1. IT Support Staff Seminar 27 August 2004 Tony Brett New registration procedures for 2004 – ITSS Briefing Tony Brett Associate Head of IT Support Staff Services Oxford University Computing Services

2. IT Support Staff Seminar 27 August 2004 Tony Brett Agenda Where we are now What’s changing Why it is changing Account Activation Demos of Procedures –Account Activation –Password Reset Future developments Questions

3. IT Support Staff Seminar 27 August 2004 Tony Brett Where we are now New users are sent a username and password via their College. –Automatic for Undergrads only –Others self-register Password is valid for 30 days then it expires –Users often don’t bother/forget to change it Forgotten/lost passwords require helpdesk intervention People who haven’t self-registered may have a null mail routing

4. IT Support Staff Seminar 27 August 2004 Tony Brett What’s changing No longer sending out passwords Users will get an activation code –Valid for 30 days Self-registration will change for Oxford Accounts –Account with activation code now sent to registered postal address –But only needed for people who have valid cards and no Oxford account before changeover Self-service password reset will be available All NEW university cards for eligible categories will automatically trigger creation of an Oxford Account Nobody new will have a null mail routing

5. IT Support Staff Seminar 27 August 2004 Tony Brett Why the change? Registration letters are a security weak point –in the wrong hands they give access with no further information Units need to have confidence in OUCS SSO –Confidence increase in username/passwords Online self-registration displays a password which may be grabbed or viewed New process keeps clear text password off the wire and screen at all times Password changing is inconvenient both for users and helpdesk Won’t have dozens of users at the 30-days-after- account-creation point unable to access accounts

6. IT Support Staff Seminar 27 August 2004 Tony Brett Account Activation Verify DOB, Barcode, and Surname –Not provided on registration letter Verify Username and Activation Code –Provided on registration letter Solicit security question and answer –Advice given about good choices Set password –Never displayed or transmitted over the network in clear text. Immediately valid for the year. No 30-day expiry

7. IT Support Staff Seminar 27 August 2004 Tony Brett Demos - Activation

8. IT Support Staff Seminar 27 August 2004 Tony Brett Demos – Password Reset

9. IT Support Staff Seminar 27 August 2004 Tony Brett Future Developments More use of SSO for departments Kerberised services will be able to use SSO database directly Helpdesk will be freer to give proper support as password change burden should drastically decrease Web form for those who already have password but not security question/answer –To enable generation of question/answer pair Web form for those who have neither –Will require one time URL to be generated/issued by helpdesk, possibly ITSS in future

10. IT Support Staff Seminar 27 August 2004 Tony Brett Questions