1. Passwords are Dead (or how I learned to love my phone)

2. What got us here? Breaches, breaches breaches Account & password sharing Tension between strong password policies and user acceptance Time it takes to crack a password

3. Source: http://www.darkreading.com/perimeter/cartoon--end-user-security-prayer/d/d-id/1316122?image_number=1

4. How did we start? YearEvent Pre-2011Faculty concern about access to benefit information 2010-11Evaluation of existing technologies 2011-12Evaluation of integration with Shib 2013Pilot with Duo 2013IT rollout 2014Direct deposit phishing incident 2014-15Voluntary adoption + mandatory for some services

5. Our Approach 1.Focus on shibb’ed sites, but don’t forget other technologies (SSH, RDP, VPN) 2.Allow strength checking for multiple factors in shib 3.Build our own self-service interface 4.Provide options 5.Make it easy to recover

6. Our Approach (cont) Four-pronged rollout 1.Evangelize across campus for voluntary enrollment 2.Make mandatory for specific services (protected network) 3.Make mandatory for certain groups 4.Duke Medicine implemented a policy and mandatory enrollment by Aug 1

7. Multi-factor adoption over time

8. What’s Next? Mandatory for Duke Medicine remote access Mandatory for Duke@Work access (coming!) Solve the “thick client” problem for SAP and Peoplesoft Test how we can accept an “MFA” attribute from federation partners for shib logins.