![](media/image1.png){width="4.166666666666667in"
height="4.166666666666667in"}

**NATIONAL LABOR RELATIONS BOARD (NLRB)**

**ACCESS CONTROL STANDARDS**

**PASSWORD MANAGEMENT**

# August 13, 2001

**Foreword**

This Password Management Standard is mandatory and applies to all
individuals, and entities that process, store, or transmit any National
Labor Relations Board (NLRB) information. It contains the minimum
requirements for ensuring appropriate protections are afforded to the
NLRB enterprise. The Division of Administration, Information Technology
Branch (ITB), currently manages the majority of the NLRB systems
operations. The NLRB organizational structure consists of 19 divisions,
offices and staff's within the agency, hereafter referred to as Office
or Offices.

This standard contains detailed information about the types of passwords
in general use, vulnerabilities associated with passwords and the
controls that may be imposed to address the vulnerabilities, operating
standards, and configuration information for specific operating systems.
New operating systems and configurations will be added as they are
developed.

Offices that cannot meet the minimum requirements must request a waiver.
Waivers to individual standards may be obtained by submitting, in
writing to the NLRB Chief Information Officer (CIO), detailed
information stating business, technical, or other issues associated with
implementing the standards and the alternative countermeasures that will
be put in place to ensure that the NLRB enterprise security profile is
not degraded.

Questions or comments concerning this document should be addressed to
the NLRB Information Technology Security Office on 202-273-0766.

1.0 Password Management

1.1 Password Usage

The purpose of this document is to provide a set of minimum-security
standards to be implemented agency-wide for passwords used to
authenticate access to National Labor Relations Board (NLRB) information
systems. Offices may impose more stringent security measures.

Currently within the NLRB, passwords assigned to individual users are
the primary means used to authenticate a user's access to computer
systems. Passwords are the first technical line of defense against
unauthorized access. Specific techniques used to bypass password
controls are described in section 3.0, Password Vulnerabilities and
Compensating Controls.

Technology has changed considerably since the National Institute of
Standards and Technology (NIST) published the Federal Information
Processing Standard (FIPS) 112, "Password Usage", published in 1985. Due
to changes in technology, the latest guidance from NIST, and within the
industry, indicates that the traditional password, particularly in the
telecommunications environment, no longer provides adequate security.
Within the IT industry, there is a trend towards the use of tokens or
\"one-time\" passwords. This standard addresses those changes.

This standard is a basic reference document for general use, applicable
to all agency offices supporting information technology (IT) processing
activities. This standard is applicable to all users of IT systems
within or supporting the agency.

1.2 Use of Cryptography for User Authentication

The use of Cryptography or Cryptographic Exchange that meets the Federal
Information Processing Standard (FIPS) Publication 140-1, Security
Requirements for Cryptographic Modules, may be used instead of passwords
to authenticate user access to systems.

1.3 Use of Passwords to Protect Data

In addition to passwords, NLRB systems will use algorithmic and
view-based access controls implemented by operating systems, security
subsystems, or database management systems (e.g., file attributes,
access control lists, security rules, object-oriented security labels,
database sub-schemas) to control access to data. Due to the potential
risks associated with uncontrolled password dissemination and the need
for shared data access, the use of passwords as a primary means of
controlling access to data is prohibited. Password protection may only
be used as an adjunct to these methods and is not recommended.

1.4 NLRB Password Implementation Minimum Standards

All stored passwords must be encrypted using an approved encryption
method. Passwords must not be displayed on the monitor.

1.4.1 Minimum Password Length

All passwords must be at least **eight** characters in length. Due to
technology vulnerabilities associated with the use of passwords for
authentication, this minimum has been set in excess of the FIPS
requirement. Passwords must be composed of representatives of at least
two of the following character sets: upper case English; lower case
English; numeric characters; and special characters. It is strongly
recommended to use at a minimum three of the character sets.

1.4.2 Password Lifetime

All passwords will have a maximum password lifetime of 90 days. Systems
must have an automated mechanism to ensure that users change their
passwords at an interval not greater than 90 days. In addition, user IDs
are to be suspended after three invalid password attempts.

1.4.3 Initial Password

An initial password is a password defined by a system administrator or
computer systems security officer and given to a user to enable access.
FIPS 112, section 3.5, Ownership, requires that \"personal passwords
used to authenticate identity shall be owned (i.e., known) only by the
individual who created the private data.\" Therefore, agency systems
must have the ability to allow new users to change their passwords after
initial access to a system. Systems must be configured to require the
user to select a new password after signing on with an initial password.
Any operating system or applications system \"feature\" that would allow
a system administrator to view passwords must be disabled. All system
default passwords, including service accounts, must be changed as soon
as possible after system installation and before becoming operational.

1.4.4 Password Distribution

FIPS 112, section 3.6, Distribution, requires that \"Personal passwords
shall be distributed from the password source in a way that only the
intended owner may see or obtain the password." Initial passwords must
be created and distributed by local system administrators/security
administrators that have direct contact with system users. The use of
mail (sealed envelope) is authorized to distribute passwords, but this
means must be viewed as less secure than distributing passwords in
person by a systems or security administrator. Use of the telephone is
allowed if the following conditions are met:

> A call is made to the new user\'s authorized work phone number,
>
> An effort is made to verify the user\'s identity based upon a personal
> identifier, voice recognition, information on an access request form,
> etc.;

If a non-encrypted voice line is used for password distribution, the
user must immediately log on and change his or her password.

