CIO Council Identity and Access Management September 11, 2015 Friday 2:40-3:10 p.m. Smith Center 561

Agenda HarvardKey Implementation Schedule Multifactor Authentication in HarvardKey

Proposed HarvardKey Timeline 8/28/2015 Proposed HarvardKey Timeline 2016 Jan Feb Mar Apr May Jun Jul Aug Sept HarvardKey rollout Claim HarvardKey Harvard Phone my.Harvard Simplified Sign-On Integration of School and local systems Integrated Users and Resources New HKS/HLS students provisioned via HarvardKey Security Groups Strategy (now – 3/16) Grouper (4/16 – 6/16) HarvardKey in use HKS / HLS Provisioning HMS Provisioning Strategy Grouper Buildout

HarvardKey Implementation Schedule 8/28/2015 HarvardKey Implementation Schedule School Number of Users Rollout Date Provisioning Date Alumni 350,000 9/22 DCE 10,842 11/12 n/a HBS 3,678 12/3 (Proposed) FAS / College 29,616 GSD 1,585 TBD GSE 1,922 HKS 5,882 3/31 HLS 3,622 11/19 HSPH 3,926 HDS 750 SEAS 265 HMS 25,534 12/3 later in 2016 Radcliffe 158 CADM 9,355 since July 2015

Multifactor Authentication: The Factors Something you know Something you have login/password, SSN physical keys, smartphone app, FOB fingerprint, retina, voiceprint, DNA Something you are

Multifactor Authentication: Starts With “Who Are You?” Usernames and passwords are the most common method of authentication, but have significant weaknesses Multifactor authentication (MFA) plays a pivotal role in improved authentication Answers the question “Who are you?” with a higher degree of certainty than passwords alone Often confused with authorization, which answers the question “What are you allowed to access?” Duo Security was selected as the platform for Harvard’s multifactor solution Over time, Duo will replace other vendor MFA solutions in use at Harvard and extend protection to additional applications

Multifactor Authentication in HarvardKey Multifactor authentication using Duo Security will be available at time of HarvardKey rollout in November Participation per user is optional for HarvardKey web applications In the future, applications may be configured to require multifactor authentication for access Demand is high for enabling MFA with additional Harvard applications; through the end of CY15, IAM is evaluating the use of MFA with VPN, Windows administration tools, and Office 365 services

Thank you!