SecQual

User Login Password Changes
S2011/056 - 29 Nov 2011

User Login Password Changes

NZQA is taking steps to enhance the security of the NZQA secure extranet. Changes for secondary schools will include:

• improved password strength for low-security secondary school users
• upgraded high-security login for secondary school users using individual login and passwords.

What is Education Sector Authentication and Authorisation (ESAA)?

ESAA is the authentication and authorisation mechanism that provides users with access to NZQA (and other Education Sector) online services.

More detailed information about ESAA operations policy is available.

Why are we upgrading?

NZQA is required to meet the New Zealand e-government password minimum requirements because of the risks posed for users of shared accounts for schools, particularly when their password could be easily guessed.

When is this happening?

We would like to encourage existing users to change their password. The requirement to improve password strength took effect on 28 October 2011. Please note that password changes will be required for all users in March 2012.

Schools should be aware that the first person to login on 1 March 2012 will be presented with a message about the new password requirements, and, therefore, may need to manage this change of password. However, any user with a password that already meets the new rules will not be required to change their password on 1 March 2012.

Improved passwords

Passwords must:

• be a minimum of seven (7) characters
• contain characters from all three (3) of the following sets:
  • lowercase characters (a-z)
  • uppercase characters (A-Z)
  • digits (0-9).

Passwords should not be predictable or guessable choices, e.g. those involving your username, dates, ‘password’, ‘login’ or ‘logon’.

Low-security school users

Users who access the low security area will still have a shared login ID (MOE number) and password. Only the password strength has changed. Schools must manage the change to their new password for access to their low security area between now and 1 March 2012.

High-security school users

We will be requiring high-security users to have individual accounts. Secondary school staff will be gradually transitioned to an individual login which can be used across Ministry of Education (MOE) and NZQA systems through the ESAA service. Some staff may already have completed this process for MOE. They will need to complete a form to register for this ESAA service. The form can be downloaded (PDF, 27KB) and returned to NZQA as instructed on the form.

For high security access, it will be necessary to determine and advise NZQA of the following:

• who requires access to the high-security extranet
• who already has an ESAA login ID and password (i.e. for accessing the MOE website)
• who needs to be set up with an ESAA user ID and password.

NZQA will need to add a school role to secure user profiles before they can access the high security school area using the new login. NZQA will contact users when this has been completed. Please note, it may take up to 10 days for the security role to be added to a user profile.

Once a high security user has an ESAA login and password, they should start using this and discontinue use of the shared login service. As soon as a school has all their high security users migrated onto individual ESAA accounts, the shared high security account will be deactivated.

Password protection

Please remind all users to protect their user ID and password:

User IDs and passwords:

• should not be written down (if they are, it should be in a secure location such as a locked drawer, safe or similar secure location)
• should not be disclosed.

If someone has forgotten their user ID or password they should contact the help desk at NZQA.

Enquiries

Please refer any enquiries relating to this circular to your School Relationship Manager:

School Relationship Manager
School Quality Assurance and Liaison
Telephone: 04 463 3000
Email: firstname.lastname@nzqa.govt.nz