Passwords for everyday use

When it comes to passwords you use regularly, keeping them secure is the biggest challenge. In principle, there are two ways to do this:

1) You memorise the password

There are various techniques for remembering passwords effectively. For example, you can think of a simple sentence and use the first letters, last letters, and perhaps even punctuation marks or similar elements from it.‘How do I come up with 1 secure password?’ becomes, for example, ‘Wdim1sPa?’. The password should be at least 8 characters long. Another option is a relatively long password made up of whole words. These words should, as far as possible, have no direct connection to one another and should not form a sentence. Example: “Dog, cat, mouse, lizard, Spock” – whilst this means you have quite a bit to type, the password is relatively easy to remember. It is still secure, however, as when trying every possible combination, 5 (random) words are about as difficult to guess as 10 random letters.

2) Using a secure password manager

The BSI website provides useful guidance on using a password manager. One tool we recommend, for example, is KeePassXC (available on UOL computers via the Baramundi Software Kiosk). Another option is to use a password hint as a memory aid, kept in a secure place (e.g. in your own wallet).

Other solutions, such as writing down the entire password on a piece of paper (whether under the keyboard or locked away in a desk drawer) or storing it in unsecured files on smartphones or in cloud storage, are too insecure.

Admin passwords / passphrases for encryption

Passwords that you do not need to remember – because they are rarely used and are, for example, stored in encrypted password archives rather than being typed in – should be generated at random.

We recommend, for example, the KeePassXC password generator – with 32 characters, you’ll be on the safe side by today’s standards.

Changing passwords

Fortunately, the common practice of recommending or enforcing regular password changes has now been abandoned. As long as your password remains secret, there is no reason to change it. If you suspect that a password has been hacked or compromised, you should, of course, change it immediately.

Further information on the subject of passwords can be found, for example, in a well-organised format on the BSI’s website.

You can find good introductory articles on the basics of research data management linked in our RDM information collection.

The open access article Good enough practices in scientific computing lists many practical tips. Most of them do not relate to computing in the narrow sense, but are universally applicable in data-driven research. The tips offer a pragmatic introduction to reproducible and reproducible research.

The article contains recommendations and tips on the following topics:

1. Data management
   1. Save the raw data.
   2. Ensure that raw data are backed up in more than one location.
   3. Create the data you wish to see in the world.
   4. Create analysis-friendly data.
   5. Record all the steps used to process data.
   6. Anticipate the need to use multiple tables, and use a unique identifier for every record.
   7. Submit data to a reputable DOI-issuing repository so that others can access and cite it.
2. Software
   1. Place a brief explanatory comment at the start of every program.
   2. Decompose programs into functions.
   3. Be ruthless about eliminating duplication.
   4. Always search for well-maintained software libraries that do what you need.
   5. Test libraries before relying on them.
   6. Give functions and variables meaningful names.
   7. Make dependencies and requirements explicit.
   8. Do not comment and uncomment sections of code to control a program's behaviour.
   9. Provide a simple example or test data set.
   10. Submit code to a reputable DOI-issuing repository.
3. Collaboration
   1. Create an overview of your project.
   2. Create a shared "to-do" list for the project.
   3. Decide on communication strategies.
   4. Make the licence explicit.
   5. Make the project citable.
4. Project organisation
   1. Put each project in its own directory, which is named after the project.
   2. Put text documents associated with the project in the doc directory.
   3. Put raw data and metadata in a data directory and files generated during cleanup and analysis in a results directory.
   4. Put project source code in the src directory.
   5. Put external scripts or compiled programs in the bin directory.
   6. Name all files to reflect their content or function.
5. Keeping track of changes
   1. Back up (almost) everything created by a human being as soon as it is created.
   2. Keep changes small.
   3. Share changes frequently.
   4. Create, maintain, and use a checklist for saving and sharing changes to the project.
   5. Store each project in a folder that is mirrored off the researcher's working machine.
   6. Add a file called CHANGELOG.txt to the project's docs subfolder.
   7. Copy the entire project whenever a significant change has been made.
   8. Use a version control system.
6. Manuscripts
   1. Write manuscripts using online tools with rich formatting, change tracking, and reference management.
   2. Write the manuscript in a plain text format that permits version control.

