TO TOP

IT-Sicherheitsvorfall/IT-Notfall | A-Z | Kontakt/Beratung

Password security

All access to systems and services at Ruhr University Bochum must be protected by strong and unique passwords. Depending on the importance/significance of access, additional security measures may also be required (e.g. 2FA). Passwords for personal access must not be shared or made public.

When choosing a password, please note the following points:

  • Use a different password for each service.
  • A password should contain at least twelve characters, consisting of upper and lower case letters, special characters and numbers. Avoid terms that may be found in dictionaries, dates, names, keyboard combinations, etc. These can be guessed quickly.
  • Passwords must always be kept secret and entered without being observed. This means that they should never be passed on to third parties, written down on notes where they can be easily seen, or stored in the browser. Exceptions apply to passwords for shared function accounts/function mailboxes. These passwords can be passed on to authorised persons within the team.
  • A password must be changed if it has become known to unauthorised persons or if there is suspicion that this may be the case.
  • Passwords for functional accounts/functional mailboxes must be changed when a team member leaves or is no longer authorised to access them.
  • Old passwords may not be reused after a password change. A new password must also be sufficiently different from the previous password. For example, password changes in which only a single character is changed or a counter is incremented are not permitted.

If the password has been compromised

Act quickly if your password has been compromised (german text).

Measures

Password manager

Be careful when saving passwords and using password managers (german text).

Password manager

RUB-Links

Additional security

You can gain additional security by using two-factor authentication or installing proper password manager software (NOT password storage in your browser).

Passwords are only transmitted securely if the transmission is carried out using an encrypted service (e.g. websites with HTTPS in your browser or use of a VPN when working from home).

Form a sentence that you can remember and use the first letters for your password. We could choose the proverb, which is

A journey of a thousand miles begins with a single step!
The password is: Ajoatmbwa1s!

You may replace certain characters with numbers or special characters to increase the complexity of your password:

‘a’ becomes ‘@" and “s” becomes ‘$’:
Ajo@tmbw@1$!

If you really want to use the password for different services, extend it:
Password for the university service. The first two letters of the service can be added to the front or end of the existing password:
usAjo@tmbw@1$!

Do not use the above example, but think of your own phrase.

  • Use different passwords for different roles.
  • An admin account has more extensive rights than ‘normal users’. Therefore, the admin password must be even better protected. For this reason, use particularly long (more than twelve characters) and complex passwords for an admin account and, if possible, always use multi-factor authentication.

Authentication methods that use biometric data, such as fingerprint readers on laptops or facial and voice recognition on smartphones, are convenient but only appear to be secure at first sight.

  • Biometric data is becoming increasingly easy to obtain, and images and voices can be faked using artificial intelligence.
  • If biometric data is stolen or lost, it cannot be used again because, unlike passwords, it cannot be changed.
  • Furthermore, only biometric login procedures should be used where the biometric data is processed locally on the IT device.

When using biometric procedures, you should note the following:

  • Use biometric features sparingly and only for applications from trusted providers.
  • Always use a second factor..
  • Use different biometric features for login/unlocking and apps.

 

Identity-Leaks

Information about stolen access data  (german text)

learn more

Attack methods

How secure is a secure password? (german text)

learn more

2FA/MFA

Two-factor authentication at the RUB (german text).

2FA