Identification, Authentication, Authorization Policy
All users of Bowdoin College IT resources will be assigned a unique identity to securely authenticate to College IT resources that they have been authorized to access.
This policy is approved by the Chief Information Officer.
To ensure the security and integrity of both College data and data belonging to individuals, this policy establishes requirements for the digital identification of all users of Bowdoin computer systems and networks. Identified users will securely authenticate to College systems and access only resources that they have been authorized to access.
This policy covers students, faculty, staff, outside agents, contractors and any and all individuals or entities using any Bowdoin College IT resource.
Management of Identifiers
- Linked Identifiers. Bowdoin College maintains dual records identifying all employees, students, and others who use the College’s computing resources. These records correlate Bowdoin ID and Network ID records.
- Uniqueness. Each identifier (College ID or Bowdoin NetID) is unique; that is, each identifier is associated with a single person or other entity.
- One Identifier per Individual. An individual may have no more than one College ID number and on personal NetID.
- Non-Reassignment. Once and identifier is assigned to a particular person it is always associated with that person. It is never subsequently reassigned to identify another person or entity.
- Alternative IDs (alternative names registered along with a personal Bowdoin ID) may be reassigned after a waiting period.
- Social Security Number. Social Security Numbers shall not be used to identify Bowdoin employees or students.
Bowdoin College Network Identifiers
Bowdoin NetIDs consist of alphabetic characters and digits and are three to eight characters in length. Other Bowdoin NetIDs may be up to 256 characters in length.
Types of Bowdoin NetIDs
- Regular Personal Bowdoin NetIDs. Regular NetIDs are available to:
- Authorized, registered students
- Regular faculty and staff
- Emeritus faculty and staff
- Sponsored Personal Bowdoin NetIDs. Sponsored NetIDs are available to all others subject to the following conditions:
- The ID is to be used by a specific, named individual
- The ID is sponsored by a person who has a Bowdoin NetID
- The sponsor accepts responsibility for ensuring that the sponsored ID is used in support of work consistent with the College’s mission or instruction, research, and public service, and in a manner consistent with the College’s policies.
- Other Bowdoin NetIDs. IDs are available to identify other kinds of entities such as groups, departments, mailing lists, roles, computer-based services, etc.
Eligibility for Bowdoin IDs
- College ID and Regular Personal NetIDs. Eligibility begins when the individual accepts the offer of student registration or employment. Eligibility ends when a person’s active association with the College ends (i.e. when an employee is no longer employed and does not have emeritus status, or a student is no longer registered). A grace period may be allowed as a courtesy after eligibility ends.
- Sponsored NetIDs. A sponsored NetID is sponsored for a specific period of time. The sponsor determines the length of sponsorship; sponsorship must be renewed to keep the ID valid. There is no grace period: the entry becomes invalid immediately at the end of the sponsorship period.
- Reactivation. A NetID may be reactivated if the individual subsequently rejoins the College, either via regular association or sponsorship.
- Suspension. The use of a NetID may be revoked if it is used in a manner inconsistent with Bowdoin policies or if an individual is subject to other administrative action that denies them College privileges.
A five-digit College identification number is automatically assigned to regular, continuing employees and to students. This number appears on the printed Bowdoin Identification Card.
Access to non-public College IT resources will be achieved by individual and unique logins, and will require authentication, minimally a username and password combination. Authentication credentials will not be coded into programs or queries unless they are encrypted, and only when no other reasonable options exist.
Authentication methods involve presenting both a public identifier (such as a user name or identification number) and private authentication information such as a personal identification number (PIN), password, token, or information derived from a cryptographic key.
Authentication against Bowdoin’s central computing infrastructure is recommended when possible. One of the following methods must be implemented:
- Strictly controlled passwords
- Biometric identification
- Tokens in conjunction with a PIN
No Unencrypted Authentication
Unencrypted authentication and authorization mechanisms are only as secure as the network they use. Traffic across the network may be monitored, rendering these mechanisms vulnerable to compromise. Therefore, all College services must use only encrypted authentication mechanisms unless otherwise authorized. In particular, historically insecure services, such as Telnet, FTP, SNMP, POP, and IMAP must be replaced by their encrypted equivalents.
- Official Actions. Use of a NetID and authentication method to identify oneself to an on-line system constitutes an official identification of the user to the College, in the same way that presenting an ID Card does. Users can be help responsible for all actions taken during authenticated sessions.
- Integrity. Regardless of the authentication method used, users must use only the NetID and authentication information that they have been authorized to use (i.e. a user must never identify themselves falsely as another person or entity).
- Confidentiality. Regardless of the authentication method used, users must keep authentication information confidential (i.e. a user must not knowingly or negligently make it available for use by an unauthorized person).
- Reporting Problems. Anyone suspecting that their authentication information was compromised should immediately contact the Bowdoin IT Help Desk.
- Security Precautions. Users are encouraged to change their password regularly (at least once every three months), to limit possible abuse of passwords that may have been compromised without the user’s knowledge. Passwords should be chosen so that they are not easily guessable (i.e. not based on the user’s name or birth date).
- Disciplinary Action. Individuals who are found to have knowingly violated one of these provisions will be subject to disciplinary action. The possible disciplinary actions for violations, which can include termination of employment or student status, will depend on the facts and circumstances of each use.
Access to information and IT system resources will be granted on a “need to know” or “minimum necessary” basis and must be authorized by the immediate information owner. Any of the following methods are acceptable for providing access:
- Context-based access. Access control based on the context of a transaction (as opposed to being based on attributes of the initiator or target). The “external” factors might include time of day, location of users, strength of user authentication, etc.
- Role-based access. Access control model that permits the specification and enforcement of enterprise-specific security policies in a way that maps more naturally to an organizations structure and business activities. Each user is assigned to one or more predefined roles, each of which has been assigned the various privileges need to perform that role.
- User-based access. Security mechanism used to grant users of a system access based upon the identity of the user.
4. Identification and Authentication of Local Systems
This section contains recommendations and requirements for systems and services that use local identification and authentications methods rather than centrally supported methods.
- Use NetIDs. Systems should use personal NetIDs to identify their users. This will be less confusing for users, and will ease future transition to centrally supported authentication.
- Avoid Clear-Text Passwords. Systems may not transmit reusable passwords across the network unencrypted. Such passwords are vulnerable to capture and abuse.
- Support Password Quality. System should check proposed passwords and reject those that are likely to be easily guessable.