801014r8.pdf

UNCLASSIFIED

NI 8010.14R8 Approved: September 2008 Subgroup: Information Assurance

NGA Instruction for Password Administration

1. References.

a. Primary. NGA PD 8000R3, Policy Directive for Information Management and the Chief Information Officer, 24 November 2003.

b. Secondary references are listed in appendix 1.

2. Purpose. Provide policy and procedures for password administration. This instruction supersedes NI 8010.14R6, Password and Global Address List Administration, 18 October 2006.

3. Policy. NGA will ensure that only authorized users have access to NGA computer systems.

4. Applicability and Scope. This instruction applies to all organizations and to all personnel who have access to NGA computer systems. A phased implementation approach for strong passwords will be used across the information technology environment.

5. Definitions. Terms used in this instruction are generally understandable in their context.

6. Responsibilities.

a. The Office of the Chief Information Officer (OCIO), Information Security Management Division (OCIOCS) administers access control for the NGA Exploitation System (NES) and the NES Information System (NIS).

b. The Security and Installation Operations Directorate (SI), Security Office (SIS), Computer Investigation and Analysis Division (SISCI) reports violation investigation findings to Agency leadership for resolution.

c. The Enterprise Operations Directorate (E) administers access control for all other Sensitive Compartmented Information (SCI), collateral, and unclassified systems.

d. The SIS Personnel Security Division (SISP) administers security clearances and immediately notifies the supervisor for civilian and military personnel and the contracting officer’s representatives (CORs) for contractor personnel when an individual’s security clearance is suspended.

NI 8010.14R8

Password Administration

e. The Office of International Affairs and Policy (OIP) reviews and approves requests for SBU system access by foreign users assigned to work in NGA facilities prior to request acceptance by the E SBU System Administrators (SAs).

f. Supervisors and CORs request that E or Information Assurance Certification Authorities (OCIOCSIC) (depending on the type of system, as specified in paragraph 6.a. or 6.b.) give new users access to systems, certify need-to-know, and notify the relevant organization regarding any change in the user’s status.

g. SAs provide userids and passwords functions.

h. Information Assurance Officers (IAO) audit accounts to identify anomalies.

i. Users request, establish, and maintain their individual passwords and upon leaving the Agency (or upon reassignment within the Agency), inform the IAO to request removal from NGA systems.

7. Procedures. During the phased implementation approach, program managers must request from the Designated Accrediting Authority (DAA) an exception for systems not in compliance. If an exception is requested, program managers must provide the Enterprise Configuration Control Board a Request for Change and a clear and definitive plan to phase the system to the strong password use. All systems must include the strong password requirement in their System Security Authorization Agreement (SSAA).

a. Default passwords. Before placing a system in service, the SA must replace all standard or default vendor passwords with organizational passwords. Whenever possible, password functions are automated.

b. Initial password and operational password assignment. SAs assign an initial password for each userid which is changed to an operational password by the user at first logon.

c. Password characteristics. Users must create strong passwords following the guidance in appendix 2.

d. Password classification. Users should memorize their passwords and not record them on any medium. If passwords must be written for classified systems, they must be placed in a sealed envelope, stored in an approved container or room approved for the data level on the system, and protected at the highest level of information accessed when using that password.

e. Logon to system. Users are required to have their identity authenticated at logon by using their Common Access Card (CAC) and pin number on the

Sensitive But Unclassified (SBU) Network and userids and passwords on classified networks.

f. User lockouts. After three consecutive logon attempts a workstation is “locked out” and remains so until access is restored by an SA or the Enterprise Service Center. Only two unsuccessful attempts are allowed within a 120-minute time period. The IAO is required to monitor frequent lockouts of users by reviewing the system audit accounts. Frequent lockouts may indicate that a penetration attempt is in progress and may warrant investigation and possible corrective action.