1.4.5 Password Generation

FIPS 112 states that \"Since many user-created passwords are
particularly easy to guess, all passwords should be machine generated
using an algorithm that meets the specification in Appendix E.1,\" i.e.,
a random password. Because the use of random passwords introduces a
vulnerability of having users write down passwords, systems may require
user-selected passwords if the following conditions can be met:

> A user ID is suspended after three invalid password attempts such that
> manual action by a security administrator is required to reactivate
> the ID.

A restricted password list or algorithmic means (e.g. password masking,
required use of special characters, etc.) is used to limit the selection
of trivial passwords.

1.4.6 Password Re-use

The system should maintain a queue of previously used passwords. The
password queue should store a minimum of eight passwords and be
protected against re-use by a given user.

2.0 Types of Passwords

2.1 User Generated Password

As the name implies, the password is selected or generated by the user
in accordance with rules specifying the character sets used, subject to
restrictions on the use of common words, as defined in Section 3.0, and
the re-use of passwords.

2.2 One-Time Password or Token

One-time passwords are those that have a limited lifetime, i.e. a few
minutes or less. Use of token assisted authentication is mandated for
users having an extraordinary level of access to system resources. This
category includes system and security administrators. New systems
implemented after the effective date of this standard will include such
capability. Legacy systems must be modified or replaced to include these
functions not later than February 2003. One-time passwords may be
randomly generated or selected by the system administrator and delivered
to the user.

2.3 Random Passwords

A random number generator that uses a random seed as input generates a
random password. Within the NLRB, random passwords will be generated
using software and/or algorithms favorably evaluated by the National
Computer Security Center, Department of Defense, or by the NIST,
Department of Commerce.

3.0 Password Vulnerabilities and Compensating Controls

3.1 Password Guessing

Password guessing generally takes two forms. An intruder may attempt to
use a password that is in some way related to a user account/ID, e.g.,
spouses or child\'s name, or type of car. Another common technique is
the \"dictionary attack,\" i.e., the use of common words. Often the
dictionary attack is automated.

All agency systems must implement the following compensating controls
for this threat:

-   Disabling an ID after three invalid password attempts;

-   Use of password masking to ensure that common words are not used as
    passwords;

-   Use of randomly generated passwords or conditional user-selected
    passwords, see Section 1.4.7;

-   Use of \"one-time\" passwords; and

-   Implementation of regular training and awareness.

3.2 Social Engineering

Social engineering is a means of obtaining a password via the
manipulation of people. In the most common form of social engineering
attack, the attacker calls a help desk, pretends to be an authorized
system user, and requests a new password. Another scenario involves an
attacker talking an authorized user into \"loaning\" his or her
password.

NLRB systems must implement the following compensating controls for this
threat:

-   Use of a local administrator to assign passwords;

-   User verification procedures; and

-   Security awareness training.

3.3 External Disclosure

External disclosure is the disclosing of a password to unauthorized
users. The most common means of doing this is by obtaining a password
that has been written down or finding a password

on a printout (\"dumpster diving\"). Another technique is observing a
user typing in a password (\"shoulder surfing\").

All NLRB systems must implement the following most appropriate
compensating controls for this threat:

-   Security awareness training;

-   Use of \"one-time\" passwords; and/or

-   Token-based authentication.

3.4 Password Interception

Interception is modification or illicit installation of software to scan
for network passwords as illustrated by Internet \"sniffer\" attacks.
Passive password interception takes three forms: 1) line tapping; 2)
network eavesdropping; and 3) emanations from computer and/or
telecommunications equipment.

When a system risk assessment indicates a serious risk of interception,
NLRB systems must implement one or more of the following compensating
controls for this type of threat:

-   The use of link or end-to-end encryption;

-   Token-based authentication; and/or;

-   \"One-time\" passwords.

3.5 Denial of Service

Denial of service is an attack based on the deliberate entry of invalid
passwords with a valid ID resulting in the valid ID being disabled. All
NLRB systems must automatically disable user IDs after three invalid
password attempts.

4.0 Configuration and Operating Standards for Specific Operating Systems

The configuration settings in this section should be viewed as Best
Practices in addition to the general requirements of this standard.
Components that have developed alternative configurations are encouraged
to submit them to the Information Management and Security Staff for
inclusion in this section.

4.1 NOVELL NETWARE (5.1)

The following options are specified using \"Account Restrictions\" in
the SYSCON \"User Information\" menu.

> Allow user to change password = **Y**.
>
> Require Password = **Y**.
>
> Minimum password length = **8**.
>
> Force periodic password changes = **Y**.
>
> Days between forced changes = **90.**
>
> Limit grace logins = **Y** (a grace login allows a user to sign on
> with an expired password).
>
> Grace logins = **3.**
>
> Require unique password = **Y** (prevents password re-use up to 8
> passwords).

4.2 Microsoft Windows NT (4.0.x)

The following options are specified using the Policy Account window in
the User Manager or User Manager for Domains.

-   In the "Policy Account" window, select the "At Least" radio button
    under "Minimum Password Length." Type in **8** for the number of
    characters.

-   Set the "Maximum Password Age" to expire every **90** days.

-   In the "Minimum Password Age" area, select the radio button "Allow
    Changes In" to **1** day. In the "Password Uniqueness" area, select
    the radio button "Remember" and type **5** for the number of
    Passwords.

-   "No Account Lockout" option will be set to **4** bad logon attempts.
    Manual action by a security administrator is required to reactivate
    the ID.

Additional material may found in National Security Agency *Report
C4-001R-00 Guide to Securing Windows NT Networks.*

3.  Microsoft Windows 2000 Operating System/Win 95

The National Security Agency has made Windows 2000 security materials
available at [http://nsa1.www.conxion.com/win2k/index.html]{.underline}