Security Updates to Duo in 2024
To protect against recent cyber threats, NAU is enhancing Duo Two-Step Verification protections for the NAU community.
August 2024
NAU Computers now requiring Duo authentication for login
Beginning on August 16th of 2024, NAU computers will require authorization through Duo to complete the login process. After you enter your NAU username and password on your device’s login screen, a Two-Step Verification prompt will be sent to your authorized Duo device for approval. Once you approve this prompt, you can finish logging into your device.
Why is ITS making this change?
Work from home, remote work, and hybrid work have changed the threat landscape when protecting University systems and assets. While on-prem systems are typically stored in controlled access environments with security above that of consumer-grade, our new landscape does not reflect this same level of protection. With more individuals spread worldwide, ITS must adapt our security practices to meet these new threats and increase our diligence to protect the campus community.
As the world has shifted to more remote and hybrid work different vulnerabilities and attack vectors have become more prevalent. By requiring Two-Step Verification at desktop logon, we can better protect information that is stored or accessible locally on workstations, better protect network shares and other systems and assets that do not currently support Two-Step Verification before access, assist with protection of sensitive information in the event of lost or stolen devices, and help protect from attacks such as keylogging.
Frequently asked questions & use cases
Will I need to Two-Step every time I login to my workstation or just the first time I login for the day? Accordion Closed
University community members will have an opportunity to select a checkbox during the login process to “Remember” their login, or until an environmental variable change requires a refresh of your credentials. Environmental changes that can impact your ability to be remembered include but are not limited to, joining a different wireless access point such as moving between offices or buildings, joining the VPN, or restarting your device.
Will you still be able to use a Two-Step fob to login if you do not have a mobile device that can support Duo? Accordion Closed
Yes, Two-Step fobs will be usable for logging into workstations in a similar fashion as it would be with logging into CAS or other Microsoft services.
What should I do if I forget or lose my phone or Two-Step fob? Accordion Closed
In the event that you forget your Two-Step authentication devices or if it is lost or stolen, you may call into the ITS Service Desk at 928-523-3335 to request a Two-Step Bypass code to use for the day. This code will allow you to access the workstations as well as other systems protected by Two-Step Verification.
Will I still need to authenticate with Duo into Outlook, Teams, CAS, and other services? Accordion Closed
Will I need to authenticate with Duo if I remote into my workstation? Accordion Closed
Will I still be able to use biometrics to log into my system? Accordion Closed
On Windows devices, Cisco Duo does not currently support Windows Hello, and you will not be able to utilize facial or fingerprint recognition.
On MacOS devices, Cisco Duo does not support fingerprint recognition on the initial logon of the system but will support subsequent authentications to unlock any existing session.
How will this affect students? Accordion Closed
Will this affect servers or non-standard accounts? Accordion Closed
No, at this time, this change will not impact any servers or non-standard accounts. In the future, we will be evaluating remote and terminal services to determine if it is appropriate and prudent to deploy these same Two-Step Verification requirements to those systems and services.
Will this impact personal or BYOD devices? Accordion Closed
May 2024
Three-digit code now required for Duo Two-Step Verification
Beginning in late May of 2024, NAU employees (including student employees) and NAU Affiliates (including retirees and emeritus) must enter a three-digit verification code when logging into NAU services requiring Duo Two-Step Verification. Upon login, you’ll see a three-digit code in the Duo login prompt in your web browser and a push notification from Duo on your verified device to enter the code you’re given before allowing access.
Why is this happening?
Recently, NAU has observed cybercriminals in the higher-education landscape attempting to gain access to users’ accounts through a social engineering technique known as “MFA Fatigue”. This technique involves a malicious entity spamming a user with login attempts and subsequent Duo prompts until a user slips focus on the action and unintentionally approves an unauthorized prompt.
Frequently asked questions & use cases
Can I still complete a verification from my Apple Watch? Accordion Closed
Yes, you can still complete a verification request from your Apple Watch.
I teach in multiple classrooms, what does that mean for me? Accordion Closed
These updates will not impact the functionality of ‘Remember me’ when you transition between classrooms. However, you will need to physically carry your phone or Two-Step fob with you every time you visit a classroom.
I currently use a Two-Step fob device. What can I expect? Accordion Closed
This change only affects users who utilize the push verification functionality. If you use a fob, you won’t notice any changes to your login behavior.
Questions or concerns?
If you have a question or concern regarding this change, contact the ITS Service Desk and reference the updates to MFA for NAU employees.