NOTICE: VCU Portal and VCU Google GSuite, including Email, Calendar, and Google Drive are scheduled to use VCU 2Factor Authentication on AUGUST 1, 2017. Blackboard will start using VCU 2Factor Authentication on AUGUST 15, 2017.
In order to safeguard our information from cyber adversaries, VCU is integrating VCU 2Factor Authentication to its Central Authentication Service.
What is VCU 2Factor Authentication?
In the cyber security field, there are three factors that can be used to identify an individual to a computer system. These factors include:
-
Something you know (e.g. a user name, password, answer to a question)
-
Something you have (e.g. a phone, an ID card, or a hardware token)
-
Something you are (e.g. your fingerprint, retina/iris scan, or voice print)
Traditionally, the username and password model rely only on something you know, therefore is considered single factor authentication. The weakness with single factor authentication using something you know is the fact that an adversary can usually find ways to steal this information, thus allowing the adversary to masquerade as the victim. VCU 2Factor Authentication helps to drastically reduce the usefulness of stolen usernames and passwords, as it relies on one or more other factors in proving one’s identity in addition to the username and password.
Why is VCU Doing This?
The beginning of a sophisticated cyber attack usually starts with a phishing scam. A phishing scam is a social engineering attack that utilizes phone call, email, social media or text message to trick a victim into disclosing information that he or she would normally not disclose. The end goal of phishing scams is usually the theft of login credentials such as usernames and passwords. Armed with the username and password of an individual, a cyber adversary can then masquerade as the victim, steal his or her personal information protected by those credentials, or silently compromise the organization for which the victim works while minimizing the chances of raising an alarm.
The implementation of VCU 2Factor Authentication will significantly reduce the likelihood that these stolen accounts can be used by a cyber adversary, as individual identities are verified by not only assigned login credentials, but also something the individual has in his or her possession.
How is This Done?
VCU already deployed its VCU 2Factor Authentication solution to various authentication services, and will continue to integrate the VCU 2Factor Authentication solution with the VCU Central Authentication Service.
For VCU’s deployment of VCU 2Factor Authentication to the Central Authentication Service, VCU will utilize the combination of your eID credentials and a message delivered to your phone using VCU 2Factor Authentication provider.
How Will I Be Affected?
VCU will integrate VCU 2Factor Authentication to all new applications protected by the Central Authentication Service. By default:
-
VCU 2Factor Authentication will be required for all faculty and staff accessing applications protected by the Central Authentication Service (CAS) when logging in from unknown and / or untrusted locations (e.g. off-campus).
- VCU 2Factor Authentication will be optional for students accessing applications protected by the Central Authentication Service (CAS) when logging in from unknown and / or untrusted locations (e.g. off-campus).
- Once an individuals signs up for the VCU 2Factor authentication service, the 2factor authentication service will be mandatory for any applications used by the individual.
-
A risk based approach will be taken with the VCU 2Factor Authentication implementation with the Central Authentication Service (CAS). This means that you will be prompted to authenticate via VCU 2Factor only when logging into CAS protected VCU applications from unknown and / or untrusted locations only (e.g. off-campus).
-
All individuals using VCU 2Factor Authentication with the Central Authentication Service (CAS) will have the option to remember their device for 60 days when logging in from an unknown and / or untrusted locations (e.g. off-campus).
Registering with VCU 2Factor Authentication
Individuals who have never used VCU 2Factor Authentication, will need to watch the video or follow the text instructions below to enroll in the service.
1. Open a browser and go to the DUO Registration Page at https://duo.vcu.edu.
2. Enter your user name and password and press Login.
3. At the "Protect your Virginia Commonwealth University Account" screen, click on the Start Setup button
Please note, for some applications, you may have the option to skip the registration for a period of time, or all together. This grace period and Skip button is shown on the initial registration screen of applications that provide optional enrollment. If you do choose to skip, then you will login without the VCU 2Factor Authentication and will be periodically reminded to enroll.
4. At the "What type of Device Are you Adding?" screen, choose either mobile phone, tablet, landline, or U2F Token options, and click Continue.
- Mobile phone - This is the most used and recommended option. Using this option will provide you with the secondary authentication through DUO Push (from DUO Mobile app for smartphones), Soft Token (from DUO Mobile App for smartphones), phone call, or SMS Text messages to your registered cell phone. Please see the DUO Enrollment Guide for detailed instructions on registering your phone.
- Tablet - This option will allow you to register a tablet computer such as an Apple iPad or an Android tablet. Using this option will provide you with the secondary authentication through DUO Push (from DUO Mobile app) or Soft Token (from DUO Mobile App). Please note this option will require the installation of the DUO Mobile App. Please see the DUO Enrollment Guide for detailed instructions on registering your device.
