Many students are familiar with the routine of logging into Shibboleth using Duo, and into their university emails using Google 2-Step. Although currently only required for NC State employees, Office of Information Technology (OIT) expects two-factor authentication to be required for all NC State students soon, protecting both students’ and NC State’s accounts.
Darren Fallis, an information security analyst, and Sarah Ward, a security incident response analyst*, addressed common student and faculty dilemmas surrounding two-factor authentication and described the likelihood of this requirement being extended to include all NC State students.
“Duo is a two factor authentication system that the university has chosen to help secure our accounts,” Fallis said. “As opposed to merely requiring a password on a single factor authentication, Duo asks you to provide a second factor, in this case, something you have versus something you know, to help prevent attackers from abusing our accounts.”
Fallis said that two-factor authentication is required for all employees due to their access to more sensitive data and systems compared to the vast majority of students.
“Initially we required it for Payment Card Industry, so anything having to do with credit card systems,” Fallis said. “It was expanded to include all employees on November 1, 2017, and that meant any employee, including student employees.”
In hopes of increasing cybersecurity, Fallis said that he expects two-factor authentication to be a requirement for all students in the future.
“The only time that students who aren’t workers will be required to enroll in two-factor authentication is if their account was administratively disabled by their security person or by Google themselves,” Ward said. “We do try to add extra protective measures when a student’s account either has some strange activity or we see phishing or spam being sent through their email. We take that as an opportunity to reset the password as well as enroll in two-factor.”
Ward said that in the event a faculty member forgets their device and is unable to log into Shibboleth, they can call the help desk to get a backup code.
“There tends to be more of a learning curve when it comes to older faculty and staff as opposed to student workers or students who have to enroll when they get an account disabled,” Ward said. “Not that the staff doesn’t see an importance for it but there’s definitely more of a learning curve and more instructions that they might need to understand how to use it correctly.”
After the Google Service Team changed the maximum session time to 14 days, Fallis said that the Duo “remember me” option on Google* for two-factor authentication on NC State accounts was changed from 30 to 14 days to match. Ward said that some students noticed the lack of a “remember me” button, clarifying that even though the button is gone, the feature still applies up to the 14 day maximum (unless a student logs out or clears cookies).
Both Fallis and Ward said that students should strongly consider having a backup device, such as a Universal 2nd Factor (U2F) USB security key, in case their primary device is lost, stolen, broken, etc. Ward said that students studying abroad often have issues logging into their accounts when they change their SIM card and only have two-factor authentication set up with text messaging.
“Having a backup device is very important,” Fallis said. “You put [a U2F key] on your keychain. Usually have your phone, or your keys, or both with you at all times.”
Fallis said that thousands of students have enrolled in two-factor authentication even though they are not yet required to.
“The more students that hear about two-factor as an option, the better they can protect their information, not just at the university but personally as well,” Ward said.
For more information on two-factor authentication for NC State accounts, students can visit the Office of Information Technology website or call (919-515-HELP) or email the NC State Help Desk. To learn more about two-factor authentication for personal accounts, students can visit twofactorauth.org.
*Editor’s Note: Sarah Ward’s job title has been updated for accuracy.
**Editor’s Note: Words were added to this sentence to clarify that only the “remember me” option on Google was changed.
