What are we doing?
CWU is implementing multi-factor authentication for the campus community. This means that any CWU faculty or staff member (and eventually student) would not only enter a username and password, but also use a “second factor” when logging in to systems including PeopleSoft, MyCWU, Canvas, Outlook, and most other CWU systems.
Why are we doing it?
Passwords alone are no longer a safe or secure method of accessing systems. CWU faculty, staff, and students have been the targets of countless phishing attacks and other malicious activities. When successful, attackers can gain access to employee confidential personal information, use their accounts to send spam or more phishing emails, change payroll information, steal information, and perform many other malicious activities. Nearly all of these attacks are possible because CWU only uses passwords to secure our accounts. Users frequently reveal their passwords during phishing attacks, share passwords with others, or use simple passwords that can be easily guessed.
Multi-factor authentication will greatly decrease the possibility of a hacker gaining unauthorized access to CWU systems. Simply knowing a user’s password will not be sufficient to access a system; bad actors will also need a user’s second factor before they can login. This is similar to the process when accessing online banking. Many banks send you a text message with a special number, or require you to answer extra questions, before you are able to access online banking.
How will it work?
Once you have enrolled in MFA, you will need to verify your identity with a second factor when you login to most key CWU systems. In some cases, you may need to verify your identity more often.
The available second factors include:
- Using an app on a mobile device to push an “Accept” button when prompted
- Using an app on a mobile device to generate a number, and entering that number when prompted during login
- Answering a phone call and pushing a button on the phone to approve login
If you elect to use options one or two, you will need to install the Microsoft Authenticator app on your smartphone or tablet. Instructions on installing and configuring the app will be sent to you when it is your turn to enroll in MFA.
What are the officially supported email applications for smartphones?
Note: Best efforts will be made to troubleshoot issues on non supported email applications.
Android :
- Built in Email application (varies on device type)
- Microsoft Outlook
iPhone:
- Built-in in Email (Apple Mail)
- Microsoft Outlook
What if I don’t have a smartphone or tablet?
If you do not have a smartphone or tablet, you can use the phone call option. You can enter the phone number for up to two phone numbers for office phones, home phones, or cell phones.
How often will I need to use MFA?
MFA will prompt you for your second factor once every 8 days for most CWU systems. You may be prompted more frequently if you use VPN, if you use more than one computer, or if you frequently clear your browser cache.
Why am I getting MFA authentication requests on my smartphone or by phone call when I’m not expecting them (such as in the evening, on weekends, etc.)?
The MFA process is on an eight day cycle, and it will request that you re-authenticate every eight days if your computer is turned on and logged in – even if you are not actively trying to login to a system. The best way to prevent this from happening is to log off your computer at the end of the day or when you’re not using it. If your computer is logged in when the 8 day time runs out, you will get an MFA request regardless of the time or day.
If you get an MFA request when you are not expecting it, we recommend that you do NOT tap Deny, but rather ignore the request or hang up your phone. Tapping Deny will trigger a process that blocks your account from further attempts to login, and you will not be able to access any CWU systems until Information Services unblocks your account. If you tap Deny, you will need to call the Service Desk for assistance, and there may be a delay in unblocking your account. Ignoring an MFA request will not block your account, but it will also prevent an unauthorized person from accessing your account.
Will installing the Microsoft Authenticator app on my personal phone allow CWU to see anything on my phone?
No. The Microsoft Authenticator app is a tool provided by Microsoft for anyone with an Apple or Android smartphone. Many other websites and services also rely on the Microsoft Authenticator app for MFA; the app is not provided by CWU, nor does it provide CWU with access to your phone.