- LandLine - This option will allow you to register a stationary phone such as a home phone or an office phone, and will provide you with the secondary authentication through a phone call to one of these phones. Please note that you must have access to these phones at time of login in order for this option to work properly. Please see the DUO Enrollment Guide for detailed instructions on registering your phone.
- U2F Token - This option will allow you to self-register a compatible FIDO U2F security key. This option will provide you with the secondary authentication through the use of the security key. Please note that the registered key will only work with 2Factor enabled websites, but will not work with other services such as VPN. Please see the DUO U2F enrollment guide for more information on registering your U2F security key.
5. For this walk-through, we will select the Mobile Phone option as recommended. At the "Enter your phone number" screen, enter the full 10-digit cell phone number as instructed, check the "This is the correct number" check box, and click on Continue.
6. At the "What type of phone" screen, choose the correct platform for the device from the list, and click Continue.
Please Note: If you do not wish to install the DUO Mobile App, simply choose the "Other (and cell phones)" option during this step. If you select the "Other (and cell phones)" option, then please skip to Step 9.
7. If you selected iPhone, Android, or Windows Phone option from the previous step, you may then have the option to install DUO Mobile App to enable the DUO Push and the Soft Token authentication options. Download and install the DUO Mobile App and click on the I Have Duo Mobile button.
8. Open DUO Mobile on your phone / tablet, tap the "+" button, and hold your phone camera over the QR barcode on the screen. Once the code scan is complete, a green checkmark will appear over the QR Code. At this point, click the Continue button.
9. At the "My Settings & Devices" screen, click on the Continue to Login button to proceed to login.
10. Choose the Send me a Push, Call Me, or Enter a Passcode option to sign in.
Logging into CAS with VCU 2Factor Authentication
Individuals who are already enrolled in VCU 2Factor Authentication,
follow the instructions below to use with the VCU Central Authentication Service.
1. Once you have registered with the VCU 2Factor Authentication System, login with your VCU eID to any VCU 2Factor Authentication protected application or website.
2. Choose a secondary authentication method by clicking on the corresponding button.
- Send Me a Push - This option allows you to receive a Push notification to your phone on your DUO Mobile App. The DUO Mobile app will notify you of a sign in attempt, simply check your phone and press the Green Checkmark button to login.
- Call Me - This option allows you to receive a phone call on your registered phone. The automated call will instruct you to press a key on your phone's keypad to login.
- Enter a Passcode - This option allows you to enter codes generated from the Soft Token in the DUO Mobile App (generated by tapping the Key icon in the app), codes generated from a hardware token, or codes received through SMS text messages. If you choose this option, you can also request the system to text additional passcodes to you via SMS text message.
As an option, you can also check the "Remember me for 60 days" checkbox, which will allow you to bypass VCU 2Factor authentication from the device you are using for up to 60 days. Please note, this option should only be used on your trusted computing devices and should not be used on shared computers or public computers.
3. Complete the login process.
Existing applications protected by Central Authentication Service will be migrated in phases to include support for VCU 2Factor Authentication within the next 12 months.
How Long Will the Project Take to Complete?
The migration schedule for all existing applications is listed below. VCU is planning to provide this capability to all CAS protected applications throughout 2017.
Fall 2016 / Winter 2017 - Phase one
The initial implementation phase will focus on small and low impact applications and websites used by specific departments or schools. The implementation time will span across December 2016 to the end of January 2017. Applications such as selected VCU departmental intranet sites, specific online request forms and small scale single function departmental web applications will be migrated through the initial phase. This phase is now complete.
Spring 2017 - Phase two
The second implementation phase will focus on high risk (based on information handled by the applications and sites and accessibility of the applications and sites from the Internet) and medium impact applications. The second implementation phase will focus on medium sized applications that may be used by multiple departments or schools. This phase is now complete.
Summer 2017 - Phase three
The third implementation phase will focus on high risk (based on information handled by the applications and sites and accessibility of the applications and sites from the Internet) and high impact applications. This phase will focus on enterprise applications that may be used by multiple schools or the University. This phase is in progress, migration of large enterprise applications such as Email, Blackboard, and Portal are scheduled to complete in August, 2017.
Fall 2017 - Phase four
The last implementation phase will focus on large enterprise wide applications used across the University. This phase will start by mid-Q4 2017.
Where Can I Find More Information?
For more information, please contact the VCU IT Support Center (itsc@vcu.edu, 828-2227) or VCU Information Security Office at infosec@vcu.edu.
