Select a heading, requirement, or navigation link to open its direct link and highlight the corresponding policy content.
Purpose: The purpose of this policy is to define information security controls around identification and authentication.
Scope: This policy applies to the Texas State University System and its component institutions. All users are responsible for understanding and observing these and all other applicable policies, regulations, and laws in connection with their use of the institution’s information resources.
Application: The statements in this document establish the minimum requirements for each component institution. At the discretion of the component institution, more stringent, restrictive, or enhanced requirements may be established.
Management: This policy is managed by the TSUS Information Security Council and will be reviewed at minimum every five years, or more frequently as needed, by the chief information security officer and appropriate component institution information security officers.
Exceptions: Pursuant to TAC §477.71 (c), the component institution’s Information Security Officer, with the approval of their agency head, may issue exceptions to information security requirements or controls in this policy. Any such exceptions shall be justified, documented, and communicated.
1.1.Identification and authentication controls implemented by component institutions must comply with applicable federal or state laws, Executive Orders, directives, regulations, policies, standards, and guidance.
2.1.Texas State University System defines technical policy terms in the information technology glossary.
3.1.Component institutions must:
3.1.1.Develop procedures to facilitate the implementation of the Identification and Authentication policy and associated controls;
3.1.2.Review and update Identification and Authentication procedures at an institution-defined frequency; and
3.1.3.Designate an institution-defined individual as responsible for managing, developing, documenting, and disseminating institutional Identification and Authentication procedures related to the controls in this policy.
4.Identification and Authentication (Organizational Users), Multifactor Authentication to Privileged Accounts, & Multifactor Authentication to Non-privileged Accounts
4.1.Component Institutions must ensure that information systems uniquely identify and authenticate institutional users or processes acting on behalf of institutional users prior to granting the user or process access to a given information system.
4.1.1.Non-unique identifiers may only be used in situations in which risk analysis performed by institution-defined personnel demonstrates no need for individual accountability of users.
4.2.Component Institutions must implement multifactor authentication for access to privileged accounts on institutional information systems.
4.3.Component Institutions must implement multifactor authentication for access to non-privileged accounts on institutional information systems.
5.1.Component Institutions must manage information system identifiers by:
5.1.1.Receiving authorization from institution-defined personnel to assign an individual, group, role, service, or device identifier;
5.1.2.Selecting an identifier that identifies an individual, group, role, service, or device;
5.1.3.Assigning the identifier to the intended individual, group, role, service, or device; and
5.1.4.Preventing reuse of identifiers for an institution-defined time period.
5.2.Component Institutions must ensure a user’s access authorization is appropriately modified or removed when the user’s employment, job responsibilities, or affiliation with the institution changes.
6.1.Component Institutions must manage information system authenticators by:
6.1.1.Verifying, as part of the initial authenticator distribution, the identity of the individual, group, role, service, or device receiving the authenticator;
6.1.2.Establishing initial authenticator content for authenticators defined by the institution;
6.1.3.Ensuring that authenticators have sufficient strength of mechanism for their intended use;
6.1.4.Establishing and implementing administrative procedures for initial authenticator distribution, for lost/compromised or damaged authenticators, and for revoking authenticators;
6.1.5.Changing default authenticators prior to first use;
6.1.6.Establishing minimum and maximum lifetime restrictions and reuse conditions for authenticators;
6.1.7.Changing or refreshing authenticators at an institution-defined time period by authenticator type;
6.1.8.Protecting authenticator content from unauthorized disclosure and modification;
6.1.9.Requiring individuals to take, and having devices implement, specific security controls to protect authenticators; and
6.1.10.Changing authenticators for group or role accounts when membership to those accounts changes.
7.1.For password-based authentication, component institutions must:
7.1.1.Maintain a list of commonly used, expected, or compromised passwords and update the list at an institution-defined frequency and when institutional passwords are suspected to have been compromised directly or indirectly;
7.1.2.Verify, when users create or update passwords, that the passwords are not found on the institution-defined list of commonly used, expected, or compromised passwords;
7.1.3.Transmit passwords only over cryptographically protected channels;
7.1.4.Store passwords using an approved salted key derivation function, preferably using a keyed hash;
7.1.5.Require immediate selection of a new password upon account recovery;
7.1.6.Allow user selection of long passwords and passphrases, including spaces and all printable characters;
7.1.7.Employ automated tools to assist the user in selecting strong password authenticators; and
7.1.8.Enforce institution-defined password composition and complexity rules.
8.1.Component institutions must ensure that information systems obscure feedback of authentication information entered during authentication processes.
9.1.Component institutions must:
9.1.1.Implement mechanisms for authentication to cryptographic modules in information systems; and
9.1.2.Ensure that implemented cryptographic modules meet the requirements of applicable laws, executive orders, directives, policies, regulations, standards, and guidelines for such authentication.
10.1.Component institutions must ensure that information systems uniquely identify and authenticate non-institutional users or processes acting on behalf of non-institutional users.
11.1.Component institutions must document a Standard defining the circumstances or situations which require users to re-authenticate.
11.2.Component institutions must require users to re-authenticate according to the component institution’s Standard.
11.3.Component institutions’ standard for re-authentication must include the following minimum requirements:
11.3.1.Users must be required to re-authenticate when a device automatically locks; and
11.3.2.Users must be required to re-authenticate when the user’s password is known to be compromised or publicly disclosed.