For many, October 31st this past fall signified Halloween but for students at the University of Wisconsin-Madison, this fall it symbolized something much more frightening: the deadline to enroll in multi-factor authentication with Duo.
In an attempt to eliminate the numerous hacking issues the university has faced in 2018 (4,946 UW–Madison NetIDs stolen and 92,483 phishing reports) UW-Madison started a project aimed at preventing unauthorized access to student, faculty, and staff identities and online data. Campus IT professionals deemed multi-factor authentication (MFA) the best system to address these issues. MFA requires users to not only login with their registered username and password, but provide an additional authorization through a secondary method, such as through an app on their smartphone.
The application chosen to support the newly appointed MFA system was Duo Security. MFA-Duo allows users to instigate a “push” or temporary passcode on the Duo Mobile App or on a physical keychain called a “token” that ensures secure access into their UW account. The implementation of Duo, proven successful at other Big Ten universities, started with faculty members and staff over the summer and moved to students in the fall of 2019.
Many students faced problems when forced to register for this software, resulting in consequently being logged out of their accounts until accomplished. Some took to social media platforms to convey their dislike for the new technology and the inconvenience enrolling in MFA-Duo imposed upon them. “I wish there was more information provided to students than us getting a notification saying you have to sign up for this, regardless if you have no clue what it is and why UW-Madison is making you do it,” said Claire Holesovsky, an LSC Master’s student.
Since students were curious about the reasoning behind MFA’s implementation, two experts from the project were invited to a roundtable discussion with students in Life Sciences Communication (LSC) 625: Risk Communication class. During the discussion, Stefan Wahe, the Deputy Chief Security Information Officer on campus, and Will May, the IT Support Manager for Helen C. White IT, emphasized the importance of cybersecurity on campus.
“Prior to the class, I didn’t realize there were so many phishing scandals and identity thefts occurring on UW accounts,” said Søren Warland, an LSC master’s student in LSC 625. This lack of knowledge on the necessity of MFA explains why some had an adverse reaction towards this system that would make accessing their UW account cumbersome.
“When a solution to a problem is somewhat inconvenient, it is important to make sure your audience understands they are facing a problem and need a solution,” stated LSC senior Leonardo Barolo Gargiulo and one of the risk communication students.
Students in LSC 625 pointed out that cybersecurity risks should have been communicated earlier in the process in a way that made it personally relevant to students, faculty, and staff. Becca Beets, an LSC Ph.D. student in the class, had good insights for the university. She said, “they [UW] could have used messaging strategies to help students perceive that Duo is there to protect them as individuals, not just the University more broadly.” Mikhaila Calice, another an LSC Ph.D. student in LSC 625, agreed. “For example, including language such as, ‘Duo isn’t just about protecting UW-Madison, it’s about you. It’s there to protect your social security number, bank information, and other personal and academic records.’” Calice stated.
Overall, the classroom discussion highlighted how difficult it can be to please everyone with a new system, such as MFA-Duo. However, students were able to emphasize the importance of social science and how it can communicate strategies that can be applied to a project such as this one to make it successful.
“When students are able to take what they are learning in the classroom and apply their knowledge to pressing real-world issues, it makes for more meaningful learning experiences,” said LSC 625 professor and department chair, Dominique Brossard. “I’m glad we can provide these types of opportunities here at LSC.”
Story by Jessica Knackert, LSC B.S. ’20 and LSC’s 2019-20 Lenore Landry Scholar