1. From 0 to 34,000 Multifactor Users in Six Months
Educause Security Professionals Conference
Brad Judy

2. Jan 2014 - Motivations and requirements

3. Who here was hit with direct deposit fraud?

5. Requirements Mitigate common phishing Easy for end users
Rapid deployment
Flexible for other purposes (no specific use cases)
 Brad Judy • Educause SPC Multifactor • 5/5/2015

6. Feb-Apr 2014 - Key decisions

7. What is the most important aspect of deploying multifactor?

8. Things we considered Go manual Existing info MFA
PIN or security questions
“Risk based” MFA
Tokens
Phones

9. +

10. How to get phone #’s into Duo?
Real-time integration between HRMS and Duo
Oracle Service Bus and Master Data Management in between
HRMS
OSB
MDM
Duo

11. How good is your HR home/mobile phone number data?

12. +

13. Support Employee Services IT Service Desk Vendors
Support begins with Employee Services service desk
Employee Services
IT Service Desk
Vendors

14. Apr-July 2014 - Implementation
 Brad Judy • Educause SPC Multifactor • 5/5/2015

15. Where are you with MFA? All done implementing, here to gloat
Implemented for some services, expanding
In progress deploying
Planning deployment (tech chosen already)
Early phases (requirements, selection, etc.)
Just starting to think about it

16. Initial setup
The easy step

17. Data integrations Load ALL the users!!
Returning employee update issue
Load ALL the phones!! (well, three of them)
Fixing international phone formats
HRMS
OSB
MDM
Duo

18. Functional integration
Connecting GreyHeller ERP Firewall to Duo

19. Communications
Website, video, s. Separate comm about updating phone numbers and MFA.
 Brad Judy • Educause SPC Multifactor • 5/5/2015

20. July 18, 2014 – Go Live

21.  Brad Judy • Educause SPC 2015 - Multifactor • 5/5/2015

22.  Brad Judy • Educause SPC 2015 - Multifactor • 5/5/2015

23.  Brad Judy • Educause SPC 2015 - Multifactor • 5/5/2015

24. Nine month stats 21,000+ people have used it
63,000+ authentication attempts
16.5% failure rate = 52,000+ successful
55% voice, 45% SMS (for successful)
100,000 telephony “credits” = $1,000

25.  Brad Judy • Educause SPC 2015 - Multifactor • 5/5/2015

26. Problems encountered Duo UI didn’t like 100,000+ users/phones
Data feed bumps (international number formatting, etc.)
Still issues with bad phone numbers
Duo account reps keep calling me about the 100,000+ users

27. Next steps

28. Where do you want to use MFA?
IT admins (SA, DBA, Network, etc.)
VPN
Other remote access (SSH, RDP, etc.)
ERP systems
General web authentication system
Specific application
Other?

29. Student self-service
HR/HCM privileged user
Examining other use-cases with ERP Firewall options like field-level step-up MFA
Implement new Duo delegated admin roles for service desks

30.  Brad Judy • Educause SPC 2015 - Multifactor • 5/5/2015