Wilson G, Bryan J, Cranston K, Kitzes J, Nederbragt L, Teal TK (2017) Good enough practices in scientific computing. PLoS Comput Biol 13(6): e1005510. doi.org/10.1371/journal.pcbi.1005510

In the context of research data management, there are various legal regulations that must be observed. This can give rise to complex issues in individual cases. The relevant topics and areas of law include

• Copyright, ancillary copyright and patent rights
• Assignment and ownership issues
• Non-disclosure agreements
• Service contract regulations
• Licence models for publication
• Liability issues
• Personal rights and data protection

Due to the wide range of data and possible legal regulations, it is difficult to make general recommendations. However, there are already extensive and well-prepared publications by legal experts. We are happy to refer you to a brief summary of the legal framework (under CC-BY-SA 4.0 licence) and a detailed guide to legal issues in Open Science (under CC-BY 4.0 licence).

The Research Data Management Service Centre is not permitted to provide legal advice. If you have specific legal questions or problems, please contact PGR - General Legal Affairs or the Data Protection and Information Security Unit for information on data protection. The Research Data Management Service Centre will be happy to provide you with general recommendations and, in particular, support with technical implementation.

How can I transmit data in encrypted form?

In research, confidential (and in some cases personal) data frequently needs to be exchanged. It is a prerequisite – and in some cases explicitly required by ethics committees or data protection authorities – that data is transmitted securely so that it cannot be accessed by third parties.

Established communication channels (e.g. email) or cloud storage/messaging solutions that you might use in your private life (e.g. Dropbox, WhatsApp or similar providers) have their limitations in this regard. When using external services, a common problem is that there is no suitable contractual agreement with the provider, meaning that the confidentiality of the data cannot be guaranteed. For this reason, the professional use of such services for confidential data is generally not permitted. Another common problem is the insecure (unencrypted) transmission of data, which is used, for example, when sending standard emails.

When it comes to encryption, a distinction must be made between three basic methods that are frequently mentioned or used in this field:

1. File encryption

Encryption at file level generally offers the highest level of protection, but is also the least convenient form. In practice, the main drawback is the limited availability of the relevant tools (installation, user training, etc.), as all parties involved must use them.

Where appropriate, it is advisable to use software such as 7-Zip (with AES-256), VeraCrypt or similar tools when files need to be stored in encrypted form or sent by email.

2. Email encryption (content encryption)

Email encryption works via S/MIME certificates (which can be obtained from the DFN’s IT services) or via comparable alternatives such as PGP. Once configured, this is a convenient way to communicate securely, but the problem of limited adoption is even greater here than with file encryption tools, meaning that this approach can hardly be recommended in practice. Although well-configured mail servers also use transport encryption, you cannot rely on this and should therefore regard emails as unencrypted unless further measures are taken.

Please note: In addition to content encryption, there are also digital signatures, which are displayed in Outlook as a seal icon. This does not mean that the email is automatically encrypted. It merely means that the sender’s identity has been verified by the certificate authority.

3. Transport encryption

Transport encryption is already standard practice in many tools today and usually takes place without any action on the part of the user and without the need to install any special software. In web-based systems, encryption can be recognised by ‘https’ or by the padlock icon in the browser.

Transport encryption should always be used. However, generally speaking, it is only an adequate measure if the tools or portals used are also secure (and, where applicable, bound to the UOL by organisational or contractual agreements).

For transport-encrypted file transfers to or from the university’s infrastructure, the cloud storage service operated by IT services itself is recommended. Instructions on how to use this can be found on the IT services website.