Additional documentation for the VCU 2Factor Authentication initiative can be found at go.vcu.edu/duo.
If your new phone has the same phone number, then all you need to do is to simply login to the DUO Self-Service Portal to invoke VCU 2Factor Authentication. After logging in with your eID and password, choose the “My Settings and Devices” link from the VCU 2Factor Authentication page.
NOTE: If you immediately receive a message stating that you've successfully logged in, then please open the DUO Self-Service portal in a new session. This can be done using "Incognito Mode" (Chrome), "Private Browsing" (Firefox and Safari), or "InPrivate" (Edge).
You will be prompted to verify your identity. At this stage, simply choose the “Call me” option.
You will then receive a phone call asking you to press any key to complete your verification. At the next screen, simply click on the “Device Options” button for the device you need to re-activate.
Next, click on the Reactive DUO Mobile button.
Follow the on-screen instructions to download and activate your new device with the same phone number.
If you change your telephone number and got a new phone, then please contact the VCU IT Support Center at (804) 828-2227 or itsc@vcu.edu to update your information in the system.
Yes! Other devices such as tablets, landlines, and even hardware tokens can be associated with your eID for the VCU 2Factor Authentication system.
To add a new device, login to CAS from off-campus to invoke the VCU 2Factor Authentication system, click on the “Add a new device” link from the VCU 2Factor Authentication page.
Next the system will need to verify your identity, simply choose “Send me a push”, “Enter a passcode” or “Call me” for your existing device to verify your identity.
Next, you will have the option to add a new device to your account. Choose the desired device, and follow the on-screen instructions to complete the setup of your new device.
If you lost your phone, you should remotely wipe your phone if possible, and contact your cellular service provider and have your phone disabled. You should also report the incident to the police if the loss of the device is the result of suspected theft. Once this is done, you should contact the VCU IT Support center and have your phone removed from your account, a temporary and timed bypass code can be generated for you while you work with your cellular service provider to replace your phone. Once you have your new phone, then you will be able to re-register your phone with the VCU 2Factor Authentication system.
If you're attempting to access a VCU application from your mobile phone or a tablet with cellular data, your connection may travel a long geographic distance through your mobile carrier's network before being "transferred" to the public Internet. DUO is reporting the location where your mobile device's cellular connection is being "transferred" to the Internet, which may be a good distance from your physical location. In some cases, it can even be in another state!
You can always use the phone call or SMS text option if you don't want to install the app. To do so, at the beginning of device setup, choose the Mobile Phone option.
At the next screen, enter your phone number, check the checkbox to verify the number is correct, and hit Continue.
Next, you must verify the ownership of your device, simply choose the "Call me" or "Text me" option, enter the verification code (provided via phone call or text message), click on "Verify", and Hit "Continue"
The registration system will then prompt you to select the type of mobile device, at this screen, simply choose "Other", and hit "Continue" to bypass the DUO Mobile registration.
Please note, setting up your phone this way will not give you the DUO Mobile authentication option, and you will be required to take phone call or use a passcode (via SMS text message or a hardware token) for any future authentication. If you want to use DUO mobile in the future, then please contact the VCU IT Support Center at 804-828-2227 to re-register your device.
There are multiple options for you to complete your 2factor authentication. You can choose the phone call option if you do not wish to receive SMS text messages for authentication codes, or use the DUO Push option if you have enrolled your phone to use the DUO Mobile app.
Alternatively, if you do not wish to register any phones with the system, you may purchase and use hardware tokens for your 2factor authentication needs. YubiKey tokens support YubiCo OTP (Not the U2F only tokens) or hardware tokens supporting TOTP or HOTP can be used as hardware tokens. Once you acquire these tokens, it is necessary for you to contact the VCU IT Support Center (828-2227) in order to place a service request on the registration of the tokens. DUO also provides its own tokens that can be used. Please contact your IT support unit on how to acquire and register these tokens.
There are multiple options for you to complete your 2factor authentication. If you don't want to take a phone call, you can use the SMS text message option, or the DUO Push option if you have registered and installed the DUO Mobile app on your phone.
Alternatively, if you do not wish to register any phones with the system, you may purchase and use hardware tokens for your 2factor authentication needs. YubiKey tokens support YubiCo OTP (Not the U2F only tokens) is the most common form of tokens that can be used with many 2Factor Authentication systems. Alternatively, hardware tokens supporting TOTP or HOTP can also be used as hardware tokens. Once you acquire these tokens, it is necessary for you to contact the VCU IT Support Center (828-2227) in order to place a service request on the registration of the tokens.
