Passwords are integral to K-12 IT support in a very simple way—they are the frontline defense against hackers, impersonators, or other unsavory actors. That’s why it’s constantly drilled into our head to create strong passwords. Not only do passwords protect a user’s online identity, it’s the gateway to where their data is stored. Whether it’s for personal or educational use, no one ever wants to log on and find that their information has been compromised.
When you bring data security into the K-12 space, the need for greater password security is stronger than ever. With the rise in 1:1 technology, more young learners are logging into their user accounts without the strict supervision of the classroom.
That’s why we gathered some pivotal info about password policy best practices. Read on to find a few simple ways to keep passwords strong and data secure for K-12 districts.
Risks that Come From Weak Passwords
First and foremost, we have to address why passwords are so important. K-12 IT teams should underline what weak passwords can cost both the district and the individual user.
Weak passwords can:
- Expose the device to malware or destructive viruses
- Increase the risk of data breach
- Put sensitive information at risk
- Damage the institution or user’s reputation
- Incur legal problems
No one wants to deal with those problems, so it’s important to highlight to everyone in your district (especially teachers and staff) how a strong password can decrease the chances of any of those issues happening.
Password Guidelines from the National Institute of Standards and Technology
NIST was founded over 100 years ago, and is a part of the U.S. Department of Commerce. NIST’s mission is to support technologies of all sizes so that science, standards, and tech can improve economic security and quality of life.
Passwords are just as much a part of technology as the data itself, so NIST created the Digital Identity Guidelines to build a strong password policy.
Password Complexity and Length
If you’ve ever had to create a user password, you know the struggle to incorporate special characters, numbers, and a healthy mix of uppercase and lowercase letters. Interestingly enough, NIST discovered that complex passwords weren’t as beneficial as they originally thought. In fact, the complicated nature of the passwords often made it “much harder for users to remember and type.”
Instead, NIST recommends choosing user passwords (or passphrases) that go up to 64 characters for better password protection. Long passwords have a habit of sticking in people’s minds more than a random collection of symbols and letters.
Password Age
Previously, IT teams encouraged users to change passwords every 90 days. For the average K-12 school district, that means going through password changes twice a year. It may sound simple on the outside, but when it means overhauling the passwords for every student, teacher, and staff member, the process can take up valuable time that was normally reserved for teaching and learning.
Nowadays, NIST recommends creating a new password only when a potential threat arises, or if they suspect unauthorized access. The goal is to use strong passwords reliably, instead of scrambling to remember passwords that fit an arbitrary set of rules and symbols.
5 Best Practices for School Password Safety
Now that we have the official recommendations from NIST, we can narrow our focus down to our specialty: K-12 districts.
The tips below can be used from admin accounts, but we also encourage you to share these ideas with teachers, staff, and students, so they understand why these rules are in place.
Minimum Password Length
As NIST points out, long passwords that spell out a sentence or idea are more secure than nonsense passwords.
Example:
“Tobeornottobe.”
Vs.
“$hake~spear!!”
The ideal password length is between 14-15 characters, so keep those messages short, sweet, and memorable. (Disclaimer: do not use the passwords above. If we’ve thought of it, chances are hackers have too.)
Enable Complexity Requirements
While this may seem arbitrary, it is a good idea for K-12 IT admins to set up complexity requirements.
For instance, Windows’ password complexity rules make it impossible to set a password that contains the user’s account name or more than two characters from a user’s full name. It’s not safe for students to take the easy way out when creating passwords by simply taking on a few special characters to the end of their username.
Instead, encourage users to think of something completely different and unique to them (and make sure they write it down in an easy-to-find place, just in case they forget it.)
Execute Time-Based Password Resets
For K-12 IT admin, NIST recommends resetting passwords every 180 days. K-12 IT admins are in charge of district technology and sensitive data, so it’s important for the top level of the organization to be as secure as possible.
As for regular users, we recommend resetting passwords at the beginning of every school year. It lets each year start off on a clean slate, and lets students grow comfortable with their password all year long.
Enable Two-Factor (or Multi-Factor) Authenticators
This is becoming the gold standard for K-12 IT teams. Even though it costs valuable time to set up, two-factor authentication has been found to prevent 80 – 90% of cyberattacks.
Even though we work in K-12, we’re no strangers to the rise of cyberattacks on district devices. The K12 Security Information Exchange just released their 2022 report, which cataloged the 1,331 cyber incidents involving US school districts that have been publicly disclosed since 2016. The incidents involved DoS attacks, student data breaches, ransomware attacks, and more.
For more help in this area, check out this article from EdTech Magazine on how to implement two-factor authentication for your district.
Establish Password Audits
Auditing is a great way to ensure that your password policies are working. Use this checklist to implement a district-wide inventory audit, where you can test the efficacy of users’ passwords while keeping an eye on the entire fleet of student devices.
Final Thoughts
Passwords are the link between a user and potentially sensitive information. It’s crucial for K-12 IT teams to reinforce password security lessons so that young learners can continue using technology that connects them to their classrooms.
Even though we’ve walked through 5 key ways to keep passwords safe, it’s always helpful for IT teams to explain other components of password protection. Whether it’s useful to remind them not to share passwords between classmates and to never share on social media, these helpful reminders may be vital in keeping students’ identities safe online.
At Incident IQ, we take cybersecurity very seriously. Incident IQ districts can even utilize Password Assistant, which streamlines password resets and recovery for K-12 districts.
If your district is looking to upgrade to a workflow management platform built with K-12 security in mind, reach out to us and schedule a demo today.
