Duo Status Update
In the age of the internet, hacking attempts are common, ranging from brute force attempts to keylogging. Duo is William & Mary’s two-factor authentication service and it provides an additional layer of security when logging into William & Mary services.
Rather than simply relying on a password for security, which can be compromised easily, Duo provides additional protection by confirming your identity through a secondary device of your choosing. With Duo, even if your password is compromised, your information remains safe.
Just check out these alarming numbers from the W&M Information Technology security team. There are approximately 75,000 malicious login attempts to W&M systems per day. There are also over a 160,000 email phishing attempts in an average month. Fortunately, most phishing attempts are blocked by our security filters, but sometimes they can wiggle through to your inbox.
Duo protects you from the fall-out of this type of credential theft. Duo not only verifies your identity, but also serves as an alert, notifying you when someone successfully hacked and used your password for unauthorized access. It gives you the chance to reset your password and notify support@wm.edu before any data is stolen.
Faculty & Staff Now Using Duo
Over the past year, Duo has been implemented gradually for W&M faculty and staff, allowing time for adaptation to the new security measure. However, parts of the W&M community started using Duo well before that time.
“A couple years ago, we started using Duo with the VPN (Virtual Private Network) and VDI (Virtual Desktops). Those two systems provide off-campus access to sensitive W&M data, and therefore were more vulnerable to compromise,” said Director of Infrastructure & Security Peter Kellogg. “The experience with Duo on the VPN and VDI helped us get our feet wet before diving in to the full implementation.”
The Spring 2018 semester is when the Duo implementation started in earnest. At that time, the Banner 9 AdminPages were rolling-out, and required Duo for the login process. Since then, Duo has also been added to various systems used by W&M faculty and staff. "The goal was to ease W&M faculty and staff on Duo gradually," says Kellogg. "We focused on getting staff enrolled in Duo in the Fall 2018 semester, and then shifted to faculty in the Spring 2019 semester. Students will start using Duo in the fall. After that, we'll turn-on Duo for all systems that use a CAS login."
Here are the systems that now use Duo listed in alphabetical order.
- Blackboard (learning management system)
- Box (storage and file sharing)
- Chrome River (travel management system)
- Cornerstone (evaluation and training system)
- Microsoft Office 365 (email and webapps)
- PeopleAdmin (hiring and recruiting system)
- Salesforce (marketing, communications, and admissions)
- Virtual Desktops (VDI)
- Virtual Private Network (VPN)
Qualtrics (survey system) will also require Duo starting on August 1, 2019. After that, almost all other CAS-enabled systems, will require Duo starting October 1, 2019. Find a full listing on our Duo Requirement Start Dates announcement.
Students – Duo is Coming Soon!
Now W&M IT is preparing to onboard students. If you are a student at William & Mary, you may have seen posters or heard about something called Duo, but you may not be entirely sure what Duo is. Beginning Oct. 1, 2019, you too will be required to use Duo for access to most W&M systems, so it is important to understand what Duo is and the security benefit it provides.
Learn more about Duo for Students
Duo is fairly simple to use. Once enrolled at 2f.wm.edu, you can either have the Duo app on your phone and respond to "push notifications" to confirm your identity, or you can opt for texts or phone calls to confirm. Also, if you don’t have a smartphone, cellphone, or landline phone where you can be reached consistently, then there is a hardware token that can be issued to you from the Technology Support Center. W&M IT is working to ensure that everyone at the university is able to use Duo.
We encourage you to enroll now for Duo – even though you won’t start using it until October 1st – to avoid a disruption in service. Enrolling simply sets up your account in the system and lets you pick your secondary method of authentication. If you don’t enroll by October 1st, you will be blocked out of W&M systems until you are enrolled. So, it’s better to do it early!
Find enrollment instructions here.
For convenience, Duo also has a Remember Me option. It will remember your successful authentication for 14 days, when using the same device and browser. With this convenient feature, you can protect your information and minimize the hassle.
William & Mary joins a plethora of other universities, such as the nearby University of Virginia and Old Dominion University, that already require Duo for students. Duo will soon be a useful tool for entire William & Mary community to maintain the security of information in a world where that is an increasingly difficult goal.
