1May 2006 – Unit Liaison Meeting Two-Factor Authentication Project MToken Distribution Bill Wrobleski MAIS Joint UL Meeting May 24, 2006

2May 2006 – Unit Liaison Meeting Goals To bring you an up date on our plans for Two-Factor Authentication To give you a high-level idea of what to expect in regards to Two-Factor Authentication Some details are still being worked out, and we will present those at future Liaison meetings

3May 2006 – Unit Liaison Meeting Authentication Authentication is the means that a person uses to identify himself/herself to a computer Most systems use “reusable passwords” for authentication A reusable password is any password that can be used more than once. (Most passwords used at the University are reusable.) Although they are commonly used, reusable passwords are one of the least secure forms of authentication Many systems try to strengthen reusable passwords by making users change their passwords often, forcing complex passwords, or locking accounts after failed login attempts

4May 2006 – Unit Liaison Meeting Two-Factor Authentication Adding a second “factor” for authentication improves security A reusable password plus a physical device greatly increases the security around authentication Most common example: ATMs require that you have a reusable password (PIN) and a physical card in order to access your bank account Two-Factpr authentication is being more widely embraced by the banking and financial services industries (e.g. ETrade) MAIS will be implementing two-factor authentication for all of its systems this fall We have used this in the past for the mainframe and UNIX access; now it will be extended to other applications as well

5May 2006 – Unit Liaison Meeting MToken The device that will be used for two-factor authentication will be called the “MToken” It is an updated version of the “SecurID Card” that we have used on the mainframe and for UNIX servers in the past

6May 2006 – Unit Liaison Meeting Why a USB Connection? Future Uses In the future, we plan on using the device to store “electronic credentials” You’ll be able to plug your device into your computer to authenticate And when you unplug, you’ll be unauthenticated We need to implement additional infrastructure to make this possible (which we plan to do in the next year or two) Can I store files on it? Sorry, no. The vendor does not provide storage at this time, but we hope in the future that will be a possibility

7May 2006 – Unit Liaison Meeting Who will use an MToken? Initially, staff using any M-Pathways system, BusinessObjects or DAC Students and staff that only use “Student Business” and “Employee Business” on Wolverine Access will NOT be issued an MToken Faculty members and lecturers that only use “Teaching Support” will NOT be issued an MToken We will provide them an MToken if they want one though

8May 2006 – Unit Liaison Meeting Project Timeline Summer 2005 – Project approved Fall 2005 – Project initiated; product selection began Winter/Spring 2006 – Development, Testing Fall 2006 – Deployment September – MTokens distributed to MAIS staff October – MTokens distributed to Business and Finance users Late October/December – MTokens distributed to remaining Ann Arbor, Dearborn and Flint users

9May 2006 – Unit Liaison Meeting Distribution of MTokens Initial Rollout MTokens will be delivered via campus mail to users An online process is used to activate the MToken Any user that doesn’t activate their token within a specified timeframe ( days) will receive an reminder to activate the token; system access will no longer work if they do not Later New users can get an MToken at one of several locations Online activation still available

10May 2006 – Unit Liaison Meeting Using the Token 1.From Wolverine Access, select the system that you want to use 2.When presented with the web login screen, type in your uniqname and UMICH password (just as you do today) 3.Also type in the 6-digit tokencode that is displayed on the front of your MToken Note: the tokencode changes every 60 seconds, and each tokencode can only be used once 4.Click the Log-in button, and your in Just like before, once you have logged in, you have access to all Cosign-enabled web systems until you either log-out or are timed- out by the system.

11May 2006 – Unit Liaison Meeting The New Cosign Web Login Screen

12May 2006 – Unit Liaison Meeting Support Support provided through the MAIS Help Desk Lost tokens can be replaced at a number of different sites. (We are currently investigating if this will require a fee.) If a user leaves his/her MToken at home or if the MToken is otherwise temporarily unavailable to him/her, we will have a process that enables the person to get a temporary reusable passcode

13May 2006 – Unit Liaison Meeting Communication Communication phases Build awareness (Summer) Prepare for Deployment (Early Fall) Rollout (Fall) Communication will include: Record article, UL meetings, sponsor meetings, posters, flyers, web site and MTokens will be distributed with useful support materials as well

14May 2006 – Unit Liaison Meeting Questions?