e-mail from your account under your name. An intruder could also store material in your account that would implicate you in illegal or unethical acts, such as software piracy. If an investigation ensued, you might have to prove it was not actually you who was using the account.

University computing resources

The motivation of many intruders is to use your account as a staging ground for broader intrusions into IU computers. While we protect our systems with the latest technology and constantly monitor the development of any threat, intruders still view individual accounts as possible entry points. You can help protect everyone's resources by keeping your account secure.

These are very real risks. Intrusions such as these have actually occurred at IU. Following the suggestions listed here will substantially reduce your risk.

Your responsibilities

When you accepted your computer accounts at IU, you agreed to use the university's computing resources responsibly. A major part of "responsible use" is protecting your computing accounts.

It's up to you to maintain the security and confidentiality of your computer accounts and the information you store in them. The agreement you signed on receiving your accounts included the following points:

• Your computer accounts, passphrases, and other types of authorization are assigned to you; you should never share them with others.
• Select an obscure account passphrase and change it every six months.
• Protect your accounts. Log out when you're finished using them.

You'll read more about these issues below. The main point to remember is this: You are responsible for the security of your computer accounts.

For the full text of the statement of your responsibilities as a user of IU's computing resources, see Computer Users' Privileges and Responsibilities.

What you can do

Log out!

Problems arise when you fail to log out of your accounts before leaving any computer that is accessible to other people (including computers in public labs, offices, and shared housing). This leaves your account open to abuse by hijacking. Anyone can sit down at that computer, continue working from your account, and do damage to your files or use your account illicitly. Please remember to log out of your account whenever you leave a computer to avoid misuse by others.

Your Passphrase

To create a strong passphrase:

• Use at least 4 words, the longer the better, as long as you can remember it.
• Use randomly selected words or intentionally misspell one or more words in the passphrase.
• Don't use personal data, such as your middle name, birth date, Social Security Number, phone number, address, or any other data which may be on record.
• Don't use easily guessed phrases like to be or not to be, the early bird gets the worm, or april showers bring may flowers.
• Use upper- and lowercase carefully. Most systems consider a to be different from A. Make sure your Caps Lock key is not on.

To make a good passphrase work:

• Never share it with anyone, not even people you trust. Sharing passphrases increases the odds of them getting stolen.
• Never send it in an e-mail message.
• Don't keep the same passphrase for more than 6 months. If you need help changing your passphrase, see the IU Knowledge Base document At IU, how do I change or synchronize my Network ID passphrase?

Report a problem

If you believe the security of your account has been compromised, change your passphrase immediately and contact the help desk on your campus.