Duo Multi-Factor Authentication

The college has engaged in a coordinated effort to further strengthen system and network access safeguards. Columbia College is partnering with DUO Security to implement Multi-Factor Authentication (MFA) on various software systems as well as on college hardware. Multi-Factor Authentication is an additional layer of security on top of user IDs and passwords, Single Sign-On, or VPN.   

As a result, when you enter your username and password into one of these systems, Duo will send a message to your smart device prompting a response to gain access. 

Beginning Monday, May 17, 2021, Duo will be enabled for all students when accessing college systems.  

What does this mean for you?  

• College systems such as Canvas, the student portal, and O365 will require this additional layer of security.  

Multi-Factor Authentication requires two things: 

• Something you know: your UserID and password. 
• Something you have with you: your phone. 

What does using DUO mean? 

• Check your smart device to be sure the most current Operating System is running. This Team Dynamix Knowledge base article has Additional Duo Information.
• When you attempt to log into a college system such as the student portal or Canvas, you will be prompted to enroll in Duo (takes about 2 minutes). Here is a how-to video. 
• Going forward, access to these systems will require the approval of the authentication “push” to your phone. 
• You will approve the push when you are attempting to access a system. You will deny the push if you receive it and are not attempting to access a system. 

What are the benefits?   

• By utilizing Multi-Factor Authentication, you will be notified if anyone is attempting to access a system or your machine using your ID and password credentials. If that person is not you, you can deny the access from your smart device. This preserves the college’s security around sensitive data and systems. 
• A password is no longer enough. Attacks on accounts are increasingly sophisticated. MFA helps to determine that you are who you say you are and are not someone with a stolen password. 
• The college will be able to quickly assess any instances of access that are denied, safeguarding our systems further. 
• Each and every person utilizing our systems will be assisting in keeping our community safe from outside, unauthorized access. 

New Students: Your experience will include your first access to Columbia systems and this video shows you step-by-step 

If You Forget Your Phone, you can contact Technology Support for a passcode that may be entered in place of the “push”. 

Note: If you have already enrolled in Duo with your student worker account and are now adding your student account, there is an additional step.  Video instructions for new students Duo How-To for Students who are also Student Workers 

If you have questions, please send an email to duoquestions@colum.edu.

Frequently Asked Questions:  

• What to do when you get a new phone?
  https://guide.duo.com/add-device 
• How much space does the Duo App use on my device?
  30mb. By Comparison, Facebook app is 498mb. Outlook app is 290mb.  This equates to about 5 medium-sized pictures. 
• Do I need a new smart device?
  No.  If the device is running a recent Operating System, you can install and run Duo.  Please see two FAQs below that address the two different kinds of smart devices. If you do not have a device that meets these requirements you can request a token. See FAQ below about Tokens. 
• What version of Apple iOS does Duo support?

  Currently iOS 15 and greater.

  https://help.duo.com/s/article/1871?language=en_US  

• What version of Android does Duo support?

  Currently Android 11 and greater.

  https://help.duo.com/s/article/1872?language=en_US  

• How much data does Duo use?

  Duo Push authentication requests require a minimal amount of mobile data – less than 2 KB per authentication. This amount of data usage falls well within a "typical" push notification. While concerns regarding data usage are certainly understandable, the bandwidth consumed by Duo Mobile for many authentication requests every day would have an overall negligible effect on mobile data use.  
     
  For example, you would only consume 1 megabyte (MB) of data if you were to authenticate 500 times in a given month.  That's over 16 authentications per day, which is well above the average authentication threshold of our most aggressive users.  1MB is also the equivalent of loading 1 webpage on your mobile phone.  

  As with any other app, Duo Mobile utilizes WIFI whenever the user is connected to it, so no mobile data would be used at all under those circumstances. 

• What outside access to my device does Duo allow?

  Duo Mobile has no access to change settings on your phone.  Duo Mobile cannot read your emails, it cannot see your browser history, and it requires your permission to send you notifications. Lastly, Duo Mobile cannot remotely wipe your phone.  The visibility Duo Mobile requires is to verify the security of your device, such as OS version, device encryption status, screen lock, etc.  We use this to help recommend security improvements to your device and you always are in control of whether or not you act on these recommendations.  

  Much more in-depth information may be found here:  
  https://help.duo.com/s/article/4683?language=en_US 

• What is the process to acquire a Duo Token?

  The college understands that not all users have smart devices that will support Duo.  It is to these users that the college will loan a token.  Token use requires the user to carry it at all times and is about the size of a lighter.  Should the token be lost or damaged, the user will be responsible for the replacement cost.  

  Tokens may be requested only by using a ticket type specified in the Duo Communications.  When a request is received, a workflow immediately sends a Team Dynamix Ticket to the requestor’s manager.  The manager must respond using the ticket to approve or deny the request.  Manager approval is required for IT to begin the fulfillment process.  IT will contact the requestor to determine whether token pickup is possible or whether the token must be sent via FedEx due to the requestor working remotely.  If the requestor is on campus, the token should be picked up as directed by IT.  Step-by-step authentication instructions are included when a token is picked up or sent out.  

  While IT will do our best to ensure timely delivery, there will be a lag for remote users.  During that time, IT will place the requestor on bypass status so that system access is not denied in the interim.  Once the token is received, the requestor must contact IT to confirm receipt.  The maximum time for a bypass is 7 days from the manager’s approval to allow for token receipt and authentication. Alternatively, single-use bypass codes may be acquired from Technology Support.  

  Columbia College Chicago apps will not be accessible from a smart device that is not protected by Duo so if you opt to not use your smart phone and obtain a token, access will be removed. 

• How do I use DUO when connecting to VPN?

  For instructions on how to use DUO when conencting to VPN, refer to the following instructional video for how students connect to VPN.