Versions Compared

Version Old Version 40 New Version Current
Changes made by

Douglas 2brown

Douglas 2brown

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Expand
titleWhy do organizations use MFA?

Here's what you need to know about why organizations like us use MFA:

Safeguarding both your personal data and the sensitive information of our RRU and our students is paramount. Organizations implement MFA to enhance security and protect against unauthorized access to your accounts and confidential data.

MFA adds an extra layer of protection, ensuring that even if your password is compromised, unauthorized individuals still can't gain access without an additional verification step. This significantly reduces the risk of data breaches and enhances the overall security posture of organizations.

Enhanced security
Protection against unauthorized access
Reduced risk of phishing and credential theft
MFA adds an extra layer of security beyond just your username and password. It is harder for unauthorized individuals to access data or systems if they need to know your password AND have your cell phone or key fob to do so. 

Remote Work and Mobile Access: 
With the rise of remote work and mobile device usage, securing access to corporate resources from various locations and devices is critical. MFA ensures that even when you are not physically in your office, your access is secure. 

User-Friendly Experience: 
Modern MFA solutions are designed to be user-friendly, offering options like push notifications, biometrics, or one-time codes via SMS or mobile apps. This makes it easier for you to use MFA without significantly disrupting your work. Microsoft will soon stop supporting SMS (text) messaging so RRU will offer two options for your second factor: push notifications to the MS Authenticator app or a Security Key/Fob (a little USB stick that you carry around with you).

Adaptive Security: 
Some MFA systems can adapt their security measures based on the context of the login attempt using access policies. For example, policies could specify that if you're on campus plugged into the network on an RRU device, there's low risk so there's no need to ask for MFA. But if you're trying to access our remote server from a personal computer in Greece, we will ask for MFA to make sure that's really you. Other policies are time-based and may ask you to MFA if you haven't done so in a certain period of time. The goal is to use these policies to manage when you're asked to MFA so that the process is not intrusive but that we remain secure.

Preventing Insider Threats: 
MFA can also be effective in preventing insider threats by adding an additional layer of security for employees and trusted users. It helps ensure that even those with legitimate access are properly authenticated. None of the cybersecurity incidents experienced at RRU over the last two years were deliberately permitted by RRU staff. MFA would have prevented ALL of the cybersecurity incidents that RRU has experienced​ over the past two years.

Cost of Data Breaches: 
Data breaches can be extremely costly in terms of both financial losses and damage to an organization's reputation. MFA reduces the likelihood of breaches, which can save organizations a significant amount of money and prevent long-term damage. 

Scalability: 
MFA solutions can scale with growth. We're implementing MFA starting in February by asking employees to register. Then we'll move on to contractors, then students. Initially, only a small number of applications will be MFA-enabled but we'll add others as we go. 

MFA is important to RRU

We're on it! and we need you on it, too.

Expand
titleWhy do I need to use MFA at RRU?

Here’s why it’s important for you to set up MFA:

  • Very real (and close to home) cyber security concerns

  • Some RRU resources like webmail already require MFA, even when you’re on campus

  • Soon there will be more applications behind MFA including other MS applications and eventually, Moodle and other non-MS applications

  • While outside the country, Outlook, webmail, and other MS applications always require MFA

    • you cannot independently set up MFA while outside the country

    • technical support is not available on evenings and weekends so you may find yourself locked out for an inconvenient amount of time

  • You need to set up MFA to prevent service interruptions that will negatively affect your access to resources. Better to do it now, then when you are in a time crunch and really need access to a resource behind MFA

We are truly all in this together. Please do your part to keep RRU secure from cyber criminals.

Expand
titleHow often will I be prompted to authenticate?

  • The current default* for people using Microsoft office products domestically on a personal computer is 12 hours. This is only enabled for Microsoft Webmail at this time.

  • The current default* for people using Microsoft office products internationally on a personal computer is 12 hours. This is enabled for most Microsoft Office programs including webmail, Teams and SharePoint/OneDrive

  • The current default* for people using Microsoft office products domestically or internationally on an RRU computer is 12 hours. This is not currently enabled for any Microsoft product locally but that might change in the future.

*As of August 1st, 2024 (subject to change without notice)

Expand
titleI am not in Canada, will this MFA setup be a problem?

Yes, the setup will be a problem. Please contact the RRU Help Desk because we need to adjust your account so you can complete the setup process.

Once setup, MFA will work in any country as long as you have a wireless/data connection on your mobile device to authenticate.

...

Expand
titleI am NOT getting a code when going to webmail, instead it says "More information needed"
image-20240531-181956.png

This means you have not completed the RRU MFA enrollment for everyone or are using the wrong authenticator app.

Please scan the QR code and make sure you have installed the Microsoft Authenticator App which looks like this:

image-20240531-182323.pngimage-20240531-182500.png
Expand
When am I required to register for MFA?
title

Employees: starting in Feb 2024

Contractors (academic and non-academic): starting in March 2024

Students: starting in May 2024

Expand
titleWhat MFA method is recommended for international travel?

