Passwords should be encrypted. When the password is entered at a workstation keyboard, it should be encrypted at the workstation before it is transmitted to the server for verification. User passwords known only to the user and the system. The user's supervisor or the LAN administrator does not need to know a user s password. Users should be required to use passwords which are a least six characters long.
Longer passwords are harder for someone else to guess.
The recommended minimum length for reusable passwords is six characters. The system should require periodic changes of a user s password. Thirty days is the recommended password change interval. The longer the life of a password, the greater the chances that it can be compromised. Users should be required by the system to choose unique passwords.