If you have a password that has never been compromised, you can continue to use it forever, it will not expire, although you can still change it manually should you wish.

 

If you know you have a password which is used elsewhere or suspect it's weak, change it now. Over the next week, the system which checks passwords will start running, if you get an email informing you that your password has been compromised, you must change it as soon as possible.

 

Do not use this password anywhere else, it may be strong but if used on another service that gets hacked, then you must start again.

 

We recommend using a phrase or random words, the National Cyber Security Centre have good resources around this topic at https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words 

 

You should use whatever method that works for you, it's no use if your password is so complicated you can't recall it.

 

Your password must be twelve characters or more - you do not need to include special characters anymore ()!# etc.

 

Please ensure that you avoid family names or other easy to access details such as pet names. Hackers often use social media to profile you and use information they have discovered to guess passwords.

 

Take this approach with your personal accounts, if you only do one account then make it your email account, this is a particularly nice target as many other online applications use email for account recovery!

​

Always be sceptical! If you receive any communication with a suspicious call to action, do not reply directly - instead use a secondary form of communication to verify.

 

Feel free to reach out to IT at any time if you have concerns, it is better to delay a response than to reply to a suspect email.