To maintain a strong security posture, all user passwords should follow the most
restrictive policy appropriate to how the user accesses the system. Jamf recommends less restrictive password policies for younger students and students
who need accessibility accommodations. The following recommendations apply to student passwords by
grade level:
- Grades K-3
- Use QR authentication or a pictograph. QR authentication generates a QR code based on the user's ID and password, which removes the need for a user to enter their username and password. A pictograph requires the student to select and remember a set of icons to sign in, which is easier for younger children than a memorized password.
- Grades 4-8
- Use passwords that combine letters and numbers.
- Grades 9-12
- Use passwords that combine uppercase letters, lowercase letters, numbers, and special characters.
Jamf recommends the following for staff passwords:
- Use passwords that combine uppercase letters, lowercase letters, numbers, and special characters.
- Use a multifactor authentication or passwordless authentication policy.
If you require password expiration, you can configure a setting that forces users to update their password after a set period. NIST does not recommend password expiration (see NIST SP 800-63B, section 5.1.1.2), but it may be required for compliance in legacy environments. All password policies must account for every system involved.
In Identity Hub, you can configure the initial password that the system generates
when it creates accounts for the first time. Jamf recommends allowing the system to
generate random passwords. The following recommendations apply to student passwords by
grade level:
- Grades K-3, QR authentication
- Generate a random password.
- Grades K-3, pictograph
- If passwords are needed for target systems, the student still needs to remember a password for those systems. Generate a random password and allow initial access through a claim policy. If passwords are not synchronized to target systems, an attribute-based password may be acceptable, because it is used only the first time the student sets up the pictograph options.
- Grades 4-12
- Generate a random password and allow initial access through a claim policy.
For staff initial passwords, generate a random password and allow initial access through a claim policy.