Provided that all parties involved have a UOL account, direct file sharing by entering the authorised names or email addresses should be used. The recipient is then automatically notified and only needs their UOL login details, meaning the sender does not have to send any sensitive data (particularly passwords). Guidance and instructions on sharing files can also be found in the IT services documentation.

When sharing with external parties, you must use the ‘Share link’ option with ‘Password protection’ selected. Please ensure that the password chosen is not too simple (it is best to generate it randomly) and that it is transmitted securely. Unfortunately, sending a password by email together with the link is not a particularly good solution. It would be best if the password were communicated via a completely different channel (e.g. in person or by telephone).

Information on security requirements regarding Transport Layer Security (TLS) is available, for example, from the BSI. For example, TLS should only be used in the current versions 1.2 and 1.3 (BSI minimum standard, version 2.4 dated 25 May 2023, last checked for validity on 20 December 2024). In the case of IT services provided by the University of Oldenburg, it can be assumed that the relevant standards are taken into account. For in-house developments or external services, this should be checked or appropriate agreements concluded.

How do I store my research data?

The Research Data Management Service recommends using the infrastructure services offered by the University of Oldenburg for storing research data . These services are high-performance, designed to be fail-safe and disaster-resilient, and the data remains on the university’s own servers. These services include:

• Network drives
  The personal network drive (L drive) is available to every member of the university and access is restricted to the user’s own university account. If other people need access to the data, the IT services can provide it group drive . You can grant access to this for other members of the university.
  
• Cloud storage (Nextcloud)
  Cloud storage allows you to synchronise a local folder on your computer with the university’s data storage system. The advantage over using the network drive is that individual files or entire folders in the cloud storage can be shared with external parties. This enables collaborative work on the data even if project partners are not members of the University of Oldenburg. The service is accessible at cloud.uol.de/. Further information can be found on the IT services website.
  
• MySQL databases
  Depending on the type, scope and intended use of the research data, it may be advantageous to store the data in a database. For this purpose, you can use a MySQL database from IT services. Please feel free to ask us for advice if you are unsure whether this is the most suitable storage format for your data.
  
• GitLab
  It is important to note that programme code also falls under the term ‘research data’. For version control, visit gitlab.uni-oldenburg.de/ the the University’s GitLab service is available for version control.

Note on data backup and recovery
A daily backup is created for network drives and databases, which is retained for 30 days. Recovery can be carried out for the entire network drive or for individual files. The cloud storage features a simple version control system, meaning that when files are modified, the old versions are automatically stored for a limited period and can be restored by you. Files deleted by mistake can also be restored. You can find an overview of how long versions remain recoverable here:
As backups are retained for a limited time and are created once a day, we recommend that you create a manual copy (e.g. with a timestamp in the filename) whenever you make significant changes to your data. This is particularly advisable if several such changes are made in a single day, as the automatic backup cannot restore any intermediate states from that day.
If you use our REDCap or SoSci Survey service, backups of the data and files contained therein are automatically created once a day. However, the same applies here: interim versions within a single day can only be restored manually. It is therefore also advisable to carry out a manual backup before making major changes. Both services provide suitable functions for this purpose. Further information on backup and recovery can be found in the respective operating guidelines.

If you do not use the university’s recommended services and wish to store your research data locally, you should ensure adequate protection against unauthorised access (e.g. through encryption or password protection). You should also create regular backups on a physically separate storage medium, which is likewise protected against unauthorised access.

In general, the storage of your research data should be accompanied by the description of the data via metadata and the storage of this metadata.

The recommendations described here do not relate to long-term storage, which, in accordance with good academic practice, is intended to last for a period of ten years. At present, no specific service is available for this area. Further information can be found in the glossary article.

We would like to draw your attention to the extensive collection of FAQs and useful information on the pages of the Data Protection and Information Security Unit.

The following factsheets published by the NFDI are also recommended as a general introduction to the topic of data protection vs. FAIR data use in research:

• Consent: FAIR and data protection compliant
• Methods for FAIR and data protection-compliant handling of personal data
• Data linkage: FAIR and data protection-compliant