Password Protected Screen Saver Policy

As vulnerabilities (e.g. viruses, denial of service assaults, worms, etc.) to our campus computing environment continue to be exposed and as we place more and more personal bits of information about students and employees in databases and (hopefully not) on our computer hard drives, there is an equally growing need to secure our workstations and servers. A number of policies and procedures are currently in place to minimize or prevent unauthorized access to sensitive data. The following set of FAQs are meant to answer many questions arising from these proactive responses.

Password-Protected Screen Saver:

As a result of new federal laws and security policies from Indiana and Purdue Universities, IPFW has recently had to put into place additional security controls dictated by a number of federal acts requiring compliance such as:

• The Patriot Act: Covers wide areas protecting electronic transmission of information & data
• Gramm-Leach-Bliley Act: Covers protection of customer information gathered from financial transactions
• Health Insurance Portability & Accountability Act (HIPAA): Protects a person's health information

New Security Measure at the Desktop

Another step we are compelled to make to further protect data that is accessible from the desktop computer is a password protected screen saver.

The screen saver will automatically lock your network-connected machine after 15 minutes of inactivity. After it takes effect you will be prompted to enter your network password to regain use of your workstation.

This change will not impact Macs at this time. We urge Macintosh users to manually implement such a screen saver on their workstations.

The mandatory Windows screen saver will be controlled by the network, and will be the same for all network-connected Windows machines. You will not be able run your preferred screen saver or picture file.

Changes to Desktop Support (technician that comes to your computer)

This security measure means our desktop support procedures will also have to be adjusted. When you have a work order or track opened for an ITS technician to work on your machine, the technician will call to inform you when they expect to be in your office.

If you are not available when they call, they will leave voice-mail stating when they expect to be at your office. If you are not available when they do arrive, and your workstation is password protected, they will not be able to work on your computer. They will continue with their next scheduled call and try to re-schedule with you.

You can avoid this rescheduling by logging off your workstation whenever you leave the office while you have a work order open for a technician to work on your computer. If the machine is logged off, the technician can work on it whether you are physically there or not.

The same invalid password rule applies to the password protected screen saver as to logging onto the network. If you enter the incorrect password at the screen saver prompt 6 times your password will be locked out. You will have to wait 15 minutes or call the Help Desk to remove the lock out.

There are inconveniences for all of us with these changes to security, but protecting confidential information is critical to the university and our students. The mandatory/automated password protected screen saver went into effect July 15, 2003.

Why was this implemented?

The implementation of a password protected screen saver is required by the Purdue security auditors and was so stated in their audit report of March 21, 2003. Ultimately the requirement is based on Purdue policy.

Why 15 minutes?

We chose 15 minutes based on the recommendation of Purdue's Security Auditors. They recommended the screen saver be invoked following 15 minutes or less of inactivity. We used the longest period of time we could, 15 minutes.