info9000-1205-7-1-00-SOP.doc

SBA Information NoticePRIVATE

TO:

ALL EMPLOYEES

CONTROL NO.:9000-1205

SUBJECT

Electronic Mail (E-Mail) Passwords EFFECTIVE: 4-13-00

The Small Business Administration (SBA) recently commissioned an independent security study on all SBA servers. The report indicated that several users had not changed their e-mail password since the inception of Microsoft’s e-mail system at SBA. This practice does not meet SBA standards for maintaining a secure computing environment.

What measures will be implemented to improve the e-mail security environment?

To improve SBA’s e-mail security environment, passwords will now be changed on a regular basis in accordance with SBA Standard Operating Procedure #90-47 (Draft) that states:

· All accounts must be password protected.

· Passwords must be a minimum of six characters.

· Passwords must automatically expire every 90 days.

When will this policy go into effect?

Beginning April 20, 2000, users will be required to change their e-mail passwords every 90 days.

Should I change my password before the policy goes into effect?

Absolutely! All users who have not changed their password in the 90 days preceding April 20th should take this opportunity to do so. Once the system is configured to automatically expire passwords over 90 days old, it will inform you that your password has expired and force you to change it immediately.

How do I change my e-mail password?

Attached is an Office of the Chief Information Officer (OCIO) TechNote on “Changing Your Outlook Password.”

What should I do if I fail to change my password in time and I cannot access e-mail?

You should alert your Information Resources Manager (IRM) or LAN Administrator to the problem. Your IRM will contact the Field Information Technology Specialist (FITS) who

EXPIRES:7-1-00

supports your office. The FITS will reset your password so that you can access your e-mail account. Headquarters LAN Administrators will do the same by contacting the technical support staff at the HQ Help Desk. When you are notified that your password has been reset you should access the e-mail system and proceed to change your password.

Will the e-mail system alert me whenever it is time to change my password?

Yes. You will receive a warning that will advise you of the number of days left before your password expires.

Will I be able to use the same password multiple times?

No. The system will require you to use unique passwords.

Will the system provide me with multiple opportunities (grace logins) to change my password?

No.

PLEASE REMEMBER:

· DO NOT SHARE YOUR IDs OR PASSWORDS WITH ANYONE! Your ID and password are issued for your personal use. There is no legitimate reason for anyone to ask you for your password.

· Under no circumstances should you reveal your password to anyone, including security personnel within SBA. (If they are security personnel they can either (a) get your password themselves, in the case of mainframe passwords, or (b) issue you a new password).

If you need additional information concerning security matters, please contact Howard Bolden, Agency Computer Security Program Manager, at 202-205-7172. If you require assistance please call the HQ helpdesk at 202-205-6400.

Lawrence E. Barrett

Chief Information Officer

Attachment

EXPIRES: 7-1-00

Changing Your Microsoft Outlook 98 Password from the Login Screen

Double click on the Outlook Icon. The following screen will appear. Make sure the user name is correct. Enter all information and click on the Change Password Box.

The following screen will appear. Enter all information. The Exchange server name varies depending on your location. Headquarters staff and remote users should enter NTHQ3 as their Exchange server. Field Office personnel should contact their Information Resources Manager (IRM) for the name of their Exchange server. After all information has been entered Click on the OK button.

A message box will appear indicating that your password has been changed successfully.

Complete the steps below to change your password from within Outlook 98:

The following steps are used to change your password while you are in Outlook98:

· Click on the "Tools" menu

· From the Tools menu, Select "Options"

· From the Options dialog box, Select the "Other" Tab

· Click on the "Advanced Options" button

· From the "Advanced Options" dialog box, Click on the "Custom Forms" button

· Next, Click on the "Password" Button

· A "Change Windows NT Password" dialog box will appear.

· Fill in the requested Password Information:

· In the "Username" field: enter your username, ie: irakram

· In the "Domain" field: enter your domain name, ie: SBA

· In the "Old Password" field: enter your current password, ie: ******

· In the "New Password" field: enter the desired password: ******

· In the "Confirm New Password" field, re-enter the desired password: ******