All faculty and staff, including students workers are expected to use VCU 2Factor authentication system. Most students will have the option of using 2Factor authentication to protect their personal information, but will not required to use it. Some students, particularly those in the various health disciplines, may be required to use 2Factor at the individual school's discretion.
For all individuals enrolling a phone with the VCU 2Factor authentication service, the phone number of the individual is collected during the process of enrollment.
In addition to the phone number, for individuals using the DUO Mobile App, the type of device and the version of the Operating System on the device is collected. (e.g. Apple iPhone 7 with iOS 10.3)
For individuals using hardware tokens for VCU 2factor authentication service, the token's public key, secret key, and serial number is collected in order to ensure the functionality of the token.
During any login attempts into VCU IT systems, regardless of whether VCU 2Factor authentication service is used, the location information of the login attempt is collected. (e.g. Login from an IP xxx.xxx.xxx.xxx from Boston, MA). The collected information is used for identification of anomalies that may indicate the compromise of an individual's credentials.
Some students, especially student workers, may be required to use the VCU 2Factor Authentication system. If it is optional for you, look for the blue "Skip" button below the "Protect Your Account" Dialog. We will periodically remind you about this service if you choose to skip. If you had access to the blue "Skip" button, and found that the button is gone following an initial attempt to setup 2Factor authentication, you can contact the VCU IT Support Center at 828-2227 to have the button restored for you.
If you started the enrollment process for VCU 2Factor but were unable to complete it, your "skip" button may have disappeared. Please call the IT Support Center at (804) 828-2227 to submit a request to have your VCU 2Factor account "reset."
Additionally, the skip button will also disappear if the "grace period" of the application has passed. Please note for non-mandatory applications, the grace period is set to 50 years in the future.
You will not see a "Skip" button if any of the following applies:
1. The application you are trying to access requires VCU 2Factor Authentication.
2. You have already enrolled in the VCU 2Factor Authentication system from another application or system.
3. You attempted enrollment into the VCU 2Factor Authentication system but never completed the enrollment.
You can contact the VCU IT Support Center at 828-2227 for additional assistance.
Applications where you see this will be optional indefinitely. We're working on system changes that will make this info clearer. It's not a typo, and you can still enroll now if you'd like.
The owner of the generic account will need to determine how access should be handled, and submit a service ticket to VCU Collaboration Services if changes are needed or DUO authentication is not feasible for a generic account.
In most cases, you can opt to only perform the VCU 2Factor authentication once every sixty days from the same trusted device. To do this, simply check the "Remember Me for 60 days" checkbox. When you select the checkbox, please make sure you are not using a browser in "Incognito" or "Private Browsing" mode, and that your browser supports cookies.
In most cases, you will not be prompted to use the VCU 2Factor Authentication system on-campus. However, you may be prompted if any of the following applies:
1. You have never enrolled in the VCU 2Factor Authentication Service. In this case, you will be prompted for enrollment.
2. You are using your cellular connection, residential wireless network, the VCU guest wireless network, a VCU residence hall network, or another open or public network that is not a part of the trusted internal VCU networks.
3. You are accessing the VCU 2Factor Authentication management portal. The portal is designed to provide you with the ability to manage your devices and register / re-register the DUO mobile app, therefore it is made available to you regardless of your location.
If you would like to use a YubiKey for VCU 2Factor, VCU Information Security can only assist you with the use of a YubiKey NEO or YubiKey 4 model. Other YubiKey models (such as those offering only FIDO and/or U2F), while good products, may not work as well with the diverse technology environment at VCU.
If you choose to purchase a new YubiKey NEO or YubiKey 4, you will receive a small card with the token, usually containing a QR code. Be prepared to provide a close-up photo of this card, including the QR code, to technology support staff upon request.
If you would like to use a YubiKey NEO or YubiKey 4 that you already own, you will need to be prepared to provide the following information:
- Serial Number
- Private Identity
- Secret Key
If you no longer have the above information from a YubiKey NEO or YubiKey 4 that you already own, you may need to use the YubiCo utilities to "regenerate" a new configuration, in "YubiCo OTP" mode. Make sure to consult the YubiCo documentation for your model, which is available online!
Once you have the necessary information for your situation (photo of the card OR serial/private ID/secret key), contact the VCU IT Support Center at (804) 828-2227. An IT Support Center staff member will assist you with the process.
Finally, PLEASE NOTE that you should be EXTREMELY CAUTIOUS of purchasing used or "second-hand" YubiKey tokens! Some YubiKey models support having their configurations locked with a passcode, in a process called "Configuration Protection;" if you purchase a used YubiKey and do not know the passcode for its configuration protection, you may not be able to use it!