General Requirements:

1. Password policy must be followed upon creation while observing the following rules:

·       All passwords must comply with this policy.

·       Username or password fields must not be left blank.

·       Passwords must be sufficiently strong.

·       Password management systems must be interactive and verify password quality.

·       Passwords must include all of the following:

-         Lowercase English letters.

-         Uppercase English letters.

-         Numbers.

-         Special characters (such as @#$%^&*()! +|~-=` {} []:";'<>/ etc.).

·       Weak passwords contain the following characteristics and must be avoided:

§  Less than ten (10) characters in length.

§  A word that can be found in a dictionary (Arabic or English).

§  Commonly used words such as:

§  Names of family, friends, colleagues, pets, etc.

§  Terms, names, commands, sites, companies, devices, and software related to computers.

§  Birthdays and other personal information such as addresses and phone numbers.

§  Number or word patterns such as aaabbb, qwerty, zyxwvuts, 123321, etc.

§  Reverse of the patterns above.

§  Any password mentioned above preceded or followed by a number (e.g., secret1, 1secret).

·       Passwords must be created in a way that makes them easy for the owner to remember and avoids writing them down. (For example, creating a password based on a statement or phrase. The phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!" or "Tmb1W>r~", etc.).

Note: None of these examples may be used as an actual password.

·       Temporary passwords (set by administrators of many information processing systems) must comply with this policy.

·       Where possible, biometric techniques should be used to spare end users from remembering long passwords.

2. Policy for Affiliates (Faculty Members and Staff) at King Saud University:

·       Passwords must not be less than 10 complex characters.

·       All inactive government employee accounts in the system will be disabled with the option "Suspended" if no login occurs within the last 6 months.

·       Accounts of contracted university employees will be disabled if no login occurs within the last 6 months, excluding resigned or terminated employees.

·       Contractor accounts will be deleted after one year if not reactivated within 6 months of being disabled.

3. Student Password Policy:

·       Passwords must not be less than 10 complex characters.

·       Passwords must remain valid for 4 months.

·       Password complexity must meet the requirements stated in this policy.

4. Passwords must be protected by observing the following rules:

·       All passwords are considered "confidential" and must not be shared or disclosed.

·       Accounts containing system-related passwords must not be used for daily activities and should be stored in a Privileged Access Management (PAM) tool.

·       Passwords must not be written in emails or other electronic communication methods such as social media.

·       Passwords at the university must not be shared with anyone, including IT support staff, administrative assistants, secretaries, managers, team members, faculty members, family members, or others.

·       Users must not hint at the structure of their password (e.g., "My password is my family name").

·       Users must not disclose their passwords in surveys or security forms.

·       If anyone requests a user’s password, the user must refer them to this document and direct them to the General Directorate of Cybersecurity.

·       If there is suspicion of any account or password being compromised, it must be reported to the university’s General Directorate of Cybersecurity.

·       All system passwords (e.g., root accounts, network administration, application management, etc.) must be changed at least every three months.

·       All user passwords (e.g., email, web, etc.) must be changed every three months.

·       All passwords must be unique. Users are not allowed to reuse the last six (6) passwords.

·       Users must be locked out after ten (10) unsuccessful login attempts. Locked accounts can only be unlocked by the system administrator.

·       A progressive delay must be enforced after each failed authentication attempt (e.g., 5 seconds after the first failure, 10 seconds after the second, 20 seconds after the third, etc.).

·       Users must exercise extreme caution when entering passwords and ensure they are typed in the designated password field.

·       Users must be aware of common password theft methods such as phishing, social engineering, shoulder surfing, etc.

·       Users must not include passwords in any automated login processes, such as storing them in macros or function keys.

·       If a password is changed or reset and the user did not request it, they must notify the IT support team immediately.

5. Passwords must be stored by observing the following rules:

·       Passwords are classified as confidential and must be protected accordingly.

·       Access to password files must be restricted, and stored passwords must be hashed and encrypted rather than stored in plain text. All data processing systems must retain a password with a predefined validity period.

·       All information systems must, where technically feasible, maintain a history of previously used passwords for each user account.

·       Passwords must not be stored in a manner that allows unauthorized viewing, such as written on desks or displayed on screens.

·       Plaintext passwords must not be included in application files, user files, file transfer settings, etc.

·       Password files must be stored separately from core application system data.

·       The "Remember Password" option in applications (e.g., Outlook) must always be disabled.

·       Privileged Access Management tools must securely store, retrieve, and manage administrative account passwords. Access to this system is restricted only to authorized system administrators.

6. Passwords must be changed by observing the following rules:

·       All data processing systems must enforce users to change their passwords after their first login.

·       System administrators must enforce users to change their passwords after a reset.

·       All data processing systems must enforce users to change their passwords periodically after a predefined period.

·        Default passwords on devices, operating systems, and applications must be changed before deployment.

·       Passwords must be changed immediately in case of a compromised user account or if data leakage is discovered or suspected, and such cases must be reported as incidents.

·       When university employees/contractors leave the university, their accounts must be deleted, or their passwords must be changed immediately.

·       If the end user wishes to change their password, they must enter their current password to verify their identity before setting a new one.

Application Passwords must follow these rules:

Application developers must ensure their programs contain the following security precautions:

·       Applications must support individual user authentication and not group authentication.

·       Passwords must not be stored in plain text or any reversible form.

·       Applications must support the university’s password policy enforcement.

·       Task management features must be provided so that one user can take over another user’s tasks without needing to know their password.

Mobile Passwords must follow these rules:

The following minimum password standards must be applied to all King Saud University employees who use mobile services provided by the university through the Mobile Device Management (MDM) tool.