In the wake of phishing attacks on accounts associated with NC State in the past few years, most recently last summer, the Office of Information Technology is implementing dual authentication, a new login system all NC State students and employees will be required to adopt by the end of the year.
“We are trying to keep the university assets more secure,” said Andrew Kotynski, the project co-leader for OIT. “By doing this, it all but eliminates the threat of being phished… It’s a quick and easy way to help eliminate the threat.”
Phishing attacks have affected universities across the country, and NC State is among the few adopting 2-step authentication.
“In some ways, I think NC State is leading the pack with moving forward with this on such a large scale”, said Stan Martin, head of the Office of Information Technology.
When asked if the change was directly associate with the large-scale hack that took place last summer, Sarah Noell, the other dual authentication project co-leader, said that the large-scale hack partially contributed to the decision to roll out multi-factor authentication.
“It just kind of kicked us into high gear,” Noell said. “We were moving down that path anyway, but when something like that happens, it is a good idea to figure out how to beat that threat and figure out how to make the campus secure.”
Once a user has enrolled in the dual authentication system, logging in begins as usual, entering username and password. Once this information is correctly entered, an additional security measure has to be passed (hence the “dual” in the name). These measures can be entering a code delivered via text or voice call, a USB security key, a printed backup code or accepting a push notification on your smartphone.
NC State will use Google 2-Step to provide these services for email and Google Drive, and Duo, an app that specializes in 2-step authentication programs and preventing phishing attacks, to protect MyPack Portal, WolfWare, and library resources.
All faculty and staff, including student and non-paid employees, will be required to enroll in the new dual authentication system by October 31.
“We are closely monitoring the numbers,” Noell said. “We don’t want to get to October and have a huge percent of our population not having done it. We don’t want people to see this as punishment; we want people to see this as the right thing to do to keep the university and their personal data safe.”
The 2-step authentication is not a guarantee of safety, but, according to Martin, it is a step in the right direction.
“It’s going to be an evolving process,” Martin said. “Technology always changes and so there will be new, better ways of securing our information … but this is a much better method and something that we can implement right now.”
While students are not required to enroll in dual authentication now, many student-employees have already made the change.
“I can understand why it’s important to have protection, but it was annoying to have to go through with it,” said Federica Garcia, a junior and administrative coordinator at Lee Hall. “Once I figured it out and downloaded the app that you have to have to do it, it is very easy to use.”
According to Martin, the push notification is “by far the most popular second method”, mainly due to the fact that the app does not need a Wi-Fi connection in order to notify.
According to Martin, not all students will be required to change until some time in 2018, but he believes that shouldn’t discourage the student body from preemptively registering.
“While we don’t have a set date for students to register by, we are encouraging students to go ahead and sign up now”, Martin said.
To enroll in or learn more about dual authentication at NC State, visit OIT’s website on Two-Factor Authentication.
