The University of Oregon's two-step login service will expand in the coming weeks to further protect the campus community.
The first change, on June 3, will add Office 365 and UOmail to the list of services protected by Duo, the university's two-step login service.
Then by July 29, all UO faculty members, staff and graduate employees must begin using two-step login by enrolling in Duo.
"With so many of us now remote, it becomes all the more important to add this extra layer of protection to our UO accounts, especially for email," said Leo Howell, chief information security officer.
Thousands of UO employees are already using Duo with Canvas, Zoom, the UO Service Portal and other UO services that use Shibboleth single sign-on. Starting on Wednesday, June 3, those users will also start seeing Duo prompts when logging in to UOmail email or any Microsoft application.
To help ensure a smooth transition, all current Duo users will be automatically logged out of UOmail and all UO-provided Microsoft applications — including Word, Teams and Outlook — at 2 a.m. June 3. Information Services recommends waiting until at least 6 a.m. before logging in to any Microsoft services again.
"We hope this process will minimize any disruptions," said Patrick Chinn, associate chief information officer for customer experience. "That first day, Duo users may need to do two-step login multiple times. Luckily, it only takes a few seconds. And after that, you'll only have to do it once a week for most services."
Two-step login — also known as two-factor authentication, 2FA, two-step verification or multifactor authentication — is a common method of securing login processes. After entering a username and password, users must also verify their identity by tapping a button in a mobile app, entering a code or answering a telephone call.
For UO's two-step login service, people first register a mobile phone, tablet, landline or a small hardware device called a token. Within a day, two-step login will go into effect for their Duck ID account. From that point on, when the user logs in to protected services, Duo will prompt them to confirm their identity using the device they've registered.
Instructions for getting started with Duo are available in the UO Service Portal.
"Signing up is quick and easy," Howell said. "Take a few minutes to do this now, before the deadline comes."
Starting on July 29, faculty members, staff and graduate employees must be enrolled in Duo before they can access Canvas, Zoom, UOmail, Office 365 or other protected services.
The university's modified operations due to COVID-19 have temporarily limited the range of devices available to UO employees for two-step login. Specifically, Information Services is distributing fewer hardware tokens right now, and UO office phones currently aren't an option for faculty and staff members working remotely.
For those reasons, Howell strongly encourages staff and faculty members who have a smartphone or tablet to register that device for Duo, at least temporarily.
"Once campus operations return to normal, you can register a different device and unregister your smartphone, if you wish," Howell said.
Currently, student employees can opt to enroll in Duo. All UO students will be required to enroll in a future phase of the Duo rollout.
Since the COVID-19 pandemic began, cyberattacks have increased globally, Howell said. At the same time, with most students, faculty members and staff studying and working off campus, it is more difficult for universities to secure data that would typically be accessed through campus networks without strengthening login processes.
"Two-step login protects you wherever you are, in addition to protecting your colleagues and students," Howell said. "You may not think your own credentials would be so valuable to steal, but cybercriminals can use them to steal identities and intellectual property and empty bank accounts."
In the coming months, Information Services plans to protect more systems with Duo, including the UO virtual private network.
Training videos, FAQs and other information about Duo are available in the UO Service Portal.
Employees seeking help with two-step login are encouraged to contact the IT staff responsible for supporting their respective areas, if applicable, or contact the Technology Service Desk by live chat through the two-step login support page in the UO Service Portal or by phone at 541-346-4357.
More information about the two-step login project is available on the Information Services website. Anyone with questions about the project can contact the project team at twostepproject@uoregon.edu.
—By Nancy Novitski, University Communications