If you are traveling with your mobile device, use the authenticator app, which is designed to work internationally (using the verification code method). All you need is a wifi connection.

Expand
titleWhat devices can I use to MFA?

Any smart phone with data (required for Authenticator app). When traveling out of country, please note you might require a travel pack for that country or you must connect to local WIFI.

For people that do not have a mobile device or cannot use their mobile device, USB security keys are provided upon demand. The USB key allows any device with a USB A connection to authenticate.

Expand
titleDo I need cellular data/wi-fi and will I incur cellular data charges if I use the MS Authenticator app for my second factor?

If you connect your mobile device to WIFI you will not use data. If you are not connected to wifi then it will require cell data to authenticate.

Please note that our test show the app using <2mb over a 6 month periodSince you are required to authenticate when connecting to remote services, you can use the same data source for your authenticator as you are using for your computer.

Expand
titleMust we use our personal smart phones if we choose the MS Authenticator app?

We understand concerns about using personal resources for work-related purposes. However, the Microsoft Authenticator app, which we recommend for MFA, consumes minimal data—likely less than 1% of a gigabyte for the entire yeardata. This means the impact on your data plan will be negligible.

And, if you're already using the Microsoft Authenticator app for other purposes, such as accessing your bank or investment information, adding an account for RRU is seamless. It streamlines the process and ensures consistency in your security practices across different platforms.

When/if you leave RRU, it’s easy to delete the authenticator app.

Everyone must use MFA. It is a requirement.

Special notes by group

Employees participating in flexible work arrangements (you work some days per week on campus)

Our blended work agreement indicates you may require additional personal resources to work effectively from off campus. Using your personal cell phone for MFA is one example of this.

You also have the option of using a security key (not our recommended option).

Employees who come to campus full time

If you prefer an alternative to your cell phone, you can choose to use a security key for authentication (not our recommended option).

Everyone who primarily works off campus including academic and non-academic contractors and students

There is an expectation that you have the means to access the RRU resources required to fulfill your contractual obligations and/or your school work.

We appreciate your cooperation

Whatever 2nd factor authentication method you use, you're enhancing the security of your own account(s) and contributing to the protection of sensitive student data and the integrity of our organization.

Thank you for your understanding and cooperation in maintaining a secure work environment.

...

Expand
titleWhat should I do if I plan to upgrade my mobile device or if I lose the smart phone I use for MFA authentication?

If you plan to replace your mobile device, it is STRONGLY recommended that you follow the MFA instructions on the new phone before you wipe or otherwise dispose of your old phone. You will need your old phone to authenticate your new phone.

(This authenticator app is one of the few things that does not transfer from the old phone to new phone. We think this is done as a security measure to prevent phone cloning to bypass authentication)

If you've lost or had your mobile device stolen, you can sign in using the secondary authentication method you selected when you registered your device for MFA.

If this option has not been configured, a secondary authentication was not configured, and you no longer have the old phone, then you can contact the RRU Help Desk to clear your settings. After your settings are cleared, you'll be prompted to register for two-factor authentication the next time you sign in. 

Expand
titleWhat if I get challenged for a second authentication factor and my second factor is not with me? (e.g. forgot smartphone / hardware token at home)

We recommend you have a backup device associated with your account to help prevent this issue. If you have lost the only MFA device associated with your account, contact the RRU Help Desk for assistance. The IT Support Centre can only assist you during business hours. Therefore, if you haven't set up a backup method you will have to wait until the RRU Help Desk is open. 

Expand
titleI already have a work account setup for MFA. I cannot set up a second account.

Please make sure when you log into http://myprofile.microsoft.com/ that the info on the screen is your RRU account, not your work account. If it is any other account info showing, then when you try add the MFA, it will try to add the MFA for the account showing.

If the account showing is not your RRU account, open an Inprivate (Firefox) or Incognito (Chrome) tab and log into http://myprofile.microsoft.com/ again with your RRU credentials.

Expand
titleWhat if I receive a prompt for authentication that I did not initiate?

If you are not attempting to log into an RRU resource when you receive the prompt to authenticate. Deny or ignore the request. This means the MFA is working and that some else is trying to access your account.

In some cases the perpetrator might “bomb” you with repeated requests to “authenticate” hoping that out of frustration, or by accident, you might approve the request. If this happens please put your phone aside, or on silent, and ignore the requests. Please notify the Contact the RRU Help Desk so we can track these instances.

Expand
titleI am scanning the QR code, but it just gives me a circle and eventually times out

Make sure you mobile device has a active data or wifi connection. If the mobile device does not have access to the internet, it cannot process the QR code.

On Campus? If connected to RRU guest, you do need to accept the “proper use” agreement every day. Try turning off wifi temporarily and use cellular data to complete the process.

Expand
titleI didn't find the answer to my question in these FAQs - where can I get help?

Contact the RRU Help Desk for assistance. 

...