g. Password change authorization. Individual users must change their own password when prompted by a system to do so. Otherwise, SAs notify users to make password changes and then audit to confirm compliance. Passwords must be changed every 60 days. Users, other than the IAO and SA, are permitted to change only their own passwords. The system is set to remember 5 or more passwords for an individual and not allow reuse.

h. Shared or group passwords. These are not authorized unless specifically approved by the DAA. Any decision must be based on a compelling need, adequate justification, and the fact that they are included in the SSAA.

i. Superuser privileges. These specific privileges are restricted to the SA and specific privileged individuals who perform system maintenance and administration. An annual assessment is required to ensure that only those who requirement superuser privileges maintain them.

j. Removal of users from systems. Passwords are disabled or cancelled upon a significant change in a user’s status such as reassignment, transfer, retirement, or loss of a security clearance. Users notify the Enterprise Service Center and the relevant IAO of their date of departure or reassignment. Supervisors and CORs confirm that the Enterprise Service Center and the IAO are notified. IAOs notify the SIS Public Key Infrastructure Registration Authority. The Enterprise Service Center contacts the relevant SA regarding the user’s change in status. SAs ensure that the user’s access is promptly removed from all NGA systems.

k. Inactive accounts. For any account on a specific system not accessed for 60 days, the Enterprise Operations ISP Core Services Office (ES) disables the account, but does not remove it from the system until account disposition is determined by checking with either the user’s office or with the COR. Users who know that they will only sporadically access a system, such as personnel on long-term training, must notify the Enterprise Service Center in advance so that their accesses remain active.

l. Disabled accounts. SAs delete disabled accounts after 60 days. SAs and IAOs perform quarterly checks to ensure user accounts are disabled and deleted.

m. Electronic file review. Personnel leaving a position must review all of their electronic files, deleting those files (with supervisor or, if a contractor, COR approval) that are not official records and are no longer needed and deleting those files that are official records but are not required to be kept. To determine what comprises an official record refer to the web site http://osis.nga.mil:80/ciohome/NRMP/rindex.html. Personnel must indicate those official electronic files that are for retention and disposition according to NI 8040.1R9 (reference 1.b.(5). They must also transfer to their supervisor or coworkers their shared files, any electronic files that might be useful to someone else who works in the same business area.

http://osis.nga.mil/ciohome/NRMP/rindex.html

NI 8010.14R8 Appendix 1

Appendix 1 References

1. Director of Central Intelligence Directive (DCID) 6/3, (U//FOUO) Protecting Sensitive Compartmented Information Within Information Systems, 3 May 2002.

2. DoD Directive 8500.1, Information Assurance (IA), 24 October 2002.

3. DoD Instruction 8500.2, Information Assurance (IA) Implementation, 6 February 2003.

4. Joint Task Force – Global Networks Operations, Communications Tasking Order 07-015, 11 December 2007.

5. NI 8040.1R9, NGA Instruction for Records and Information Life-Cycle Management, 30 August 2005.

6. National Geospatial-Intelligence Agency, Security Classification Guide, classified, 25 March 2008.

NI 8010.14R8 Appendix 2

Appendix 2 Password Guidelines

Strong Password Construction

a. Is at least fourteen characters long.

b. Contain all of the following items at a minimum:

(1) One upper case characters: A-Z

(2) One lower case characters: a-z

(3) One numerals: 0.1.2.3.4.5.6.7.8.9

(4) One non-alphanumeric (symbol) characters: !@#$%^&*()_ +|~-

c. Is not a word in any language, slang, dialect, or jargon.

d. Is not based on personal information or names of family.

e. Is easy to remember.

(1) One way to do this is create a password based on a song title, affirmation, or other phrase. For example, the phrase might be: "This May Be One Way To Remember" and the password could be: "TmB1w2R!!" or "Tmb1W>r~!" or some other variation. NOTE: Do not use either of these examples as passwords.

(2) Use symbols instead of characters

(a) @ for an a

(b) $ for an s

(c) ! for an I or L

(d) 3 for an E

Appendix 2 Password Guidelines