Re: 2-Factor Authentication / FERPA

["Hudson, Edward" <ehudson () CALSTATE EDU>]

Hey Mike et al
We are in the early stages of rolling out MFA (Duo) system wide. Twenty-three campuses and our Chancellors Office. We 
are taking a prioritized approach, focusing first on our Common Financial System then the campuses will prioritize on 
their own their high risk applications in the order they deem appropriate.  The effort has its roots in an audit 
finding regarding off campus access to common systems not being not be protected by MFA. So, we had that to buttress 
our reasoning.
Also, the California Attorney General issued a 2016 Breach Report that called for MFA as a recommendation on all 
internet facing “customer accounts.” That report is publically available by the way.

To clear the hurdles of faculty and others who might me hesitant or resistant, we are starting communication now, 
focusing on the benefits using the “Lock Down Your Log In” campaign 
https://www.lockdownyourlogin.com<https://www.lockdownyourlogin.com/>.  Some great resources there for your 
communication plan.

Best
Ed


Ed Hudson, CISM
Director, Information Security
California State University, Office of the Chancellor
401 Golden Shore
Long Beach, CA 90802
Tel 562-951-8431
ehudson () calstate edu

[cid:image001.png@01D29408.D3945A90]





From: The EDUCAUSE Security Constituent Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> on behalf of "Dodor, 
Michael" <DodorM () UWSTOUT EDU>
Reply-To: The EDUCAUSE Security Constituent Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU>
Date: Friday, March 3, 2017 at 8:36 AM
To: "SECURITY () LISTSERV EDUCAUSE EDU" <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] 2-Factor Authentication / FERPA

Greetings,

A number of regional campuses are in discussions on requiring 2-factor for access to High Risk data and one of the 
elements would be non-directory (private) FERPA records.
The consensus concern with such a rollout would be usability on such a large scale and backlash from Faculty.

Has anyone implemented and required 2-factor authentication for faculty accessing non-directory records? And if so, any 
tips?

Thank you.

Mike Dodor
Network Administrator/Information Security
Learning and Information Technology
University of Wisconsin – Stout
327 Millennium Hall
Menomonie, WI  54751
Phone: 715-232-2671
dodorm () uwstout edu<mailto:dodorm () uwstout edu>