by Dace Freivalds, head, Information Technology
As of December 3, 2015, two factor authentication (2FA) will be enabled for WebAccess, impacting the more than 2,300 websites behind WebAccess across the University. 2FA is a critical service and will address some of the security challenges the University has recently faced. WebAccess (aka “thumbprint” login window) is the University’s login authentication system for such services as ESSIC, Benefits open enrollment, Angel, and many more services. At the Libraries, WebAccess is used for authentication into databases, UCS, My Library Account, “I Want It”, ILL requests, ABLE and many other services.
What Does This Mean for You?
If You Have Already Enrolled in 2FA:
Beginning December 3, 2015, students, faculty and staff who are already enrolled in 2FA will be required to use two factor authentication when logging in to WebAccess. They will use their Penn State Access ID and password to login on WebAccess, and then will be prompted for the device (or devices) they registered for 2FA. These individuals received an email from the IT Service Desk on Nov. 19 announcing the 2FA implementation date.
I-Tech will be available throughout Dec. 3 and 4 to help if you encounter any problems with 2FA. Drop in and we’ll offer assistance.
If You Have Not Yet Enrolled in 2FA:
You do not have to do anything at this point. You will continue to login to WebAccess the way you do today even after Dec. 3, i.e., you will not be required to use the second level authentication.
However, you will need to enroll in 2FA within the next few months since it will become mandatory for all Penn State faculty and staff in late spring 2016. We encourage you to wait until after Dec. 3 to enroll since we will be offering a number of training/drop-in sessions during December, January and February to help you get enrolled and demonstrate how to to use 2FA once you have enrolled. We will also schedule a number of Adobe Connect sessions for campus library faculty and staff.
What Will I Need to Do When I Enroll?
When you enroll in 2FA you will need to register a device for the second level authentication. A smartphone is the best choice for 2FA authentication since it provides the greatest level of security and allows you to use the Duo Mobile app. The app allows you to receive push notifications for easy, one-tap authentication and can also generate passcodes for login (even without cellular connectivity). We will encourage faculty and staff to use the push notification, but other options are available. You will also be able to use a mobile phone, a tablet, a landline or a token for 2FA. We will be providing more details on these options during the training sessions, in Library News and via email after Dec. 3.
I Already Have a Token for IBIS. That Means I’m All Set, Right?
Some of you already have tokens for use with IBIS, eLion, ISIS, etc. The token you are currently using for these services will not work with 2FA. You will need to continue to use your current token for these services and use another device for WebAccess authentication as well as any other system that has been integrated with 2FA.
We are working with Libraries’ administration to develop a process for requesting 2FA tokens. We will have more information on this Dec. 3.
Does 2FA Change How Users Authenticate at Their Workstations?
2FA will not change access and/or authentication protocols at public workstations in library buildings, library staff computers at service desks, desktop or laptop workstations in Library employee offices, or desktop access via cable modem off campus (e.g., from an employee’s home computer)? Logging in to a workstation does not require WebAccess, so no 2FA will be needed. However, once a user is logged in to a laptop, computer, etc. then he/she will need to use 2FA for resources that are behind 2FA.
More Information?
Karen Estlund, associate dean for Technology and Digital Strategies, will address 2FA at the Dec. 1, 2015 Tech Update.
Please email questions to Dace Freivalds, head of I-Tech, at dace@psu.edu. We will use the questions, and our responses, to populate a Libraries’ specific FAQ.