Policy 7230A - Department of Administration

authenticators for critical information systems must not be provided together while
identifiers and authenticators for non-critical information systems should not be
provided together. In circumstances where authentication must be cryptographically
protected, the solution that provides this functionality must meet the minimum
specifications of FIPS 140-2.
Should an information system user’s account be disabled for any reason (see section
4.2, Account Management) the users identifier and authenticator will also be disabled,
where applicable.
A. Passwords
Passwords form the primary means of authentication for the State of Kansas. To
ensure that passwords present as much security as possible, the following
restrictions apply to them:
• Passwords must be constructed according to set requirements.
• Passwords will have both minimum and maximum lifespan.
• Passwords may not be reused for a set number of generations.
• Passwords may not be displayed while they are being entered.
• Password should not be transmitted in clear text.
• Passwords are to be individually owned and kept confidential – they are
not to be shared.
• If passwords must be electronically stored, they cannot be stored in clear
text.
Guidelines for these requirements will be provided in a separate document.
B. Authentication Tokens
Though the State does not, as a rule, require the use of hardware tokens for
authentication purposes, in those circumstances where the choice is made to use
them, the following restrictions apply:
• A defined process must be followed for token distribution.
• A defined process must be followed for token revocation.
• A defined process must be followed for the handling of
lost/stolen/damaged tokens.
Guidelines for these requirements will be provided in a separate document.
4.2 Account Management
The State of Kansas requires that all information system accounts be actively managed
by appropriate administrative staff. Active management includes the acts of
establishing, activating, modifying, disabling and removing accounts from information
systems.
Information system accounts are the only legitimate method by which State
information systems may be accessed. Without active account management, the
12