Starting at 2 p.m. Thursday, Feb. 20, the Office of Information Technology (OIT) will require students using NC State’s Virtual Private Networking (VPN) service to use Duo Security, one of the two-factor authentication (2FA) mechanisms used at NC State.
Stan North Martin, senior director for outreach, communications and consulting in OIT, said this new requirement will affect about 1,100 students.
“We will be starting to require students who are using the virtual private network service that NC State provides,” Martin said. “They will begin being required to use Duo to be able to use VPN. Once they sign up for Duo to be able to use the VPN, then it will also show up when they’re authenticating via any Shibboleth interface.”
Martin said two-factor authentication is another level of security for users’ accounts.
“Here at NC State, we have two different two-factor authentication mechanisms, one for G Suite, which is [Google 2-Step], and then for our other campus web and active directory interfaces we use the Duo Security two-factor authentication process,” Martin said.
Andrew Kotynski, director of Information Security Services, said over 31,500 people in the campus population are active 2FA users. Of this number, he said almost 15,000 are students, about 12,000 are staff members and about 4,500 are faculty members.
Martin said university employees, including student employees, are already required to use two-factor authentication.
Kotynski said of the total campus population that has used NC State’s VPN in the last 90 days, about one-third did not have 2FA enabled.
“When they go out to use VPN … there’s going to be a pulldown menu that you receive,” Martin said. “Right now when you pull that pulldown menu, and you say that you’re a student, then you just use your unity ID and password to login. But after this goes live on the 20th, there will be an additional field there that you have to enter.”
Kotynski said 2FA is beneficial to combating the issue of lost and stolen credentials.
“One of the things we see when an account is compromised … is that they’ll oftentimes try to come into the campus system via the virtual private network,” Martin said. “Once you’re coming in via VPN, there’s more access to resources within the university environment that they can have access to, to be able to try to infiltrate other campus services, different servers and things like that.”
Martin said OIT encounters an average of 57 compromised accounts per month.
“It definitely is some work on our part,” Martin said. “But ultimately, we think it will save the university and our security folk’s time and energy because when we find accounts that had been compromised, and they’re in the system, it takes a fair amount of work to go and clean that up.”
While this new 2FA requirement affects about 1,100 students, Kotynski and Martin said OIT would like to make 2FA a requirement for all students by the end of 2020.
“We will be, in the future, requiring all students to enable Duo and Google 2-Step on their accounts even if they’re not current VPN users,” Martin said. “It’s another reason to go ahead and just do it now as an extra layer of security. But certainly by the end of the fall semester, our plan is to have all students using our 2FA mechanisms.”
Students can contact the NC State Help Desk via the NC State IT Service Portal or at 919.515.4357 (HELP) for more information.
